3 ms·

Maybe this kind of origin laundering that cloudflare and cloud providers do shouldn't be allowed.

JackSlateur 3y ago
Maybe UPS and all delivery compagnies should not be allowed, because one can send a knife and use it to kill people ? Maybe water should not be allowed because rapists can drink it ? Maybe using IP as identifier is wrong (it does not work since more than 20 years) and doing any kind of IP-based policy in 2024 is a sick behavior that shall be cured in specialized hospitals ?
- okasaki 3y ago
  How else can we filter TCP/IP except by IP??
  - orangeboats 3y ago
    Why are you fixated on TCP/IP?
  - JackSlateur 3y ago
    Why would you "filter TCP/IP except by IP" ? When I download a file, what is important is the content of the file. Not the pipe it came in. When I buy something on amazon, what is important is the stuff delivered, not the delivery man. You would filter packages from entering home based on the delivery man ? Insane ? Yes this is an insane behavior. As if one delivery man were dedicated per home, as it was in 1994. INSANE.
    - netsharc 3y ago
      The alternative is deep packet inspection, which is another can of worms. So it's a good thing that they're clowns at this.
      - JackSlateur 3y ago
        You are right ! Also called "URSS", where kind people read your mail and inspect your stuff etc. Perfect;
        shiroiushi 3y ago
        Well, the Italian Post is already famous for opening people's mail and taking goods shipped through the mail for themselves.
    - rvnx 3y ago
      Further on this example: The delivery guy knowingly delivers drugs, it's written on the package, and the authorities told him to stop doing that. Then what to do ? Remove the license of that most specific delivery guy. That's what they try to do (though it would be easier if the delivery guy would collaborate of course). Not saying that blocking internet hosts is a good thing, but I don't see what else they can do, if the counterparty is not compliant :| (DNS blocking doesn't work anymore as browsers provide circumvention methods by default, and blocking the whole BGP peer has too much side-effects because it blocks all the legitimate delivery guys too)
      - JackSlateur 3y ago
        The authorities, you mean "the authorities of some other people, not mine".
    - lock-the-spock 3y ago
      You would not filter based on the delivery man but based on the sender. If you know someone sends bombs or drugs in the mail but you cannot stop them initiating parcels, you would find ways to stop the parcels halfway. Physical mail is scanned in the real world, and customs stop stuff from entering the country - so the analogy is already reality! In theory this would also work for IPs if not for the IP laundering OOP criticised. Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. There are of course many reasons for those and many of them legitimate, but it doesn't mean this is the right approach (and with IPv6 certainly other options are possible...)
      - JackSlateur 3y ago
        Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. Well, if you want "CDN", then you must break the TCP connection. That is, you must have one TCP connection from client to CDN, and then one from CDN to the backend. Unless you are against CDNs (they do serve a real-world purpose, tho), then it is a system necessity;
  - nradov 3y ago
    That's the point. We shouldn't be filtering.
    - hruzgar 3y ago
      Yeah true. governments shouldn't filter. But you definitely want to filter tracking, ads, malware etc in your home network.
      - lock-the-spock 3y ago
        Counterexample: If a set of IPs consistently and intentionally run DDoS to shut down small sites or e.g. newspapers, should the government not intervene? If they cannot stop, say, the russian government from running such attacks would it not be the only route to block such IPs?
        hruzgar 3y ago
        I'm sure there are better ways to deal with this. You have to be careful with this because sometimes the people who create the solution (censorship) are also the ones creating the problem. I'm not saying that's the case.. But if we don't want a completely censored internet in the next few years we have to be careful.
        throwaway11460 3y ago
        Cut the cable to Russia?
  - hruzgar 3y ago
    There is a possibility of doing it. Or better said I had an idea the last few months on how to possibly do this. I have written a detailed explanation here if anybody wants to see it: https://discuss.privacyguides.net/t/why-did-nobody-do-this-dns-blocking-might-be-useless/16336 https://discuss.privacyguides.net/t/why-did-nobody-do-this-d... The idea basically is to block all ip's which weren't resolved by the dns server in past specific time period (for example in the last 3 minutes). So all static ip's would be blocked by default. When a domain get's resolved by the dns server, the ip address gets to the whitelist for a specific amount of time. There is some issues. For example if somebody downloads something, the ip address might only get resolved once but the download happens by directly connecting to the ip address. But I think these issues are definitely solvable. Would be interested to hear other peoples thoughts on this. edit: of course this is for home network filtering purposes. If governments did this we are not in a good position.
    - petronio 3y ago
      It could work, as it's pretty rare for IP addresses to be used directly and not through DNS, but that also defeats the purpose of the mechanism: it doesn't add anything of value if everyone is using DNS. Even malware writers will purchase several domain names (several for redundancy from government take downs) so that they can rotate command servers easily.
      - hruzgar 3y ago
        yeah kinda true. But if you had a whitelist (i know this would be very hard to maintain etc) instead of a blacklist, you could have the most secure network blocker ever created for consumers. Malware could still leak from some of the "safe" domains but it would definitely be A LOT safer than any conventional ip or dns blocking.
- tmnvix 3y ago
  > Maybe water should not be allowed because rapists can drink it ? You joke, but this is a significant part of the justification given for denying water to millions right now (in Gaza).
gorkish 3y ago
Maybe it should be encouraged; anything that disincentivizes someone to fuck with Internet traffic under a faulty premise is a win in my book.

Maybe UPS and all delivery compagnies should not be allowed, because one can send a knife and use it to kill people ? Maybe water should not be allowed because rapists can drink it ? Maybe using IP as identifier is wrong (it does not work since more than 20 years) and doing any kind of IP-based policy in 2024 is a sick behavior that shall be cured in specialized hospitals ?

okasaki 3y ago
How else can we filter TCP/IP except by IP??
- orangeboats 3y ago
  Why are you fixated on TCP/IP?
- JackSlateur 3y ago
  Why would you "filter TCP/IP except by IP" ? When I download a file, what is important is the content of the file. Not the pipe it came in. When I buy something on amazon, what is important is the stuff delivered, not the delivery man. You would filter packages from entering home based on the delivery man ? Insane ? Yes this is an insane behavior. As if one delivery man were dedicated per home, as it was in 1994. INSANE.
  - netsharc 3y ago
    The alternative is deep packet inspection, which is another can of worms. So it's a good thing that they're clowns at this.
    - JackSlateur 3y ago
      You are right ! Also called "URSS", where kind people read your mail and inspect your stuff etc. Perfect;
      - shiroiushi 3y ago
        Well, the Italian Post is already famous for opening people's mail and taking goods shipped through the mail for themselves.
  - rvnx 3y ago
    Further on this example: The delivery guy knowingly delivers drugs, it's written on the package, and the authorities told him to stop doing that. Then what to do ? Remove the license of that most specific delivery guy. That's what they try to do (though it would be easier if the delivery guy would collaborate of course). Not saying that blocking internet hosts is a good thing, but I don't see what else they can do, if the counterparty is not compliant :| (DNS blocking doesn't work anymore as browsers provide circumvention methods by default, and blocking the whole BGP peer has too much side-effects because it blocks all the legitimate delivery guys too)
    - JackSlateur 3y ago
      The authorities, you mean "the authorities of some other people, not mine".
  - lock-the-spock 3y ago
    You would not filter based on the delivery man but based on the sender. If you know someone sends bombs or drugs in the mail but you cannot stop them initiating parcels, you would find ways to stop the parcels halfway. Physical mail is scanned in the real world, and customs stop stuff from entering the country - so the analogy is already reality! In theory this would also work for IPs if not for the IP laundering OOP criticised. Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. There are of course many reasons for those and many of them legitimate, but it doesn't mean this is the right approach (and with IPv6 certainly other options are possible...)
    - JackSlateur 3y ago
      Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. Well, if you want "CDN", then you must break the TCP connection. That is, you must have one TCP connection from client to CDN, and then one from CDN to the backend. Unless you are against CDNs (they do serve a real-world purpose, tho), then it is a system necessity;
- nradov 3y ago
  That's the point. We shouldn't be filtering.
  - hruzgar 3y ago
    Yeah true. governments shouldn't filter. But you definitely want to filter tracking, ads, malware etc in your home network.
    - lock-the-spock 3y ago
      Counterexample: If a set of IPs consistently and intentionally run DDoS to shut down small sites or e.g. newspapers, should the government not intervene? If they cannot stop, say, the russian government from running such attacks would it not be the only route to block such IPs?
      - hruzgar 3y ago
        I'm sure there are better ways to deal with this. You have to be careful with this because sometimes the people who create the solution (censorship) are also the ones creating the problem. I'm not saying that's the case.. But if we don't want a completely censored internet in the next few years we have to be careful.
      - throwaway11460 3y ago
        Cut the cable to Russia?
- hruzgar 3y ago
  There is a possibility of doing it. Or better said I had an idea the last few months on how to possibly do this. I have written a detailed explanation here if anybody wants to see it: https://discuss.privacyguides.net/t/why-did-nobody-do-this-dns-blocking-might-be-useless/16336 https://discuss.privacyguides.net/t/why-did-nobody-do-this-d... The idea basically is to block all ip's which weren't resolved by the dns server in past specific time period (for example in the last 3 minutes). So all static ip's would be blocked by default. When a domain get's resolved by the dns server, the ip address gets to the whitelist for a specific amount of time. There is some issues. For example if somebody downloads something, the ip address might only get resolved once but the download happens by directly connecting to the ip address. But I think these issues are definitely solvable. Would be interested to hear other peoples thoughts on this. edit: of course this is for home network filtering purposes. If governments did this we are not in a good position.
  - petronio 3y ago
    It could work, as it's pretty rare for IP addresses to be used directly and not through DNS, but that also defeats the purpose of the mechanism: it doesn't add anything of value if everyone is using DNS. Even malware writers will purchase several domain names (several for redundancy from government take downs) so that they can rotate command servers easily.
    - hruzgar 3y ago
      yeah kinda true. But if you had a whitelist (i know this would be very hard to maintain etc) instead of a blacklist, you could have the most secure network blocker ever created for consumers. Malware could still leak from some of the "safe" domains but it would definitely be A LOT safer than any conventional ip or dns blocking.
tmnvix 3y ago
> Maybe water should not be allowed because rapists can drink it ? You joke, but this is a significant part of the justification given for denying water to millions right now (in Gaza).

gorkish 3y ago

Maybe it should be encouraged; anything that disincentivizes someone to fuck with Internet traffic under a faulty premise is a win in my book.