3 ms·

I mean, the actual solution here is... don't buy devices that refuse to do what you tell them. Don't use closed-source, auto-updating software. You can live wit

I mean, the actual solution here is... don't buy devices that refuse to do what you tell them. Don't use closed-source, auto-updating software. You can live without a Chromecast and a Amazon Echo and your cloud-based smart lighting system. There's alternatives to all these things anyway, which do what you tell them to.

throw0101a 7y ago
> Don't use closed-source, auto-updating software. Sometimes you don't choose the software, the software chooses you: * https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-new-doh-dns-over-https-protocol/ https://www.zdnet.com/article/first-ever-malware-strain-spot... * https://www.zdnet.com/article/psixbot-malware-upgraded-with-google-dns-over-https-sexploitation-kit/ https://www.zdnet.com/article/psixbot-malware-upgraded-with-...
- vertex-four 7y ago
  Malware can do whatever it wants anyway - DNS-over-whatever can be implemented no matter who supports it. Maybe we should be banning Tor because it might be used by malware?
  - throw0101a 7y ago
    Tor has its own traffic signature and so can be detected by network monitoring software. If it's on the IT network I help run then I'm tracking down the source IP and MAC and finding the network port it's coming from and asking "WTF?". I'm happy to implement DoT on work's network to help encourage encrypted DNS. My problem is DoH can now be used by all sorts garbage and we can't tell it from legitimate HTTPS--which is by design. All this for the laudable goal of protecting Internet surfers' privacy. However I'm curious to know how well this will work against the Great Firewall of China, and how many other regimes will now implement Great Firewalls of their own.
    - vertex-four 7y ago
      Tor has bridges, which are specifically designed to thwart the Great Firewall - and I'm guessing your network monitoring software. Malware can ship with an arbitrary number of DNS-over-HTTPS servers accessible anyway, no matter whether Google supports it. The cat was out of the bag as soon as you allowed encryption on your network in general. Finally, there are system architectures that are inherently less susceptible to malware, which is what we should really be focusing on. If your document viewer doesn't need to access the Internet, why does it have access to the Internet? Why does your general-web-browsing browser have access to your intranet and worse, your network drives and USB sticks? The reason we're stuck with what we have now is that operating systems research largely died in the 90s, but we're now aware that e.g. microkernel capability systems can be implemented in ways that are both fast and secure.
    - lawfulcactus 7y ago
      Tor also gives you the option to use a variety of pluggable transports, which are purpose-built to circumvent DPI boxes and such. Pretty sure obfs4 (based on [1]) works against the GFW. [1] https://www.cs.kau.se/philwint/scramblesuit/wpes2013.pdf https://www.cs.kau.se/philwint/scramblesuit/wpes2013.pdf

throw0101a 7y ago

> Don't use closed-source, auto-updating software. Sometimes you don't choose the software, the software chooses you: * https://www.zdnet.com/article/first-ever-malware-strain-spotted-abusing-new-doh-dns-over-https-protocol/ https://www.zdnet.com/article/first-ever-malware-strain-spot... * https://www.zdnet.com/article/psixbot-malware-upgraded-with-google-dns-over-https-sexploitation-kit/ https://www.zdnet.com/article/psixbot-malware-upgraded-with-...

vertex-four 7y ago
Malware can do whatever it wants anyway - DNS-over-whatever can be implemented no matter who supports it. Maybe we should be banning Tor because it might be used by malware?
- throw0101a 7y ago
  Tor has its own traffic signature and so can be detected by network monitoring software. If it's on the IT network I help run then I'm tracking down the source IP and MAC and finding the network port it's coming from and asking "WTF?". I'm happy to implement DoT on work's network to help encourage encrypted DNS. My problem is DoH can now be used by all sorts garbage and we can't tell it from legitimate HTTPS--which is by design. All this for the laudable goal of protecting Internet surfers' privacy. However I'm curious to know how well this will work against the Great Firewall of China, and how many other regimes will now implement Great Firewalls of their own.
  - vertex-four 7y ago
    Tor has bridges, which are specifically designed to thwart the Great Firewall - and I'm guessing your network monitoring software. Malware can ship with an arbitrary number of DNS-over-HTTPS servers accessible anyway, no matter whether Google supports it. The cat was out of the bag as soon as you allowed encryption on your network in general. Finally, there are system architectures that are inherently less susceptible to malware, which is what we should really be focusing on. If your document viewer doesn't need to access the Internet, why does it have access to the Internet? Why does your general-web-browsing browser have access to your intranet and worse, your network drives and USB sticks? The reason we're stuck with what we have now is that operating systems research largely died in the 90s, but we're now aware that e.g. microkernel capability systems can be implemented in ways that are both fast and secure.
  - lawfulcactus 7y ago
    Tor also gives you the option to use a variety of pluggable transports, which are purpose-built to circumvent DPI boxes and such. Pretty sure obfs4 (based on [1]) works against the GFW. [1] https://www.cs.kau.se/philwint/scramblesuit/wpes2013.pdf https://www.cs.kau.se/philwint/scramblesuit/wpes2013.pdf