3 ms·

It's odd you refer to endpoints as being the "more affordable place". Because running monitoring software on 5,000 PCs plus management infrastructure and softwa

It's odd you refer to endpoints as being the "more affordable place". Because running monitoring software on 5,000 PCs plus management infrastructure and software updates is a lot more "expensive" than having a single purpose-built box on the border between the network and the wider Internet. Now, I get that QUIC's developers live in a zero-trust/BeyondCorp model, and expect everyone else to too, and with COVID-19, a lot of businesses are suddenly having to look at thinking that way, it's far from how most companies work at present. And having a single box handle filtering and monitoring is actually the most affordable place to put it. ;)

marcosdumay 7y ago
> It's odd you refer to endpoints as being the "more affordable place". The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.
- ocdtrekkie 7y ago
  The middle of the network has always afforded monitoring, until certain companies with a vested interest in interfering with said monitoring started pushing the Internet to not afford it. Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
  - JoshTriplett 7y ago
    Users have a vested interest in not having their connections MITMed. End-user security is not an "agenda" or a "vested interest". And portraying MITM attacks and similar security holes as "inspection" is spin. See also RFC 7258 (https://tools.ietf.org/html/rfc7258 https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.
    - ocdtrekkie 7y ago
      I disagree. Because when clients get phished or infected by malware that bypassed my inspection boxes, the end user was harmed. For me to buy that we shouldn't MITM for security reasons, you'd need to convince me that cloud providers on the other end were mildly successful at preventing malware, scams, and fraud. And they're not. Google, Amazon, Microsoft, etc. have failed to keep the Internet safe. And when they fail they hide behind liability shields like Section 230. So it falls on IT staff, more often than not, to filter, block, and intercept where Big Tech has demonstrated inability to do so.
      - JoshTriplett 7y ago
        TLS is now pervasive. Certificate Transparency prevents CAs from aiding interception. http is now explicitly flagged as "insecure". Browser vendors have had a major part in those improvements to Internet security. (So have many other parties, such as Let's Encrypt for removing cost as an excuse for not using TLS.) People trying to make protocols more secure don't need to convince you, they just need to make your job as hard as possible until most users reject what you're offering. We need a dozen more ideas like Certificate Transparency. We need pervasive end-to-end DNS security, with unencrypted DNS flagged as insecure. We need a means of preventing DNS servers from altering the DNS records of sites they aren't authoritative for. We need browsers to all agree to explicitly flag connections as insecure when they chain to a locally installed certificate, in a way that can't be hidden without rebuilding from source. And this isn't a purely technical problem, either. We also need legal support to review regulations in certain regulated industries and demonstrate well-supported ways to fulfill those regulations without breaking security (e.g. "if you do XYZ to log the time and endpoints of connections but don't actually MITM their traffic, it's reasonably well-established that you're fulfilling ABC regulation"). We need lobbyists to change regulations incompatible with secure protocols. We need designers to make security as usable as possible, because poor usability is a security problem.
  - marcosdumay 7y ago
    Hum... The status quo is a very obvious consequence of Math. Cryptography is relatively easy, while endpoint security is a botomless pit of despair.

marcosdumay 7y ago

> It's odd you refer to endpoints as being the "more affordable place". The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.

ocdtrekkie 7y ago
The middle of the network has always afforded monitoring, until certain companies with a vested interest in interfering with said monitoring started pushing the Internet to not afford it. Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
- JoshTriplett 7y ago
  Users have a vested interest in not having their connections MITMed. End-user security is not an "agenda" or a "vested interest". And portraying MITM attacks and similar security holes as "inspection" is spin. See also RFC 7258 (https://tools.ietf.org/html/rfc7258 https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.
  - ocdtrekkie 7y ago
    I disagree. Because when clients get phished or infected by malware that bypassed my inspection boxes, the end user was harmed. For me to buy that we shouldn't MITM for security reasons, you'd need to convince me that cloud providers on the other end were mildly successful at preventing malware, scams, and fraud. And they're not. Google, Amazon, Microsoft, etc. have failed to keep the Internet safe. And when they fail they hide behind liability shields like Section 230. So it falls on IT staff, more often than not, to filter, block, and intercept where Big Tech has demonstrated inability to do so.
    - JoshTriplett 7y ago
      TLS is now pervasive. Certificate Transparency prevents CAs from aiding interception. http is now explicitly flagged as "insecure". Browser vendors have had a major part in those improvements to Internet security. (So have many other parties, such as Let's Encrypt for removing cost as an excuse for not using TLS.) People trying to make protocols more secure don't need to convince you, they just need to make your job as hard as possible until most users reject what you're offering. We need a dozen more ideas like Certificate Transparency. We need pervasive end-to-end DNS security, with unencrypted DNS flagged as insecure. We need a means of preventing DNS servers from altering the DNS records of sites they aren't authoritative for. We need browsers to all agree to explicitly flag connections as insecure when they chain to a locally installed certificate, in a way that can't be hidden without rebuilding from source. And this isn't a purely technical problem, either. We also need legal support to review regulations in certain regulated industries and demonstrate well-supported ways to fulfill those regulations without breaking security (e.g. "if you do XYZ to log the time and endpoints of connections but don't actually MITM their traffic, it's reasonably well-established that you're fulfilling ABC regulation"). We need lobbyists to change regulations incompatible with secure protocols. We need designers to make security as usable as possible, because poor usability is a security problem.
- marcosdumay 7y ago
  Hum... The status quo is a very obvious consequence of Math. Cryptography is relatively easy, while endpoint security is a botomless pit of despair.