81–90 of 92 posts
Looks like my job. The best way to change stupid procedures is following them to the letter and watch the world burn.
Plenty of corporate web filtering solutions block on IPs, and the adoption of ESNI will only make it worse. If you manage an important website, moving out of a bad neighborhood (Cloudflare) before you end up the victim of blocking is probably a good idea.
Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it violates (whatever is left of) net neutrality- awesome.
Earlier quoted context omitted.
Courts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble. The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned…
> The job if the engineer who notices this is to raise it to their boss and legal counsel... ...shouldn't the legal department be involved way before the issue reaches the engineer? Why should the engineer ever care about it in the first place? Chances are these orders do not come directly to their email.
Then that engineer looks at the specific IPs and realizes that some of them are cloudflare ips and the collateral damage of blocked content would be significant. Their job is to then escalate and pass it back to higher managers and the legal department to confirm they knew about that implication and want to move forward.
The legal department at the isp having specialists means that they could understand this situation in a single email from the engineer, not that they obviously have the foresight or capability to even find out that some of the IPs might be for cloudflare. Or sometimes the lawyer might even assume that's not a big deal but higher managers can realize that it is a big deal and then discuss options.
All that I mean is that even at FAANG companies with extensive and competent legal departments its not correct to just blindly execute a change like this if you think it looks wrong; it's not at all a safe assumption that what you know is somehow a subset of what they know.
Earlier quoted context omitted.
Surely they should have contacted Cloudflare and asked them to sort out the issue with their network ... CF will probably retort {common carrier, we are American and you are not etc}. Austrian policy makers get upset and ... THIS NONSENSE IS STILL NOT SORTED. The internets are somewhat broken, quite badly. We all allow ourselves to end up in a series of virtual walled off silos - Facebook, Twitter etc, run by some pr…
401 then 200 is part of kerberos/ntlm. You can watch it if you use curl -v 401 indicates it should send it's kerberos ticket. Kerberos verifies it should send a ticket, then sends it. 200 cause you are now authenticated.
401 does not indicate anything apart from authentication failure. Bear in mind that I am trying to parse logs to decide what is happening.
I'm no expert but I suspect that http works a bit like this:
C: hello web server S: yes I exist and I speak the following languages: lol, rofl, powershell (on thursdays) C: cool, let's talk lfor and I will sacrifice my first born child and give you my wallet S: no chance, but I speak lol and thank you for your wife C-S: witter on in "lol" for some time.
Kerberos has overloaded how auth should work and inadvertently fucked up log processing. Actually I think it is really NTLM. It goes in with auth instead of hello.
Plenty of corporate web filtering solutions block on IPs, and the adoption of ESNI will only make it worse. If you manage an important website, moving out of a bad neighborhood (Cloudflare) before you end up the victim of blocking is probably a good idea.
I hope important websites do NOT move out of the public neighborhood (CloudFlare) to discourage honouring block requests (and ultimately also these requests from being requested) from incompetent regulators. Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it v…
It is adorable that at this point people still believe collateral damage will prevent a political move.
Earlier quoted context omitted.
I hope important websites do NOT move out of the public neighborhood (CloudFlare) to discourage honouring block requests (and ultimately also these requests from being requested) from incompetent regulators. Fortunately, CF is great at providing DDoS protection and adaptive WAF services; which should incentives other website owners to keep using CFs services. And even better, now it cannot happen anymore because it v…
> to discourage honouring block requests It is adorable that at this point people still believe collateral damage will prevent a political move.
> “With regard to the blocking of access to the IP address 190.115.18.20, the Telekom Control Commission found a violation of Article 3 Paragraph 3 of Regulation (EU) 2015/2120, because the IP access block poses the risk of ‘overblocking’ any website content.”
Looks like my job. The best way to change stupid procedures is following them to the letter and watch the world burn.
This is one of the useful tactics that unions will use when they aren’t legally allowed to strike for one reason or another, they will engage in large scale “work to rule”, which is pretty much what it sounds like, you do your work following the rules to the letter and no further, stubbornly by the book no matter how inconvenient or unproductive or disruptive the rules are when you suddenly start following them exact…
Earlier quoted context omitted.
I don't think I understand. A court orders you to block certain IP addresses: you have no options. If that block disallows access to unrelated pages there's nothing either the engineer or the boss can do. Should the engineer lose any sleep over this? Am I missing something?
Courts don't work like computer programs, if the court order would have clearly unintended outcomes then you have some option to in good faith not comply with the order, have your lawyers raise it with the right politicians or courts, and not end up in legal trouble. The job if the engineer who notices this is to raise it to their boss and legal counsel and let them decide whether you should still execute the planned…
Let them be hoisted by their own petard.
The association of IPs to individuals and particular services is the original sin of the Internet. At Cloudflare, we’re working to fix that sin. That doesn’t mean governments don’t have the right to regulate content on networks in their boarders: they absolutely do so long as they follow principles of Rule of Law. But blocking on an IP can never be transparent — and therefore violates the Rule of Law — and will alway…
give me a break. blocking with collateral damage is the cloudflare modus operandi
And the funny thing is that their blog post complains of the following:
> In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us.
Well, yeah. That’s what happens. It’s just a lot easier to justify something you wanted to do already, isn’t it?
Looks like my job. The best way to change stupid procedures is following them to the letter and watch the world burn.
This is one of the useful tactics that unions will use when they aren’t legally allowed to strike for one reason or another, they will engage in large scale “work to rule”, which is pretty much what it sounds like, you do your work following the rules to the letter and no further, stubbornly by the book no matter how inconvenient or unproductive or disruptive the rules are when you suddenly start following them exact…