7 ms·

Speaking as someone who has implemented [shallow] inspection/filtering and CALEA-type features on comms equipment for markets both in and outside of the US.) I

• bstpierre 14y ago
  Every feature I've implemented has been security/stability related. Inspection/filtering/shaping/limiting are absolutely critical on ISP networks. Taps/mirrors are critical to troubleshooting. If ISPs didn't deploy all kinds of filtering, the Internet would be mostly unusable.
  • sp332 14y ago
    I work at an ISP, and this is absolutely true. Sometimes our mail servers get hammered, and we need to modify our blacklist to include servers, netblocks, and/or entire countries(!) at a time. In order to know what to block, we need to be able to know who is emailing whom. Sometimes, it's one of our customers, and we can call them up and tell them their box is owned. This kind of intrusive access is only used for maintenance, and without it we literally couldn't keep the mail servers online.
    • ceph_ 14y ago
      If the traffic is terminating on your own servers you in no way need deep packet inspection to determine the source of traffic and its nature. Even if the traffic wasn't terminating on your machines, you don't need DPI to determine src and dst ip:port tuples. Which is all you need to do what your suggesting.
      • sp332 14y ago
        My comment isn't about DPI specifically, but a whole range of intrusive monitoring policies at ISPs. In order to determine the originator of an email, you have to read (at least) the email headers. The IP address of the last hop is not that useful in routing email.
  • ceph_ 14y ago
    If you need DPI to determine what traffic to drop, you are running your pipes way too hot. It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another?
    • mfukar 14y ago
      It's their network.
      • ceph_ 14y ago
        User traffic is user traffic, if they're paying for it it should be all treated the same. I'm not saying you don't need to prioritize some traffic with QoS. I'm saying you don't need DPI to run a network. Sincerely, A network engineer
        • mfukar 14y ago
          If you treat your network's users them all the same, more power to you. Running the network and deciding what goes through it is still out of their control. I don't get why you're against those that do use DPI to run their network more easily, though.
        • lttlrck 14y ago
          User traffic is user traffic is whole lot of different kinds of traffic. So there should be QoS, but how? You cannot depend on the IP Differentiated Services Field, so perhaps heuristics to deduce what the traffic is? Thats prone to misidentifying Netflix vs. CDN download thus ruining UX. No DPI is needed.
    • bstpierre 14y ago
      Note that I said in my original comment that my experience has primarily been implementation of shallow inspection. Subscriber-connected edge gear is often oversubscribed. Lots of little pipes coming in from households; one or two medium-sized pipes headed to the core. > It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another? All too often it's not actually the subscribers' traffic that causes problems; it may be malware.
• enraged_camel 14y ago
  >>I'm not trying to flame you here, but I really must ask: How do you live with yourself? It's not the tool itself that matters, but how it is used and by whom.
  • thatoneguy 14y ago
    Why is it that technology is always a panacea when its benefits are positive but value-neutral when its benefits are negative?
    • Karunamon 14y ago
      Probably because almost any tool ever created can do amazing things in the right hands and commit horrible atrocities in the wrong hands? And usually the positive outweighs the negative?
      • thatoneguy 14y ago
        Like nuclear weapons? Nerve gas? Anthrax?
• tptacek 14y ago
  This comment was so emptily mean that I took the time to flag it.
  • novalis 14y ago
    I didn't read it to be empty, it actually displayed a point of view that is missing in public discourse. Questioning white wash may or may not look mean depending on the observer. It also proposes a very simple moral implication for this type of white wash. I think the white wash is real and it is very mean. But like you, I also like spending time with what is really interesting to me. I hope I don't read void. Or mean-spirited.
  • RobAley 14y ago
    It is not empty. I've refused a job I was head-hunted for (IT at a morally questionable firm) on a moral basis, even though pay and conditions would have been better than what I have now. If my current job started requiring me to do something I didn't agree with morally, I would leave (or refuse to do it and be forced out if necessarily). So I think it is a perfectly valid question (albeit an uncomfortable one) to ask. There may be valid reasons for the OP to do/stay in the job that we aren't seeing. Or there may not. We won't know if we don't ask, and the OP doesn't have to answer. It is well within the guidelines of HN, it adds to the discourse, particularly on a topic that is basically about morals/ethics. Just because it is an uncomfortable question, doesn't make it fall within what should be flagged.
• Nrsolis 14y ago
  Allow me to add my $0.02 to this discussion. I've implemented CALEA type features for a major ISP. I did it because it was the law that we implement it. I'm generally in favor of following the law. Mind you, CALEA doesn't do anything that couldn't already be done with the law. And you get more protections via CALEA than you'd get otherwise. For one thing, there are warrants that are delivered to a judge for review which then find their way to a company attorney. Only then does any interception take place. I can live with the checks and balances that are in place under this system. I sometimes find it incredible that people are so quick to embrace lawlessness and then expect their duly-elected governments to follow those laws to the letter. Believe me, if enough people actually cared and went to their legislature, things would change. Of course, most people agree that we should pursue criminals using all legal means. BTW, I'm in agreement that this system could be abused. Of course, that's always been the case. Laws are just words on paper unless there are people who will enforce them. If those folks look the other way, well, you're right back where you started. And before you go into privacy rights, let me suggest to you that the millions of people posting their personal information on FB and getting their email via Google provide a pretty substantial counterweight to your position.
  • svachalek 14y ago
    I honestly don't see how voluntary self-disclosure on FB or anywhere else has anything to do with privacy rights.
    • Nrsolis 14y ago
      It matters if you're trying to gain popular support for your political positions. The average joe doesn't see why wiretapping has anything to do with them. They don't understand or care. And those people vote. Sometimes.
  • mcantelon 14y ago
    Yup. People are ignorant of history and therefore of the need for privacy rights. Thankfully encryption doesn't yet depend on the public not being ignorant and politicans not being corrupt.
  • 14y ago
• npsimons 14y ago
  No employee boycott is going to help, they'll just hire someone else. We won't see change until we start electing better leaders, or changing the system. Reduce the demand.
  • meaty 14y ago
    Or stop being employees in the industry which is why I no longer work for a defence contractor.
  • flyinRyan 14y ago
    >We won't see change until we start electing better leaders, or changing the system. No amount of voting is going to help until we get a better voting system... which is set up by the people who get voted in. You can sit around justifying why you're helping spread evil or you can take control of the only things you can actually change: your own actions.