5 ms·

Seems annoying, but any application can work around any firewall rules pretty trivially provided they can get at least one type of connection out to the interne

Seems annoying, but any application can work around any firewall rules pretty trivially provided they can get at least one type of connection out to the internet. TCP, UDP, DNS... anything. Just need that one connection and it can be turned into a tunnel. The private relay feature is worth being aware of, but it's irritating for users to deal with overzealous and clueless admins who think that locking down systems by disabling features like this can "increase security". It just ends up getting in the way of getting work done without any real benefit.

ocdtrekkie 4y ago
You're ignoring that admins have often legal responsibilities and compliance requirements to manage and monitor their networks. It doesn't really matter how I feel about a given VPN service... if you want to be on my network you have to turn it off. (And yes, I often end up annoying myself by blocking stuff I myself would like to access at work. But that's my job.)
- tomjen3 4y ago
  Sure and that is understandable, but it doesn't really do much. My personal phone is not on my employeers wifi but is still right next to me. There is nothing technical that they can do, short of a faraday cage for the building, to prevent me from going where ever I want on it. I feel like rules such as yours are a pre smartphone era thing, when I had to use the company laptop to get online away from home.
  - ocdtrekkie 4y ago
    It does a lot: You aren't exposing our network to security threats or legal liability. I don't care what you do with your phone on your own Internet connection. But if you want to connect it to my Wi-Fi then it has to follow my rules.
    - msh 4y ago
      If you don't control the endpoints you don't control the network.
      - ocdtrekkie 4y ago
        It depends. Obviously a lot of effort by certain monopolistic advertising companies have gone into ensuring the web platform is increasingly opaque and difficult to manage or monitor, but it's entirely in the purview of a network owner to disable or block anything that can't be inspected to satisfaction.
        msh 4y ago
        Well if you want to block everything that can't be inspected you will block a lot of common functionality. The question about if it's in the network owners purview to inspect depends on the network and traffic. It could also be illegal privacy violations.
        ocdtrekkie 4y ago
        There is no reasonable expectation of privacy on someone else's network, particularly an employer's. Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment. I understand that ad companies have a vested interest in circumventing this and trying to move internet standards to opaque protocols, but until that particular fiefdom is unseated, we have to make reasonable tradeoffs. In the meantime, we block a massive amount of malware by blocking their ad domains.
        izacus 4y ago
        > There is no reasonable expectation of privacy on someone else's network, particularly an employer's. This is a massive [Citation needed]. Do you have a court precendence case where you can prove that admins have the right to snoop through private and sensitive data of users that are just connected to some network?
- Maxburn 4y ago
  This is why apple tells you how to block private relay. https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for... mask.icloud.com mask-h2.icloud.com
  - tinus_hn 4y ago
    In addition if this service is a problem, consider there could be a thousand providers you have never heard of providing the same kind of service but while going out of their way to make sure you don’t actually have a way to block it. If you really ‘need’ to block that kind of connection the onus is on you, not on the services.
    - Maxburn 4y ago
      Absolutely. There are block lists out there that can help but they are unlikely to be perfect. This guy seems to be up to date; https://github.com/oneoffdallas/dohservers https://github.com/oneoffdallas/dohservers
- hesdeadjim 4y ago
  Yea, like enforcing the seemingly obvious “don’t use the fucking office network for torrenting”. I nearly lost my mind when I got a DMCA notice from our ISP. I never thought I’d need to lecture a team of professionals that the consequences of losing our office internet would be significant to the business.
  - deleted 4y ago
    [deleted]
2Gkashmiri 4y ago
you comment "anything. Just need that one connection and it can be turned into a tunnel." this interests me because a few years ago i was subjected to a government imposed firewall https://thewire.in/government/kashmir-internet-whitelisted-websites https://thewire.in/government/kashmir-internet-whitelisted-w... and i tried my best to bypass this but i did not have the energy to fashion a touniquet of sorts. i did end up spinning up a free amazon vps because apparently "amazon website" was unblocked and that forced them to allow aws. i ended up simply using ssh -D to the ip of the vps. that worked for a while but it was not fun... the connection would drop frequently but otherwise it was a POC. my point is, when we are talking about a hostile adversary like your government that is out to get you, regular "vpn" does not work, in my case, i tried every darn thing but until i came up with my thing, i could not get access to regular internet so for the next time, what can i do?
- hhh 4y ago
  This is my first thought of how to do my own VPN in a hostile environment, with the term VPN do you think of consumer VPNs? (Mullvad, Nord, etc.) When I moved to university, bandwidth was limited in the dormitory to 1mbps/user (in 2016…) This was unacceptable to me, but we had a private link (non-internet) to the campus with virtual desktop infrastructure that had no such limits :). ssh -D immediately gave me 500mbps download to my dorm room, and I guess this sort of thing is probably why I think of ssh -D and running on port 53 etc to evade this sort of thing. Public education in the US can function pretty well as a government out to get you in terms of digital freedom :)
  - 2Gkashmiri 4y ago
    yeah, i even ended up using firefox foxyproxy addon because then i could either go all in on the proxy or whitelist style only few websites or blacklist with all websites and few open. that addon probably was the best thing in all of it because i was not pushing the entire OS through the tunnel. yeah, i guess for some time, cisco was called out by news outlets for helping the government impose the firewall which the company later denied but the damage was done by then so it didnt really matter, still, i think this just slipped from their minds, a random port, somethimes 80, 8080, 3400. it was fun (well considering the circumstances) with the added risk of incarceration if caught and many were unfortunately so yeah
danamit 4y ago
The issue here is that an application is bypassing a kernel-level firewall, seems crazy to me that a Unix system is allowing that.
- dismantlethesun 4y ago
  Apple seems to consider that they are the kernel and your machine is just a terminal that happens to run on their platform.

ocdtrekkie 4y ago

You're ignoring that admins have often legal responsibilities and compliance requirements to manage and monitor their networks. It doesn't really matter how I feel about a given VPN service... if you want to be on my network you have to turn it off. (And yes, I often end up annoying myself by blocking stuff I myself would like to access at work. But that's my job.)

tomjen3 4y ago
Sure and that is understandable, but it doesn't really do much. My personal phone is not on my employeers wifi but is still right next to me. There is nothing technical that they can do, short of a faraday cage for the building, to prevent me from going where ever I want on it. I feel like rules such as yours are a pre smartphone era thing, when I had to use the company laptop to get online away from home.
- ocdtrekkie 4y ago
  It does a lot: You aren't exposing our network to security threats or legal liability. I don't care what you do with your phone on your own Internet connection. But if you want to connect it to my Wi-Fi then it has to follow my rules.
  - msh 4y ago
    If you don't control the endpoints you don't control the network.
    - ocdtrekkie 4y ago
      It depends. Obviously a lot of effort by certain monopolistic advertising companies have gone into ensuring the web platform is increasingly opaque and difficult to manage or monitor, but it's entirely in the purview of a network owner to disable or block anything that can't be inspected to satisfaction.
      - msh 4y ago
        Well if you want to block everything that can't be inspected you will block a lot of common functionality. The question about if it's in the network owners purview to inspect depends on the network and traffic. It could also be illegal privacy violations.
        ocdtrekkie 4y ago
        There is no reasonable expectation of privacy on someone else's network, particularly an employer's. Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment. I understand that ad companies have a vested interest in circumventing this and trying to move internet standards to opaque protocols, but until that particular fiefdom is unseated, we have to make reasonable tradeoffs. In the meantime, we block a massive amount of malware by blocking their ad domains.
        izacus 4y ago
        > There is no reasonable expectation of privacy on someone else's network, particularly an employer's. This is a massive [Citation needed]. Do you have a court precendence case where you can prove that admins have the right to snoop through private and sensitive data of users that are just connected to some network?
Maxburn 4y ago
This is why apple tells you how to block private relay. https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/ https://developer.apple.com/support/prepare-your-network-for... mask.icloud.com mask-h2.icloud.com
- tinus_hn 4y ago
  In addition if this service is a problem, consider there could be a thousand providers you have never heard of providing the same kind of service but while going out of their way to make sure you don’t actually have a way to block it. If you really ‘need’ to block that kind of connection the onus is on you, not on the services.
  - Maxburn 4y ago
    Absolutely. There are block lists out there that can help but they are unlikely to be perfect. This guy seems to be up to date; https://github.com/oneoffdallas/dohservers https://github.com/oneoffdallas/dohservers
hesdeadjim 4y ago
Yea, like enforcing the seemingly obvious “don’t use the fucking office network for torrenting”. I nearly lost my mind when I got a DMCA notice from our ISP. I never thought I’d need to lecture a team of professionals that the consequences of losing our office internet would be significant to the business.
- deleted 4y ago
  [deleted]

2Gkashmiri 4y ago

you comment "anything. Just need that one connection and it can be turned into a tunnel." this interests me because a few years ago i was subjected to a government imposed firewall https://thewire.in/government/kashmir-internet-whitelisted-websites https://thewire.in/government/kashmir-internet-whitelisted-w... and i tried my best to bypass this but i did not have the energy to fashion a touniquet of sorts. i did end up spinning up a free amazon vps because apparently "amazon website" was unblocked and that forced them to allow aws. i ended up simply using ssh -D to the ip of the vps. that worked for a while but it was not fun... the connection would drop frequently but otherwise it was a POC. my point is, when we are talking about a hostile adversary like your government that is out to get you, regular "vpn" does not work, in my case, i tried every darn thing but until i came up with my thing, i could not get access to regular internet so for the next time, what can i do?

hhh 4y ago
This is my first thought of how to do my own VPN in a hostile environment, with the term VPN do you think of consumer VPNs? (Mullvad, Nord, etc.) When I moved to university, bandwidth was limited in the dormitory to 1mbps/user (in 2016…) This was unacceptable to me, but we had a private link (non-internet) to the campus with virtual desktop infrastructure that had no such limits :). ssh -D immediately gave me 500mbps download to my dorm room, and I guess this sort of thing is probably why I think of ssh -D and running on port 53 etc to evade this sort of thing. Public education in the US can function pretty well as a government out to get you in terms of digital freedom :)
- 2Gkashmiri 4y ago
  yeah, i even ended up using firefox foxyproxy addon because then i could either go all in on the proxy or whitelist style only few websites or blacklist with all websites and few open. that addon probably was the best thing in all of it because i was not pushing the entire OS through the tunnel. yeah, i guess for some time, cisco was called out by news outlets for helping the government impose the firewall which the company later denied but the damage was done by then so it didnt really matter, still, i think this just slipped from their minds, a random port, somethimes 80, 8080, 3400. it was fun (well considering the circumstances) with the added risk of incarceration if caught and many were unfortunately so yeah

danamit 4y ago

The issue here is that an application is bypassing a kernel-level firewall, seems crazy to me that a Unix system is allowing that.

dismantlethesun 4y ago
Apple seems to consider that they are the kernel and your machine is just a terminal that happens to run on their platform.