4 ms·
It's sad to see the reasoning for using VPN's being so deeply mixed with bittorrent and similar things "worth hiding" according to some. There are actually many
by jcr 14y ago
It's sad to see the reasoning for using VPN's being so deeply mixed with
bittorrent and similar things "worth hiding" according to some. There
are actually many good reasons to use various forms of secure tunneling.
Many ISP's serve requested pages from massive caches. Although provider
caching can improve performance in some cases as well as reduce
bandwidth costs for the ISP, it can often result in stale information
being passed to the client (you!).
Another common speed/cost improvement for ISP's is serving degraded
images from their cache -- by recompressing images (jpg) at a higher
compression ratio, the file size is reduced at the expense of degrading
the image quality. This is extremely common on mobile networks, but it
is becoming more common with land-based providers. In most cases, you'll
never notice, since you'll just assume it's a crappy image from the
original server. On the other hand, if you do any work with images, then
you could be stuffed by the modified images being delivered to you.
Having a consistent endpoint provided by a VPN provider can also be a
real advantage. For example, if you're doing checking, testing or
trouble shooting, against a system on the `net, then knowing what traffic
is yours in the logs can be real helpful. With dynamic IP addressing,
your endpoint (public IP) always changes. When you're using a VPN and
helping out a friend with something as trivial as reporting bugs, you
can tell them that the funky traffic from xxx.example.com is just you
running some tests. Even if the site owner isn't your best friend or
anyone you really know, it's great when reporting bugs to say, "Hey pg,
my traffic is always coming from la.tunnelr.com" so it's easier for them
to find it in their logs.
If you need to do your own pen testing across the `net and your ISP does
deep packet inspection (DPI) and egress filtering, then once again,
you're stuffed without a VPN or unfiltered remote host. Of course, you
need to be on good terms with your VPN provider and let them know in
advance that you'll be sending some dodgy traffic over their network,
but that's not a big deal most of the time.
If you participated in the recent Stripe.com Capture The Flag contest
without using a VPN or staged connection (ssh), then you really didn't
put very much thought into what could happen if some malicious person
rooted the game server and attacked the game participants. Sure, the
Stripe folks are fantastic, and they keep an eye on things, but no
person has sub-microsecond response times. ;)
Also, some ISP's have bandwidth caps and automated thresholds for
reducing connection performance, but they usually have a stipulation in
their contract excluding VPN bandwidth from the cap/limit accounting.
The reason is simple; business customers would use another ISP if the
caps/limits interfered with doing work, and most (sane) businesses
provide a company VPN to their employees for remote work.
I use http://www.tunnelr.com http://www.tunnelr.com almost all of the time simply because it
makes my mobile (EVDO VerizonWireless) connection a lot more consistent
and reliable on UNIX (OpenBSD). A lot of mobile ISP's don't support UNIX
at all, and they expect you to run inane and unaudited software
("VZAccess" which is actually just rebranded stuff from SmithMicro).
Having a SSH connection present prevents some of the (intentional)
oddities of mobile connections (e.g. "pausing" the link/connection).
There are plenty of good reasons to use a VPN that don't involve
bittorrent or similar. The best reason of all is if your ISP does
not provide all of the exact details of their filtering and caching
methods --of course, none do.
- DanBC 14y ago> Another common speed/cost improvement for ISP's is serving degraded images from their cache -- by recompressing images (jpg) at a higher compression ratio, the file size is reduced at the expense of degrading the image quality. This is extremely common on mobile networks, but it is becoming more common with land-based providers. In most cases, you'll never notice, since you'll just assume it's a crappy image from the original server. On the other hand, if you do any work with images, then you could be stuffed by the modified images being delivered to you. T-Mobile in the UK does this. They also re-write the HTML. This line is added after the first <html> - <script src="http://1.2.3.8/bmi-int-js/bmi.js http://1.2.3.8/bmi-int-js/bmi.js language="javascript"> Images come from <img src="http://1.2.3.11/bmi/ycombinator.com/images/s.gif http://1.2.3.11/bmi/ycombinator.com/images/s.gif And they add an alt message to tell you how to update the images to the original images. Which is annoying if the alt originally contained useful information. (The original alt comes back if you update the images.) I'm in the UK. Having images served from 1.2.3.x is suboptimal.
- jcr 14y agoDan, are you being cautious and making up those IP addresses, or those actual IP addresses? I ask since 1.0.0.0/8 is APNIC and 1.2.3.0/24 is the APNIC "Debogon" project. For notes, a "bogon" is an supposedly unroutable address, or more accurately, an address that you shouldn't see in use.
- DanBC 14y agoI'm not making them up! It's what I see on the Chrome "status bar" (or whatever it's called now) and in the html. 1.2.3.8, 1.2.3.13, etc. I'm in a coffee shop at the moment, but when I get back I'll try and get a list of the IPs that are used. (The last digit is always quite small though.)
- jcr 14y agoI wasn't entirely clear in my description of a "bogon" since the definition is a bit hazy. Some define it as unallocated address, and others define it as an address you shouldn't see in use. For example, if you get a packet supposedly from 192.168.1.1 (in private address space) on your public interface (i.e. has a public IP address), then some consider it a bogon. Address space that hasn't been allocated by any of the RIR's (Regional Internet Registries like APNIC, RIPE, ...) are sometimes used without permission, and usually for nefarious purposes. These are also considered bogons since you should never see those addresses in use. When you see a bogon, something is definitely wrong. It could be your service provider is misusing address space that hasn't been allocated to it, or it could be something far worse (malware, compromised network routers, ...). The "Debogon Projects" and "Bogon Monitoring" are run by the various RIR's to find those who are squatting on misued address space, and also to get firewall sysadmins to no longer block the unused ranges. Usually, following the allocation lists of the RIR's is sufficient, but some folks don't update their firewall rules as often as they should. http://www.ris.ripe.net/debogon/ http://www.ris.ripe.net/debogon/ http://www.ripe.net/ripe/docs/ripe-351 http://www.ripe.net/ripe/docs/ripe-351