6 ms·

I have a corporate laptop which funnels all traffic through zscaler. I was somewhat surprised when I was getting a different IP address on ipinfo.io (my home I

by ta1243 3y ago

I have a corporate laptop which funnels all traffic through zscaler. I was somewhat surprised when I was getting a different IP address on ipinfo.io (my home IP) compared with whatsmyip.org (a zscaler datacentre IP) Curlling ipinfo.io though came back with the zscaler address. Turns out they don't funnel UDP via zscaler, only TCP. Looking into zscaler, https://help.zscaler.com/zia/managing-quic-protocol https://help.zscaler.com/zia/managing-quic-protocol > Zscaler best practice is to block QUIC. When it's blocked, QUIC has a failsafe to fall back to TCP. This enables SSL inspection without negatively impacting user experience. Seems corporate IT is resurging after a decade of defeat

wkat4242 3y ago
Zscaler is pure crap, we use it at work too. It's especially hard to configure docker containers for its proxy settings and ssl certificate. When I test something new in our lab I spend 10 minutes installing it and half a day configuring the proxy.
- fein 3y ago
  It causes minor annoyances with ssl + maven as well, which can be fixed by -Dmaven.wagon.http.ssl.insecure=true. Well, at least they tried I guess.
  - ta1243 3y ago
    No, setting any variable including the line "http.ssl.insecure=true" Is not a fix under any circumstance.
    - Thiez 3y ago
      Sure it is. The org insists on making your life difficult, and you just want to get your work done. If they really cared about security they would prioritise fixing stuff like this, but they don't, so you know they don't really care, it's just for show and a need for control. And if they don't really care about security, why should you?
- mongol 3y ago
  It is the single most annoying impediment in corporate IT. And you are on your own when you need to work around the issues it causes. Is it really providing value, or is it just to feel better about security?
  - steve_taylor 3y ago
    It's not just an impediment. It's corporate spyware and possibly a prototype for Great Firewall 2.0.
- brewmarche 3y ago
  Man, here I am reading this while fighting zScaler when connecting to our new package repository (it breaks because the inspection of the downloads takes too long). No one feels responsible for helping developers. Same with setting up containers, git, Python, and everything else that comes with its own trust store, you have to figure out everything by yourself. It also breaks a lot of web pages by redirecting HTTP requests in order to authenticate you (CSP broken). Teams GIFs and GitHub images have been broken for months now and no one cares.
  - wkat4242 3y ago
    Ahhhh so that's why my teams gifs don't work. Thanks. We use an external auth provider which makes even more complex config yeah.
    - brewmarche 3y ago
      At least for me that’s the problem. When I open the redirect url manually it also fixes the problem for some time. You can open the Teams developer tools to check this. Click the taskbar icon 7 times, then right click it. Use dev tools for select web contents, choose experience renderer AAD. Search for GIFs in Teams and monitor the network tab
  - caerwy 3y ago
    amen, brother!
- ippi72 3y ago
  Which zscaler products does your company use? Do you have an idea of what better solutions are out there?
  - wkat4242 3y ago
    The cloud service. I don't know what it's called exactly. It just says "Zscaler". In terms of better solutions, I would prefer a completely different approach. Securing the endpoint instead of the network. Basically the idea of Google's "BeyondCorp". What happens now is that people just turn off their VPN and Zscaler client to avoid issues, when they're working from a public hotspot or at home. In the office (our lab environment) we unfortunately don't have that option. But by doing so they leave themselves much more exposed than when we didn't have Zscaler at all.
fsniper 3y ago
I hate corporate IT. Security with decades old arcane practices. Killing user experience with any way possible. MITM all around..
- Bluecobra 3y ago
  Blame viruses, malware, phishing, ransomware, etc. IT has a responsibility to keep the network secure. Google is already experimenting with no Internet access for some employees, and that might be the endgame.
  - blkhawk 3y ago
    This has nothing to do with security and more with ineffective practices based on security where nobody knows why its done just that its done. Running MitM on connections basically breaks basic security mechanism for some ineffective security theater. This is basically "90-day password change" 2.0.
    - Spivak 3y ago
      > where nobody knows why its done just that its done Compliance. You think your IT dept wants to deploy this crap? How ever painful you think it is as an end user multiply it having to support hundreds/thousands of endpoints. Look, I hate traffic inspection as much as the next person but this is for security, it's just not for the security you want it to be. This is so you have an audit trail of data exfiltration and there's no way around it. You need the plaintext to do this and the whole network stack is built around making this a huge giant pain in the ass. This is one situation where soulless enterprises and users should actually be aligned. Having the ability in your OS to inspect the plaintext traffic of all incoming and outgoing traffic by forcing apps off raw sockets would be a massive win. People. seem to understand how getting the plaintext for DNS requests is beneficial to the user but not HTTP for some reason. Be happy your setup is at least opportunistic and not "block any traffic we can't get the plaintext for."
      - steve_taylor 3y ago
Faaak 3y ago
Hopefully, IT doesn't notice when I use my `kill-zscaler.sh` script. It's horrible to work around when you arrive on a new company using it.
- PrimeMcFly 3y ago
  Care to share?
  - Faaak 3y ago
    https://github.com/bkahlert/kill-zscaler https://github.com/bkahlert/kill-zscaler
    - PrimeMcFly 3y ago
      Should have tried searching for it first I guess, thanks!
- rcstank 3y ago
  What all is in that script? I'd love to have it. Sincerely, another dev abused by Zscaler.
  - Faaak 3y ago
    https://github.com/bkahlert/kill-zscaler https://github.com/bkahlert/kill-zscaler
- ta1243 3y ago
  The only reason I have one is so I can prove the problem is with zscaler and not my network. I remember someone complaining about the speeds writing to a unc file share over a 10G network, using a blackmagic file writing test tool It was really slow (about 100MB/sec), but iperf was fine. I did a "while (true) pkill sophos" or similar. Speeds shot upto about 1GB/sec. Closed the while while loop, sophos returned in a few seconds, and speeds reduce to a crawl again. But who needs to write at a decent speed in a media production environment. And people still wonder why ShadowIT constantly wins with the business.
jarym 3y ago
> without negatively impacting user experience I can't stop laughing.
betaby 3y ago
You can try to block zscaller ( or netskope) IP on you home router. Most of the times IT laptops are default to 'normal' web behaviour if zscaller/netskope is not available.

by ta1243 3y ago

wkat4242 3y ago

Zscaler is pure crap, we use it at work too. It's especially hard to configure docker containers for its proxy settings and ssl certificate. When I test something new in our lab I spend 10 minutes installing it and half a day configuring the proxy.

fein 3y ago
It causes minor annoyances with ssl + maven as well, which can be fixed by -Dmaven.wagon.http.ssl.insecure=true. Well, at least they tried I guess.
- ta1243 3y ago
  No, setting any variable including the line "http.ssl.insecure=true" Is not a fix under any circumstance.
  - Thiez 3y ago
    Sure it is. The org insists on making your life difficult, and you just want to get your work done. If they really cared about security they would prioritise fixing stuff like this, but they don't, so you know they don't really care, it's just for show and a need for control. And if they don't really care about security, why should you?
mongol 3y ago
It is the single most annoying impediment in corporate IT. And you are on your own when you need to work around the issues it causes. Is it really providing value, or is it just to feel better about security?
- steve_taylor 3y ago
  It's not just an impediment. It's corporate spyware and possibly a prototype for Great Firewall 2.0.
brewmarche 3y ago
Man, here I am reading this while fighting zScaler when connecting to our new package repository (it breaks because the inspection of the downloads takes too long). No one feels responsible for helping developers. Same with setting up containers, git, Python, and everything else that comes with its own trust store, you have to figure out everything by yourself. It also breaks a lot of web pages by redirecting HTTP requests in order to authenticate you (CSP broken). Teams GIFs and GitHub images have been broken for months now and no one cares.
- wkat4242 3y ago
  Ahhhh so that's why my teams gifs don't work. Thanks. We use an external auth provider which makes even more complex config yeah.
  - brewmarche 3y ago
    At least for me that’s the problem. When I open the redirect url manually it also fixes the problem for some time. You can open the Teams developer tools to check this. Click the taskbar icon 7 times, then right click it. Use dev tools for select web contents, choose experience renderer AAD. Search for GIFs in Teams and monitor the network tab
- caerwy 3y ago
  amen, brother!
ippi72 3y ago
Which zscaler products does your company use? Do you have an idea of what better solutions are out there?
- wkat4242 3y ago
  The cloud service. I don't know what it's called exactly. It just says "Zscaler". In terms of better solutions, I would prefer a completely different approach. Securing the endpoint instead of the network. Basically the idea of Google's "BeyondCorp". What happens now is that people just turn off their VPN and Zscaler client to avoid issues, when they're working from a public hotspot or at home. In the office (our lab environment) we unfortunately don't have that option. But by doing so they leave themselves much more exposed than when we didn't have Zscaler at all.

fsniper 3y ago

I hate corporate IT. Security with decades old arcane practices. Killing user experience with any way possible. MITM all around..

Bluecobra 3y ago
Blame viruses, malware, phishing, ransomware, etc. IT has a responsibility to keep the network secure. Google is already experimenting with no Internet access for some employees, and that might be the endgame.
- blkhawk 3y ago
  This has nothing to do with security and more with ineffective practices based on security where nobody knows why its done just that its done. Running MitM on connections basically breaks basic security mechanism for some ineffective security theater. This is basically "90-day password change" 2.0.
  - Spivak 3y ago
    > where nobody knows why its done just that its done Compliance. You think your IT dept wants to deploy this crap? How ever painful you think it is as an end user multiply it having to support hundreds/thousands of endpoints. Look, I hate traffic inspection as much as the next person but this is for security, it's just not for the security you want it to be. This is so you have an audit trail of data exfiltration and there's no way around it. You need the plaintext to do this and the whole network stack is built around making this a huge giant pain in the ass. This is one situation where soulless enterprises and users should actually be aligned. Having the ability in your OS to inspect the plaintext traffic of all incoming and outgoing traffic by forcing apps off raw sockets would be a massive win. People. seem to understand how getting the plaintext for DNS requests is beneficial to the user but not HTTP for some reason. Be happy your setup is at least opportunistic and not "block any traffic we can't get the plaintext for."
    - steve_taylor 3y ago

Faaak 3y ago

Hopefully, IT doesn't notice when I use my `kill-zscaler.sh` script. It's horrible to work around when you arrive on a new company using it.

PrimeMcFly 3y ago
Care to share?
- Faaak 3y ago
  https://github.com/bkahlert/kill-zscaler https://github.com/bkahlert/kill-zscaler
  - PrimeMcFly 3y ago
    Should have tried searching for it first I guess, thanks!
rcstank 3y ago
What all is in that script? I'd love to have it. Sincerely, another dev abused by Zscaler.
- Faaak 3y ago
  https://github.com/bkahlert/kill-zscaler https://github.com/bkahlert/kill-zscaler
ta1243 3y ago
The only reason I have one is so I can prove the problem is with zscaler and not my network. I remember someone complaining about the speeds writing to a unc file share over a 10G network, using a blackmagic file writing test tool It was really slow (about 100MB/sec), but iperf was fine. I did a "while (true) pkill sophos" or similar. Speeds shot upto about 1GB/sec. Closed the while while loop, sophos returned in a few seconds, and speeds reduce to a crawl again. But who needs to write at a decent speed in a media production environment. And people still wonder why ShadowIT constantly wins with the business.

jarym 3y ago

> without negatively impacting user experience I can't stop laughing.

betaby 3y ago

You can try to block zscaller ( or netskope) IP on you home router. Most of the times IT laptops are default to 'normal' web behaviour if zscaller/netskope is not available.