2 ms·
I think that's a consequence of another network principle: default deny. In practice anything that doesn't look like a standard and common protocol gets firewal
by gpderetta 5y ago
I think that's a consequence of another network principle: default deny. In practice anything that doesn't look like a standard and common protocol gets firewalled out into oblivion at some stage or other: first anything that doesn't look like TCP, and if you are lucky UDP, then block everything but well known ports. Then block anything that doesn't look like HTTP, and so on and on.
So we end up with a matrioska stack of encapsulated protocols.
- c-linkage 5y agoTo default deny everything other than HTTP is patently absurd and it should not be used as an excuse for poor engineering. The security argument is poor at best, and dangerous at worst. The fact that one can SSH over HTTP means organizations are no more secure than if they just allowing direct SSH access. Forcing everything over HTTP serves to obfuscate what could be dangerous traffic (SSH-based exfiltration) as innocuous web-browsing. The real way to implement default deny is to block everything except that which is required. If new ports were required for HTTP2 and HTTP3 then you would simply open those ports. If you didn't want to support HTTP/1 because it's unencrypted and it closes the connection after each request you would block port 80 and be done with it. Instead, we build super-complex software that changes its behavior based on a version string in a GET request.
- gpderetta 5y agoI agree completely, but often that's the reality for protocol designers.