7 ms·

> When the ISPs discovered that the IP addresses belonged to Cloudflare, arms were thrown up in despair. The level of desperation the ISP’s engineers have felt

> When the ISPs discovered that the IP addresses belonged to Cloudflare, arms were thrown up in despair. The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. I am getting tired of our politics here in europe: tech literate people in governments are put to work on surveilance stuff, never for actual policymaking. The shit show continues.

veave 3y ago
>The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. If I was an engineer there I would block the addresses and call it a day. What do I care? After all it's customer service who will deal with the angry calls.
- clnq 3y ago
  Fortunately they didn't do that and instead got this in front of regulators.
  - gsich 3y ago
    Some, if not all did it.
- redox99 3y ago
  Obviously your boss or boss's boss would care.
  - veave 3y ago
    It would be my boss or boss' boss ordering me to block the addresses, wouldn't it?
    - redox99 3y ago
      Yes, who would also yell at you when customers can't access their cat pictures. Of course it could be an accident, and you didn't know. But if it was clearly malicious compliance, personally and I think I speak for many, I wouldn't continue to have on the team somebody with these kinds of traits.
      - veave 3y ago
        I don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
        throwitaway156 3y ago
        you are missing the experience of an asshole manager pressuring you to 'just fix it' in an enraged state accompanied by their phone constantly buzzing from the sweet notification sound of getting bombarded by emails/tickets. for context, i didnt experience this yet. I hope i never do.
        esrauch 3y ago
        Courts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble. The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned block or not. If they decide you should then you do, if they decide you shouldn't then you don't.
        badsectoracula 3y ago
        > The job if the engineer who notices this is to raise it to their boss and legal counsel... ...shouldn't the legal department be involved way before the issue reaches the engineer? Why should the engineer ever care about it in the first place? Chances are these orders do not come directly to their email.
gsich 3y ago
The ISPs didn't discover this, they knew. But it was mandated so they had to do it.
gerdesj 3y ago
Surely they should have contacted Cloudflare and asked them to sort out the issue with their network ... CF will probably retort {common carrier, we are American and you are not etc}. Austrian policy makers get upset and ... THIS NONSENSE IS STILL NOT SORTED. The internets are somewhat broken, quite badly. We all allow ourselves to end up in a series of virtual walled off silos - Facebook, Twitter etc, run by some pretty worrying monster commercial companies, whilst living within quite disparate physical societies. I think that the fediverse is a possible contender for the way forwards. I dumped Reddit for Lemmy and that seems to be working so far. I know a lot of 'X'iles are finding a home with Mastodon. I worry about quite a few networks. One of the tools in the box is the IP block list. With the rise of the hyper-scalers, the IP blocklist is becoming increasingly useless. Same with SMTP filtering for spam. You can't block M365 or Gmail en-masse (tempting for my home setup, though!) I recently gave CrowdSec a run at work (I will stick with it but with care). Great idea for the 2010s but not so much now. I got it to watch HA Proxy logs (proxies on site Exchange) and it pretty soon decided that my real users should be banned because of how Outlook works, or rather how the auth that Outlook uses works. Outlook doesn't just use Kerberos, it also uses EWS for the Addressbook and the good Lord knows what else. So you get a connection to a endpoint from Outlook without auth creds which generates a 401 (failed auth) error, then Outlook tries again, this time with creds and it works OK (200). To a CrowdSec agent those repeated 401s look like bots pissing around. That is one reason why we cannot have nice things. I'm a Brit (yes we Brexited) but I am still very much a European and so is my little country, like it or not - I have seen shed loads of number plates from across the EU trundling along the large A30/A37 crossroads/roundabout called Yeovil in Somerset. Mostly lorries and quite a few cars and campervans. So I am from country X (GB in my case, not that X!) but I engage with (w,x,y,z) societies on line. Now whose laws apply? In general it seems we muddle along effectively but should there be a formal internationally accepted agreement?
- Atotalnoob 3y ago
  401 then 200 is part of kerberos/ntlm. You can watch it if you use curl -v 401 indicates it should send it's kerberos ticket. Kerberos verifies it should send a ticket, then sends it. 200 cause you are now authenticated.
deleted 3y ago
[deleted]

veave 3y ago

>The level of desperation the ISP’s engineers have felt in front of such incompetence must have been through the roof. If I was an engineer there I would block the addresses and call it a day. What do I care? After all it's customer service who will deal with the angry calls.

clnq 3y ago
Fortunately they didn't do that and instead got this in front of regulators.
- gsich 3y ago
  Some, if not all did it.
redox99 3y ago
Obviously your boss or boss's boss would care.
- veave 3y ago
  It would be my boss or boss' boss ordering me to block the addresses, wouldn't it?
  - redox99 3y ago
    Yes, who would also yell at you when customers can't access their cat pictures. Of course it could be an accident, and you didn't know. But if it was clearly malicious compliance, personally and I think I speak for many, I wouldn't continue to have on the team somebody with these kinds of traits.
    - veave 3y ago
      I don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
      - throwitaway156 3y ago
        you are missing the experience of an asshole manager pressuring you to 'just fix it' in an enraged state accompanied by their phone constantly buzzing from the sweet notification sound of getting bombarded by emails/tickets. for context, i didnt experience this yet. I hope i never do.
      - esrauch 3y ago
        Courts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble. The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned block or not. If they decide you should then you do, if they decide you shouldn't then you don't.
        badsectoracula 3y ago
        > The job if the engineer who notices this is to raise it to their boss and legal counsel... ...shouldn't the legal department be involved way before the issue reaches the engineer? Why should the engineer ever care about it in the first place? Chances are these orders do not come directly to their email.

gsich 3y ago

The ISPs didn't discover this, they knew. But it was mandated so they had to do it.

gerdesj 3y ago

Surely they should have contacted Cloudflare and asked them to sort out the issue with their network ... CF will probably retort {common carrier, we are American and you are not etc}. Austrian policy makers get upset and ... THIS NONSENSE IS STILL NOT SORTED. The internets are somewhat broken, quite badly. We all allow ourselves to end up in a series of virtual walled off silos - Facebook, Twitter etc, run by some pretty worrying monster commercial companies, whilst living within quite disparate physical societies. I think that the fediverse is a possible contender for the way forwards. I dumped Reddit for Lemmy and that seems to be working so far. I know a lot of 'X'iles are finding a home with Mastodon. I worry about quite a few networks. One of the tools in the box is the IP block list. With the rise of the hyper-scalers, the IP blocklist is becoming increasingly useless. Same with SMTP filtering for spam. You can't block M365 or Gmail en-masse (tempting for my home setup, though!) I recently gave CrowdSec a run at work (I will stick with it but with care). Great idea for the 2010s but not so much now. I got it to watch HA Proxy logs (proxies on site Exchange) and it pretty soon decided that my real users should be banned because of how Outlook works, or rather how the auth that Outlook uses works. Outlook doesn't just use Kerberos, it also uses EWS for the Addressbook and the good Lord knows what else. So you get a connection to a endpoint from Outlook without auth creds which generates a 401 (failed auth) error, then Outlook tries again, this time with creds and it works OK (200). To a CrowdSec agent those repeated 401s look like bots pissing around. That is one reason why we cannot have nice things. I'm a Brit (yes we Brexited) but I am still very much a European and so is my little country, like it or not - I have seen shed loads of number plates from across the EU trundling along the large A30/A37 crossroads/roundabout called Yeovil in Somerset. Mostly lorries and quite a few cars and campervans. So I am from country X (GB in my case, not that X!) but I engage with (w,x,y,z) societies on line. Now whose laws apply? In general it seems we muddle along effectively but should there be a formal internationally accepted agreement?

Atotalnoob 3y ago
401 then 200 is part of kerberos/ntlm. You can watch it if you use curl -v 401 indicates it should send it's kerberos ticket. Kerberos verifies it should send a ticket, then sends it. 200 cause you are now authenticated.

deleted 3y ago

[deleted]