3 ms·

Man, what a condescending tone you take. > Block whatever stupid protocols Windows uses for file sharing so you don't leak your credentials, that's all the out

Man, what a condescending tone you take. > Block whatever stupid protocols Windows uses for file sharing so you don't leak your credentials, that's all the outgoing filtering you need. It's clear that you've never managed networks that need to meet stringent security requirements. > Universities are research facilities, they're supposed to be at the forefront of technology, not run into service issues because their policies are frozen in the late 90s. It's also clear that you've never worked on infrastructure in a large heterogenous environment that grew organically over decades. Or dealt with infrastructure that was grant funded. Yeah both of those problems are solved or alleviated with tooling but it can take years to get all the disparate systems managed in house.

jeroenhd 4y ago
This is about a university, not the NSA. Sure, there are other security measures you need to take (known botnets etc.) but a blanket ban on all outgoing network traffic? That's just excessive. This isn't the first post the author has made about their university's network infrastructure. The HTTP/3 issues start being named years back. The university, as an organisation, doesn't seem to want to move away from the old way of doing networking. There's no indication this is a "we have to hotfix it for now because our new systems are done in 2030" network, and every indication that they're stretching their current design for as long as it'll hold. Even if they're doing this for security reasons, the days of unsecured bastions with a strict firewall around them, as suggested by their latest infrastructure blog post, are long gone. I highly doubt security is the reason the university can't move on. With no migration plans as far as I can see, they're setting themselves up for failure again when HTTP/4 inevitably comes around, or when strict networking peculiarities cause the next QUIC/HTTP3/TLS 1.3 bug the author will have to dive into and figure out.
lucideer 4y ago
> that need to meet stringent security requirements That need to meet overreaching legal compliance requirements, maybe, but this isn't the same as security. > you've never worked on infrastructure in a large heterogenous environment that grew organically over decades. Or dealt with infrastructure that was grant funded. I should hope you don't need to be an outsider/inexperienced to point out obvious dysfunction. Yes, said dysfunction almost always has very explainable context and causes (organic growth over decades, inconsistent/dependent funding structures, etc.) but neither negate the fact that it is a form of dysfunction, nor should they put it beyond criticism (from inside or out).

jeroenhd 4y ago

This is about a university, not the NSA. Sure, there are other security measures you need to take (known botnets etc.) but a blanket ban on all outgoing network traffic? That's just excessive. This isn't the first post the author has made about their university's network infrastructure. The HTTP/3 issues start being named years back. The university, as an organisation, doesn't seem to want to move away from the old way of doing networking. There's no indication this is a "we have to hotfix it for now because our new systems are done in 2030" network, and every indication that they're stretching their current design for as long as it'll hold. Even if they're doing this for security reasons, the days of unsecured bastions with a strict firewall around them, as suggested by their latest infrastructure blog post, are long gone. I highly doubt security is the reason the university can't move on. With no migration plans as far as I can see, they're setting themselves up for failure again when HTTP/4 inevitably comes around, or when strict networking peculiarities cause the next QUIC/HTTP3/TLS 1.3 bug the author will have to dive into and figure out.

lucideer 4y ago

> that need to meet stringent security requirements That need to meet overreaching legal compliance requirements, maybe, but this isn't the same as security. > you've never worked on infrastructure in a large heterogenous environment that grew organically over decades. Or dealt with infrastructure that was grant funded. I should hope you don't need to be an outsider/inexperienced to point out obvious dysfunction. Yes, said dysfunction almost always has very explainable context and causes (organic growth over decades, inconsistent/dependent funding structures, etc.) but neither negate the fact that it is a form of dysfunction, nor should they put it beyond criticism (from inside or out).