4 ms·

I wonder if the various corporate MITM nanny gateways and firewalls will keep up with this. And not just the manufacturers, but the device owners that don't ke

by tyingq 5y ago

I wonder if the various corporate MITM nanny gateways and firewalls will keep up with this. And not just the manufacturers, but the device owners that don't keep them up to date. I know Chrome had to implement a race between tcp and quic to detect various forms of broken firewalls, content filtering devices, etc. Maybe it would be better just to let things break and force the issue?

sgift 5y ago
> Maybe it would be better just to let things break and force the issue? I think it would be better, but unfortunately it won't happen. Too much money riding on it. I still hope newer versions of http continue to be designed to be more resistant against these garbage tools.
kmonsen 5y ago
I helped out with implementing quick in chrome, letting things break was never an option that was considered.
FridgeSeal 5y ago
I'm really interested to know how far we could push performance, encryption/security, features, etc if we didn't care about legacy systems or breaking current setups. What are we missing out on, because of the refusal to let go of pointless legacy systems?
- tyingq 5y ago
  Yeah, that's an interesting question. If we had, for example, moved to IPV6 only some time ago...what innovations would have followed on that more solid ground, no NAT, etc. Or perhaps on a smaller timescale, just pushing ESNI as a non-negotiable thing.
  - josephcsible 5y ago
    > just pushing ESNI as a non-negotiable thing Well, ECH instead of eSNI now, but yes, I would have loved this. Since browsers are all going to be willing to fall back to sending the website name in cleartext, anyone evil enough to be willing to do censorship or surveillance will just block eSNI and ECH.
- jayd16 5y ago
  No more middle box caching. Maybe that's pointless, maybe not.
- hogrider 5y ago
  This is what makes me think they should mandate an expiry date for this infrastructure stuff, this is good programmable obsolescence.
userbinator 5y ago
I personally run a MITM proxy and force everything on the network through it. If you can't inpect --- and alter --- what your devices are sending and receiving, it's not yours. Big Tech seems to be on a race to own the Internet through increasing complexity and "upgrade treadmilling", and I block everything except HTTP 1.1 and 1.0 as a form of protest.
- josephcsible 5y ago
  I agree with this, but remember that it's just as important that devices make sure that anyone who's not you can't inspect or alter what your devices are sending or receiving.
- jpambrun 5y ago
  My company essentially does that and I find it incredibly annoying. It breaks many stuff and makes performance much worst. Just so they can more easily spy on us.
  - userbinator 5y ago
    The company's network isn't yours. You may understand their perspective when it is your own network that you want to control the traffic on. I've always found it ironic that a lot of the anti-MITM-proxy folks are the same ones who work at or approve of the companies which are bringing more pervasive-surveillance "smart" devices to the market, locking down end-user-devices against the user, or trying to get you to consume more of their ads. Everything they say they do is for "security" and "privacy". They obviously don't want you getting in the way. Coincidence or not? You decide...

by tyingq 5y ago

sgift 5y ago

> Maybe it would be better just to let things break and force the issue? I think it would be better, but unfortunately it won't happen. Too much money riding on it. I still hope newer versions of http continue to be designed to be more resistant against these garbage tools.

kmonsen 5y ago

I helped out with implementing quick in chrome, letting things break was never an option that was considered.

FridgeSeal 5y ago

I'm really interested to know how far we could push performance, encryption/security, features, etc if we didn't care about legacy systems or breaking current setups. What are we missing out on, because of the refusal to let go of pointless legacy systems?

tyingq 5y ago
Yeah, that's an interesting question. If we had, for example, moved to IPV6 only some time ago...what innovations would have followed on that more solid ground, no NAT, etc. Or perhaps on a smaller timescale, just pushing ESNI as a non-negotiable thing.
- josephcsible 5y ago
  > just pushing ESNI as a non-negotiable thing Well, ECH instead of eSNI now, but yes, I would have loved this. Since browsers are all going to be willing to fall back to sending the website name in cleartext, anyone evil enough to be willing to do censorship or surveillance will just block eSNI and ECH.
jayd16 5y ago
No more middle box caching. Maybe that's pointless, maybe not.
hogrider 5y ago
This is what makes me think they should mandate an expiry date for this infrastructure stuff, this is good programmable obsolescence.

userbinator 5y ago

I personally run a MITM proxy and force everything on the network through it. If you can't inpect --- and alter --- what your devices are sending and receiving, it's not yours. Big Tech seems to be on a race to own the Internet through increasing complexity and "upgrade treadmilling", and I block everything except HTTP 1.1 and 1.0 as a form of protest.

josephcsible 5y ago
I agree with this, but remember that it's just as important that devices make sure that anyone who's not you can't inspect or alter what your devices are sending or receiving.
jpambrun 5y ago
My company essentially does that and I find it incredibly annoying. It breaks many stuff and makes performance much worst. Just so they can more easily spy on us.
- userbinator 5y ago
  The company's network isn't yours. You may understand their perspective when it is your own network that you want to control the traffic on. I've always found it ironic that a lot of the anti-MITM-proxy folks are the same ones who work at or approve of the companies which are bringing more pervasive-surveillance "smart" devices to the market, locking down end-user-devices against the user, or trying to get you to consume more of their ads. Everything they say they do is for "security" and "privacy". They obviously don't want you getting in the way. Coincidence or not? You decide...