3 ms·

Well you made the conscious choice to make your own traffic indistinguishable from abuse traffic.

by kccqzy 3y ago

jsheard 3y ago
Yeah I get it, I'm not blaming anyone for shitlisting those IP ranges given the circumstances. There is no way to ensure user privacy that doesn't also give bad actors the same privacy, and end up necessitating the assumption that anyone who goes out of their way to be private is a bad actor. This is why we can't have nice things.
- kccqzy 3y ago
  > There is no way to ensure user privacy that doesn't also give bad actors the same privacy I disagree. There are upcoming technologies that have the potential of making this a reality. Like Private Access Tokens (https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...) and its successor protocols, the Privacy Pass suite of protocols (split over many documents https://www.ietf.org/archive/id/draft-ietf-privacypass-architecture-16.html https://www.ietf.org/archive/id/draft-ietf-privacypass-archi... https://www.ietf.org/archive/id/draft-ietf-privacypass-auth-scheme-15.html https://www.ietf.org/archive/id/draft-ietf-privacypass-auth-... https://www.ietf.org/archive/id/draft-ietf-privacypass-protocol-16.html https://www.ietf.org/archive/id/draft-ietf-privacypass-proto... https://www.ietf.org/archive/id/draft-ietf-privacypass-rate-limit-tokens-06.html https://www.ietf.org/archive/id/draft-ietf-privacypass-rate-...) and so on. These efforts are spearheaded by Apple, Google, Cloudflare and Fastly. Of course Apple has iCloud private relay so they have incentives to make such things work well with iCloud private relay. Google has Google One VPN too. It also has reCAPTCHA that's widely used to block abuse traffic. Cloudflare and Fastly of course are big CDNs. Imagine a world where visiting a website over a VPN, and these tokens clearly distinguish you from abuse traffic while preserving your privacy, so that Cloudflare has no reason to present you with a CAPTCHA and reCAPTCHA gives you that tick without forcing you to pick pictures of motorcycles. Watch this space. Very interesting developments here.
  - jsnell 3y ago
    Google One VPN is being shut down. And separate from that, I bet that wide deployment of privacy-preserving anti-abuse mechanisms is dead after the WEI fiasco. It's just not possible for Chrome to ship anything even remotely resembling that feature given the PR damage from that proposal. That includes PATs, which are pretty much exactly the same thing as WEI. And as long as PATs remain an Apple-only feature, implementing them as captcha bypasses is not very attractive. (And honestly, giving Safari iPhone users a special fast lane that other users simply can't get strikes me as a really bad idea.)
    - kccqzy 3y ago
      My own opinion on the WEI fiasco is that Google had done a terrible job communicating to the outside world about it. I feel much better if Apple were to be in charge of it as well as anything remotely similar. That is, have Apple completely roll it out, achieve the initial mindshare and acceptance, and then let Google merely copy whatever Apple does with minor changes.
      - freedomben 3y ago
        Is the only possibility that Google did a bad job communicating it, or is it possible that it's a terrible idea that will lead us to a dystopian future where anybody using non-closed/locked hardware can't use the web? I strongly suspect it would (over time as every website adopts it) be like VPNs are now, except for every single Linux user. Maybe Google will release an official Linux distro for people like me, but they won't be able to allow us to have root or sudo on our boxes, otherwise they can't vouch for the machine. That pretty much defeats the whole point of running Linux. Though, if you would feel much better if Apple were in charge of it, then I get the feeling you don't have a lot of sympathy for people like me. That's a reasonable and valid position, but it does sadden me greatly.

Well you made the conscious choice to make your own traffic indistinguishable from abuse traffic.

by kccqzy 3y ago

Well you made the conscious choice to make your own traffic indistinguishable from abuse traffic.

Yeah I get it, I'm not blaming anyone for shitlisting those IP ranges given the circumstances. There is no way to ensure user privacy that doesn't also give bad actors the same privacy, and end up necessitating the assumption that anyone who goes out of their way to be private is a bad actor. This is why we can't have nice things.

kccqzy 3y ago
> There is no way to ensure user privacy that doesn't also give bad actors the same privacy I disagree. There are upcoming technologies that have the potential of making this a reality. Like Private Access Tokens (https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...) and its successor protocols, the Privacy Pass suite of protocols (split over many documents https://www.ietf.org/archive/id/draft-ietf-privacypass-architecture-16.html https://www.ietf.org/archive/id/draft-ietf-privacypass-archi... https://www.ietf.org/archive/id/draft-ietf-privacypass-auth-scheme-15.html https://www.ietf.org/archive/id/draft-ietf-privacypass-auth-... https://www.ietf.org/archive/id/draft-ietf-privacypass-protocol-16.html https://www.ietf.org/archive/id/draft-ietf-privacypass-proto... https://www.ietf.org/archive/id/draft-ietf-privacypass-rate-limit-tokens-06.html https://www.ietf.org/archive/id/draft-ietf-privacypass-rate-...) and so on. These efforts are spearheaded by Apple, Google, Cloudflare and Fastly. Of course Apple has iCloud private relay so they have incentives to make such things work well with iCloud private relay. Google has Google One VPN too. It also has reCAPTCHA that's widely used to block abuse traffic. Cloudflare and Fastly of course are big CDNs. Imagine a world where visiting a website over a VPN, and these tokens clearly distinguish you from abuse traffic while preserving your privacy, so that Cloudflare has no reason to present you with a CAPTCHA and reCAPTCHA gives you that tick without forcing you to pick pictures of motorcycles. Watch this space. Very interesting developments here.
- jsnell 3y ago
  Google One VPN is being shut down. And separate from that, I bet that wide deployment of privacy-preserving anti-abuse mechanisms is dead after the WEI fiasco. It's just not possible for Chrome to ship anything even remotely resembling that feature given the PR damage from that proposal. That includes PATs, which are pretty much exactly the same thing as WEI. And as long as PATs remain an Apple-only feature, implementing them as captcha bypasses is not very attractive. (And honestly, giving Safari iPhone users a special fast lane that other users simply can't get strikes me as a really bad idea.)
  - kccqzy 3y ago
    My own opinion on the WEI fiasco is that Google had done a terrible job communicating to the outside world about it. I feel much better if Apple were to be in charge of it as well as anything remotely similar. That is, have Apple completely roll it out, achieve the initial mindshare and acceptance, and then let Google merely copy whatever Apple does with minor changes.
    - freedomben 3y ago
      Is the only possibility that Google did a bad job communicating it, or is it possible that it's a terrible idea that will lead us to a dystopian future where anybody using non-closed/locked hardware can't use the web? I strongly suspect it would (over time as every website adopts it) be like VPNs are now, except for every single Linux user. Maybe Google will release an official Linux distro for people like me, but they won't be able to allow us to have root or sudo on our boxes, otherwise they can't vouch for the machine. That pretty much defeats the whole point of running Linux. Though, if you would feel much better if Apple were in charge of it, then I get the feeling you don't have a lot of sympathy for people like me. That's a reasonable and valid position, but it does sadden me greatly.