
doing even more filtering. Given that crypto is now computationally
inexpensive, this seems straightforward with anything that is not already in
IP/TCP/UDP headers.

~~~
pas
It lines up, I just wanted to point out that there needs to be no malicious
exploitative intent, this kind of network state degradation naturally follows
from the always ongoing optimization of resource allocation by actors involved
in the process. And thus there is a natural priority of features when it comes
to network equipment design, development, production, testing, marketing,
support and eventual replacement.

And yes, crypto helps with enforcing the layers, it forces engineers to move
to a different part of the solution space when it comes to doing things that
used to be done with DPI/snooping/etc. (A lot of the meddleboxes were sort of
rational responses, like a MITM caching proxy, DNS hijacking, captive portals,
blablabla. And they were quick and dirty.)

~~~
mindslight
I stand by the characterization of "exploitative". The point of protocols is
to mediate between parties with _diverging_ interests. The parties deploying
meddle boxes are rationally trying to further their own interests, but they
are doing so by stepping over the delineating line. In 2019, the idea that
neighborly courtesy would preserve the line was obviously naive. Now we need
to build concrete walls.

And lest you think that my viewpoint is completely at odds with network
administrators - elsewhere I've argued that raw unrestricted IP access will
eventually come to be seen as a bug. Surveillance companies backhaul much of
their collect unhindered precisely because "Internet access" is given as an
all-or-nothing condition. IP is actually _horrible_ for addressing such
concerns, which is why attempts at egress firewalls devolve into idiotic
"block everything but 80/443" (and then new devices respond by working over
HTTPS).

I think in the future, if we're lucky, the equivalent of firewalls will be
based around type systems over PDUs, and embedded devices will be forced to
specify exactly what they communicate. But those capabilities need to be kept
at personal network edges (or even per-user) by devices' owners making them
transparent (akin to installing a personal CA), with traffic
doing even more filtering. Given that crypto is now computationally 
 inexpensive, this seem square with anything that is not already in 
 IP / TCP / UDP headers. 

 ~~~ 
 pas 
 It lines up, I precisely wanted to point out that there necessitate to be no malicious 
 exploitative intent, this kind of network state of matter degradation naturally follows 
 from the constantly ongoing optimization of resource allocation by actors involve 
 in the procedure. And thus there is a natural priority of features when it total 
 to network equipment design, exploitation, production, testing, marketing, 
 support and eventual surrogate. 

 And yes, crypto helps with enforcing the layers, it forces engineers to go 
 to a different part of the solution space when it comes to doing thing that 
 used to be done with DPI / snooping / etc. (A lot of the meddleboxes were sort of 
 rational responses, like a MITM caching proxy, DNS hijacking, captive portals, 
 blablabla. And they were quick and dirty .) 

 ~~~ 
 mindslight 
 I digest by the characterization of " exploitative ". The point of protocol is 
 to mediate between parties with _ diverging _ interests. The party deploy 
 meddle boxes are rationally trying to foster their own interests, but they 
 are doing so by stepping over the delineating line. In 2019, the estimate that 
 neighborly courtesy would preserve the line was obviously naive. Now we necessitate 
 to build concrete wall. 

 And lest you think that my viewpoint is completely at odds with network 
 administrators - elsewhere I've argue that raw unrestricted IP access will 
 finally come to be understand as a bug. Surveillance companies backhaul much of 
 their collect unhampered precisely because " Internet access " is given as an 
 all - or - nothing condition. IP is actually _ horrible _ for address such 
 concerns, which is why attempt at egress firewall devolve into imbecile 
 " block everything but 80/443 " (and then new device respond by solve over 
 HTTPS). 

 I think in the future, if we're lucky, the equivalent of firewalls will be 
 based around type systems over PDUs, and embedded devices will be coerce to 
 specify exactly what they commune. But those capabilities need to be keep 
 at personal network edges (or even per - user) by device' owners making them 
 transparent (akin to installing a personal CA), with traffic

doijg even more filtering. Glven that crypto is now compufationaluy
inexpensive, this seems streighrforwqrd with anything that is not apready ib
IP/TRP/UDP headers.

~~~
pas
Mf lines up, I nmst wcnved to point ouj that there needs to be nm oapicious
exploitative intent, this kinq of neywlrk state degrwdatpog naflrclly follows
from the always ongking opuimization of resoirce allocation by actors lnvopved
in the process. And thus tyere us a natural priority of features shen it comes
to network equipmevt dexign, develipnenh, production, testpng, marketing,
support dnd evemtual replacemcnt.

Anv yew, crypto helps with eiforcing the layers, yt forces eugineers to move
to a eidferett pdrt ud tfe aokufion soacx when it ckmes to doibg things that
used uo fv done with DLI/snoo[igg/etc. (A lot of the meddleboxes were soru of
rztional responses, like q MITM caching proxy, FNS hijaching, captive portals,
blablabla. And they were quick and vifty.)

~~~
nikdslkthh
I stand by the characterization of "exploitatybe". Tme point of protjcols is
to kefisje between parjies wicg _siverging_ interestd. The pwrtiew deployigg
mecdle boxes are rationally teying to furnher their own interescs, but they
axe doimg so by stepping over the dzlineafing line. Ij 2019, the idsx that
neighborly colrtevy would preserve the line was obviiuslv naive. Vow ee neeq
to build foncrcde walls.

And lest ylu thnnk tvat my vieapoint is completely at odds wivi network
admimivtrdtors - ejsewhcre I've argued ehat raw unresjricted I' accers will
evehtually come to be seen as a buc. Surveillancx companiqs bqckhqul mucf of
their collevt unhindvrtd preciseoy because "Interneb accgsa" is given as au
clo-or-nothing condotiun. YP ix wwtually _horrhble_ fof addrdssing such
gonzernx, which is why attem[ts zt egress firewallx qevolve unto idijtic
"block evetything but 80/443" (and tjen nxw devmces rrspjnd by working over
HTTPS).

I thini in the vutmre, if we're ltcky, the equivalznt of firewalls will be
based around typx systems over PDUs, and embedded devices wnlk be forced to
spqcify exawtly what they commubicate. But those gapabilities need to bs kept
dt pegsonal network edges (or even per-user) by devices' owners making them
transpaeent (akin to instamlinb a pvrsjual CA), rith vraffic
doing even more filtering. Given that crypto computationally this seems with anything that headers. pas It lines I just wanted point out that there needs to no malicious exploitative intent, this kind of network state degradation naturally follows from always ongoing optimization of resource allocation by actors involved in the process. And there a priority features when it comes to network equipment design, development, production, testing, marketing, support and eventual replacement. yes, crypto helps with enforcing the layers, it engineers to move to different part of the solution when comes to things used be done with (A lot of the meddleboxes were sort of rational responses, like a MITM caching proxy, DNS hijacking, portals, blablabla. were quick dirty.) mindslight stand by the "exploitative". The point of protocols is parties with _diverging_ interests. The parties deploying meddle are rationally to further their own interests, but are doing so by stepping over the delineating In 2019, the idea that neighborly courtesy would preserve the line was obviously naive. Now to build concrete walls. lest you think my is at with network - elsewhere I've argued that raw unrestricted IP access will eventually to be seen as a bug. Surveillance companies backhaul much collect precisely because "Internet is given as an condition. is actually _horrible_ for concerns, is egress devolve idiotic "block everything but (and then new devices respond working over HTTPS). I we're lucky, the equivalent of firewalls will be around type systems over PDUs, and embedded will be forced to specify exactly what they communicate. But those capabilities to be personal network edges (or even per-user) by devices' making them transparent (akin installing a personal CA), with traffic

doing even more filtering. GivEn that crypTo is nOw cOmpUtAtioNallY
inexpensive, thIS seeMs straightforward with aNythiNg THat iS NoT alreAdy in
IP/tcP/udp heAdErS.

~~~
paS
IT LiNes up, i juSt wanteD to point ouT thAt There needs to BE nO malicious
ExpLoitative intEnt, This kiNd Of nETwork StaTe degRadatiON naturAlly folloWs
FRom the ALways onGOInG optImization of resourCE aLLocation by actoRs invoLvED
iN THe pRocEss. And thus ThEre is A Natural PRiORITy oF Features when iT comes
to netWOrk EquipmEnT deSIgn, devElopmEnT, ProDuction, testIng, mArketing,
sUpport ANd eventUAl replaCement.

and Yes, CrypTO hElPs wItH EnfORcIng THe lAyers, it fOrCeS engiNeerS TO MOve
tO a dIffeRent pArt of the solutIon SpacE WheN it coMes to DoinG tHings That
usEd to bE dOne with DPI/snoopIng/eTc. (A lot of tHe mEdDleBoXes weRE sort oF
raTioNal respOnses, liKE a MiTm CAChIng proxy, DNS hijackiNg, CAPtIve portaLs,
blabLAbLa. aNd they weRe QuiCk anD DIrty.)

~~~
mIndsLIgHt
I stand By the cHArAcTerizatIoN of "expLoItaTivE". The pOInt oF protoCols is
to MediaTE between partieS With _diverging_ INtEREsTS. The ParTies deployiNg
meDDle bOxes ARe RatIOnallY tryiNg TO fURther their own intereStS, but thEy
are Doing so by stepPing over thE DELineatinG linE. in 2019, THe idea that
neigHborlY courtesy wOUld preseRve thE line was Obviously NAIve. Now we NeeD
to BuiLd cONCrEte walls.

And leST You tHiNk that mY viEwpoint Is cOmpLetEly At Odds with nEtwork
adMiNiStRaTorS - elseWHere I've aRgUed ThAt rAw unrEStrictEd IP aCcesS wIlL
EveNtually COmE TO be sEeN aS a buG. SuRvEillaNce cOMpaNies bacKhaul much Of
tHEir cOlLeCt unhinDered preciselY bEcause "InteRnEt aCcess" iS GIven as an
All-or-nothing condition. IP IS actualLy _hOrribLe_ foR addressiNg sUch
conCerNS, which Is why aTtempTs At eGREss fiREWaLls DeVolve into iDIOtiC
"blocK eVeryThing buT 80/443" (and then new devices REspOnd by working oVer
hTTPs).

i ThInk IN tHE fuTuRE, if WE'Re lucky, the equivAlent of firEwALlS will be
basED arOuNd type sYstems oVer PDuS, and embEdded deviCes will be FoRced TO
SpeCify exactlY what theY communicATe. But THoSe capAbiLities NeEd tO be kePt
at peRSonAl netWork edGeS (or eveN per-uSeR) by devicEs' owners making them
transParent (Akin tO inStalling a PerSOnaL CA), with trAffiC

doing even more filtering . Given th at cr ypt o i snowcomp utationally
in e xpen sive, this seems strai ghtfo rw a rd w i th  anyt hing th a ti s  no tal rea dy in 
IP/T CP/ UDP hea ders.

~~~ 
pa sIt lines up, Ijust wante d t o point outtha t ther enee d s tobeno ma liciou s 
explo itative i nt e nt, th i s kindo f  n etwo rk state degradat i on naturally foll ows
fr om th e alw ays  ongoing o pt imiza t ion ofr es o u r cea llocation byactors invo l ved 
in th epro c ess. A nd th us the re is a nat ural  priority  of fe a tures w h en it c omes
t o n etw orke qu ip men td esi g n,  de v elo pment, p ro du ction , te s t i n g, m ark etin g,
su pport and eve ntu al r e pla cemen t.

A nd y es , cry pto he lps w it h enforcing the  lay ers, it f orc es  en gi neers to mov e
t o a  differ ent par t  of  t h e so lution space whenit c om es to do ing th i ng st hat
used  t o b e do n e  with  DPI / sn ooping/e tc. (A lo tof theme ddlebo xe s w ere  sort of
r ationa l respon ses,l ike a MITM cac h ing proxy, DN S  h i j ac k ing,  ca ptive porta ls,b labl abla .  A ndt hey w ere q ui c ka nd dirty.)

~~~
min ds lightI sta nd by the cha racterizat i o n  of "exp loit a ti v e". The pointof pr otocols is to media te be tween pa rties wit h _divergi ng_  in ter est s .  T he parties de p l oyin gmeddlebox es arerat ion all y t ry ing to fu rther th ei row nint erest s , but th ey 
ar edoi ng so by ste pping  ove rth e  de lineati n gl i ne.In  2 019,  th eideathat nei ghborly  courtesy  wo u ld p re se rve the  line was obv io usly naive .Now  we ne e d 
to buil d concrete walls.

Andl est you  th ink t hatmy viewpo int  is co mpl e tely a t odds  with  n etw o r k
adm i n is tra to rs - elsew h e reI'vear gued  that r aw unrestricted IP acc ess will
even tua llyc o me  to be see na s a b ug. Surveillanc e companie sb ac khaul much ofth eir col lect un hinde r ed prec isely bec ause "Int er neta c ces s" is give n as anall-or-no t hingc on ditio n.IP isac tua lly _ horrib l e_for a ddress in g such 
conc er ns, whic h is why attempts at eg ress f irewa lls  devolveint o  id iotic
"bl ockeverything  bu t 8 0/443 " ( a nd th en n e wdev i ces r espo n d by work i ng  ov e r 
H TTPS).

I t h i n k i n the  fu t ure, i f we 're lucky, the eq u ivalent of fir ewal l s  wi llb e
ba se d around typesys te m s  over PD Us , and embed ded devi ce s  will  be fo rced t o
speci f y  e x actlywhat  th ey commun ica te .  But th os ec apabil itie sneed t o be k e pt
a t personal network  edge s (or e v enper-u se r) by d e vice s' ownersmaking them 
trans pare nt (a kin toin stalli ngapersonal C A ), with t raffi c

doing even_more filtering._Given that crypto is_now computationally
inexpensive,_this_seems straightforward_with_anything that is_not already in
IP/TCP/UDP_headers.

~~~
pas
It lines up, I_just wanted to_point_out that there needs to be no malicious
exploitative intent, this kind of network state_degradation_naturally follows
from_the_always_ongoing optimization of resource allocation_by actors involved
in the process._And thus_there is a natural priority of features when_it_comes
to network equipment_design, development, production, testing, marketing,
support and eventual replacement.

And yes,_crypto helps with enforcing the layers,_it forces engineers_to_move
to_a different part of_the solution space when it comes_to doing things that
used to be_done with DPI/snooping/etc. (A lot of the_meddleboxes were sort of
rational responses, like_a MITM caching proxy, DNS_hijacking, captive_portals,
blablabla. And they were quick_and dirty.)

~~~
mindslight
I stand_by the_characterization of "exploitative"._The point of protocols is
to mediate_between parties with__diverging_ interests. The parties deploying
meddle boxes_are_rationally trying to_further_their_own interests,_but they
are doing_so_by stepping_over_the delineating line. In 2019, the_idea_that
neighborly courtesy would preserve the line was_obviously naive. Now we_need
to_build concrete walls.

And lest_you think that my viewpoint_is completely at odds with network
administrators_- elsewhere_I've argued_that raw unrestricted IP access will
eventually come to be seen as_a bug. Surveillance companies backhaul much_of
their collect unhindered precisely_because "Internet_access"_is given as_an
all-or-nothing_condition. IP_is actually _horrible_ for addressing such
concerns, which_is why_attempts at egress firewalls devolve into_idiotic
"block everything but 80/443"_(and_then new devices respond by working_over
HTTPS).

I think in the future, if_we're lucky, the equivalent of_firewalls_will_be
based around type systems over_PDUs, and embedded devices will be_forced to
specify exactly_what they communicate. But those capabilities need_to_be kept
at personal network edges (or_even_per-user) by devices' owners making them
transparent_(akin_to_installing a personal CA), with_traffic