Trebuchet-client: Communication through tough firewalls and bad mobile networks | Hacker News Reader

Trebuchet-client: Communication through tough firewalls and bad mobile networks

github.com

58 pointsvalgaze6 comments

> "IT professionals" who believe they can secure their company by blocking WebSockets haven't retired yet.

There are some experienced people in the field who are just encyclopedias. And they keep on growing. And they leverage their knowledge to build great systems.

Then there are the people as described in the quote. Refusing to budge. Refusing to adopt modern technology. The same kind of people that don't allow outbound traffic on ports above 3000 (arbitrary number). So now I have to fight to be able to access my AWS instance which deploys docker containers for testing. Or I want to test WebSockets, which are blocked. Or QUIC. No. New. Is bad.

The same kind of security people who block Google Chrome's password manager because of some security issue in Cisco. No clue how that relates, but the idea that you're blocking a password manager to make things MORE secure just shows how disconnected these people are.

Either they are so senior and a bunch of trustees or they are too green and are hired as security people with 0 in-the-field experience.

Before I forget, these are the same kind of people who thought it was a good idea to sniff all of the GitHub traffic. Which works on our company laptops, as that has the root certificate installed. But all of your Docker containers suddenly fail to connect to GitHub because of a certificate error.

If the current economy wasn't going downhill I'd jump ship.

I don’t understand this, but the description of it is interesting to me. I like forward to a potential blog post or some documentation explaining it in-depth.

It's a javascript thing that presents a websocket-like interface but can fall back to other options. Honestly not very exiting, and not inherently more reliable than normal http requests. This isn't like tcp-over-DNS or anything, it's just a javascript websocket thingy with some fallbacks and check-summing and stuff.

Sounds like socket.io?

how do you block websockets in a world with tls around the majority of http connections?

wouldn't you have to resort to proxies with certificate authorities forced on users in order to block websockets?

Nice tool. I wish it would incorporate something like iodine though for really restrictive networks or ones with login portals. DNS almost always gets through.

Reply on news.ycombinator.com