5 ms·
You are the network admin, just block access to port 443 and the problem is solved. The power of a network admin over a host admin is limited to what can be blo
by phicoh 3y ago
You are the network admin, just block access to port 443 and the problem is solved. The power of a network admin over a host admin is limited to what can be blocked.
And the more that is blocked, the more traffic will move to port 443, maybe using some relays at big cloud providers.
I'd say, the job a network admin is to provide positive services: reliable transport of bits, reliable DNS resolvers, etc. Beyond that, a network admin should not look at what users are doing with those bits.
- doubled112 3y agoI do want my bits to transported reliably, but when I have internal services, I want my bits to stay realiably internal. Split DNS is the easiest way to achieve this, but it breaks. DoH is not the problem. I'm using it too. It is the "surprise" that my devices are not using the one given to them.
- throw0101b 3y ago> I'd say, the job a network admin is to provide positive services: reliable transport of bits, reliable DNS resolvers, etc. Beyond that, a network admin should not look at what users are doing with those bits. I'll be sure to tell that to the regulator overseeing my industry and my Compliance department.
- phicoh 3y agoMaybe you don't want to place that solely on the shoulders of the network admin. These days most network data is encrypted, so the network admin cannot do much. So either the host must be trusted to conform to policy. In which case it up to the host admin to avoid bad setups, or the host should have no (direct) access to the internet.