2 ms·

You are correct and that is my point as well. I have yet to see a company that manages all proxy settings for all browsers, operating systems, API clients, etc

You are correct and that is my point as well. I have yet to see a company that manages all proxy settings for all browsers, operating systems, API clients, etc. At least, not very well. Shops that are strictly windows can enforce this from AD. Everyone else will have to shim something in. We are a mix of Windows, Mac and Linux. Mostly Mac. Without a decent path forward, I could imagine that many corporations may go the heavy handed route of blocking all the known DoH resolvers. I envision IP and DNS lists like firehol and various RBL databases to eventually contain these if they do not already.

geocar 8y ago
The place I work blocks all Internet access. If you want to visit a webpage, you need to use the http (clear) proxy. Most web pages are blocked, and if you need one unblocked you open a ticket and wait a week (or escalate).
- LinuxBender 8y ago
  I've seen that too. One of our partners has such a stringent policy that the government of China allows them to entirely circumvent their "great firewall" with their own dedicated circuits. They track metrics on every single packet to and from anywhere. They essentially built their own world-wide ISP.
derefr 8y ago
I worked for IBM a few years ago as a remote worker. Interestingly, they don't try to solve this problem (Intranet + managed settings for proxying out) at all. Instead, they have the opposite arrangement: even sitting in an IBM 'work center' (that you needed to use your employee key-card to access), you're actually just on the public Internet, and you need to use a VPN to reach the IBM Intranet. The VPN backend interacts with a backend that records the device-management (MaaS360) enrollment status of the device, so you can't get onto the Intranet unless your machine is conformant. And if you aren't connected over VPN to the Intranet, you may as well just be sitting in an Internet cafe with a regular laptop—there's no data available for you to exfiltrate.

geocar 8y ago

The place I work blocks all Internet access. If you want to visit a webpage, you need to use the http (clear) proxy. Most web pages are blocked, and if you need one unblocked you open a ticket and wait a week (or escalate).

LinuxBender 8y ago
I've seen that too. One of our partners has such a stringent policy that the government of China allows them to entirely circumvent their "great firewall" with their own dedicated circuits. They track metrics on every single packet to and from anywhere. They essentially built their own world-wide ISP.

derefr 8y ago

I worked for IBM a few years ago as a remote worker. Interestingly, they don't try to solve this problem (Intranet + managed settings for proxying out) at all. Instead, they have the opposite arrangement: even sitting in an IBM 'work center' (that you needed to use your employee key-card to access), you're actually just on the public Internet, and you need to use a VPN to reach the IBM Intranet. The VPN backend interacts with a backend that records the device-management (MaaS360) enrollment status of the device, so you can't get onto the Intranet unless your machine is conformant. And if you aren't connected over VPN to the Intranet, you may as well just be sitting in an Internet cafe with a regular laptop—there's no data available for you to exfiltrate.