7 ms·
IP address blocking banned after anti-piracy court order hit Cloudflare
- notamy 3y agoIn Austria.
- oxygen_crisis 3y ago> [Austria's] Telekom Control Commission found a violation of Article 3 Paragraph 3 of Regulation (EU) 2015/2120, because the IP access block poses the risk of ‘overblocking’ any website content. Since the blocking was illegal per the European Union's regulations, presumably any other EU nation would have to enact similar decisions if this blocking was done elsewhere in the EU.
- tuetuopay 3y ago> When the ISPs discovered that the IP addresses belonged to Cloudflare, arms were thrown up in despair. The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. I am getting tired of our politics here in europe: tech literate people in governments are put to work on surveilance stuff, never for actual policymaking. The shit show continues.
- veave 3y ago>The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. If I was an engineer there I would block the addresses and call it a day. What do I care? After all it's customer service who will deal with the angry calls.
- clnq 3y agoFortunately they didn't do that and instead got this in front of regulators.
- gsich 3y agoSome, if not all did it.
- redox99 3y agoObviously your boss or boss's boss would care.
- veave 3y agoIt would be my boss or boss' boss ordering me to block the addresses, wouldn't it?
- redox99 3y agoYes, who would also yell at you when customers can't access their cat pictures. Of course it could be an accident, and you didn't know. But if it was clearly malicious compliance, personally and I think I speak for many, I wouldn't continue to have on the team somebody with these kinds of traits.
- veave 3y agoI don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
- throwitaway156 3y agoyou are missing the experience of an asshole manager pressuring you to 'just fix it' in an enraged state accompanied by their phone constantly buzzing from the sweet notification sound of getting bombarded by emails/tickets. for context, i didnt experience this yet. I hope i never do.
- esrauch 3y agoCourts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble. The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned block or not. If they decide you should then you do, if they decide you shouldn't then you don't.
- gsich 3y agoThe ISPs didn't discover this, they knew. But it was mandated so they had to do it.
- gerdesj 3y agoSurely they should have contacted Cloudflare and asked them to sort out the issue with their network ... CF will probably retort {common carrier, we are American and you are not etc}. Austrian policy makers get upset and ... THIS NONSENSE IS STILL NOT SORTED. The internets are somewhat broken, quite badly. We all allow ourselves to end up in a series of virtual walled off silos - Facebook, Twitter etc, run by some pretty worrying monster commercial companies, whilst living within quite disparate physical societies. I think that the fediverse is a possible contender for the way forwards. I dumped Reddit for Lemmy and that seems to be working so far. I know a lot of 'X'iles are finding a home with Mastodon. I worry about quite a few networks. One of the tools in the box is the IP block list. With the rise of the hyper-scalers, the IP blocklist is becoming increasingly useless. Same with SMTP filtering for spam. You can't block M365 or Gmail en-masse (tempting for my home setup, though!) I recently gave CrowdSec a run at work (I will stick with it but with care). Great idea for the 2010s but not so much now. I got it to watch HA Proxy logs (proxies on site Exchange) and it pretty soon decided that my real users should be banned because of how Outlook works, or rather how the auth that Outlook uses works. Outlook doesn't just use Kerberos, it also uses EWS for the Addressbook and the good Lord knows what else. So you get a connection to a endpoint from Outlook without auth creds which generates a 401 (failed auth) error, then Outlook tries again, this time with creds and it works OK (200). To a CrowdSec agent those repeated 401s look like bots pissing around. That is one reason why we cannot have nice things. I'm a Brit (yes we Brexited) but I am still very much a European and so is my little country, like it or not - I have seen shed loads of number plates from across the EU trundling along the large A30/A37 crossroads/roundabout called Yeovil in Somerset. Mostly lorries and quite a few cars and campervans. So I am from country X (GB in my case, not that X!) but I engage with (w,x,y,z) societies on line. Now whose laws apply? In general it seems we muddle along effectively but should there be a formal internationally accepted agreement?
- Atotalnoob 3y ago401 then 200 is part of kerberos/ntlm. You can watch it if you use curl -v 401 indicates it should send it's kerberos ticket. Kerberos verifies it should send a ticket, then sends it. 200 cause you are now authenticated.
- deleted 3y ago[deleted]
- veave 3y agoIP address blocking may have been banned, but DPI to block domains based on SNI is alive and kickin'. I've seen people talk about encrypted SNI for a very long time now and it's still not working; someone must have dropped the ball pretty hard regarding that
- ls612 3y agoECH seems to have been rolled out in browsers as dev features so idk what the real blocker is anymore. Edit: it looks like as of late May if you enable some dev flags in Firefox any site behind Cloudflare should use ECH.
- dilyevsky 3y agothere was a pushback from vendors who drumroll.... sell dpi
- wbl 3y agoThe evolution of ESNI into ECH has been slow but basically encryption of just the SNI would not play nicely with the rest of the protocol. So more had to be encrypted but that meant a deeper interaction to analyze. It's also dependent on a new kind of DNS record and the original design wasn't great for DNS load balancing. Some tweaking had to happen there too.
- getcrunk 3y ago> According to reviews conducted by local telecoms regulator TKK, the IP address blocking violated net neutrality regulations and will no longer be allowed. Thank god for net neutrality. We of course have that here in America right? Cus freedom!
- astrange 3y agoYes, we do have that. It's at the state level.
- msla 3y agohttps://www.nytimes.com/2018/01/22/technology/montana-net-neutrality.html https://www.nytimes.com/2018/01/22/technology/montana-net-ne... https://www.multistate.us/insider/2018/1/24/montana-leads-state-action-on-net-neutrality https://www.multistate.us/insider/2018/1/24/montana-leads-st... Montana's had it since 2018, which was a first: > Montana Governor Steve Bullock (D) signed an executive order requiring internet service providers (ISPs) with state contracts to adhere to “net neutrality.” The state became the first to enact such measures in response to the Federal Communications Commission's (FCC) decision to repeal net neutrality rules last December.
- ars 3y agoAnd despite not having net neutrality in the US not a single one of the fears came true. Which is what I said way back then: There's nothing wrong with net neutrality but it's simply not necessary.
- knodi123 3y agobut they could have. still could. and you might not even know. and the fact that one of our political teams has been fighting SO HARD against net neutrality is a big red flag. protections are important even if someone's not actively and noticeably abusing people right this minute.
- ars 3y agoThere's been exactly zero problems in 20 years (the idea was introduced in 2003), yet somehow "still could. and you might not even know.". No one is fighting "so hard" this is a dead topic. T-Mobile offers to zero rate YouTube if you let them throttle it - it's your choice. Would that be legal under Net Nutrality? Would they have to get permission from YouTube?
- chaxor 3y agoI always assumed businesses such as Cloudfare or Google would have a good reason to be the main IPFS or tor node hosts, since that can help improve the backbone infrastructure for this side of of the internet, and can also help catch bad actors if there are any there (easily turn in all logs to three letter agencies if they knock, or they can simply offer it up for anon tips).
- hutzlibu 3y agoGoogle should run Tor? Yeah, that's an interesting idea, if you want to get rid of that annoying build in anonymity in tor which is its main purpose?
- chaxor 3y agoIt's mostly navy run right now is my understanding, and used by journalists, so I don't see how it's that much of a downgrade.
- ZeroZeroOneZero 3y agoIt was started by the Navy way back in the '90s for secure communication online. Then the source was released like a year after being made public and development was funded by the EFF until the Tor Project itself was officially founded. They still do (or did?) get grants from a few federal agencies though. But they had no strings attached. This is probably what you're thinking of. Source: Hung out with a few Tor devs in Berlin a few years back. Including He Who Shall Not Be Named.
- botanical 3y agoI think they meant it's believed that most/some exit nodes are run by US intelligence to spy on people. Not that development has anything to do with them now.
- tbrownaw 3y ago... They should host the big anonymous services for the purpose of being able to break that anonymity? Somehow I think that might not go over so well.
- jrockway 3y agoWhy can't they discover the IP addresses of the backend and block those? It wouldn't work very well, but then they won't ask again next time.
- LilBytes 3y agoThey could, but they'd need to take CloudFlare to court or similar to force them to disclose that information. Or drop them as a customer.
- fake-name 3y agoThat wouldn't do anything, since CF's CDN connects to the backends directly. As such, any CF server not within the nation in question would effectively be a circumvention tool.
- jrockway 3y agoThese are BGP blocks, right? If Cloudflare's ISP doesn't have a route to the system in question, then it can't proxy the site anymore. Maybe Cloudflare has an Ethernet cable between the server in question and itself, but that seems unlikely to me. There is probably some ISP in the middle that will play ball, right?
- yuliyp 3y agoCloudflare owns/leases fiber to form its own international network. A user's request hits a cloudflare server. if that server needs to contact the origin, it can exit from anywhere in cloudflare's network. If the origin is in the country which is wanting the block to happen they'd just ask the hosting provider to take the service down, otherwise CF would almost certainly be able to reach it from somewhere in their network.
- fake-name 3y agoYou seem to be assuming that cloudflare's CDN is located in the country doing the blocking. I'd imagine that CF's first act would be to remove any of the "offending" content from the country, at which point BGP blocking would no longer do anything.
- worewood 3y agoLooks like my job. The best way to change stupid procedures is following them to the letter and watch the world burn.
- techdragon 3y agoThis is one of the useful tactics that unions will use when they aren’t legally allowed to strike for one reason or another, they will engage in large scale “work to rule”, which is pretty much what it sounds like, you do your work following the rules to the letter and no further, stubbornly by the book no matter how inconvenient or unproductive or disruptive the rules are when you suddenly start following them exactly. It’s particularly effective if the rules are a large part of their collective grievances with management, as it highlights to all involved that the current rules need changing, and can sometimes result in fairly quick and positive changes since it demonstrates to management that the current “rules as written” are not the most fiscally effective set of rules for running the business.
- ternaus 3y agoCalled "Italian strike" https://en.wikipedia.org/wiki/Work-to-rule https://en.wikipedia.org/wiki/Work-to-rule
- yencabulator 3y agoSee also "Simple Sabotage Field Manual", by United States Office of Strategic Services, written by US military for use in occupied countries in Europe. https://www.gutenberg.org/ebooks/26184 https://www.gutenberg.org/ebooks/26184
- vGPU 3y agoEspecially if you stop every single step to go back, make sure that every single previous step has been correctly completed, assign roles for the following steps, have a discussion on workers rights and the equal share of labor to make sure that the workload for each of those steps is distributed equally, and so on and so forth.
- xyst 3y ago
- mike_d 3y agoPlenty of corporate web filtering solutions block on IPs, and the adoption of ESNI will only make it worse. If you manage an important website, moving out of a bad neighborhood (Cloudflare) before you end up the victim of blocking is probably a good idea.
- Daneel_ 3y agoLayer 7 gear has been around for a long time. At an ISP level I’d be shocked if they weren’t running big F5s or something similar that can handle this properly. Actually do so is another matter entirely though, and I’m not even considering throughput.
- zamadatix 3y agoLayer 7 gear has also been pretty irrelevant for a long time and not really something an ISP wants to waste money on when all it needs to do is deliver L3 fast and cheap. First payload encryption, then protocol encryption like the aforementioned ESNI or QUIC, and now DNS encryption. Even if you invest in it how much good is it going to do? Most ISPs have boxes that can handle volumetric attacks and the minimum required logging for legal compliance.
- Daneel_ 3y agoOh, I totally agree. Sorry, I just re-read my post and it does come across as “they should just use layer 7 gear to filter it”. I certainly wouldn’t expect to see it in the real world, I was mostly just musing on ISPs deploying/leveraging their layer 7 gear if required.
- Jamie9912 3y agoIt's called ECH now
- hashstring 3y agoI hope important websites do NOT move out of the public neighborhood (CloudFlare) to discourage honouring block requests (and ultimately also these requests from being requested) from incompetent regulators. Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it violates (whatever is left of) net neutrality- awesome.
- NoZebra120vClip 3y agoThe EU engineers should just say "we followed the lead of Musk's X and we've taken the liberty of removing the IP/DNS blocking features from our network equipment. Sorry!"
- px43 3y agoI noticed earlier today that thepiratebay.org seems to be down for the first time in a while. It's just a cloudflare error page at the moment. Really curious what's going on there.
- ttul 3y agoThat's just the usual shit show that is thepiratebay.org.
- MR4D 3y ago“in Austria” for those who are curious where this is relevant.
- johndhi 3y agoCan someone explain to me why cloudflare shares IPs across customers? Why not just give one to each?
- tenebrisalietum 3y agoNot enough IPs, and HTTP has the "Host:" header which decouples the IP from a domain.
- kstrauser 3y agoThat would be incredibly wasteful. It can use many IPs per host when using geographically local endpoints, and relatively few customers are large enough to need IPs to themselves.
- NoZebra120vClip 3y agoThis is an IPv4 hack thing again, isn't it.
- kstrauser 3y agoNah, not really. It’s just TLS SNI + old-fashioned Host: headers.
- patmorgan23 3y agoCan you explain why they wouldn't? They provide a proxying service, and we've been able to serve multiple domains on the same proxy since... The 90s?
- eastdakota 3y agoDo you have any idea how many customers we have?
- eastdakota 3y agoThe association of IPs to individuals and particular services is the original sin of the Internet. At Cloudflare, we’re working to fix that sin. That doesn’t mean governments don’t have the right to regulate content on networks in their boarders: they absolutely do so long as they follow principles of Rule of Law. But blocking on an IP can never be transparent — and therefore violates the Rule of Law — and will always cause collateral damage. Terrific that the Austrian authorities recognized that.
- da768 3y agoCome on. Nothing regulates what we can reach on the Internet more than Turnstile/Great Firewall of Cloudflare abusing wrongful association of IPs.
- tbrownaw 3y ago> The association of IPs to individuals and particular services is the original sin of the Internet. At Cloudflare, we’re working to fix that sin. ... Being able to talk to someone without an intermediary is a problem? > That doesn’t mean governments don’t have the right to regulate content on networks in their boarders: they absolutely do so long as they follow principles of Rule of Law. Pretty sure governments have the right to do whatever they want regardless. It's that pesky "sovereignty" thing. > But blocking on an IP can never be transparent What do you mean by this?
- asddubs 3y agogive me a break. blocking with collateral damage is the cloudflare modus operandi
- vGPU 3y agoIsn’t it funny how quickly they went from “we won’t block for any reason” to where they are today? And the funny thing is that their blog post complains of the following: > In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us. Well, yeah. That’s what happens. It’s just a lot easier to justify something you wanted to do already, isn’t it?
- deleted 3y ago[deleted]
- franga2000 3y agoWhat I don't get is how DNS blocking and other DPI is legal while IP blocking isn't. Sure, you can make and argument that the ISP-provided DNS is a service they provide so you can compel them to not resolve certain addresses, but inspecting and modifying other DNS packets on the network seems no different to inspecting and modifying HTTP packets to inject crap or throttle streaming - the exact things net neutrality was meant to protect against.
- toyg 3y agoRead the article or the sentence - the difference with DNS is that it's not as likely to result in blocking innocent third-parties. Services don't typically share DNS names, whereas IPs are typically shared or reused constantly.
- franga2000 3y agoI did, but that still doesn't explain how that relates to net neutrality. I guess the court might have used the likelihood of false positives as the factor that decides whether net neutrality or copyright law pervails in a given situation, but this isn't mentioned in the article.
- toyg 3y agoI think it makes more sense if you consider the Directive is about "universal service and users’ rights relating to electronic communications networks and service", rather than "net neutrality" (which is a very ISP-oriented term).