5 ms·

Does anyone else think it's weird/futile that they're building a protocol over UDP? QUIC is disabled on our corporate network, simply because the network firew

Does anyone else think it's weird/futile that they're building a protocol over UDP? QUIC is disabled on our corporate network, simply because the network firewall/SSL inspector can't see what's going on, and can't regulate traffic, so it just blocks all UDP. our internet still works because sites see that QUIC doesn't work and fall back to TCP. Heaven forbid the entire web moves to QUIC or we'd be in trouble.

sammy2244 6y ago
I think its weird/futile to block all UDP traffic.
- gravypod 6y ago
  It's strangely common. As someone who has worked in a few IoT companies that ship devices that run on other people's networks the amount of enterprise gear that just drops all UDP as a default is astonishing. Every single IoT device I've worked on has had some custom, hand rolled, NTP-over-HTTP to get around RTC failures.
- mr_toad 6y ago
  Many enterprises have a “block everything” mentality and only allow traffic on “expected” ports and protocols.
judge2020 6y ago
TCP+UDP will probably be the norm for a decade once it's rolled out, and with this being announced for Chrome, it'll only show the market that there's demand for UDP packet inspection - not that that's the best solution to DLP; endpoint security and MDM gives the most insight and solves the problem of middlemen [who might be a trusted local network operator, or might be a government-controlled ISP] being able to inspect/limit traffic.
agwa 6y ago
Frankly, that would be your problem. Enterprise intransigence should not hold back the rest of the Internet.
- djhaskin987 6y ago
  My point is that it is a lot of people's problem. Mine isn't the only company using large-scale, off-the-shelf, really-very-normal firewall and network safety equipment and software. Just because you work at a start up, doesn't mean most people do. Lots of us work at banks, financial institutions, insurance companies. These companies make a lot more money than the average start up, and are risk averse and care a lot about compliance. They house a lot of "dark matter" developers and technology professionals. The whole way this debate is going irks me. It's like there is two camps: those who think all the world is smart phones being used by people way out in the desert and everyone else. There are lots and lots of devices that have high speed, low latency connections. The people that use those devices are people, too. We should not over optimize for the remote smart phone user over everyone else.
  - agwa 6y ago
    Enterprises can still have all this stuff that is supposedly so important to them, like network interception and "compliance". But they might have to upgrade their software, insist that their vendors implement standards correctly, or maybe change the way they do some things. As you point out, these companies make more money than anyone else. That means change shouldn't be a problem for them. But of course they would prefer to externalize their costs onto less-resourced companies and individuals. It's everyone else's job to make sure they can't get away with that.
  - userbinator 6y ago
    The biggest users of MITM technologies are companies but there are probably quite a few individual users too --- I have a proxy for network-wide adblocking and page rewriting/filtering.
- mike_d 6y ago
  I encourage you to reach out to your elected representatives and let them know you are opposed to things like banking regulations that require corporations to capture all employee communications.
  - 6y ago
nsgi 6y ago
Does your company really need to do SSL inspection or are they doing it just because they can? My experience of working in places that do that is that it encourages poor security practices because people end up being too lazy to install the root certificates in their software or can't work out how and end up just disabling certificate checking entirely
- djhaskin987 6y ago
  I want to go out there and say that I hate SSL inspection. But in the case of our VDI workstations the way the company has it it's not something you can turn off. They're trying to put software on all our laptops which would make SSL inspection a reality on our laptops as well but I'm avoiding it like the plague. It's just too hard to teach all the applications that I use to use a certificate chain that they're not interested in using.

sammy2244 6y ago

I think its weird/futile to block all UDP traffic.

gravypod 6y ago
It's strangely common. As someone who has worked in a few IoT companies that ship devices that run on other people's networks the amount of enterprise gear that just drops all UDP as a default is astonishing. Every single IoT device I've worked on has had some custom, hand rolled, NTP-over-HTTP to get around RTC failures.
mr_toad 6y ago
Many enterprises have a “block everything” mentality and only allow traffic on “expected” ports and protocols.

judge2020 6y ago

TCP+UDP will probably be the norm for a decade once it's rolled out, and with this being announced for Chrome, it'll only show the market that there's demand for UDP packet inspection - not that that's the best solution to DLP; endpoint security and MDM gives the most insight and solves the problem of middlemen [who might be a trusted local network operator, or might be a government-controlled ISP] being able to inspect/limit traffic.

agwa 6y ago

Frankly, that would be your problem. Enterprise intransigence should not hold back the rest of the Internet.

djhaskin987 6y ago
My point is that it is a lot of people's problem. Mine isn't the only company using large-scale, off-the-shelf, really-very-normal firewall and network safety equipment and software. Just because you work at a start up, doesn't mean most people do. Lots of us work at banks, financial institutions, insurance companies. These companies make a lot more money than the average start up, and are risk averse and care a lot about compliance. They house a lot of "dark matter" developers and technology professionals. The whole way this debate is going irks me. It's like there is two camps: those who think all the world is smart phones being used by people way out in the desert and everyone else. There are lots and lots of devices that have high speed, low latency connections. The people that use those devices are people, too. We should not over optimize for the remote smart phone user over everyone else.
- agwa 6y ago
  Enterprises can still have all this stuff that is supposedly so important to them, like network interception and "compliance". But they might have to upgrade their software, insist that their vendors implement standards correctly, or maybe change the way they do some things. As you point out, these companies make more money than anyone else. That means change shouldn't be a problem for them. But of course they would prefer to externalize their costs onto less-resourced companies and individuals. It's everyone else's job to make sure they can't get away with that.
- userbinator 6y ago
  The biggest users of MITM technologies are companies but there are probably quite a few individual users too --- I have a proxy for network-wide adblocking and page rewriting/filtering.
mike_d 6y ago
I encourage you to reach out to your elected representatives and let them know you are opposed to things like banking regulations that require corporations to capture all employee communications.
- 6y ago

nsgi 6y ago

Does your company really need to do SSL inspection or are they doing it just because they can? My experience of working in places that do that is that it encourages poor security practices because people end up being too lazy to install the root certificates in their software or can't work out how and end up just disabling certificate checking entirely

djhaskin987 6y ago
I want to go out there and say that I hate SSL inspection. But in the case of our VDI workstations the way the company has it it's not something you can turn off. They're trying to put software on all our laptops which would make SSL inspection a reality on our laptops as well but I'm avoiding it like the plague. It's just too hard to teach all the applications that I use to use a certificate chain that they're not interested in using.