3 ms·

Why would you "filter TCP/IP except by IP" ? When I download a file, what is important is the content of the file. Not the pipe it came in. When I buy somethin

Why would you "filter TCP/IP except by IP" ? When I download a file, what is important is the content of the file. Not the pipe it came in. When I buy something on amazon, what is important is the stuff delivered, not the delivery man. You would filter packages from entering home based on the delivery man ? Insane ? Yes this is an insane behavior. As if one delivery man were dedicated per home, as it was in 1994. INSANE.

netsharc 3y ago
The alternative is deep packet inspection, which is another can of worms. So it's a good thing that they're clowns at this.
- JackSlateur 3y ago
  You are right ! Also called "URSS", where kind people read your mail and inspect your stuff etc. Perfect;
  - shiroiushi 3y ago
    Well, the Italian Post is already famous for opening people's mail and taking goods shipped through the mail for themselves.
rvnx 3y ago
Further on this example: The delivery guy knowingly delivers drugs, it's written on the package, and the authorities told him to stop doing that. Then what to do ? Remove the license of that most specific delivery guy. That's what they try to do (though it would be easier if the delivery guy would collaborate of course). Not saying that blocking internet hosts is a good thing, but I don't see what else they can do, if the counterparty is not compliant :| (DNS blocking doesn't work anymore as browsers provide circumvention methods by default, and blocking the whole BGP peer has too much side-effects because it blocks all the legitimate delivery guys too)
- JackSlateur 3y ago
  The authorities, you mean "the authorities of some other people, not mine".
lock-the-spock 3y ago
You would not filter based on the delivery man but based on the sender. If you know someone sends bombs or drugs in the mail but you cannot stop them initiating parcels, you would find ways to stop the parcels halfway. Physical mail is scanned in the real world, and customs stop stuff from entering the country - so the analogy is already reality! In theory this would also work for IPs if not for the IP laundering OOP criticised. Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. There are of course many reasons for those and many of them legitimate, but it doesn't mean this is the right approach (and with IPv6 certainly other options are possible...)
- JackSlateur 3y ago
  Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. Well, if you want "CDN", then you must break the TCP connection. That is, you must have one TCP connection from client to CDN, and then one from CDN to the backend. Unless you are against CDNs (they do serve a real-world purpose, tho), then it is a system necessity;

netsharc 3y ago

The alternative is deep packet inspection, which is another can of worms. So it's a good thing that they're clowns at this.

JackSlateur 3y ago
You are right ! Also called "URSS", where kind people read your mail and inspect your stuff etc. Perfect;
- shiroiushi 3y ago
  Well, the Italian Post is already famous for opening people's mail and taking goods shipped through the mail for themselves.

rvnx 3y ago

Further on this example: The delivery guy knowingly delivers drugs, it's written on the package, and the authorities told him to stop doing that. Then what to do ? Remove the license of that most specific delivery guy. That's what they try to do (though it would be easier if the delivery guy would collaborate of course). Not saying that blocking internet hosts is a good thing, but I don't see what else they can do, if the counterparty is not compliant :| (DNS blocking doesn't work anymore as browsers provide circumvention methods by default, and blocking the whole BGP peer has too much side-effects because it blocks all the legitimate delivery guys too)

JackSlateur 3y ago
The authorities, you mean "the authorities of some other people, not mine".

lock-the-spock 3y ago

You would not filter based on the delivery man but based on the sender. If you know someone sends bombs or drugs in the mail but you cannot stop them initiating parcels, you would find ways to stop the parcels halfway. Physical mail is scanned in the real world, and customs stop stuff from entering the country - so the analogy is already reality! In theory this would also work for IPs if not for the IP laundering OOP criticised. Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. There are of course many reasons for those and many of them legitimate, but it doesn't mean this is the right approach (and with IPv6 certainly other options are possible...)

JackSlateur 3y ago
Cloudflare chooses to hide thousands of IPs on a single IP - this is a technical choice, not a system necessity. Well, if you want "CDN", then you must break the TCP connection. That is, you must have one TCP connection from client to CDN, and then one from CDN to the backend. Unless you are against CDNs (they do serve a real-world purpose, tho), then it is a system necessity;