4 ms·

Am I just incredibly cynical today or does this read like dense corporate bullshit and lies from start to finish? I have no idea what the software does but it s

by Timwi 4y ago

Am I just incredibly cynical today or does this read like dense corporate bullshit and lies from start to finish? I have no idea what the software does but it sounds like network-sniffing, privacy-intruding malware being severely sugarcoated? It even starts out with the clichéd line of being “strongly committed to open-source” coming from a Microsoft executive, who (correct me if I'm wrong) haven't open-sourced Windows. Am I the only one who gets dystopian vibes from this?

amony 4y ago
Zeek is a network protocol parser used to monitor network activity. It parses protocols such as SMTP, DNS, TLS, HTTP, FTP, File, SSH, etc. and collects metadata about that activity. Here's some of the DNS fields it extracts as it observes the traffic: https://docs.zeek.org/en/current/scripts/base/protocols/dns/main.zeek.html https://docs.zeek.org/en/current/scripts/base/protocols/dns/...
- ape4 4y ago
  Does it decrypt TLS?
  - amony 4y ago
    No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...
  - dvt 4y ago
    If you have the keys, it looks like it can[1][2] (a contingency is that connections must use `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`) -- it seems like it's basically the same thing as Wireshark (a network packet sniffer for debugging/forensic purposes). Not sure why everyone on HN is freaking out about it. It's actually pretty annoying to have to install Wireshark (including their capture driver) every time I need to debug over-the-wire network data. [1] https://docs.zeek.org/en/current/scripts/policy/protocols/ssl/decryption.zeek.html https://docs.zeek.org/en/current/scripts/policy/protocols/ss... [2] https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_SSL.functions.bif.zeek.html https://docs.zeek.org/en/current/scripts/base/bif/plugins/Ze...
nemo44x 4y ago
It’s extremely popular and useful software. Government and corporations use it all over the place. > I have no idea what the software does but it sounds like network-sniffing, privacy-intruding malware being severely sugarcoated? It used to be named “Bro” as in “Big Brother”. So yea, it was designed to be very intrusive to privacy concerns.
causi 4y ago
I have no idea what the software does but it sounds like network-sniffing, privacy-intruding malware being severely sugarcoated? AKA 80% of Windows development since 2009?
- quotehelp1829 4y ago
  Why 80% and why since 2009?
  - causi 4y ago
    Well I'm not going to pretend all of Microsoft's efforts have gone into being progressively more sleazy, just most of them. 2009 is the year Windows 7 released.
    - quotehelp1829 4y ago
      What was it about Windows 7 that introduced network-sniffing, privacy-intruding malware?
      - bitwize 4y ago
        The idea is that Windows 7 was the last release without network-sniffing, privacy-intruding malware (at least, as it came stock from Microsoft, which it did not when preinstalled on a typical PC).
        causi 4y ago
        Remember being excited about the new version of Windows?
        bitwize 4y ago
        For me it seemed that with Windows 11, Microsoft was attempting to recreate the hypetrain they'd built for Windows 95 -- but without the groundbreaking improvements over the previous version of Windows that Windows 95 had. And the result was just desperate and sad.
maven29 4y ago
Wouldn't the alternative be putting everything behind an airgap and foregoing creature comforts to create parallel infrastructure at great cost? Threat actors don't care about your privacy concerns either.
deleted 4y ago
[deleted]
ethbr0 4y ago
> Am I just incredibly cynical today or does this read like dense corporate bullshit and lies from start to finish? It reads like a press release, because it is. Note the "Press Release" banner at top, and the "About *" blurbs at the bottom. > Am I the only one who gets dystopian vibes from this? No, also the tool's founder, which is why he named it Bro, as in Big Brother.

by Timwi 4y ago

amony 4y ago

Zeek is a network protocol parser used to monitor network activity. It parses protocols such as SMTP, DNS, TLS, HTTP, FTP, File, SSH, etc. and collects metadata about that activity. Here's some of the DNS fields it extracts as it observes the traffic: https://docs.zeek.org/en/current/scripts/base/protocols/dns/main.zeek.html https://docs.zeek.org/en/current/scripts/base/protocols/dns/...

ape4 4y ago
Does it decrypt TLS?
- amony 4y ago
  No. It parses that protocol and logs the metadata observed (time, duration, bytes, source IP, destination IP, ports, cert info, etc.) Edit: I suppose it could be configured to do that. I've used Zeek in several organizations over the last 15 years and I have never seen it used in that way. However, Zeek running on a client computer (not on a cluster being fed from a 100 Gbit tap or SPAN) would be more scalable. And this announcement is about that. Here's a nice paper on how Zeek has been configured to monitor fast networks: https://commons.lbl.gov/download/attachments/120063098/100GIntrusionDetection.pdf https://commons.lbl.gov/download/attachments/120063098/100GI...
- dvt 4y ago
  If you have the keys, it looks like it can[1][2] (a contingency is that connections must use `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`) -- it seems like it's basically the same thing as Wireshark (a network packet sniffer for debugging/forensic purposes). Not sure why everyone on HN is freaking out about it. It's actually pretty annoying to have to install Wireshark (including their capture driver) every time I need to debug over-the-wire network data. [1] https://docs.zeek.org/en/current/scripts/policy/protocols/ssl/decryption.zeek.html https://docs.zeek.org/en/current/scripts/policy/protocols/ss... [2] https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_SSL.functions.bif.zeek.html https://docs.zeek.org/en/current/scripts/base/bif/plugins/Ze...

nemo44x 4y ago

It’s extremely popular and useful software. Government and corporations use it all over the place. > I have no idea what the software does but it sounds like network-sniffing, privacy-intruding malware being severely sugarcoated? It used to be named “Bro” as in “Big Brother”. So yea, it was designed to be very intrusive to privacy concerns.

causi 4y ago

I have no idea what the software does but it sounds like network-sniffing, privacy-intruding malware being severely sugarcoated? AKA 80% of Windows development since 2009?

quotehelp1829 4y ago
Why 80% and why since 2009?
- causi 4y ago
  Well I'm not going to pretend all of Microsoft's efforts have gone into being progressively more sleazy, just most of them. 2009 is the year Windows 7 released.
  - quotehelp1829 4y ago
    What was it about Windows 7 that introduced network-sniffing, privacy-intruding malware?
    - bitwize 4y ago
      The idea is that Windows 7 was the last release without network-sniffing, privacy-intruding malware (at least, as it came stock from Microsoft, which it did not when preinstalled on a typical PC).
      - causi 4y ago
        Remember being excited about the new version of Windows?
        bitwize 4y ago
        For me it seemed that with Windows 11, Microsoft was attempting to recreate the hypetrain they'd built for Windows 95 -- but without the groundbreaking improvements over the previous version of Windows that Windows 95 had. And the result was just desperate and sad.

maven29 4y ago

Wouldn't the alternative be putting everything behind an airgap and foregoing creature comforts to create parallel infrastructure at great cost? Threat actors don't care about your privacy concerns either.

deleted 4y ago

[deleted]

ethbr0 4y ago

> Am I just incredibly cynical today or does this read like dense corporate bullshit and lies from start to finish? It reads like a press release, because it is. Note the "Press Release" banner at top, and the "About *" blurbs at the bottom. > Am I the only one who gets dystopian vibes from this? No, also the tool's founder, which is why he named it Bro, as in Big Brother.