7 ms·

Did the internet maybe stop working because you blocked all the major cloud providers? Nextdns (lazy man's pihole) does a decent job of adblock and seems to st

Did the internet maybe stop working because you blocked all the major cloud providers? Nextdns (lazy man's pihole) does a decent job of adblock and seems to stop stuff like Braze tracking from working.

stiray 4y ago
Sure it did. But those are the data that google is getting, it is network transfer trough its servers. They are far beyond "tracking the clicks". And btw, no. The DNS blocking is stopping only domains. The primary addressing level is ip and you cant block it by preventing access to domains. But you can do it using proxy (or firewall, but typically firewall is clueless about the data layer), that is why I made it and while it can read the pihole blacklist and use them, it can do much more (like screwing js browser fingerprinting on network level by injecting js that randomizes the image creation etc.).
- pedrocr 4y ago
  Google is not getting any data when you connect to a GCP VM through TLS. Or did I miss another huge PRISM-level scandal? Same for Azure and AWS. But if you block those no wonder a huge part of the internet is gone.
  - sp332 4y ago
    They know who owns the VM, and now they know that you connected, sent & received a certain amount of data at a certain time. [Edit: apparently this is more encrypted than I was thinking, so the next bit is probably wrong.] They could potentially look inside the VM to look at the specific data on the other side of TLS.
    - carlivar 4y ago
      Can anyone provide proof that Google records this (for Google, not as network telemetry for cloud customers)?
      - metadat 4y ago
        Google Cloud would be negligent if they didn't collect information about ingress and egress traffic mapped to each of their tenants. Since they own the servers and network, it's on them to be able to investigate and track abuse.
        carlivar 4y ago
        Perhaps I phrased it poorly. The inference seems to be Google using this data for their gain (beyond operational needs). Is there any proof of that? Or is my inference incorrect?
    - cortesoft 4y ago
      Sure, and your ISP knows every single IP you have connected to, too. That is just how the internet works.
      - sp332 4y ago
        The ISP only knows that the traffic went to GCP. Google knows which customer it went to.
        jeroenhd 4y ago
        eSNI (or similar) still hasn't been rolled out at large scale. If your ISP wants to, it can know what domain the application is trying to connect to. Domain fronting may confuse them, but most services don't use that at all.
    - freeflight 4y ago
      > They know who owns the VM, and now they know that you connected, sent & received a certain amount of data at a certain time. Which is quite similar to meta data that's collected on phone calls, such data is regularly the basis for governments killing people [0] [0] https://www.justsecurity.org/10311/michael-hayden-kill-people-based-metadata/ https://www.justsecurity.org/10311/michael-hayden-kill-peopl...
  - eurasiantiger 4y ago
    Show me the GCP setup that does TLS beyond ingress. Maybe you can find one in healthcare or finance.
- wombat-man 4y ago
  I know it blocks braze because an app I was testing it in an app I was developing. It's possible for them to hardcode IPs, but last time I checked they were too lazy for that. Maybe static IPs still cost extra? Some apps will do one DNS query and cache the IP they get, so maybe what you're seeing is them using IPs they cached before you rigged up this custom network situation.
Schroedingersat 4y ago
> Did the internet maybe stop working because you blocked all the major cloud providers? You're saying this like it's not the point. Six or seven companies control the internet and have root and logs of all incoming traffic on ~all servers.
- wombat-man 4y ago
  Yeah I mean I guess that's sort of a problem? No reason why people can't setup their own hardware other than cost/sloth. Cloud providers made themselves the best solution for a lot of services.
- pedrocr 4y ago
  There's a huge difference between Google/Microsoft/Amazon having the possibility of accessing "root and logs" just as a side effect of running the service and the OPs assertion about them actively gathering information from that source. It would be a huge scandal if any of those cloud providers were caught peering inside their customer's VMs. Have I missed that scandal?
  - Schroedingersat 4y ago
    It's been a consistently effective strategy to assume any amount of surveillance or control they can implement without leaving evidence is already something they're doing.
  - Schroedingersat 4y ago
    Microsoft openly read every email and teams message and frequently leak the contents to bing and nobody cares. Windows laptops from OEMs frequently come with backdoored https implementations and nobody cared after the first one. Dell business laptops come with malware that sends videos and photos to ukraine and israel and nobody cares. It won't even be a blip when they are caught doing it.
  - nonrandomstring 4y ago
    > It would be a huge scandal if any of those cloud providers were caught peering inside their customer's VMs. No it wouldn't. At this point it could be revealed tomorrow by mountain of incontrovertible evidence and most people would shrug, move on and ask "what next?". Snowden. Shrug. Cisco backdoors. Shrug. Pegasus. Shrug. Solar winds. Shrug... The past decade can be described by the pattern "It would be a terrible scandal if X happened", and then precisely X happens. Then we normalise to it. > Have I missed that scandal? You may say it semi-sarcastically, but of course the irony is that actually you very well could have misse it. You only need to take a vacation for one week, a major shitstorm hits the front pages and fades from the news cycle. Now it's the "new normal". The important point is, you might never know. Without homomorphic encryption you simply have to trust entities that have the means, the motive, the opportunity and the track record for screwing you over.

stiray 4y ago

Sure it did. But those are the data that google is getting, it is network transfer trough its servers. They are far beyond "tracking the clicks". And btw, no. The DNS blocking is stopping only domains. The primary addressing level is ip and you cant block it by preventing access to domains. But you can do it using proxy (or firewall, but typically firewall is clueless about the data layer), that is why I made it and while it can read the pihole blacklist and use them, it can do much more (like screwing js browser fingerprinting on network level by injecting js that randomizes the image creation etc.).

pedrocr 4y ago
Google is not getting any data when you connect to a GCP VM through TLS. Or did I miss another huge PRISM-level scandal? Same for Azure and AWS. But if you block those no wonder a huge part of the internet is gone.
- sp332 4y ago
  They know who owns the VM, and now they know that you connected, sent & received a certain amount of data at a certain time. [Edit: apparently this is more encrypted than I was thinking, so the next bit is probably wrong.] They could potentially look inside the VM to look at the specific data on the other side of TLS.
  - carlivar 4y ago
    Can anyone provide proof that Google records this (for Google, not as network telemetry for cloud customers)?
    - metadat 4y ago
      Google Cloud would be negligent if they didn't collect information about ingress and egress traffic mapped to each of their tenants. Since they own the servers and network, it's on them to be able to investigate and track abuse.
      - carlivar 4y ago
        Perhaps I phrased it poorly. The inference seems to be Google using this data for their gain (beyond operational needs). Is there any proof of that? Or is my inference incorrect?
  - cortesoft 4y ago
    Sure, and your ISP knows every single IP you have connected to, too. That is just how the internet works.
    - sp332 4y ago
      The ISP only knows that the traffic went to GCP. Google knows which customer it went to.
      - jeroenhd 4y ago
        eSNI (or similar) still hasn't been rolled out at large scale. If your ISP wants to, it can know what domain the application is trying to connect to. Domain fronting may confuse them, but most services don't use that at all.
  - freeflight 4y ago
    > They know who owns the VM, and now they know that you connected, sent & received a certain amount of data at a certain time. Which is quite similar to meta data that's collected on phone calls, such data is regularly the basis for governments killing people [0] [0] https://www.justsecurity.org/10311/michael-hayden-kill-people-based-metadata/ https://www.justsecurity.org/10311/michael-hayden-kill-peopl...
- eurasiantiger 4y ago
  Show me the GCP setup that does TLS beyond ingress. Maybe you can find one in healthcare or finance.
wombat-man 4y ago
I know it blocks braze because an app I was testing it in an app I was developing. It's possible for them to hardcode IPs, but last time I checked they were too lazy for that. Maybe static IPs still cost extra? Some apps will do one DNS query and cache the IP they get, so maybe what you're seeing is them using IPs they cached before you rigged up this custom network situation.

Schroedingersat 4y ago

> Did the internet maybe stop working because you blocked all the major cloud providers? You're saying this like it's not the point. Six or seven companies control the internet and have root and logs of all incoming traffic on ~all servers.

wombat-man 4y ago
Yeah I mean I guess that's sort of a problem? No reason why people can't setup their own hardware other than cost/sloth. Cloud providers made themselves the best solution for a lot of services.
pedrocr 4y ago
There's a huge difference between Google/Microsoft/Amazon having the possibility of accessing "root and logs" just as a side effect of running the service and the OPs assertion about them actively gathering information from that source. It would be a huge scandal if any of those cloud providers were caught peering inside their customer's VMs. Have I missed that scandal?
- Schroedingersat 4y ago
  It's been a consistently effective strategy to assume any amount of surveillance or control they can implement without leaving evidence is already something they're doing.
- Schroedingersat 4y ago
  Microsoft openly read every email and teams message and frequently leak the contents to bing and nobody cares. Windows laptops from OEMs frequently come with backdoored https implementations and nobody cared after the first one. Dell business laptops come with malware that sends videos and photos to ukraine and israel and nobody cares. It won't even be a blip when they are caught doing it.
- nonrandomstring 4y ago
  > It would be a huge scandal if any of those cloud providers were caught peering inside their customer's VMs. No it wouldn't. At this point it could be revealed tomorrow by mountain of incontrovertible evidence and most people would shrug, move on and ask "what next?". Snowden. Shrug. Cisco backdoors. Shrug. Pegasus. Shrug. Solar winds. Shrug... The past decade can be described by the pattern "It would be a terrible scandal if X happened", and then precisely X happens. Then we normalise to it. > Have I missed that scandal? You may say it semi-sarcastically, but of course the irony is that actually you very well could have misse it. You only need to take a vacation for one week, a major shitstorm hits the front pages and fades from the news cycle. Now it's the "new normal". The important point is, you might never know. Without homomorphic encryption you simply have to trust entities that have the means, the motive, the opportunity and the track record for screwing you over.