4 ms·

Plenty of corporate web filtering solutions block on IPs, and the adoption of ESNI will only make it worse. If you manage an important website, moving out of a

by mike_d 3y ago

Plenty of corporate web filtering solutions block on IPs, and the adoption of ESNI will only make it worse. If you manage an important website, moving out of a bad neighborhood (Cloudflare) before you end up the victim of blocking is probably a good idea.

Daneel_ 3y ago
Layer 7 gear has been around for a long time. At an ISP level I’d be shocked if they weren’t running big F5s or something similar that can handle this properly. Actually do so is another matter entirely though, and I’m not even considering throughput.
- zamadatix 3y ago
  Layer 7 gear has also been pretty irrelevant for a long time and not really something an ISP wants to waste money on when all it needs to do is deliver L3 fast and cheap. First payload encryption, then protocol encryption like the aforementioned ESNI or QUIC, and now DNS encryption. Even if you invest in it how much good is it going to do? Most ISPs have boxes that can handle volumetric attacks and the minimum required logging for legal compliance.
  - Daneel_ 3y ago
    Oh, I totally agree. Sorry, I just re-read my post and it does come across as “they should just use layer 7 gear to filter it”. I certainly wouldn’t expect to see it in the real world, I was mostly just musing on ISPs deploying/leveraging their layer 7 gear if required.
Jamie9912 3y ago
It's called ECH now
hashstring 3y ago
I hope important websites do NOT move out of the public neighborhood (CloudFlare) to discourage honouring block requests (and ultimately also these requests from being requested) from incompetent regulators. Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it violates (whatever is left of) net neutrality- awesome.
- mike_d 3y ago
  > to discourage honouring block requests It is adorable that at this point people still believe collateral damage will prevent a political move.
  - hashstring 3y ago
    Have you read the adorable article? I’ll quote it for you in case you missed it. > “With regard to the blocking of access to the IP address 190.115.18.20, the Telekom Control Commission found a violation of Article 3 Paragraph 3 of Regulation (EU) 2015/2120, because the IP access block poses the risk of ‘overblocking’ any website content.”

by mike_d 3y ago

Daneel_ 3y ago

Layer 7 gear has been around for a long time. At an ISP level I’d be shocked if they weren’t running big F5s or something similar that can handle this properly. Actually do so is another matter entirely though, and I’m not even considering throughput.

zamadatix 3y ago
Layer 7 gear has also been pretty irrelevant for a long time and not really something an ISP wants to waste money on when all it needs to do is deliver L3 fast and cheap. First payload encryption, then protocol encryption like the aforementioned ESNI or QUIC, and now DNS encryption. Even if you invest in it how much good is it going to do? Most ISPs have boxes that can handle volumetric attacks and the minimum required logging for legal compliance.
- Daneel_ 3y ago
  Oh, I totally agree. Sorry, I just re-read my post and it does come across as “they should just use layer 7 gear to filter it”. I certainly wouldn’t expect to see it in the real world, I was mostly just musing on ISPs deploying/leveraging their layer 7 gear if required.

Jamie9912 3y ago

It's called ECH now

hashstring 3y ago

I hope important websites do NOT move out of the public neighborhood (CloudFlare) to discourage honouring block requests (and ultimately also these requests from being requested) from incompetent regulators. Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it violates (whatever is left of) net neutrality- awesome.

mike_d 3y ago
> to discourage honouring block requests It is adorable that at this point people still believe collateral damage will prevent a political move.
- hashstring 3y ago
  Have you read the adorable article? I’ll quote it for you in case you missed it. > “With regard to the blocking of access to the IP address 190.115.18.20, the Telekom Control Commission found a violation of Article 3 Paragraph 3 of Regulation (EU) 2015/2120, because the IP access block poses the risk of ‘overblocking’ any website content.”