6 ms·

On a broader level this is why the FCC is IMHO wrong in not considering broadband a telecommunication service. As ISPs inject their content (including advertisi

On a broader level this is why the FCC is IMHO wrong in not considering broadband a telecommunication service. As ISPs inject their content (including advertising) into third party content, they essentially take over said content. E.g., if someone requests access to my content via their service, besides any corruption of functionality, artistic work and even intended meaning, any revenue generated by this is directly drawn from my content without license. From my perspective as a potential content provider, this is clearly a violation. It may be even a violation of existing contracts, e.g., if there's a no third parties clause involved in an existing advertising contract the content provider has agreed to.

masswerk 7y ago
From which quite naturally follows, if broadband providers in the US consider themselves content services rather than telecommunication services, they have to acquire licenses for the content they provide, as well. (Xfinity, may have your billing address?)
jopsen 7y ago
As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT entries.
- masswerk 7y ago
  However, this is more like "better have a lock so that thieves have a harder time breaking the door". If the US are making IP violations legal, they put themselves in danger to be treated like other countries who are considered notoriously ignoring IP as part of their overall business model.
  - jopsen 7y ago
    True.. The sad thing is that with many kinds of cybercrime, it's easier to fix the security vulnerability, than it is to track down the criminals and make them stop :) In this case, the vulnerability is using HTTP, not HTTPS.
    - masswerk 7y ago
      Still, if we do not take care of bad actors, bad actors are what we get (and probably what we deserve). Edit: Also, what stops those ISPs from impersonating the requested host by means of their own root certificate, just like antivirus software does it?
      - Sohcahtoa82 7y ago
        Then my browser would throw a certificate warning unless I added my ISPs root cert.
        masswerk 7y ago
        As pointed out by another comment already, "you" maybe as well the ISP's installer software.
- red_trumpet 7y ago
  Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.
  - jimktrains2 7y ago
    MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.
    - masswerk 7y ago
      Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
      - aaomidi 7y ago
        Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
        masswerk 7y ago
        However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)

masswerk 7y ago

From which quite naturally follows, if broadband providers in the US consider themselves content services rather than telecommunication services, they have to acquire licenses for the content they provide, as well. (Xfinity, may have your billing address?)

jopsen 7y ago

As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT entries.

masswerk 7y ago
However, this is more like "better have a lock so that thieves have a harder time breaking the door". If the US are making IP violations legal, they put themselves in danger to be treated like other countries who are considered notoriously ignoring IP as part of their overall business model.
- jopsen 7y ago
  True.. The sad thing is that with many kinds of cybercrime, it's easier to fix the security vulnerability, than it is to track down the criminals and make them stop :) In this case, the vulnerability is using HTTP, not HTTPS.
  - masswerk 7y ago
    Still, if we do not take care of bad actors, bad actors are what we get (and probably what we deserve). Edit: Also, what stops those ISPs from impersonating the requested host by means of their own root certificate, just like antivirus software does it?
    - Sohcahtoa82 7y ago
      Then my browser would throw a certificate warning unless I added my ISPs root cert.
      - masswerk 7y ago
        As pointed out by another comment already, "you" maybe as well the ISP's installer software.
red_trumpet 7y ago
Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.
- jimktrains2 7y ago
  MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.
  - masswerk 7y ago
    Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
    - aaomidi 7y ago
      Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
      - masswerk 7y ago
        However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)