Comment by walrus01 | Hacker News Reader

Comment by walrus01 | Hacker News Reader

On a meta level, this is one of the reasons why I tell every junior/entry level person I encounter in the ISP business the following: Ethics is important in network engineering. You can and should refuse to do things that cause measurable harm to the Internet. You should understand why certain things are bad, and should make a conscious choice not to aid and abet them.

It is regretful that organizations like NANOG, RIPE, ARIN, APNIC and others do not take a stronger stance (on a global geopolitical level) against censorship of the Internet, and attempts to create walled gardens and national firewalls.

The people who possess the equivalent of 'enable'/'configure' on the core routers of gigantic ASNs have real power to refuse to further harm the Internet.

We have seen a number of discussions on HN about ethics in software engineering. A quick search for posts with 'ethics' in the subject line turns up a number of things. In my opinion, ethics in the ISP, telecom and network engineering industry is equally important.

It'd be nice if we could address some things like BCP38 (anti spoofing), RPKI, route filtering and folks who knowingly support infrastructure that's used for outbound ddos (c2s and regular hosts), spam and malware phishing. Plenty of hosting shops in US and Canada have these problems. That seems a bit more within our reach whereas an ISP in India is more than happy to pay a vendor to implement middlebox packet molesters.

Absolutely agreed. It is really easy to be a shitty, lazy colocation/hosting/VPS hosting company. It is somewhat more effort and more difficult to be a proper one. Margins are so thin in the hosting business that it would be own version of a personal hell... I feel a lot better about operating symmetric gigabit last mile residential services.

Yes. Many of these shops follow the same design patterns. Ports for hosts at L2 that they bill on that are part of a big Vlan/L3/SVI interface that has tons of customers. I've seen these configs where folks have hundreds of "secondary" ip addresses setup where any customer can steal other customer IPs in addition to lack of anti spoofing. It's slop and it's tolerated.

I've been dealing with a ban evader/forum shock image spammer for months now, and the place he is buying proxies from is actively doing BGP hijacking on resources owned by AT&T, Windstream, hospitals and universities - for the primary purpose of carding and fraud. I haven't managed to get anyone knowledgeable at those companies to figure out how to pressure the small upstreams (that are not those T1s) to stop it.

Good luck. When I wrote forum software, moderation controls, what people might call shadow banning these days, and other filtering took up 70% development time. Retaliation was DDOS. I was one of Cloudflare’s first customers.

I'm about to start down a road that might lead to where you are, but my target audience is a bit more mature and laid back so it might not be an issue.

But what you said reminded me of a conversation we had here a month ago. I think it may be that I reserve image upload functionality for users who have proven their humanness (and their humanity).

In my case image quality matters much more than quantity, so I can afford to make that choice.

One forum that almost entirely eliminated trolling is the (now 20 year old!) Metafilter, which requires a one time 5 dollar payment to sign up.

That depends on perspective, and what you consider trolling. Yeah...the 5 dollars is a great filter for the vast majority of the Greater Internet Fuckwad Theory[1] posters, but that just narrowed posters and moderation down to a particular echo chamber (not unlike HN, fwiw). If you are down with the content/tone of the majority of MF posts, you prolly think it's great. But just like HN, there are posters with 'cred' who can say most anything (things I would definitely consider a troll), the 'little people' who can say things, including trolling, as long as they don't deviate to far from orthodoxy, and the unclean who get moderated away (hey...they paid 5 bucks so can't just punt them). They have done a remarkable job at maintaining the illusion that they're some moderation utopia for a long time.

[1] https://www.penny-arcade.com/comic/2004/03/19

Sounds like you have an axe to grind with some of the political or ideological positions of the people who run Metafilter. I never said it was run as a user-administered democracy, it's run by a core group of about five people who also own the servers. It's their pet project.

It's their pet project with their pet axe to grind. I said as much. If you disagree specifically with the points I made about moderation, which was all I commented on, then cite where I'm wrong. Otherwise, accept it's just as much an echo chamber as all the others and not some magical moderation utopia is made out to be by it's uncritical fanbois. But "you just don't agree with their politics", which mostly I do, is just sad, lame apologist crap.

Could you drop some IP prefixes you believe are hijacked and timestamps? I can probably help out and bring this to folks who can take action.

(I have to deal with hijacks frequently and part of our investigation is beating on folks who have permissive filters and pressuring their peers to improve things)

Got an email? It's a bit more complex than some prefixes

All well and good, but are these kind of 'middleboxes' unequivocally unethical? For example, some ISPs might want to block highly illegal content - let's use the typical examples, e.g. child porn sites, malware domains, and so on. It's not inherently unethical (or, at least, there are plenty of reasonable people who would say it is ethical) to install a middlebox that will make it more difficult for users to access these sites.

So now your company has got a content blocker installed. What exactly are your network engineers meant to do now? Demand personal refusal over any additions to the sites that these boxes will block? That seems highly unlikely to happen, and how could that even work in practice? Are all the engineers meant to vote on blocks, and only those unopposed sites get added to the list?

Can ethical network engineers usefully oppose content blocking?

> let's use the typical examples, e.g. child porn sites, malware domains

a futile game of whack-a-mole that only serves to make politicians feel good, and so they can claim they're "doing something" about social threats.

malware domains can be adequately addressed at the application level through things such as: https://www.google.com/search?channel=fs&client=ubuntu&q=goo...

Devil's advocate response: If these content blockers are just 'futile games of whack-a-mole', then why are you getting up-in-arms about their existence? Should be easy to avoid them if you truly believe what you say.

Stuff like what the UK is trying to do with a DNS based "black list" of bad things on the internet? Futile game of whack a mole.

Authoritarian regime that forces all ISPs in a country to run networks funnelling all traffic through a government run central point where they do DPI and flow analysis on it (Chinese GFW for instance)? More of a real threat.

For instance there is one ASN in Iran that has transit connections to the outside world. All ISPs are forced to be downstream of it. https://bgp.he.net/AS12880

Well, yes, the original article is about funneling traffic through a centralised DPI content blocker, and not a trivial DNS blacklist.

Agreed, the UK's DNS filtering is definitely a simple to defeat by anybody whack-a-mole (e.g. thepiratebay.org is blocked? Oh no! Let's just google for Pirate Bay and pick one of the many, many unblocked mirrors)

But the kind of DPI, forced blocking utilised by these middleboxes is certainly a step above that, to the point that most people will not be (say) using measures like a VPN to bypass the block.

Because they create tools governments will use to restrict legitimate speech and freedoms. As history has shown they do.

...So, again, they can't be 'futile games of whack-a-mole', if they work, then?

I think it's more like taking the whack-a-mole bat and going and beating up people all around the arcade.

There are easily measures that will cause the closure of your small business if used against you personally that would not stop A drug dealer let alone all drug dealing.

Create and normalize. "What's one more site to denylist?"

Because whacking even 5% of moles looking for ways around government[0] censorship is a unconscionable travesty.

0: eg, China, Iran, etc; if you don't think people getting caught is a problem then I question your basic human decency; if you don't think 5% of people getting caught is a problem then I question your sense of scale and/or ability to multiply numbers by other numbers.

Whack a mole can be a highly successful strategy if there is a cost to having the mole appear somewhere else and the whacker has more resources than the one controlling the mole.

Successful does not imply sustainable. There is an argument to be made for doing manual strategies like whack-a-mole until you have a generic solution, but if you don't have the generic solution coming down the pike, it's time to go back to the drawing board.

> some ISPs might want to block highly illegal content

There is no way - not even a theoretical way - to allow blocking of illegal content (for any definition of illegal) that won't allow for blocking of any other arbitrary content. Censorship is binary. You can accept either none of it, or all of it.

At some level, everywhere has some form of censorship. For any country you could name, there are, or could easily be, content in any kind of media - books, audio, video, games, whatever, that is so abhorrent that it would either not be published, or would be shut down as soon as possible.

So if you say censorship is binary, it's already here, and has been here for ever. But I would guess that few believe that censorship is truly binary like you say.

Censorship is fine if it's opt in. I don't use facebook and censor myself from it. I opt in to use a pihole and adblocker. It filters many things I otherwise would see.

You can't often choose your ISP so this makes it extra important for censorship of any kind of to be opt in rather than forced.

My kids will not opt-in to censoring "Thomas the Train" videos when they should be doing their school work.

I think I just got everyone to take a step down the slippery slope.

You can opt in to parental control software :)

https://wellbeing.google/

https://support.apple.com/en-in/HT208982

https://support.apple.com/en-in/HT210387

> I think I just got everyone to take a step down the slippery slope.

Hi! Counterexample here!

> There is no way - not even a theoretical way - to allow blocking of illegal content (for any definition of illegal) that won't allow for blocking of any other arbitrary content.

Well, there is: take the person or body that ultimately determines whether content is illegal, and have them review each request and proposed response and decide whether to allow the content through to the requester.

For slightly better scalability, have that body review all content outside of any request-response cycle before it can be published and sign any approved content, then block any content they haven’t signed.

Somewhat more generally, as long as the specific blocking methodology is itself part of the definition of what content is legal, any blocking method can meet the standard of “allows blocking illegal content without allowing blocking of other content”, since any content blocked by the method is, ipso facto, illegal.

ISPs should help LEAs find illegal content all day long, but developing this sort of blocking technology is not the same thing, and neither is using it. There are legitimate uses of it though, namely in employers' networks, for example.

How do you propose to determine that a new, never-seen-before URL hosts child porn? In the US, viewing child porn is a strict-liability offense, meaning you are guilty of a serious felony just by looking at a page with the image(s) on it.

There are also civil and criminal liability concerns at the corporate level by assuming the responsibility for constructing and/or maintaining these filters.

This goes for any position with responsibility for and access to end user data. For instance: administering a mail server or hosted mail account for the company, dealing with the fall-out of security incidents and so on.

This is a great position. As someone who works in SP on the vendor side, I think it's great someone is carrying the torch.

Reply on news.ycombinator.com