5 ms·
"Customers who do not want filtering still have their traffic routed through the system, but matches to Huawei's database are dismissed rather than acted upon."
by dlitz 13y ago
"Customers who do not want filtering still have their traffic routed through the system, but matches to Huawei's database are dismissed rather than acted upon."
In other words, when they screw up the implementation and it breaks something about your network connection (e.g. IPv6, TCP options, or dozens of other subtle things), there's nothing you'll be able to do to just get raw packets routed over the Internet.
This is going to break the network.
- EwanToo 13y agoIt's been in place on TalkTalk's network for 2 years now, it really doesn't break things. It's not particularly aggressive, and only looks for HTTP and HTTPS traffic, not VPNs etc. Whether you agree with it, like it, or want it, is an entirely different question (I don't want it), but it hasn't caused significant issues yet.
- omh 13y agoAre you a TalkTalk customer? I'm genuinely surprised that it isn't causing at least minor problems with some sites for more technical users. I manage a virus-scanning web proxy for our company and this is enough to throw up regular little glitches with all sorts of sites which "just work" when going direct.
- pbhjpbhj 13y agoCan you give more details. Presumably the filter is just dropping traffic sent to/from any of the IP addresses or domain names in the blacklist. What are the glitches you're seeing?
- omh 13y agoThe corporate systems for this (usually) operate by proxying all HTTP traffic, so any sites which don't play nicely with a HTTP proxy are affected. I've seen "interesting" problems with some more esoteric HTTP 1.1 features and all sorts of things with streaming sites. You're probably right that this system isn't proxying everything, so its impact would be a lot lower. It all depends on what layer it tries to operate, which we don't really know. I'd love to see an investigation from someone on TalkTalk.
- andyhmltn 13y agoWe have TalkTalk at home (although as soon as fibre optic comes in this area we are moving) and I have to admit: I had no idea this was happening. I'm a pretty 'technical' user and I haven't noticed any problems as such.
- auxbuss 13y agoThey also send a crawler to any urls that they've not "registered" before (by IP). About 30 secs after navigating to a new page their bot will crawl a visited page. robots.txt is not honoured. Something to consider when testing, or using, "hidden" sites and pages.
- harrytuttle 13y agoIt does. It fucks up Microsoft ClickOnce, causes cache headers to be destroyed and adds latency.
- dlitz 13y ago> It's been in place on TalkTalk's network for 2 years now...but it hasn't caused significant issues yet. Of course it hasn't; It's only been 2 years. You won't notice unless you're trying to build or deploy something innovative that breaks some of the assumptions that the designers of the filters never anticipated. Layered protocols exist to allow them to evolve over time with a minimum of complexity (and cost). When you break the layering, you make that evolution more expensive. Look at how expensive it is to write a basic app that has peer-to-peer conectivity, thanks to NAT. How are we supposed to deploy the next WebSockets when there are transparent HTTP proxies everywhere that aren't aware of it? Economically speaking, widespread deployment of these sorts of filtering technologies are exactly like pollution: they look fine at first, but eventually they end up being very expensive for everyone, even the people who never used them.
- DanBC 13y agoAlso, it may very well have caused a lot of issues, but users are naive and don't know how to troubleshoot these kind of problems.
- zimbatm 13y agoIt would be interesting to compare Talk Talk latency with other providers. Surely this packet inspection cannot be free in terms of performance.
- moreentropy 13y agoThis. I expect my ISP to never, ever fuck with the application layer. Do your job and route my traffic, thanks. There is no valid reason to pass traffic through the filtering system if a customer has opted out and won't be filtered. This costs real money to the ISP, so I presume they analyze that traffic. It doesn't matter if they pretend to do this to train the filter or feed some agency's data warehouse, this is madness.