Hacker News Reader

Comment by lakechfoma | Hacker News Reader

That article was so hard to read. He jumps to so many conclusions without any logical path like the use of TLS will stress the bandwidth of providers, claiming its like "unauthorized taking of the provider's transport network resources". How will TLS vs not TLS meaningfully impact amount of traffic on a network? He doesn't say, just claims it. I'm guessing he means the provider can't throttle/control traffic based on packet inspection as easily? Regardless, this is like saying everyone in the neighborhood running all of their faucets at the same time is like stealing from the water provider. That's literally their only job, to be a pipe for water. People aren't stealing by stressing the network, if anything the network would be stealing for not running as advertised.

"TLS 1.3 significantly facilitates widespread malware distribution" this guy...has to be getting paid by someone to say this, right? Who is this dude, what is CircleID?

View on HN

There's throttling to consider, but there's also caching. It's been a long time since I've had conversations with any NetOps folks working for ISPs, but it used to be very important for the health of a network to do considerable caching wherever possible. It's why http includes cache control headers. With TLS, only the browser can now honor this TTL, and an ISP can no longer cache a particularly popular webpage. I've long suspected that caching strategies are no longer very useful given how the internet looks today, but I also understand powerlaws and it wouldn't surprise me if caching is just as useful today as it was 20 years ago.

So many popular webpages these days are dynamically generated that it can't possibly make much of a difference. I suspect the bulk of traffic by weight is video these days.

If my ISP can cache my traffic they can censor it - and do. Every now and again I'm reminded by accident that EE mobile are scanning all my URLs for censorship purposes.

If my ISP can cache my traffic they can censor it - and do.

Only if they can forge a cache-hit, or block a cache-miss from passing through. Something content addressable (like IPFS) would allow an untrusted party to provide useful cache. (doesn't solve the privacy aspect of the untrusted party knowing I accessed the content though).

It would shock me if it was useful at all on today's internet - the caching I imagine is useful are the boxes that large video providers install on ISP networks. But so much of the internet is already encrypted (YouTube, Netflix, Facebook, etc) that any ISP operating a transparent cache probably has a very low hit rate.

One of the problems with http is that nobody bothered to implement some kind of integrity check for http content (and make sure that it got wide deployment). There are too many examples of parties messing with http content.

So if people cared about transparent caching, they should have added integrity checks ages ago.

Now it's too late.

It is interesting to compare with DNS. DNSSEC is basically just an integrity check. These days the lack of privacy is considered a serious issue. And DNS is likely to move to TLS as well.

The case for transparent proxies put in place by consumer side ISPs has largely been nullified by the introduction of elected CDN services like Cloudflare.

The privacy implications aren't really any different, but at least it's the webadmin of the website you're choosing to access that gets to decide. They get to ensure that they elect a company that respects their content and provides value to their visitors.

Reply on news.ycombinator.com