Targeting HTTP's Hidden Attack-Surface

About 10 years ago the CP block list used by multiple nordic ISPs were leaked and people jumped on the opportunity to test the quality of those listed. The result they got where that a couple percent was CP and the remaining was either dead or non-CP.

The problem (as was discussed in Sweden during that time), is that the list can't be made transparent since according to the police that would "guide" people to location of CP, and the owners of website is not contacted since thats not the job of those operating the lists. There is also no one willing to employ and pay people to clean the list of domains once the content is gone.

In one particular case there was a Bonsai website that got listed. Those studying the leaked list called the owners of it and the owners were completely unaware that most people in the nordic countries could not access their website since it was blocked. The Swedish police speculated in a interview that the site had been hacked and that the operators (web host/designers) cleaned it without notifying the site owners.

As a administrator for web hosting, I would be amiss if I didn't add to this that hacked websites have generally a multiple of payloads at the time anyone will start notice that something is amiss. A site could be sending spam, selling fake shoes, and running a CP site all at the same time, and the operators could have notices one of the payloads then decided to reinstall (and update).

The "CleanFeed" technology mentioned in the article, and similar technologies are deployed at all major UK ISPs (basically if you've seen it advertised on TV, it has this) which was, as the author says, deployed originally to intercept potential "Child Pornography" and block it using an otherwise transparent HTTP proxy. The proxy looks at the HTTP 1.1 Host header, or even the entire HTTP request, and decides either "Yeah that's bad" and gives a bad saying you're a bad person and should feel bad or lets it pass unmolested. This is impossible for HTTPS because the server's identity is authenticated using public key crypto

Anyway, this illustrates a peril of developing technology. Inevitably Big Copyright (in this case I think originally the major music labels) took these ISPs to court. The court asked them a plain and simple question - do you have technology that could do what Big Copyright wants here, and block arbitrary sites? And CleanFeed meant the answer was "Yes". So the court said, "OK, since you _can_ do this, we're ordering you to do it".

Now, some small UK ISPs simply don't have censorship capability, and the court told them since you don't censor anything (Child Porn, videos of people being gruesomely killed, how to cheat at popular video games) we don't find that you have any liability for not censoring copyright infringement either, carry on.

Years later this got extended still further, the UK government "ordered" the big famous ISPs to censor stuff that might offend people or was "inappropriate" for children or whatever. And all of this is managed opaquely so it can be used for any purpose that the government sees fit. But again, small ISPs simply don't obey, and the UK executive has a _history_ dating back to when printing books was a new technology, of going to court, insisting that "public morality" demands censorship and getting shut down very embarrassingly by judges, so this time they have chosen to simply pretend the smaller ISPs don't exist. tl;dr if you live in the UK and people have heard of your ISP your access to the Internet is censored. Switch to a tiny ISP run by people who'd rather face jail than destroy the Internet, or pipe everything through a VPN and/or Tor.

Note that this is all separate from the UK "Snooper's Charter" which is very secretive but probably implemented in the backbone. The "Snooper's Charter" stuff doesn't block anything, but does monitor metadata for everybody, all the time, basically like the NSA in the US. Changing ISP can't help you there.

It's not banned, it's just transparently intercepted.