6 ms·

Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti pr

by __s 7y ago

Can someone explain why this thread is full of people not caring about security? This article even goes over how TLS 1.3 is a perf improvement Have the anti privacy crowd come out in droves now that we have a public desire for contact tracing & there's a desire to scapegoat why netflix et al have reduced stream quality due to increased load? & HTTP is not an option. I for one enjoy my ISP not being able to inject ads into my streams

solinent 7y ago
We don't allow our mail to be seized and read without warrant, why should our other data be susceptible? Netflix already had a secure system with their original business model of mailing you the content. Finally, allowing advertisers to profile us based on our browsing data is one step before allowing the police to do so as well. Maybe it's the same step.
- tedunangst 7y ago
  But what about interdiction? What if the CIA swaps the directors cut dvd for the theatrical version and you never learn deckard was a replicant?
  - solinent 7y ago
    Good point. I think there's always a certain element of trust here--the law is more important than the implementation sometimes.
saurik 7y ago
I don't really see many people on this post arguing against encryption entirely... and the article isn't vs HTTP, it is about an upgrade to a new version of TLS; so it kind of feels like you are just cherrypicking a few comments in order to hit at a rather fascinating strawman agenda / conspiracy theory: is there even a single comment here--other than yours ;P--poking at Netflix over reduced stream quality due to the pandemic?
- __s 7y ago
  Those comments have now been downvoted compared to an hour ago. I want to give good faith those comments aren't trolling, & so I personally don't think they should be downvoted https://news.ycombinator.com/item?id=22933774 https://news.ycombinator.com/item?id=22933774 https://news.ycombinator.com/item?id=22934040 https://news.ycombinator.com/item?id=22934040 https://news.ycombinator.com/item?id=22934379 https://news.ycombinator.com/item?id=22934379 Maybe these comments appear first because they're less likely to've read through the article. Otherwise it'd have to be something to do with the demographic of people watching /newest. But it was posted 4 hours before I made my initial post, so I don't know
  - saurik 7y ago
    Yes: I did find those comments; I am even downthread of one of those comments myself, talking about the fascinating limitations of encryption: I simply do not consider three or four comments to be a thread "full of" such comments (and my mental model of this thread, as well as my own involvement, is from well before your comment, which seems to have now hijacked the first position on this post as people I guess like upvoting complaints about other commenters).
crazygringo 7y ago
I'm as confused as you are. My guess is some people have a greater hatred for DRM, which makes Netflix "bad", and so anything Netflix does security-wise that isn't removing DRM becomes irrelevant. But those comments seem to be mostly downvoted now anyways, so they don't seem to be representative.
KingMachiavelli 7y ago
Agreed. I've been blocking HTTP (on port 80) accross my network and I reroute all DNS traffic to a pihole configured to use DoT. At this point in time there is really no reason to let anyone see plain text traffic. A few things are whitelisted but the handful of things that break aren't necessary anyway.
- tfigment 7y ago
  Genuine question: Do you not have issues with browsers and other security products and OCSP? At work they blocked all internet access and tools that forced use of CRL and OCSP lost their minds. Digicert and other CAs seem to to use port 80 for this. Firefox requires OCSP option to be disabled for me for GitHub to work with pauses.
  - user5994461 7y ago
    OCSP is broken by design. Should turn it off for server applications. Maybe even disable it entirely when compiling openssl if possible. OCSP is to query random CA web servers when opening a SSL connection to verify if the certificate in use was revoked. It's broken by design because servers simply don't have internet access.
    - labawi 7y ago
      OCSP with server-side stapling and must-staple marked certificates should work fine for most use cases.
  - jiggawatts 7y ago
    This is what happens when people do random shit in the name of security. It's security theatre, not security engineering. Microsoft Windows, for example, allows administrators to re-publish external CRLs internally, but this only works for the built-in crypto API. Non-native applications generally won't pick this up, including most command-line tools. Blocking outbound port 80 is a mistake. A colleague said it best: Certificate private keys are like your password. Tell no one, ever. The public key is like your passport. It's safe to hand to a border officer. CRLs are the lists of passport numbers used by known terrorists wanted by Interpol. Preventing the border officer seeing that list just lets the terrorists through the airport. This is never good. Similarly, most firewalls ship with "drop" as the default rule, which means that a small error in the firewall rules will just end up with 20-120 second timeouts throughout the network. If instead they "rejected" flows with an explicit deny response, this failure mode would be instant and easier to diagnose. Just yesterday I was trying to diagnose a packet loss issue on a network where some security troll blocked all ICMP between all endpoints. The last time "ping" was used as an attack vector was in the last century, but apparently it's important to prevent any hope of diagnosing entire categories of network issues. Unsurprisingly, their network has atrocious performance, random periods of high packet loss, and asymmetric routing issues. This will not get resolved until the idiot in the security team quits or retires. PS: I suspect their issue is large UDP packets getting dropped on some paths due to MTU issues. To diagnose this without ICMP in a complex network is basically impossible. The automatic fix is to enable Path MTU Discovery... which requires ICMP! Every large environment I've been to that has these security trolls in charge with nobody to reign them in was a shitshow of broken systems performing catastrophically badly because they spend 99% of the time waiting for timeouts. PPS: Why firewalls don't simply have a default, auto-updating rule for "Enable CRL & OCSP outbound" for all known public CAs is beyond me. This is an extremely common requirement, to the point of being practically mandatory for any medium-large enterprise. If you firewall doesn't have this feature, and about a dozen similar ones, you're getting ripped off. You're probably paying some decent fraction of a million dollars for a bag a tools, not a complete solution.
upofadown 7y ago
Any change can and should be questioned as to if it actually improves things.
user5994461 7y ago
Who cares about security in the real world? Have you tried googling "should I use SSL"? The top answer is a stackoverflow answer saying no way. "Putting SSL everywhere is only a way to get a warm fuzzy feeling on security that is no good. It [SSL] is usually only used as a distraction allowing administrators to disregard actual security issues." https://stackoverflow.com/questions/2177159/should-all-sites-use-ssl-by-default/ https://stackoverflow.com/questions/2177159/should-all-sites...
- adamduren 7y ago
  I wonder if accepted answers with negative upvotes still display at the top on SO... Only one way to find out.
stronglikedan 7y ago
> netflix et al have reduced stream quality due to increased load OT, but why am I still paying full price for less-than-full quality? Same with Amazon - why am I paying for two-day Prime shipping even though it's impossible to get that level of service right now? /rant
- azinman2 7y ago
  Because a black swan event has occurred, life is anything but normal right now, and people are generally concerned about things that are far more important.
  - stronglikedan 7y ago
    I understand that, but it's trivial for them to temporarily reduce the amount they're charging me, since I'm not getting what I'm paying for. I'd see it as them during their part to help the people in this crisis. But alas, I digress, as it was just an opportunistic rant, and I feel better for getting it out.
    - vinay_ys 7y ago
      You have the option to opt into a SD only plan, don't you?
      - toomuchtodo 7y ago
        Reduces the number of simultaneous streams from 2 to 1 as well.
      - stronglikedan 7y ago
        Of course, but that's comparing apples to oranges, so not really relevant.
- stjohnswarts 7y ago
  Because that's life during a national emergency. If you don't want to pay it then stop paying it, NF and Amazon will let that happen. I assume Amazon might even prorate your refund.
elithrar 7y ago
> why netflix et al have reduced stream quality due to increased load? This is not quite true - it's less about _Netflix's_ load and more about load on the _access networks_ (end-user ISPs). They are seeing longer peaks, increased congestion (fewer folks are leaving their homes), and thus the reduction in default streaming quality by many streaming platforms was a move to limit congestion on these last-mile networks (and some IXs) where possible. The EU & India anticipated the most congestion here, which is why you likely saw these announcements start with the EU before becoming global, as other ISPs/IXs/govts began to think about the same. Disclosure: I work for Google in this space, but don't represent them here.
dang 7y ago
You're probably running into the contrarian dynamic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22contrarian%20dynamic%22%20objecti&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Your comment is a great example of the second wave: objections to the objections, getting upvoted to the top of the thread. (Edit: it's no longer at the top, see explanation below.) Comment threads don't represent the community view. They self-select for commenters who object to something. This is particularly true early on, since objecting is usually a reflex reaction that leads to quick comments. Reflective comments, the better kind, take longer to appear—because reflection is a slower cognitive process and because they take longer to write. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20reflective%20reflex&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... The third wave is people looking around and not seeing the second-wave description of the thread really matching the comments (we got one of those too: https://news.ycombinator.com/item?id=22935245 https://news.ycombinator.com/item?id=22935245). That's because the original objections have since been supplemented by more interesting comments that were slower to roll in. It may also be because the janitors a.k.a. moderators have been active in the thread, sweeping up and so on. Edit: Speaking of janitorial work, I've downweighted this subthread now, which is one of the things we do. Check out the effect: at least as of this moment, if you scroll back to the top, notice how much more enticing and curious the conversation is, than if this were the first thing were seeing. It's as if the thread can breathe.
- __s 7y ago
  Neat, I've noticed this pattern in the past, but haven't ended up in this spot myself What's the better way to play out this dynamic? Since there were three comments I didn't think it'd be optimal to spam by replying to all three individually. Maybe picking one to reply to would be better. I don't think downvoting is the right play, but ignoring may be Maybe responding with agreement to the article, without objection to the objection
  - dang 7y ago
    Great question! It's better to reply, because then it at least won't get upvoted to the top of the thread, accruing mass and blocking fresh conversation. I think you're correct that it suffices to pick one to reply to, perhaps the most prominent one, or the one where the reply will be most interesting. I don't see any problem with downvoting something like https://news.ycombinator.com/item?id=22934379 https://news.ycombinator.com/item?id=22934379 as well. The trouble with an indignant anti-crap comment is that it can't help but repeat the crap it's objecting to, because that's what it's about. Negation is a form of repetition. Crap subthreads tend eventually to get moderated by users, but that doesn't happen with their anti-crap counterparts. Usually those get upvoted to the top, since people love defending the unfairly criticized and we all respond to indignation. But then it sits there, choking out new discussion with metafumes. The best way to counter bad comments is to post a good one—for example, a reflective comment about the specifics of the article, or a curious comment about something unexpected in it. This isn't always an option, though, because one doesn't always have something like that to say. I think responding to reflexive negativity with a pleasantly-worded objection can still be helpful—just not as a top-level comment.

by __s 7y ago

solinent 7y ago

We don't allow our mail to be seized and read without warrant, why should our other data be susceptible? Netflix already had a secure system with their original business model of mailing you the content. Finally, allowing advertisers to profile us based on our browsing data is one step before allowing the police to do so as well. Maybe it's the same step.

tedunangst 7y ago
But what about interdiction? What if the CIA swaps the directors cut dvd for the theatrical version and you never learn deckard was a replicant?
- solinent 7y ago
  Good point. I think there's always a certain element of trust here--the law is more important than the implementation sometimes.

saurik 7y ago

I don't really see many people on this post arguing against encryption entirely... and the article isn't vs HTTP, it is about an upgrade to a new version of TLS; so it kind of feels like you are just cherrypicking a few comments in order to hit at a rather fascinating strawman agenda / conspiracy theory: is there even a single comment here--other than yours ;P--poking at Netflix over reduced stream quality due to the pandemic?

__s 7y ago
Those comments have now been downvoted compared to an hour ago. I want to give good faith those comments aren't trolling, & so I personally don't think they should be downvoted https://news.ycombinator.com/item?id=22933774 https://news.ycombinator.com/item?id=22933774 https://news.ycombinator.com/item?id=22934040 https://news.ycombinator.com/item?id=22934040 https://news.ycombinator.com/item?id=22934379 https://news.ycombinator.com/item?id=22934379 Maybe these comments appear first because they're less likely to've read through the article. Otherwise it'd have to be something to do with the demographic of people watching /newest. But it was posted 4 hours before I made my initial post, so I don't know
- saurik 7y ago
  Yes: I did find those comments; I am even downthread of one of those comments myself, talking about the fascinating limitations of encryption: I simply do not consider three or four comments to be a thread "full of" such comments (and my mental model of this thread, as well as my own involvement, is from well before your comment, which seems to have now hijacked the first position on this post as people I guess like upvoting complaints about other commenters).

crazygringo 7y ago

I'm as confused as you are. My guess is some people have a greater hatred for DRM, which makes Netflix "bad", and so anything Netflix does security-wise that isn't removing DRM becomes irrelevant. But those comments seem to be mostly downvoted now anyways, so they don't seem to be representative.

KingMachiavelli 7y ago

Agreed. I've been blocking HTTP (on port 80) accross my network and I reroute all DNS traffic to a pihole configured to use DoT. At this point in time there is really no reason to let anyone see plain text traffic. A few things are whitelisted but the handful of things that break aren't necessary anyway.

tfigment 7y ago
Genuine question: Do you not have issues with browsers and other security products and OCSP? At work they blocked all internet access and tools that forced use of CRL and OCSP lost their minds. Digicert and other CAs seem to to use port 80 for this. Firefox requires OCSP option to be disabled for me for GitHub to work with pauses.
- user5994461 7y ago
  OCSP is broken by design. Should turn it off for server applications. Maybe even disable it entirely when compiling openssl if possible. OCSP is to query random CA web servers when opening a SSL connection to verify if the certificate in use was revoked. It's broken by design because servers simply don't have internet access.
  - labawi 7y ago
    OCSP with server-side stapling and must-staple marked certificates should work fine for most use cases.
- jiggawatts 7y ago
  This is what happens when people do random shit in the name of security. It's security theatre, not security engineering. Microsoft Windows, for example, allows administrators to re-publish external CRLs internally, but this only works for the built-in crypto API. Non-native applications generally won't pick this up, including most command-line tools. Blocking outbound port 80 is a mistake. A colleague said it best: Certificate private keys are like your password. Tell no one, ever. The public key is like your passport. It's safe to hand to a border officer. CRLs are the lists of passport numbers used by known terrorists wanted by Interpol. Preventing the border officer seeing that list just lets the terrorists through the airport. This is never good. Similarly, most firewalls ship with "drop" as the default rule, which means that a small error in the firewall rules will just end up with 20-120 second timeouts throughout the network. If instead they "rejected" flows with an explicit deny response, this failure mode would be instant and easier to diagnose. Just yesterday I was trying to diagnose a packet loss issue on a network where some security troll blocked all ICMP between all endpoints. The last time "ping" was used as an attack vector was in the last century, but apparently it's important to prevent any hope of diagnosing entire categories of network issues. Unsurprisingly, their network has atrocious performance, random periods of high packet loss, and asymmetric routing issues. This will not get resolved until the idiot in the security team quits or retires. PS: I suspect their issue is large UDP packets getting dropped on some paths due to MTU issues. To diagnose this without ICMP in a complex network is basically impossible. The automatic fix is to enable Path MTU Discovery... which requires ICMP! Every large environment I've been to that has these security trolls in charge with nobody to reign them in was a shitshow of broken systems performing catastrophically badly because they spend 99% of the time waiting for timeouts. PPS: Why firewalls don't simply have a default, auto-updating rule for "Enable CRL & OCSP outbound" for all known public CAs is beyond me. This is an extremely common requirement, to the point of being practically mandatory for any medium-large enterprise. If you firewall doesn't have this feature, and about a dozen similar ones, you're getting ripped off. You're probably paying some decent fraction of a million dollars for a bag a tools, not a complete solution.

upofadown 7y ago

Any change can and should be questioned as to if it actually improves things.

user5994461 7y ago

Who cares about security in the real world? Have you tried googling "should I use SSL"? The top answer is a stackoverflow answer saying no way. "Putting SSL everywhere is only a way to get a warm fuzzy feeling on security that is no good. It [SSL] is usually only used as a distraction allowing administrators to disregard actual security issues." https://stackoverflow.com/questions/2177159/should-all-sites-use-ssl-by-default/ https://stackoverflow.com/questions/2177159/should-all-sites...

adamduren 7y ago
I wonder if accepted answers with negative upvotes still display at the top on SO... Only one way to find out.

stronglikedan 7y ago

> netflix et al have reduced stream quality due to increased load OT, but why am I still paying full price for less-than-full quality? Same with Amazon - why am I paying for two-day Prime shipping even though it's impossible to get that level of service right now? /rant

azinman2 7y ago
Because a black swan event has occurred, life is anything but normal right now, and people are generally concerned about things that are far more important.
- stronglikedan 7y ago
  I understand that, but it's trivial for them to temporarily reduce the amount they're charging me, since I'm not getting what I'm paying for. I'd see it as them during their part to help the people in this crisis. But alas, I digress, as it was just an opportunistic rant, and I feel better for getting it out.
  - vinay_ys 7y ago
    You have the option to opt into a SD only plan, don't you?
    - toomuchtodo 7y ago
      Reduces the number of simultaneous streams from 2 to 1 as well.
    - stronglikedan 7y ago
      Of course, but that's comparing apples to oranges, so not really relevant.
stjohnswarts 7y ago
Because that's life during a national emergency. If you don't want to pay it then stop paying it, NF and Amazon will let that happen. I assume Amazon might even prorate your refund.

elithrar 7y ago

> why netflix et al have reduced stream quality due to increased load? This is not quite true - it's less about _Netflix's_ load and more about load on the _access networks_ (end-user ISPs). They are seeing longer peaks, increased congestion (fewer folks are leaving their homes), and thus the reduction in default streaming quality by many streaming platforms was a move to limit congestion on these last-mile networks (and some IXs) where possible. The EU & India anticipated the most congestion here, which is why you likely saw these announcements start with the EU before becoming global, as other ISPs/IXs/govts began to think about the same. Disclosure: I work for Google in this space, but don't represent them here.

dang 7y ago

You're probably running into the contrarian dynamic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22contrarian%20dynamic%22%20objecti&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... Your comment is a great example of the second wave: objections to the objections, getting upvoted to the top of the thread. (Edit: it's no longer at the top, see explanation below.) Comment threads don't represent the community view. They self-select for commenters who object to something. This is particularly true early on, since objecting is usually a reflex reaction that leads to quick comments. Reflective comments, the better kind, take longer to appear—because reflection is a slower cognitive process and because they take longer to write. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20reflective%20reflex&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... The third wave is people looking around and not seeing the second-wave description of the thread really matching the comments (we got one of those too: https://news.ycombinator.com/item?id=22935245 https://news.ycombinator.com/item?id=22935245). That's because the original objections have since been supplemented by more interesting comments that were slower to roll in. It may also be because the janitors a.k.a. moderators have been active in the thread, sweeping up and so on. Edit: Speaking of janitorial work, I've downweighted this subthread now, which is one of the things we do. Check out the effect: at least as of this moment, if you scroll back to the top, notice how much more enticing and curious the conversation is, than if this were the first thing were seeing. It's as if the thread can breathe.

__s 7y ago
Neat, I've noticed this pattern in the past, but haven't ended up in this spot myself What's the better way to play out this dynamic? Since there were three comments I didn't think it'd be optimal to spam by replying to all three individually. Maybe picking one to reply to would be better. I don't think downvoting is the right play, but ignoring may be Maybe responding with agreement to the article, without objection to the objection
- dang 7y ago
  Great question! It's better to reply, because then it at least won't get upvoted to the top of the thread, accruing mass and blocking fresh conversation. I think you're correct that it suffices to pick one to reply to, perhaps the most prominent one, or the one where the reply will be most interesting. I don't see any problem with downvoting something like https://news.ycombinator.com/item?id=22934379 https://news.ycombinator.com/item?id=22934379 as well. The trouble with an indignant anti-crap comment is that it can't help but repeat the crap it's objecting to, because that's what it's about. Negation is a form of repetition. Crap subthreads tend eventually to get moderated by users, but that doesn't happen with their anti-crap counterparts. Usually those get upvoted to the top, since people love defending the unfairly criticized and we all respond to indignation. But then it sits there, choking out new discussion with metafumes. The best way to counter bad comments is to post a good one—for example, a reflective comment about the specifics of the article, or a curious comment about something unexpected in it. This isn't always an option, though, because one doesn't always have something like that to say. I think responding to reflexive negativity with a pleasantly-worded objection can still be helpful—just not as a top-level comment.