4 ms·

I had to ban Spotify on our office network as the clients don't take into account how many users are on the local net and scale back accordingly. It only took a

I had to ban Spotify on our office network as the clients don't take into account how many users are on the local net and scale back accordingly. It only took a handful of users to soak up a noticeable amount of upload bandwidth. That and there is an operational security issue with a program that uploads files from the local disk to untrusted peers and encrypts everything such that one cannot tell what it is uploading.

freehunter 14y ago
What sucks is that here at work (I work in corporate information security), we have developers who love to listen to music when they're programming. I support it. I like listening to music too. The problem is, some of them like Spotify. And since Spotify is peer-to-peer (and p2p applications are against the policy), it gets flagged in our security monitoring tool. And when it gets flagged, I have to make that action stop. And if it's flagged as a high priority, I have to report them to HR. Some people don't know it's p2p, some don't care. They've paid for it and they want to listen to it. But there's no way to turn off the p2p nature of the program. We run into this issue with Skype constantly too. People want to use these programs, and have valid reasons to use them. But our business cannot accept the risk of peer to peer traffic on our protected network, so away they go. If there was even the slightest bit of obscure and dangerous and unsupported configuration options that left a backdoor to being able to turn off the p2p, I would love it. But there's not.
- krakensden 14y ago
  Since Microsoft bought Skype, I heard they turned off the p2p part.
  - freehunter 14y ago
    It's possible there are some clients that do not have p2p enabled, but I can confirm that the clients I'm seeing do still have p2p enabled and active.
- mcculley 14y ago
  I agree. If it had an option to be polite about using upload bandwidth (e.g., do a multicast advertisement to find the count of total Spotify clients and divide upload bandwidth usage by that number) and could easily be sandboxed such that you know it isn't scouring your whole filesystem for stuff to upload, I would be okay with it. For example, it (at least last time I looked on OS X) goes poking through ~/Music/iTunes/ presumably to find music files it does not have to download. That's a little too far.
- alpeb 14y ago
  A good solution nowadays is to ban everything that is not work-related and have people just use their cellphones with their own data plans for that.
  - Ao7bei3s 14y ago
    No, thats just stupid. A good solution would be a guest WLAN that is, for example, on a separate VLAN. There is no reason to force people to use the slow and expensive cellular network -- both your employees and the people who actually need to use the cellular network will thank you. Also, the GP companies no-peer-to-peer-at-all policy seems... not well thought out, even thought it might be a pretty common policy. That an application is p2p has nothing to do with wether or not it can be trusted. (If the application wanted to steal data, wouldn't it be easier to just go for some central dump server?)
    - mcculley 14y ago
      The P2P app could make itself more trustworthy. On OS X, it could opt into the App Sandbox such that it could not read files unrelated to what it has downloaded. If you run fs_usage against Spotify on OS X, you will see that it is reading files in other places than where it downloads to.
      - csense 14y ago
        Isn't it the norm on UNIX-like OS'es for things to use tons of dynamic libraries and spew pieces of themselves all over different directories?
        mcculley 14y ago
        I would not say this is the norm. If you look at Sandbox-enabled third party applications such as Google Chrome, it is well defined what libraries it dynamically links to outside of the directory it is installed in.
        ohazi 14y ago
- ryandvm 14y ago
  > it gets flagged in our security monitoring tool. And when it gets flagged, I have to make that action stop Or... get your security monitoring tool to stop reporting legitimate P2P protocols as a security threat.
  - freehunter 14y ago
    "Legitimate" p2p protocols depends completely on your risk appetite and how you define your security. For us, our risk appetite is quite low, and there is no such thing as a legitimate p2p protocol.
  - aeturnum 14y ago
    Sure, you just write the tool that can audit encrypted traffic from Skype or Spotify in real time and check that it's legitimate as opposed to a malicious program impersonating their protocols.
  - dsl 14y ago
    "Legitimate" depends a lot on the environment. Should Spotify be pushing bits out to the world from your doctors PC? Should it be accepting inbound connections from other random people around the world? Now answer the same two questions after an exploit in the P2P library within Spotify is announced on HN.
- diminoten 14y ago
  I just don't see Spotify as a business risk unless the bandwidth itself is a cost. It almost sounds like someone just wants to make a decision and is post-hoc justifying that decision with this "security concern!" fearmongering.
  - freehunter 14y ago
    I posted this elsewhere, but... P2P applications have security risks associated with them, but they also have network constraints associated with them. It doesn't take many P2P users to choke legitimate users out of a network. When some of the network monitoring tools we use are licensed based on how much data is flowing through the network, P2P gets expensive real quick. Move that stuff to a network we're not monitoring as extensively.
    - diminoten 14y ago
      I don't think P2P applications have a significant security risk. Specifically, I don't think the security industry at large considers P2P to be inherently risky. If you trust Spotify like you trust say, Google Chrome, or Microsoft Outlook, or any of the other apps you run on your machine, the fact that one or more of them uses P2P in no way further raises your risk profile.
      - freehunter 14y ago
        The only security risk it needs to be is to blind us from other security risks. That can be accomplished by its behavior in the network monitoring tool (many malware applications behave very similarly in a p2p fashion) or by putting us at risk of running over the amount of traffic we're licensed for in any of our tools. We're not in the business of buying licenses to support a program we explicitly disallow, so instead we're in the business of explicitly disallowing software that would put us over that license. P2P raises our risk level just by being noisy. iTunes does the same thing, and it's not P2P. It's just really, really chatty and it is also disallowed by policy. Chrome and Outlook don't put us in danger of being over our license or out of bandwidth. Users don't understand. I get it. Information security is a young industry, and some decisions that are made might not be immediately clear. It's a negative job; if you're doing everything exactly right, users will be complaining that you're getting in their way and the bosses will be wondering why you even have a budget. If you're not doing everything exactly right, users will be complaining that they have odd charges on their credit cards and the bosses are wondering why they can't log into their email anymore. You might not like my driving, but covering my eyes with your hands doesn't solve that problem. P2P blinds my network monitors just like your hands blind my eyes.
- nurd 14y ago
  WebRTC is about to make every web browser a P2P app: http://www.webrtc.org/ http://www.webrtc.org/ Are you going to block all those, too, or change the policy?

freehunter 14y ago

What sucks is that here at work (I work in corporate information security), we have developers who love to listen to music when they're programming. I support it. I like listening to music too. The problem is, some of them like Spotify. And since Spotify is peer-to-peer (and p2p applications are against the policy), it gets flagged in our security monitoring tool. And when it gets flagged, I have to make that action stop. And if it's flagged as a high priority, I have to report them to HR. Some people don't know it's p2p, some don't care. They've paid for it and they want to listen to it. But there's no way to turn off the p2p nature of the program. We run into this issue with Skype constantly too. People want to use these programs, and have valid reasons to use them. But our business cannot accept the risk of peer to peer traffic on our protected network, so away they go. If there was even the slightest bit of obscure and dangerous and unsupported configuration options that left a backdoor to being able to turn off the p2p, I would love it. But there's not.

krakensden 14y ago
Since Microsoft bought Skype, I heard they turned off the p2p part.
- freehunter 14y ago
  It's possible there are some clients that do not have p2p enabled, but I can confirm that the clients I'm seeing do still have p2p enabled and active.
mcculley 14y ago
I agree. If it had an option to be polite about using upload bandwidth (e.g., do a multicast advertisement to find the count of total Spotify clients and divide upload bandwidth usage by that number) and could easily be sandboxed such that you know it isn't scouring your whole filesystem for stuff to upload, I would be okay with it. For example, it (at least last time I looked on OS X) goes poking through ~/Music/iTunes/ presumably to find music files it does not have to download. That's a little too far.
alpeb 14y ago
A good solution nowadays is to ban everything that is not work-related and have people just use their cellphones with their own data plans for that.
- Ao7bei3s 14y ago
  No, thats just stupid. A good solution would be a guest WLAN that is, for example, on a separate VLAN. There is no reason to force people to use the slow and expensive cellular network -- both your employees and the people who actually need to use the cellular network will thank you. Also, the GP companies no-peer-to-peer-at-all policy seems... not well thought out, even thought it might be a pretty common policy. That an application is p2p has nothing to do with wether or not it can be trusted. (If the application wanted to steal data, wouldn't it be easier to just go for some central dump server?)
  - mcculley 14y ago
    The P2P app could make itself more trustworthy. On OS X, it could opt into the App Sandbox such that it could not read files unrelated to what it has downloaded. If you run fs_usage against Spotify on OS X, you will see that it is reading files in other places than where it downloads to.
    - csense 14y ago
      Isn't it the norm on UNIX-like OS'es for things to use tons of dynamic libraries and spew pieces of themselves all over different directories?
      - mcculley 14y ago
        I would not say this is the norm. If you look at Sandbox-enabled third party applications such as Google Chrome, it is well defined what libraries it dynamically links to outside of the directory it is installed in.
      - ohazi 14y ago
ryandvm 14y ago
> it gets flagged in our security monitoring tool. And when it gets flagged, I have to make that action stop Or... get your security monitoring tool to stop reporting legitimate P2P protocols as a security threat.
- freehunter 14y ago
  "Legitimate" p2p protocols depends completely on your risk appetite and how you define your security. For us, our risk appetite is quite low, and there is no such thing as a legitimate p2p protocol.
- aeturnum 14y ago
  Sure, you just write the tool that can audit encrypted traffic from Skype or Spotify in real time and check that it's legitimate as opposed to a malicious program impersonating their protocols.
- dsl 14y ago
  "Legitimate" depends a lot on the environment. Should Spotify be pushing bits out to the world from your doctors PC? Should it be accepting inbound connections from other random people around the world? Now answer the same two questions after an exploit in the P2P library within Spotify is announced on HN.
diminoten 14y ago
I just don't see Spotify as a business risk unless the bandwidth itself is a cost. It almost sounds like someone just wants to make a decision and is post-hoc justifying that decision with this "security concern!" fearmongering.
- freehunter 14y ago
  I posted this elsewhere, but... P2P applications have security risks associated with them, but they also have network constraints associated with them. It doesn't take many P2P users to choke legitimate users out of a network. When some of the network monitoring tools we use are licensed based on how much data is flowing through the network, P2P gets expensive real quick. Move that stuff to a network we're not monitoring as extensively.
  - diminoten 14y ago
    I don't think P2P applications have a significant security risk. Specifically, I don't think the security industry at large considers P2P to be inherently risky. If you trust Spotify like you trust say, Google Chrome, or Microsoft Outlook, or any of the other apps you run on your machine, the fact that one or more of them uses P2P in no way further raises your risk profile.
    - freehunter 14y ago
      The only security risk it needs to be is to blind us from other security risks. That can be accomplished by its behavior in the network monitoring tool (many malware applications behave very similarly in a p2p fashion) or by putting us at risk of running over the amount of traffic we're licensed for in any of our tools. We're not in the business of buying licenses to support a program we explicitly disallow, so instead we're in the business of explicitly disallowing software that would put us over that license. P2P raises our risk level just by being noisy. iTunes does the same thing, and it's not P2P. It's just really, really chatty and it is also disallowed by policy. Chrome and Outlook don't put us in danger of being over our license or out of bandwidth. Users don't understand. I get it. Information security is a young industry, and some decisions that are made might not be immediately clear. It's a negative job; if you're doing everything exactly right, users will be complaining that you're getting in their way and the bosses will be wondering why you even have a budget. If you're not doing everything exactly right, users will be complaining that they have odd charges on their credit cards and the bosses are wondering why they can't log into their email anymore. You might not like my driving, but covering my eyes with your hands doesn't solve that problem. P2P blinds my network monitors just like your hands blind my eyes.
nurd 14y ago
WebRTC is about to make every web browser a P2P app: http://www.webrtc.org/ http://www.webrtc.org/ Are you going to block all those, too, or change the policy?