Hacker News Reader

Comment by toyg | Hacker News Reader

I expect enterprise IT will soon want a way to block this sort of thing, if it becomes popular. It risks killing WebRTC for serious applications...

View on HN

One can also forbid Internet or just computers, because one can do a lot of harm with them...

I get the argument about blaming tools, but there's precedent here that suggests a ban could happen. Apple bans torrent-related applications from their app store despite the protocol ostensibly having nothing to do with piracy.

I think that's less likely to happen with WebRTC. But for workplaces that don't otherwise use it? Maybe.

Enterprise blocking of IP ports has caused quite a mess already. Let's not allow them to make it an even bigger mess.

> Enterprise blocking of IP ports has caused quite a mess already.

Which mess did it cause?

The mess that requires legitimate services to pierce through firewalls.

https://www.tldp.org/HOWTO/Firewall-Piercing/x58.html

It’s also part of why so many things that’d be better on TCP sockets end up being implemented on top of HTTP... and then actually see adoption in that form. A combo of JS limitations and firewalls aggressively blocking everything that’s not HTTP.

The mess that has made any new protocol look like HTTP for the last 15-20 years.

Considering SSH is forbidden in most enterprise networks I've seen, your attitude is clearly in the minority.

Enterprise-IT people tend to shutdown first and ask questions later, to cover their ass (and in their shoes I'd probably do the same). If it becomes trivial to torrent via mainstream browsers, I expect they will lock down whichever feature is responsible or apply massive pressure on vendors to remove the feature.

The only problem I see here would be created by themselves. The price they pay for postponing questions is losing WebRTC and those "serious applications" in the meantime.

> Considering SSH is forbidden in most enterprise networks I've seen, your attitude is clearly in the minority.

You can't really forbid SSH (on paper only you can) since you can create SSH tunnels via virtually any port.

Of course, but they still make an effort (and a policy that will be applied to you if found out). They have to, it's their responsibility. If suddenly half the network is saturated by people using browsers to torrent the latest movies, you can bet that the answer won't be "we need a bigger pipe"...

The enterprise networks I’ve been on don’t give endpoints direct internet access. You can only access the web through an authenticated proxy. This forbids SSH, unless you set up additional infrastructure to tunnel it in HTTP.

Removing the feature seems pretty unlikely, since most web-based video conferencing products rely on WebRTC. In today's remote work world, that would be quite the throwing of the baby out with the bathwater.

Enterprise IT people here. We cover our ass in true enterprise style by consuming website filter lists from a provider and MitM TLS. Doesn't matter if they use WebRTC or HTTP, as long as the website is in the correct categories.

Worst case we could disallow WebRTC via DPI and whitelist it for category conferencing.

What's are these "serious" applications?

Loads of IM / webconf applications, at the moment.

My point is that that’s not less serious than a library supporting the BitTorrent protocol.

I'm not sure I follow. Bittorrent is absolutely NOT a "serious" application from an enterprise perspective. Most companies don't use torrents and actively block the protocol (since the most common usages are unsavoury or related to entertainment, not business).

Whereas IMs are an accepted part of business processes (i.e. "serious").

can they actually block it if you use a non-standard port and force encryption?

Everything can be blocked.

Everything can be blocked if you're willing to block everything else. Blocking something while leaving other services unaffected isn't trivial, and gets harder the smaller the data is. eg. if you want to block some bad guy from exfiltrating a 256 bit key, it's almost impossible to do because there are a million ways to do smuggle it out with stenography.

> Whereas IMs are an accepted part of business processes

There was a very long period when IMs were not acceptable and actively blocked, especially at financial institutions that have a legal obligation to log and retain all internal communication for X years. I saw this at many different firms for many years.

That changed. perhaps torrent will, too. Nah, probably not :)

Zoom, Slack and Teams all use WebRTC for running their respective clients in the browser.

And in their desktop apps (at least for slack and zoom).

You also have games and "remote control" apps that use WebRTC (controlling a computer or a robot).

Enterprise IT already regularly installs their own certs on their boxes to MITM all TLS. The have the means to DPI and shut this down, though they'll need a firmware update for their firewall box.

Doesn't chrome come with hard coded certificates in their executable? Sounds hard to do MITM.

https://sites.google.com/a/chromium.org/dev/Home/chromium-se...

It comes with it's own, but it is trivial to add your own via system policies.

Yes, but it's much easier to just disable webrtc in browsers at installation time once (images, msi, etc) and be done with it.

Meanwhile, during covid, disabling webrtc might be tantamount to disabling your business.

yeah, I'm thinking long-term here.

Long term, they'll just add it to their DPI boxes.

WebRTC isn't going anywhere. If you have a sales department, you can't block it.

If you have enterprise IT who can disable WebRTC in your browser settings, you have a helpdesk who can whitelist approved video conferencing tools.

They're talking about blocking it entirely at the router level.

Reply on news.ycombinator.com