4 ms·

> authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Goo

> authorities [...] would force them to install [...] flow logging This doesn't necessarily require Cloudflare's cooperation. Remember when the NSA tapped Google's internal network without their knowledge? SSL added and removed here :-)

lokar 3y ago
Not really internal. Long distance fiber lines between sites, mostly leased.
- greyface- 3y ago
  They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
  - ethbr1 3y ago
    Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
    - pests 3y ago
      The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
    - cavisne 3y ago
      Level 3 basically admitted they did it for them, so it would have been at a hub.
Tiberium 3y ago
That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.
- formerly_proven 3y ago
  It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.
supriyo-biswas 3y ago
But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.

lokar 3y ago

Not really internal. Long distance fiber lines between sites, mostly leased.

greyface- 3y ago
They were DC<->DC fiber links, carrying unencrypted Stubby RPC traffic. Internal is an accurate descriptor.
- ethbr1 3y ago
  Suffice to say internal to Google's network architecture at the time, subsequently remediated with encryption, but physically external to Google DCs. It did raise a fascinating question about where the physical tap was and how the take was routed back. You do the tap at a hub, and you have the egress connectivity, but you're one unexpected employee away from discovery. You do the tap in the middle of nowhere, and how do you get the data stream back? I'd guess they went rural and just leased physically adjacent dark fiber to route out on.
  - pests 3y ago
    The return routes are most likely in the same run but just a different strand. I think this is the way underwater cables are tapped - no need for a completely new run back.
  - cavisne 3y ago
    Level 3 basically admitted they did it for them, so it would have been at a hub.

Tiberium 3y ago

That Google incident sounds interesting, do you have links to the technical explanations? From a quick search all I could find are news reports.

formerly_proven 3y ago
It's from the OG PRISM slides. Previously Google's internal production network didn't use encryption, SSL/TLS was terminated at the perimeter. So the NSA simply tapped their dark fiber between data centers.

supriyo-biswas 3y ago

But it becomes significantly easier if Cloudflare performs this cooperation; most ISPs are required to maintain such data as well.