12 ms·

Considered "18+"

391 points by elvis70 4y ago

fuzzy2 4y ago
ESNI cannot come fast enough.
- raxxorraxor 4y ago
  Yes, we really need that. Glad we have TLS and questionable ambitions show that it doesn't even reach deep enough. Although the way the web works a web request to domain.xy doesn't mean much anyway but people still believe in it. Also MITM attacks in IT security should be shunned and I believe the users need to be informed about it when they happen. IT could potentially steal banking information. I believe this to be highly illegal in my country and still a data breach even if an employee wasn't allowed to do the transaction because it was private.
- slowmovintarget 4y ago
  Isn't ECH the new new? https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08
- Avamander 4y ago
  It's ECH now, Chromium/Google are actively working in it. So soon™ In addition to that we need ODoH and NTS as well. It's pretty clear neither countries or ISPs (not to mention attackers) can keep their grubby fingers out of anything unencrypted. MITM should be visible or impossible.
joeberon 4y ago
It's because there are too many x's in the name
- jka 4y ago
  I'd bet it's because the filtering vendor (Allot) sells a simple interface to the customer (Vodafone) that mostly consists of allowlist/blocklist entries manually added by support agents when someone complains. There's probably a policy to dictate what content should be filtered, but in practice: a ticket is filed to block a site, someone looks at the ticket, in all likelihood it is added to the blocklist, and then probably ends up there forever until complaints are raised. You could be correct that the presence of multiple x's in the URL makes it more likely for support agents to think "yep, this is probably sketchy, there's no harm adding it to the blocklist" - I doubt it's the original reason though.
- pimlottc 4y ago
  Clearly it's a website of sex hacks. Or a saxophone curse, I'm not sure...
  - gpvos 4y ago
    It's Swedish too!
- Minor49er 4y ago
  From the article: > It shows that this filter is for this specific host name only, not for the entire haxx.se domain.
travisporter 4y ago
I'm glad he was able to resolve this. I get the feeling most people wouldn't care, because after all they're not blocking instagram/facebook/tiktok.
- gsich 4y ago
  Where have you read that? It reads to me that he applied for unblocking, but no result as of yet.
  - travisporter 4y ago
    Sorry you're right I misread that. I can't edit the above comment
- isaacfrond 4y ago
  He is still blocked. According to: https://www.blocked.org.uk/site/http://daniel.haxx.se https://www.blocked.org.uk/site/http://daniel.haxx.se
sp332 4y ago
Why would they bother doing a TLS handshake with a phony certificate?
- JonathonW 4y ago
  If you were a school or other institutional user using this filtering service (which isn't just marketing to service providers like Vodafone), you'd probably have their root CA installed so your users see the filter error page instead of just an SSL error.
- xmodem 4y ago
  How else could they let the end user know what's going on? Due to pinning, it's either present a phony certificate, or completely fail the connection and give the user no indicationo why. Of course, accepting the phony certificate will immediately leak your cookies to the middlebox, along with giving it permission to read any credentials out of local storage. So as an end user you should not accept it.
digitallyfree 4y ago
And if this wasn't bad enough, they want your credit card info to unblock the site.
- hsbauauvhabzb 4y ago
  Citation? I wonder if the card authorities would be pleased to hear that.
  - digitallyfree 4y ago
    There's a screenshot of the block page in the original post. "3. Use your credit card to confirm your age (you won't be charged)." https://daniel.haxx.se/blog/wp-content/uploads/2022/05/vodafone-uk-daniel-haxx-se-2.jpg https://daniel.haxx.se/blog/wp-content/uploads/2022/05/vodaf...
- philjohn 4y ago
  UK citizen here - yeah, it's supper annoying. It's to verify you're over 18 as that's the age at which you can obtain a credit card. You can though ring the mobile phone provider and tell them to turn off the block - and we can blame our conservative government for pushing this through (and looking to go even further in the future).
nimbius 4y ago
im always chuffed and fascinated when tech companies cloister themselves in the robes of moral arbiter. Twitter does this now, albeit it seems like a cheap excuse to pump user numbers by forcing authentication. Why 18? why not 21? or 23? What qualifies as explicitly "adult" content? violence perhaps could disqualify most military recruiting sites from my vodaphone. Alcohol? its certainly a moral vice in the UAE but in germany even a fourteen year old can order a bier with their parents. Sex? its a sensitive subject for even the most conservative among us until we touch upon religious texts, which seem to enjoy free reign. what i wonder most is...what is the altruistic moral source of truth used as litmus by Voda and others? or is it driven largely by a small but vocal minority or is the board pushing this as some sort of nineteenth century neo-victorian purity charge.
- steventhedev 4y ago
  These content filtering schemes are usually legally mandated, and the age of 18 is set by law. More likely than not, this got caught up in a regular job that scans DNS zones for new domains to "filter". It's just a matter of time before this catches anything related to Scunthorpe[0]. [0]: https://en.m.wikipedia.org/wiki/Scunthorpe_problem https://en.m.wikipedia.org/wiki/Scunthorpe_problem
  - II2II 4y ago
    > These content filtering schemes are usually legally mandated, and the age of 18 is set by law. It's also worth adding that 18 is typically the age when someone is considered legally accountable for their actions as an adult. We shouldn't be surprised that this age pops up in so many laws because of that, even though it is an arbitrary line in most cases.
    - jjjensen90 4y ago
      The odd thing is that in most countries the age of consent is below (sometimes significantly below) 18. So we’ve got strange mixed signals.
deleted 4y ago
[deleted]
donatj 4y ago
A number of my personal sites end up blocked by corporate firewalls. It’s slightly infuriating. Even my own company. I got in a literal fight with IT needing to justify the why in why I needed access to my own website. Like I can live without it, but it’s nothing but my blog where I rant about tech. The why should be why is it blocked to begin with. The default state should not be blocked.
- Symbiote 4y ago
  Even more ridiculous: several small sites run by my team, from our own public IP space, have been blocked by the corporate firewall. There has never been anything wrong with them, it's just braindead blocking software purchased by incompetent managers.
  - ugjka 4y ago
    Yeah "We block 50% more than our competitors" "Good deal!"
  - nonrandomstring 4y ago
    > just braindead blocking software purchased by incompetent managers. Having been that IT person early in my career, responsible for networks, firewalls and policies, what you say sounds cruel. But I could not agree more. Today there is a tragic de-skilling in ICT. When I speak to modern corporate or academic IT people I make the best faith assumptions. I assume they are like we were in the early 90s and speak to them accordingly with technical respect. Then I discover they cannot configure a mail or web server, cannot compile a program, or even use a package manager... they don't know how to read logs or change permissions on a directory.... the mind boggles. I've had senior IT people tell me that they're "not technical" and it turns out they've arrived on some "management track" from an arts-history background. I'm not knocking arts history, or being "elitist" I hope, but this raises serious concerns for me. What is going on in IT? Have cloud services, tick-box webmin interfaces and packaged solutions led to a brain drain? One could argue that modern IT people don't need "geeky computer skills" any more, because Google and Microsoft have solved everything. But that doesn't pan out, because when simple things go wrong they cannot fix them (which is their job). Right now I am dealing with an international university whose impeccable pedigree is bedrock in computing history - and their IT people cannot fix a simple email issue, to the extent the staff and students have to set up their own servers. The fact is, they just don't have control over it any longer. I think the entire senior ranks are just marking time till they can retire.
isaacfrond 4y ago
It is not totally clear from the article, but it appears Vodafone blocks a site as 'for 18+' when really it is a case of an incorrect certificate. To get round it you need to register with Vodafone. At least google allows me to click away such warnings (while warning that doom is imminent).
- sofixa 4y ago
  Isn't the certificate "incorrect" only because Vodafone block the site and intercept the TLS connection? That's why the "incorrect" TLS cert presented mentions Vodafone's "solution" for traffic filtering. That's my read of things.
  - peppermint_tea 4y ago
    same. Just inspected the original cert (not on vodaphone here) and the cert is verified by GlobalSign nv-sa
edent 4y ago
Many years ago, I used to work for Vodafone - and had some responsibility for their filtering stuff. One of the main problems was that, at the time, it was all managed by Blue Coat. As they were a US company, many of the "violations" that they picked up just weren't considered problematic for a UK / EU audience. Similarly, they would use blanked keyword blocking. So sex education resources would frequently get blocked. Although, again, that may have been by puritanical design. Anything which looked like it might be used to bypass their filters (VPN, proxies, etc) were also blocked. Ultimately, the customer isn't the user. It is the network who are terrified that Johnny's parent is going to go to the papers screaming about how the evil phone company corrupted their innocent child. That's all it is there for - to protect the network.
- ______-_-______ 4y ago
  I wonder what the disconnect is that causes people to blame Vodafone for content requested over their network, but not Royal Mail for the content that arrives in their mailbox, or Google/Chrome for the content of webpages, or Dunder Mifflin for content printed on paper. Has that ever actually happened, or is it just corporate risk aversion?
  - pc86 4y ago
    Well there was that quabbity assuence issue with the two cartoon characters..
- joosters 4y ago
  Oddly enough, vodafone filtering is less restrictive in other ways. For instance, they never blocked The Pirate Bay, but I just switched ISP from vodafone and my new ISP (Sky) blocks the site via some TLS tricks. It's odd because while adult content blocks are purely a per-ISP choice (they offer it as a service/choice to customers), I had thought that TPB was blocked because of court orders. So how come one ISP blocks it, and other doesn't?
  - doublerabbit 4y ago
    If you wish to throw conspiracy in to the mix, data logging for govermentental safe-keeping. Sounded like scifi in the 00's.
astura 4y ago
Sigh Automatic classification of material as "adult" has always sucked. I remember watching a news report where schools filters had classified webpages referencing the current Super Bowl (Super Bowl XXX) as adult content due to XXX typically being associated with adult material. The opposite happens too - see Elsagate. The newest version of Elsagate material, which I've only seen one person talking about, is weird/inappropriate stories aimed at children but disguised as baking videos - https://youtu.be/HfcKCk6vPCE?t=295 https://youtu.be/HfcKCk6vPCE?t=295
- LorenPechtel 4y ago
  There is no decent solution to the Scunthorpe problem. It doesn't matter how many try, they never succeed.
- vorpalhex 4y ago
  The thing that gets me with the elsagate material is that it is weird. More weird than offensive. Is this just machine written content that has gone a bit nuts?
- gregmac 4y ago
  Yikes, this is so much worse than merely weird, though it definitely is that. Here's the transcript from a couple, both of which are played over top of those "5-minute craft" style (faked) baking videos: > > Someone knocked on the front door. I opened it and saw a strange tiny man standing there with a creepy smile on his face and he smells really good. > > He said "Hi I'm Noah I'm looking for your dad, is he home?" > > I replied "No he's out there looking for a stupid job." > > I was about to close the door in his face when he suddenly pushed it back open. I screamed, I thought he was going to hurt me. He took off his glasses and told me to stay calm. He looked a lot less intimidating without his glasses on and his face was softer. > > I said "okay, come on in" https://youtu.be/HfcKCk6vPCE?t=436 https://youtu.be/HfcKCk6vPCE?t=436 Or: > > After one of my live youtube videos one of my viewers sent a message asking if we could meet. It was a bit strange for someone to be so insistent, especially after what my brother was doing so I ignored him at first. Then, a few days later, he messaged me again. He said he knew how to deal with my brother. He believed me. I agreed to meet him but I was nervous. What if it's just a stupid prank, I wondered. I went to the coffee shop he had asked me to go to. I didn't even know his name. > And in that story he turns out to be a handsome knight in shining armor who rescues her from all her troubled home life problems. https://youtu.be/HfcKCk6vPCE?t=485 https://youtu.be/HfcKCk6vPCE?t=485
hathym 4y ago
They must have a rule like this one: return all([c in 'haxx.se' for c in ['s', 'e', 'x']])
- LeifCarrotson 4y ago
  They are to catch those sneaky, morally subversive domains like 'xes-spelled-backwards.com'!
Terretta 4y ago
Can’t think what the “ha” would stand for in their analysis, but the se and xx can be indicators of adultness when you have a naive algo for dealing with bot spam domains for adult-content-as-spam: Some even started using multiple X's (i.e. XX, XXX, etc.) to give the impression that their film contained more graphic sexual content than the simple X rating. In some cases, the X ratings were applied by reviewers or film scholars, e.g. William Rotsler, who wrote "The XXX-rating is for Hardcore, the XX-rating is for Softcore, and an X-rating is for comparatively cool films." — https://en.wikipedia.org/wiki/X_rating https://en.wikipedia.org/wiki/X_rating That said if they think the domain is a soft hit they should look at content, site age and classification in e.g. bluecoat, etc., which would counter the soft domain indicator. If the site allows comments and doesn’t always successfully moderate or filter out adult bot spam links, that can make even clean content sites get filtered. To be clear, not! aware of any spam at this site, but as a heads up to anyone w/ open commenting, comment engines that allow a website link are often bot-bait.
- deleted 4y ago
  [deleted]
- josephcsible 4y ago
  I don't think that has anything to do with it, because of this: > It shows that this filter is for this specific host name only, not for the entire haxx.se domain.
  - sockmeistr 4y ago
    No offence to the other members of haxx, but I suspect Daniel's site is the only one that gets enough traffic to be considered for filtering.
    - LordDragonfang 4y ago
      Somehow that seems worse. Don't apply automatic filters to sketchy, fly-by-night spam sites that pop up and disappear, but do apply purely automatic filters to sites with a significant enough amount of legitimate traffic? That seems to be exactly backwards of the way things should be done if it wasn't mostly security theater.
captainbland 4y ago
I'm very much of the opinion that such filtering should be opt-in rather than opt-out. Now don't get me wrong, it should be trivial for a parent to opt in if they want to but I fundamentally don't agree that it should be the default to child-proof the internet. Otherwise ISPs are basically collecting a list of self-identified internet deviants by whatever definition they have. I mean at least make them do a bit of work to process my DNS history to figure that out... Not to mention the point of the article, that the filtering is often overzealous and captures the weirdest things.
willyt 4y ago
Vodafone is a mess. I bought a 24Gb pre-paid sim which was supposed to last 2 years but they 'lost' my plan after 6months and 2Gb of data use. Spent an hour on chat with them telling me that no such plan had ever existed until I told them I had all the receipts and evidence of how much data I had used and threatened to take them to the small claims court with expenses at £60/hr for my time. They capitulated quickly after that and restored it, then 'lost' my plan again the next month. I've had problems with billing glitches with four utility companies in the UK now and I am starting to suspect that overcharging people and hoping they don't notice is actually a common business strategy in the industry and if they get caught they blame bad IT but really their systems are configured to do this on purpose.
- ectopod 4y ago
  I think it's semi deliberate. They put systems in place to catch errors that cost them money but they don't go looking for errors that cost their customers. The result is inevitable but there is enough plausible deniability to avoid any serious consequences for the company.
gorgoiler 4y ago
Good! curl is a dangerous tool that can be used to circumvent deep link protections for corporate intellectual property. Imagine the kinds of evil that can be done by pirates if they are able to construct a URL and then simply fetch it using this so called haxx (hacks, aka hackers) tool.
freedomben 4y ago
Meta-comment mostly meant for @dang daniel.haxx.se is Daniel Stenberg's blog (famously known as curl maintainer), and would best be displayed with the subdomain as daniel.haxx.se rather than haxx.se, similar to how substacks include the subdomain to make it clear at a glance what the source is.
- gus_massa 4y ago
  Send an email to hn@ycombinator.com He usually reply the same day. IIRC they only show subdomains for sites that have a lot of posts, but it's not a hard rule so he may make an exception.
inetknght 4y ago
1. intercept traffic to IP 2. present custom "valid" certificate 3. ??? 4. profit! ... isn't this something that certificate transparency should help solve?
- cryptonector 4y ago
  > isn't this something that certificate transparency should help solve? No. CT is meant to help find illegitimate server certificate issuance by participating CAs, but it cannot help the user-agent get past illegitimate server certs. Besides, the whole point here is to make the user-agent fail to load the page, therefore the network operator's firewall's CA would not participate in CT (nor be a CAB member), and the network operator does not just not mind that the illegitimate server certificate is noticed, they want it noticed.
  - inetknght 4y ago
    > CT is meant to help find illegitimate server certificate issuance by participating CAs, but it cannot help the user-agent get past illegitimate server certs. That's the point though. I'd rather the user-agent tell me that the certificate is invalid. That's as far as it's currently going anyway when a certificate is, for example, self-signed. > Besides, the whole point here is to make the user-agent fail to load the page, That's exactly the minimum that should happen, yes. User-agent sees that the certificate isn't correctly issued for the domain and refuses to send the HTTP request (though SNI is already sent...) > the network operator does not just not mind that the illegitimate server certificate is noticed, they want it noticed. More than just noticed: the network operator wants the user to inappropriately act on the illegitimate server certificate.
hatware 4y ago
I learn a little more about net neutrality every day.
mperham 4y ago
It's maddening that there's no audit trail or public record you can use to debug "why?". I had my domain put on a phishing blacklist due to DNS caching. During a 30 minute cache window, I decommissioned a server and a bad actor picked up the recycled server's IP address. The IP reverse lookup showed my domain due to the cache.
K0nserv 4y ago
I have a Virgin Media subscription for my phone and a while back I discovered that sometimes Reddit didn't load. It took me a while to figure out that it was on 4G and happened because I'd been using Virign's DNS servers. This is a similar "adult filter", that most UK ISPs implement. AFAIK the filtering isn't legally mandated, but something the ISPs decide on together based on a some government memo. In any case it's dead simple to bypass and a very blunt tool. For example, why does Virigin block Reddit, but not Twitter? Both sites feature adult content, in fact so does Google image search. The silver lining in all this stupidity is perhaps that it creates a more technically talented population. I don't expect most teenagers know or want to know about DNS, but if that's what stands between them and adult content I'm sure they'll learn.
nly 4y ago
Par for the course. It's more or less untenable to surf in the UK without a VPN.
nickdothutton 4y ago
My own blog (Cyber Security related) was also blocked by a couple of mobile operators in the UK the last time I checked. The internet has been dead for some years now.
cryptonector 4y ago
Daniel Stenberg is such a haxx.or, I guess.
diseasedyak 4y ago
I worked for over a decade as a DBA for one of the largest private data warehouse companies, and it was hilariously fun to get the so-called "naughty word list" for customer suppression reasons. I learned so many creative slurs based on where people live or were born. Australians, in particular, have an amazing amount of curse words/racial slurs.
hsbauauvhabzb 4y ago
Automated services need a mandatory human resolution service with a legal avenue if the service is substandard. Looking at you, google.
EMIRELADERO 4y ago
For once I am happy to live in a third-world country. This wouldn't fly here, thanks to the telecommunications law: ARTICLE 57. - Network neutrality. Prohibitions. Service Providers shall not: a) Block, interfere, discriminate, hinder, degrade or restrict the use, sending, reception, offering or access to any content, application, service or protocol except by court order or express request of the user.
hayd 4y ago
Related "The Conservative Woman" has been blocked by Three: https://www.conservativewoman.co.uk/yes-tcw-is-being-censored/ https://www.conservativewoman.co.uk/yes-tcw-is-being-censore... It's sad we're living in times we must exclusively use a VPN.
andrewaylett 4y ago
UK mobile data is filtered by default, while fixed-line isn't. I suspect this is an artifact of "adult" premium rate phone lines - access to those numbers must be limited to those verified to be over 18, and while I've not done the research to back this up it wouldn't surprise me at all if it's the application of this rule over the years that has led to this situation. Of course a mobile telephony provider is going to be a lot more certain which phone numbers attract the specific premium rate categories to need to be blocked than they are which random domains should be blocked :P.
account42 4y ago
> Someone on Vodafone UK could of course easily test this by simply using a different DNS server, like 1.1.1.1 or 8.8.8.8. Not if they intercept all DNS requests, which is not unheard of. DoH or DoT would prevent that though, which is getting enabled in browsers now - probably why they are now employing other methods of filtering.

Considered "18+"

391 points by elvis70 4y ago

fuzzy2 4y ago

ESNI cannot come fast enough.

raxxorraxor 4y ago
Yes, we really need that. Glad we have TLS and questionable ambitions show that it doesn't even reach deep enough. Although the way the web works a web request to domain.xy doesn't mean much anyway but people still believe in it. Also MITM attacks in IT security should be shunned and I believe the users need to be informed about it when they happen. IT could potentially steal banking information. I believe this to be highly illegal in my country and still a data breach even if an employee wasn't allowed to do the transaction because it was private.
slowmovintarget 4y ago
Isn't ECH the new new? https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08
Avamander 4y ago
It's ECH now, Chromium/Google are actively working in it. So soon™ In addition to that we need ODoH and NTS as well. It's pretty clear neither countries or ISPs (not to mention attackers) can keep their grubby fingers out of anything unencrypted. MITM should be visible or impossible.

joeberon 4y ago

It's because there are too many x's in the name

jka 4y ago
I'd bet it's because the filtering vendor (Allot) sells a simple interface to the customer (Vodafone) that mostly consists of allowlist/blocklist entries manually added by support agents when someone complains. There's probably a policy to dictate what content should be filtered, but in practice: a ticket is filed to block a site, someone looks at the ticket, in all likelihood it is added to the blocklist, and then probably ends up there forever until complaints are raised. You could be correct that the presence of multiple x's in the URL makes it more likely for support agents to think "yep, this is probably sketchy, there's no harm adding it to the blocklist" - I doubt it's the original reason though.
pimlottc 4y ago
Clearly it's a website of sex hacks. Or a saxophone curse, I'm not sure...
- gpvos 4y ago
  It's Swedish too!
Minor49er 4y ago
From the article: > It shows that this filter is for this specific host name only, not for the entire haxx.se domain.

travisporter 4y ago

I'm glad he was able to resolve this. I get the feeling most people wouldn't care, because after all they're not blocking instagram/facebook/tiktok.

gsich 4y ago
Where have you read that? It reads to me that he applied for unblocking, but no result as of yet.
- travisporter 4y ago
  Sorry you're right I misread that. I can't edit the above comment
isaacfrond 4y ago
He is still blocked. According to: https://www.blocked.org.uk/site/http://daniel.haxx.se https://www.blocked.org.uk/site/http://daniel.haxx.se

sp332 4y ago

Why would they bother doing a TLS handshake with a phony certificate?

JonathonW 4y ago
If you were a school or other institutional user using this filtering service (which isn't just marketing to service providers like Vodafone), you'd probably have their root CA installed so your users see the filter error page instead of just an SSL error.
xmodem 4y ago
How else could they let the end user know what's going on? Due to pinning, it's either present a phony certificate, or completely fail the connection and give the user no indicationo why. Of course, accepting the phony certificate will immediately leak your cookies to the middlebox, along with giving it permission to read any credentials out of local storage. So as an end user you should not accept it.

digitallyfree 4y ago

And if this wasn't bad enough, they want your credit card info to unblock the site.

hsbauauvhabzb 4y ago
Citation? I wonder if the card authorities would be pleased to hear that.
- digitallyfree 4y ago
  There's a screenshot of the block page in the original post. "3. Use your credit card to confirm your age (you won't be charged)." https://daniel.haxx.se/blog/wp-content/uploads/2022/05/vodafone-uk-daniel-haxx-se-2.jpg https://daniel.haxx.se/blog/wp-content/uploads/2022/05/vodaf...
philjohn 4y ago
UK citizen here - yeah, it's supper annoying. It's to verify you're over 18 as that's the age at which you can obtain a credit card. You can though ring the mobile phone provider and tell them to turn off the block - and we can blame our conservative government for pushing this through (and looking to go even further in the future).

nimbius 4y ago

im always chuffed and fascinated when tech companies cloister themselves in the robes of moral arbiter. Twitter does this now, albeit it seems like a cheap excuse to pump user numbers by forcing authentication. Why 18? why not 21? or 23? What qualifies as explicitly "adult" content? violence perhaps could disqualify most military recruiting sites from my vodaphone. Alcohol? its certainly a moral vice in the UAE but in germany even a fourteen year old can order a bier with their parents. Sex? its a sensitive subject for even the most conservative among us until we touch upon religious texts, which seem to enjoy free reign. what i wonder most is...what is the altruistic moral source of truth used as litmus by Voda and others? or is it driven largely by a small but vocal minority or is the board pushing this as some sort of nineteenth century neo-victorian purity charge.

steventhedev 4y ago
These content filtering schemes are usually legally mandated, and the age of 18 is set by law. More likely than not, this got caught up in a regular job that scans DNS zones for new domains to "filter". It's just a matter of time before this catches anything related to Scunthorpe[0]. [0]: https://en.m.wikipedia.org/wiki/Scunthorpe_problem https://en.m.wikipedia.org/wiki/Scunthorpe_problem
- II2II 4y ago
  > These content filtering schemes are usually legally mandated, and the age of 18 is set by law. It's also worth adding that 18 is typically the age when someone is considered legally accountable for their actions as an adult. We shouldn't be surprised that this age pops up in so many laws because of that, even though it is an arbitrary line in most cases.
  - jjjensen90 4y ago
    The odd thing is that in most countries the age of consent is below (sometimes significantly below) 18. So we’ve got strange mixed signals.

deleted 4y ago

[deleted]

donatj 4y ago

A number of my personal sites end up blocked by corporate firewalls. It’s slightly infuriating. Even my own company. I got in a literal fight with IT needing to justify the why in why I needed access to my own website. Like I can live without it, but it’s nothing but my blog where I rant about tech. The why should be why is it blocked to begin with. The default state should not be blocked.

Symbiote 4y ago
Even more ridiculous: several small sites run by my team, from our own public IP space, have been blocked by the corporate firewall. There has never been anything wrong with them, it's just braindead blocking software purchased by incompetent managers.
- ugjka 4y ago
  Yeah "We block 50% more than our competitors" "Good deal!"
- nonrandomstring 4y ago
  > just braindead blocking software purchased by incompetent managers. Having been that IT person early in my career, responsible for networks, firewalls and policies, what you say sounds cruel. But I could not agree more. Today there is a tragic de-skilling in ICT. When I speak to modern corporate or academic IT people I make the best faith assumptions. I assume they are like we were in the early 90s and speak to them accordingly with technical respect. Then I discover they cannot configure a mail or web server, cannot compile a program, or even use a package manager... they don't know how to read logs or change permissions on a directory.... the mind boggles. I've had senior IT people tell me that they're "not technical" and it turns out they've arrived on some "management track" from an arts-history background. I'm not knocking arts history, or being "elitist" I hope, but this raises serious concerns for me. What is going on in IT? Have cloud services, tick-box webmin interfaces and packaged solutions led to a brain drain? One could argue that modern IT people don't need "geeky computer skills" any more, because Google and Microsoft have solved everything. But that doesn't pan out, because when simple things go wrong they cannot fix them (which is their job). Right now I am dealing with an international university whose impeccable pedigree is bedrock in computing history - and their IT people cannot fix a simple email issue, to the extent the staff and students have to set up their own servers. The fact is, they just don't have control over it any longer. I think the entire senior ranks are just marking time till they can retire.

isaacfrond 4y ago

It is not totally clear from the article, but it appears Vodafone blocks a site as 'for 18+' when really it is a case of an incorrect certificate. To get round it you need to register with Vodafone. At least google allows me to click away such warnings (while warning that doom is imminent).

sofixa 4y ago
Isn't the certificate "incorrect" only because Vodafone block the site and intercept the TLS connection? That's why the "incorrect" TLS cert presented mentions Vodafone's "solution" for traffic filtering. That's my read of things.
- peppermint_tea 4y ago
  same. Just inspected the original cert (not on vodaphone here) and the cert is verified by GlobalSign nv-sa

edent 4y ago

Many years ago, I used to work for Vodafone - and had some responsibility for their filtering stuff. One of the main problems was that, at the time, it was all managed by Blue Coat. As they were a US company, many of the "violations" that they picked up just weren't considered problematic for a UK / EU audience. Similarly, they would use blanked keyword blocking. So sex education resources would frequently get blocked. Although, again, that may have been by puritanical design. Anything which looked like it might be used to bypass their filters (VPN, proxies, etc) were also blocked. Ultimately, the customer isn't the user. It is the network who are terrified that Johnny's parent is going to go to the papers screaming about how the evil phone company corrupted their innocent child. That's all it is there for - to protect the network.

______-_-______ 4y ago
I wonder what the disconnect is that causes people to blame Vodafone for content requested over their network, but not Royal Mail for the content that arrives in their mailbox, or Google/Chrome for the content of webpages, or Dunder Mifflin for content printed on paper. Has that ever actually happened, or is it just corporate risk aversion?
- pc86 4y ago
  Well there was that quabbity assuence issue with the two cartoon characters..
joosters 4y ago
Oddly enough, vodafone filtering is less restrictive in other ways. For instance, they never blocked The Pirate Bay, but I just switched ISP from vodafone and my new ISP (Sky) blocks the site via some TLS tricks. It's odd because while adult content blocks are purely a per-ISP choice (they offer it as a service/choice to customers), I had thought that TPB was blocked because of court orders. So how come one ISP blocks it, and other doesn't?
- doublerabbit 4y ago
  If you wish to throw conspiracy in to the mix, data logging for govermentental safe-keeping. Sounded like scifi in the 00's.

astura 4y ago

Sigh Automatic classification of material as "adult" has always sucked. I remember watching a news report where schools filters had classified webpages referencing the current Super Bowl (Super Bowl XXX) as adult content due to XXX typically being associated with adult material. The opposite happens too - see Elsagate. The newest version of Elsagate material, which I've only seen one person talking about, is weird/inappropriate stories aimed at children but disguised as baking videos - https://youtu.be/HfcKCk6vPCE?t=295 https://youtu.be/HfcKCk6vPCE?t=295

LorenPechtel 4y ago
There is no decent solution to the Scunthorpe problem. It doesn't matter how many try, they never succeed.
vorpalhex 4y ago
The thing that gets me with the elsagate material is that it is weird. More weird than offensive. Is this just machine written content that has gone a bit nuts?
gregmac 4y ago
Yikes, this is so much worse than merely weird, though it definitely is that. Here's the transcript from a couple, both of which are played over top of those "5-minute craft" style (faked) baking videos: > > Someone knocked on the front door. I opened it and saw a strange tiny man standing there with a creepy smile on his face and he smells really good. > > He said "Hi I'm Noah I'm looking for your dad, is he home?" > > I replied "No he's out there looking for a stupid job." > > I was about to close the door in his face when he suddenly pushed it back open. I screamed, I thought he was going to hurt me. He took off his glasses and told me to stay calm. He looked a lot less intimidating without his glasses on and his face was softer. > > I said "okay, come on in" https://youtu.be/HfcKCk6vPCE?t=436 https://youtu.be/HfcKCk6vPCE?t=436 Or: > > After one of my live youtube videos one of my viewers sent a message asking if we could meet. It was a bit strange for someone to be so insistent, especially after what my brother was doing so I ignored him at first. Then, a few days later, he messaged me again. He said he knew how to deal with my brother. He believed me. I agreed to meet him but I was nervous. What if it's just a stupid prank, I wondered. I went to the coffee shop he had asked me to go to. I didn't even know his name. > And in that story he turns out to be a handsome knight in shining armor who rescues her from all her troubled home life problems. https://youtu.be/HfcKCk6vPCE?t=485 https://youtu.be/HfcKCk6vPCE?t=485

hathym 4y ago

They must have a rule like this one: return all([c in 'haxx.se' for c in ['s', 'e', 'x']])

LeifCarrotson 4y ago
They are to catch those sneaky, morally subversive domains like 'xes-spelled-backwards.com'!

Terretta 4y ago

Can’t think what the “ha” would stand for in their analysis, but the se and xx can be indicators of adultness when you have a naive algo for dealing with bot spam domains for adult-content-as-spam: Some even started using multiple X's (i.e. XX, XXX, etc.) to give the impression that their film contained more graphic sexual content than the simple X rating. In some cases, the X ratings were applied by reviewers or film scholars, e.g. William Rotsler, who wrote "The XXX-rating is for Hardcore, the XX-rating is for Softcore, and an X-rating is for comparatively cool films." — https://en.wikipedia.org/wiki/X_rating https://en.wikipedia.org/wiki/X_rating That said if they think the domain is a soft hit they should look at content, site age and classification in e.g. bluecoat, etc., which would counter the soft domain indicator. If the site allows comments and doesn’t always successfully moderate or filter out adult bot spam links, that can make even clean content sites get filtered. To be clear, not! aware of any spam at this site, but as a heads up to anyone w/ open commenting, comment engines that allow a website link are often bot-bait.

deleted 4y ago
[deleted]
josephcsible 4y ago
I don't think that has anything to do with it, because of this: > It shows that this filter is for this specific host name only, not for the entire haxx.se domain.
- sockmeistr 4y ago
  No offence to the other members of haxx, but I suspect Daniel's site is the only one that gets enough traffic to be considered for filtering.
  - LordDragonfang 4y ago
    Somehow that seems worse. Don't apply automatic filters to sketchy, fly-by-night spam sites that pop up and disappear, but do apply purely automatic filters to sites with a significant enough amount of legitimate traffic? That seems to be exactly backwards of the way things should be done if it wasn't mostly security theater.

captainbland 4y ago

I'm very much of the opinion that such filtering should be opt-in rather than opt-out. Now don't get me wrong, it should be trivial for a parent to opt in if they want to but I fundamentally don't agree that it should be the default to child-proof the internet. Otherwise ISPs are basically collecting a list of self-identified internet deviants by whatever definition they have. I mean at least make them do a bit of work to process my DNS history to figure that out... Not to mention the point of the article, that the filtering is often overzealous and captures the weirdest things.

willyt 4y ago

Vodafone is a mess. I bought a 24Gb pre-paid sim which was supposed to last 2 years but they 'lost' my plan after 6months and 2Gb of data use. Spent an hour on chat with them telling me that no such plan had ever existed until I told them I had all the receipts and evidence of how much data I had used and threatened to take them to the small claims court with expenses at £60/hr for my time. They capitulated quickly after that and restored it, then 'lost' my plan again the next month. I've had problems with billing glitches with four utility companies in the UK now and I am starting to suspect that overcharging people and hoping they don't notice is actually a common business strategy in the industry and if they get caught they blame bad IT but really their systems are configured to do this on purpose.

ectopod 4y ago
I think it's semi deliberate. They put systems in place to catch errors that cost them money but they don't go looking for errors that cost their customers. The result is inevitable but there is enough plausible deniability to avoid any serious consequences for the company.

gorgoiler 4y ago

Good! curl is a dangerous tool that can be used to circumvent deep link protections for corporate intellectual property. Imagine the kinds of evil that can be done by pirates if they are able to construct a URL and then simply fetch it using this so called haxx (hacks, aka hackers) tool.

freedomben 4y ago

Meta-comment mostly meant for @dang daniel.haxx.se is Daniel Stenberg's blog (famously known as curl maintainer), and would best be displayed with the subdomain as daniel.haxx.se rather than haxx.se, similar to how substacks include the subdomain to make it clear at a glance what the source is.

gus_massa 4y ago
Send an email to hn@ycombinator.com He usually reply the same day. IIRC they only show subdomains for sites that have a lot of posts, but it's not a hard rule so he may make an exception.

inetknght 4y ago

1. intercept traffic to IP 2. present custom "valid" certificate 3. ??? 4. profit! ... isn't this something that certificate transparency should help solve?

cryptonector 4y ago
> isn't this something that certificate transparency should help solve? No. CT is meant to help find illegitimate server certificate issuance by participating CAs, but it cannot help the user-agent get past illegitimate server certs. Besides, the whole point here is to make the user-agent fail to load the page, therefore the network operator's firewall's CA would not participate in CT (nor be a CAB member), and the network operator does not just not mind that the illegitimate server certificate is noticed, they want it noticed.
- inetknght 4y ago
  > CT is meant to help find illegitimate server certificate issuance by participating CAs, but it cannot help the user-agent get past illegitimate server certs. That's the point though. I'd rather the user-agent tell me that the certificate is invalid. That's as far as it's currently going anyway when a certificate is, for example, self-signed. > Besides, the whole point here is to make the user-agent fail to load the page, That's exactly the minimum that should happen, yes. User-agent sees that the certificate isn't correctly issued for the domain and refuses to send the HTTP request (though SNI is already sent...) > the network operator does not just not mind that the illegitimate server certificate is noticed, they want it noticed. More than just noticed: the network operator wants the user to inappropriately act on the illegitimate server certificate.

hatware 4y ago

I learn a little more about net neutrality every day.

mperham 4y ago

It's maddening that there's no audit trail or public record you can use to debug "why?". I had my domain put on a phishing blacklist due to DNS caching. During a 30 minute cache window, I decommissioned a server and a bad actor picked up the recycled server's IP address. The IP reverse lookup showed my domain due to the cache.

K0nserv 4y ago

I have a Virgin Media subscription for my phone and a while back I discovered that sometimes Reddit didn't load. It took me a while to figure out that it was on 4G and happened because I'd been using Virign's DNS servers. This is a similar "adult filter", that most UK ISPs implement. AFAIK the filtering isn't legally mandated, but something the ISPs decide on together based on a some government memo. In any case it's dead simple to bypass and a very blunt tool. For example, why does Virigin block Reddit, but not Twitter? Both sites feature adult content, in fact so does Google image search. The silver lining in all this stupidity is perhaps that it creates a more technically talented population. I don't expect most teenagers know or want to know about DNS, but if that's what stands between them and adult content I'm sure they'll learn.

nly 4y ago

Par for the course. It's more or less untenable to surf in the UK without a VPN.

nickdothutton 4y ago

My own blog (Cyber Security related) was also blocked by a couple of mobile operators in the UK the last time I checked. The internet has been dead for some years now.

cryptonector 4y ago

Daniel Stenberg is such a haxx.or, I guess.

diseasedyak 4y ago

I worked for over a decade as a DBA for one of the largest private data warehouse companies, and it was hilariously fun to get the so-called "naughty word list" for customer suppression reasons. I learned so many creative slurs based on where people live or were born. Australians, in particular, have an amazing amount of curse words/racial slurs.

hsbauauvhabzb 4y ago

Automated services need a mandatory human resolution service with a legal avenue if the service is substandard. Looking at you, google.

EMIRELADERO 4y ago

For once I am happy to live in a third-world country. This wouldn't fly here, thanks to the telecommunications law: ARTICLE 57. - Network neutrality. Prohibitions. Service Providers shall not: a) Block, interfere, discriminate, hinder, degrade or restrict the use, sending, reception, offering or access to any content, application, service or protocol except by court order or express request of the user.

hayd 4y ago

Related "The Conservative Woman" has been blocked by Three: https://www.conservativewoman.co.uk/yes-tcw-is-being-censored/ https://www.conservativewoman.co.uk/yes-tcw-is-being-censore... It's sad we're living in times we must exclusively use a VPN.

andrewaylett 4y ago

UK mobile data is filtered by default, while fixed-line isn't. I suspect this is an artifact of "adult" premium rate phone lines - access to those numbers must be limited to those verified to be over 18, and while I've not done the research to back this up it wouldn't surprise me at all if it's the application of this rule over the years that has led to this situation. Of course a mobile telephony provider is going to be a lot more certain which phone numbers attract the specific premium rate categories to need to be blocked than they are which random domains should be blocked :P.

account42 4y ago

> Someone on Vodafone UK could of course easily test this by simply using a different DNS server, like 1.1.1.1 or 8.8.8.8. Not if they intercept all DNS requests, which is not unheard of. DoH or DoT would prevent that though, which is getting enabled in browsers now - probably why they are now employing other methods of filtering.