6 ms·

tcp != the web. Also, most firewall don't break TCP, they break HTTP(S) because they want levels of control.

JoshTriplett 7y ago
I wasn't referring to TCP, and the web isn't purely TCP. UDP and ICMP are important, and some firewalls just block them completely.
tyingq 7y ago
The corporate firewalls I'm talking about do often break UDP. Because chrome races QUIC/UDP with HTTP(S)/TCP, the big corps are often unaware it's broken. Chrome works around it.
- azinman2 7y ago
  So it doubles the traffic?
  - tyingq 7y ago
    Initial "connection" packets, yes. (yes, I get UDP is connectionless, but I assume you know what I mean)
  - mmm_grayons 7y ago
    A good chunk of them block UDP outbound entirely, so the additional traffic never hits the public internet.
- ocdtrekkie 7y ago
  People with corporate firewalls should also be limiting the unruly behavior of web browsers using group policy. For instance, in my environment, regardless of your browser of choice, QUIC is disabled. (As is DoH and various other recent/trendy things browsers are doing.) We also disable all but a small whitelist of approved browser extensions.
  - tyingq 7y ago
    Sure. There's lots of things non-tech Fortune 500's should do, but don't.
marcosdumay 7y ago
Well, they break TLS. That's almost as broad as breaking TCP. And it's because they want levels of control on the least affordable place. They wouldn't need to break anything if they added the supervising software to the endpoints.
- ocdtrekkie 7y ago
  It's odd you refer to endpoints as being the "more affordable place". Because running monitoring software on 5,000 PCs plus management infrastructure and software updates is a lot more "expensive" than having a single purpose-built box on the border between the network and the wider Internet. Now, I get that QUIC's developers live in a zero-trust/BeyondCorp model, and expect everyone else to too, and with COVID-19, a lot of businesses are suddenly having to look at thinking that way, it's far from how most companies work at present. And having a single box handle filtering and monitoring is actually the most affordable place to put it. ;)
  - marcosdumay 7y ago
    > It's odd you refer to endpoints as being the "more affordable place". The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.
    - ocdtrekkie 7y ago
      The middle of the network has always afforded monitoring, until certain companies with a vested interest in interfering with said monitoring started pushing the Internet to not afford it. Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
      - JoshTriplett 7y ago
        Users have a vested interest in not having their connections MITMed. End-user security is not an "agenda" or a "vested interest". And portraying MITM attacks and similar security holes as "inspection" is spin. See also RFC 7258 (https://tools.ietf.org/html/rfc7258 https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.
Spivak 7y ago
Do keep in mind that "want" isn't exactly accurate. No IT team wants to spend any time/effort maintaining that crap, the business doesn't want to shell out for it either since it's expensive, and the ops team doesn't want yet another thing mucking with traffic. Yet we have one because it's required by law. Wanna take a guess at what companies make sure it stays required by law?
- jimktrains2 7y ago
  Please tell me what law applies to most companies that do this?
  - mschuster91 7y ago
    US banking and record-keeping laws IIRC.
  - numbsafari 7y ago
    You won't find specific laws. The laws (in the US, at least) are typically written such that some part of the administration is deputized to promulgate technical standards and rules, most of which delegate to the NIST, but sometimes to industry bodies. Laws like this include HIPAA, FERPA, FISMA, and GLB. There are lots of industry standards you can reference (such as the Cloud Security Alliance Common Controls Matrix), but the government will generally look at things from the perspective of NIST publications, such as NIST 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations". So, basically, what the government thinks private enterprise should be doing to comply with legal requirements to protect sensitive information. In that document, there are a number of "controls" an organization should have in place, in particular, it should audit any and all data transfers, and ensure such transfers can be traced back to a unique user. Even within that framework, you aren't going to necessarily find a blanket "read everyone's mail!" edict. Instead, what you are going to do, is make an assessment, as an organization, about what you think you need to do in order to withstand any potential lawsuits that may arise from any kind of disclosure. If we made software engineers individually liable for these things the way civil and mechanical engineers are, things would look very different. [Ed: misspelled FERPA]

I wasn't referring to TCP, and the web isn't purely TCP. UDP and ICMP are important, and some firewalls just block them completely.

tyingq 7y ago

The corporate firewalls I'm talking about do often break UDP. Because chrome races QUIC/UDP with HTTP(S)/TCP, the big corps are often unaware it's broken. Chrome works around it.

azinman2 7y ago
So it doubles the traffic?
- tyingq 7y ago
  Initial "connection" packets, yes. (yes, I get UDP is connectionless, but I assume you know what I mean)
- mmm_grayons 7y ago
  A good chunk of them block UDP outbound entirely, so the additional traffic never hits the public internet.
ocdtrekkie 7y ago
People with corporate firewalls should also be limiting the unruly behavior of web browsers using group policy. For instance, in my environment, regardless of your browser of choice, QUIC is disabled. (As is DoH and various other recent/trendy things browsers are doing.) We also disable all but a small whitelist of approved browser extensions.
- tyingq 7y ago
  Sure. There's lots of things non-tech Fortune 500's should do, but don't.

marcosdumay 7y ago

Well, they break TLS. That's almost as broad as breaking TCP. And it's because they want levels of control on the least affordable place. They wouldn't need to break anything if they added the supervising software to the endpoints.

ocdtrekkie 7y ago
It's odd you refer to endpoints as being the "more affordable place". Because running monitoring software on 5,000 PCs plus management infrastructure and software updates is a lot more "expensive" than having a single purpose-built box on the border between the network and the wider Internet. Now, I get that QUIC's developers live in a zero-trust/BeyondCorp model, and expect everyone else to too, and with COVID-19, a lot of businesses are suddenly having to look at thinking that way, it's far from how most companies work at present. And having a single box handle filtering and monitoring is actually the most affordable place to put it. ;)
- marcosdumay 7y ago
  > It's odd you refer to endpoints as being the "more affordable place". The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.
  - ocdtrekkie 7y ago
    The middle of the network has always afforded monitoring, until certain companies with a vested interest in interfering with said monitoring started pushing the Internet to not afford it. Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
    - JoshTriplett 7y ago
      Users have a vested interest in not having their connections MITMed. End-user security is not an "agenda" or a "vested interest". And portraying MITM attacks and similar security holes as "inspection" is spin. See also RFC 7258 (https://tools.ietf.org/html/rfc7258 https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.

Spivak 7y ago

Do keep in mind that "want" isn't exactly accurate. No IT team wants to spend any time/effort maintaining that crap, the business doesn't want to shell out for it either since it's expensive, and the ops team doesn't want yet another thing mucking with traffic. Yet we have one because it's required by law. Wanna take a guess at what companies make sure it stays required by law?

jimktrains2 7y ago
Please tell me what law applies to most companies that do this?
- mschuster91 7y ago
  US banking and record-keeping laws IIRC.
- numbsafari 7y ago
  You won't find specific laws. The laws (in the US, at least) are typically written such that some part of the administration is deputized to promulgate technical standards and rules, most of which delegate to the NIST, but sometimes to industry bodies. Laws like this include HIPAA, FERPA, FISMA, and GLB. There are lots of industry standards you can reference (such as the Cloud Security Alliance Common Controls Matrix), but the government will generally look at things from the perspective of NIST publications, such as NIST 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations". So, basically, what the government thinks private enterprise should be doing to comply with legal requirements to protect sensitive information. In that document, there are a number of "controls" an organization should have in place, in particular, it should audit any and all data transfers, and ensure such transfers can be traced back to a unique user. Even within that framework, you aren't going to necessarily find a blanket "read everyone's mail!" edict. Instead, what you are going to do, is make an assessment, as an organization, about what you think you need to do in order to withstand any potential lawsuits that may arise from any kind of disclosure. If we made software engineers individually liable for these things the way civil and mechanical engineers are, things would look very different. [Ed: misspelled FERPA]