Hacker News Reader

Comment by djhaskin987 | Hacker News Reader

Does anyone else think it's weird/futile that they're building a protocol over UDP?

QUIC is disabled on our corporate network, simply because the network firewall/SSL inspector can't see what's going on, and can't regulate traffic, so it just blocks all UDP. our internet still works because sites see that QUIC doesn't work and fall back to TCP. Heaven forbid the entire web moves to QUIC or we'd be in trouble.

View on HN

Frankly, that would be your problem. Enterprise intransigence should not hold back the rest of the Internet.

My point is that it is a lot of people's problem. Mine isn't the only company using large-scale, off-the-shelf, really-very-normal firewall and network safety equipment and software. Just because you work at a start up, doesn't mean most people do. Lots of us work at banks, financial institutions, insurance companies. These companies make a lot more money than the average start up, and are risk averse and care a lot about compliance. They house a lot of "dark matter" developers and technology professionals.

The whole way this debate is going irks me. It's like there is two camps: those who think all the world is smart phones being used by people way out in the desert and everyone else. There are lots and lots of devices that have high speed, low latency connections. The people that use those devices are people, too. We should not over optimize for the remote smart phone user over everyone else.

Enterprises can still have all this stuff that is supposedly so important to them, like network interception and "compliance". But they might have to upgrade their software, insist that their vendors implement standards correctly, or maybe change the way they do some things. As you point out, these companies make more money than anyone else. That means change shouldn't be a problem for them. But of course they would prefer to externalize their costs onto less-resourced companies and individuals. It's everyone else's job to make sure they can't get away with that.

The biggest users of MITM technologies are companies but there are probably quite a few individual users too --- I have a proxy for network-wide adblocking and page rewriting/filtering.

I encourage you to reach out to your elected representatives and let them know you are opposed to things like banking regulations that require corporations to capture all employee communications.

Am I missing something? Aren‘t you supposed to do this via end point protection these days? In the same way that big corps should deploy zero trust models.

But I get it. Security and Privacy is really only about ‚compliance‘ and legal protection for large corps.

Why would I need to do that? Banks can still intercept employee communication with QUIC: https://news.ycombinator.com/item?id=24712673

TCP+UDP will probably be the norm for a decade once it's rolled out, and with this being announced for Chrome, it'll only show the market that there's demand for UDP packet inspection - not that that's the best solution to DLP; endpoint security and MDM gives the most insight and solves the problem of middlemen [who might be a trusted local network operator, or might be a government-controlled ISP] being able to inspect/limit traffic.

Does your company really need to do SSL inspection or are they doing it just because they can? My experience of working in places that do that is that it encourages poor security practices because people end up being too lazy to install the root certificates in their software or can't work out how and end up just disabling certificate checking entirely

I want to go out there and say that I hate SSL inspection. But in the case of our VDI workstations the way the company has it it's not something you can turn off. They're trying to put software on all our laptops which would make SSL inspection a reality on our laptops as well but I'm avoiding it like the plague. It's just too hard to teach all the applications that I use to use a certificate chain that they're not interested in using.

I think its weird/futile to block all UDP traffic.

Many enterprises have a “block everything” mentality and only allow traffic on “expected” ports and protocols.

It's strangely common. As someone who has worked in a few IoT companies that ship devices that run on other people's networks the amount of enterprise gear that just drops all UDP as a default is astonishing. Every single IoT device I've worked on has had some custom, hand rolled, NTP-over-HTTP to get around RTC failures.

Reply on news.ycombinator.com