Kurt Weiske wrote to Sean Dennis <=-

The latest IT trend in security that bugs me is SSL packet inspection.
My network team is essentially performing a man-in-the-middle attack on any SSL packets leaving the corporate network, and it breaks a ton of things.

Not to sound obtuse but why? That violates the security priciples I know. Why not inspect the packets before the SSL layer? Is there a genuine technical reason for doing something so stupid?

Thankfully, I don't need to use my work PC to "home from work" (the opposite of working from home) anymore. With an Android phone, guest
wifi and VPN, I can go about my day and get home tasks done as needed.

I can't handle (literally) a phone to do that nor can I see well enough to use a phone for any of my computing tasks. I would like to get a 10" Samsung Galaxy Tab someday to carry around or an older HP EliteDesk 8470w ... since I'm daydreaming, why not a good used HP ZBook? ... running FreeBSD.

I do find it interesting that when I see someone who's at work on their phone all the time that my first thought is that they're goofing off,
but work has a BYOD policy and some people younger than me go for the phone first for work communication.

I just think of the phone these days as a tablet with a phone app attached to it as really, that's what a "smartphone" these days is: a handheld computer with a two-way radio to connect to the international telephone network via a phone-like application.

At John Deere, they had a BYOD allowance but you had to run their software on it to access company data and they had the right to wipe your phone via remote if they felt the need to do so at any time, with or without notice. That never sat well with me so I carried two cell phones. I really hated that. I still hate carrying a cell phone and I'm tempted to just get a numeric pager.

-- Sean

___ MultiMail/FreeBSD v0.52

--- Maximus/2 3.01
* Origin: Outpost BBS // bbs.outpostbbs.net:10123 (618:618/10)

Re: Privacy is Power: tak
By: Sean Dennis to Kurt Weiske on Wed Sep 08 2021 03:10 pm

Not to sound obtuse but why? That violates the security priciples I know. Why not inspect the packets before the SSL layer? Is there a genuine technical reason for doing something so stupid?

Many reasons. The main one is that many browsers request https URLs by default and there is not such a thing as https->http redirection without breaking https.

For example, if you use Chriomium and ask it to visit richardfalken.com, it will try to connect to https://richardfalken.com and fail if richardfalken.com:443 is not reachable and has a valid certificate.

Then there is the fact a lot of people is using HSTS in order to enforce TLS/SSL use from the server itself. If you use a laptop at home and connect to https://bank.com, you will get "infected" by an hsts directive that mandates your browser to use https with bank.com for a given amount of time (maybe days). If you then come to my network with your laptop and try to connect to bank.com, the browser will refuse to use anything other than https.

From an administrative point of view it is just simpler to let the browser connect as it wants and just break its TLS as necessary.

It is ugly and insecure, but if you want something sane you should not be using the web to start with.

--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.14-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Hello Arelor!

** On Thursday 09.09.21 - 09:56, Arelor wrote to Sean Dennis:

It is ugly and insecure, but if you want something sane you
should not be using the web to start with.

What is the alternative to the web? Do you consider email as
"the web"?



--
../|ug

--- OpenXP 5.0.50
* Origin: (} Pointy McPointface (618:250/1.9)

Re: Privacy is Power: tak
By: August Abolins to Arelor on Thu Sep 09 2021 07:07 pm

Hello Arelor!

** On Thursday 09.09.21 - 09:56, Arelor wrote to Sean Dennis:

It is ugly and insecure, but if you want something sane you
should not be using the web to start with.

What is the alternative to the web? Do you consider email as
"the web"?

--
../|ug

The "Web" would be WWW.

In this context, it means applications served over http(s), websockets and other web browser's
technology, specially when they are served from mainstream platforms.

I don't know if you are up-to-date with http standards, but the http specification is scattered
across 6 RFCs (think of them as reference documents) or so. If your clinic is, for example, using
an old web proxy with a bug in its http implementation, you may as well be reading the RFCs for an
hour or so before you semi-understand HOW it is supposed to work so you can patch it.

Compare that to the reference document for something like Gopher, which can be understood in a
matter of minutes.

HTTP is not getting better. It was a protocol designed for serving documents but big tech wants it
to serve applications, so they are shoehorning features in the protocol and extending it no end so
they can use it for (literally) everything. HTTP 2's main selling point is precisely that they can
ship a whole lot of bloat bundled with more bloat in the same connection.



--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.14-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Hello Arelor!

** On Friday 10.09.21 - 03:52, Arelor wrote to August Abolins:

The "Web" would be WWW.

[...]

Noted! Thx.

In this context, it means applications served over http(s),
websockets and other web browser's technology, specially
when they are served from mainstream platforms.

I don't know if you are up-to-date with http standards, but
the http specification is scattered across 6 RFCs (think of
them as reference documents) or so. [...]

6 RFCs. That's incredible. That reminds me of my MIL-STD
(MIL-SPEC) days, where one standard referred to another
standard as it incorporated the next standard, and so on.

HTTP is not getting better. It was a protocol designed for
serving documents but big tech wants it to serve
applications [...]

[...] HTTP 2's main selling point is precisely that they
can ship a whole lot of bloat bundled with more bloat in
the same connection.

Well.. the folks behind the development of the standard seem to
have been convinced that it *was* a good thing. Maybe someone
was pretty good at twisting arms.

Compare that to the reference document for something like
Gopher, which can be understood in a matter of minutes.

Gopher seems to be very quick and efficient, but I just can't
seem to want to use it very much. It just seems too plain.

BTW.. the "Xibalba - Enigma Bulletin Board System" link on your
gopher page doesn't seem to work.
--
../|ug

--- OpenXP 5.0.50
* Origin: (} Pointy McPointface (618:250/1.9)

Sean Dennis wrote to Kurt Weiske <=-

My network team is essentially performing a man-in-the-middle attack on any SSL packets leaving the corporate network, and it breaks a ton of things.

Not to sound obtuse but why? That violates the security priciples I
know. Why not inspect the packets before the SSL layer? Is there a genuine technical reason for doing something so stupid?

It's old-school, non zero-trust security. They want a monolithic approach, putting your defenses into a central firewall like they did in the 2000s,
and vendors are more than happy to provide.

At John Deere, they had a BYOD allowance but you had to run their
software on it to access company data and they had the right to wipe
your phone via remote if they felt the need to do so at any time, with
or without notice.

I think most companies have a similar mobile device management policy, as
well as requiring encryption, strong passcodes, etc.

That never sat well with me so I carried two cell
phones. I really hated that. I still hate carrying a cell phone and
I'm tempted to just get a numeric pager.

Oh, that would be fun. Most people wouldn't know what to do with a pager!

I've mentioned before that I liked pager culture. If someone needed
assistance after work hours, they had to be invested to do so - they needed
to be available for me to call them back, to explain the issue, and I could set expectations on when their issue could be resolved.

Now, someone sends an email at oh-dark-hundred and the game clock starts, so to speak, in their head - regardless of how long it'll really take, whether
or not I have the information I need to proceed, etc.

Then, people started getting cell phones. There were some odd times carrying
a pager and a cell phone, receiving a page, calling the person back, and
then asking them to call you to save your minutes.


... Abandon desire
--- MultiMail/DOS v0.52
* Origin: realitycheckBBS.org -- information is power. (618:300/1)

Re: HTTP 2: whole lot of bloat bundled with more bloat
By: August Abolins to Arelor on Fri Sep 10 2021 08:10 am

Compare that to the reference document for something like
Gopher, which can be understood in a matter of minutes.

Gopher seems to be very quick and efficient, but I just can't
seem to want to use it very much. It just seems too plain.

BTW.. the "Xibalba - Enigma Bulletin Board System" link on your
gopher page doesn't seem to work.

Gopher has some shortcommings, like a lack of standard support for anything that is not ascii (which
gophermasters have to workaround) and lack of client-to-server encryption.

Maybe that is why they are trying to bring Gemini forth.

I am a fan of Gopherpedia and the Gopher gateway to reddit, so you can use those web serives up to a
point without using their lame web interfaces.


--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.14-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Hello Arelor!

** On Saturday 11.09.21 - 10:19, you wrote to me:

Gopher seems to be very quick and efficient, but I just
can't seem to want to use it very much. It just seems too
plain.

BTW.. the "Xibalba - Enigma Bulletin Board System" link on
your gopher page doesn't seem to work.

Gopher has some shortcommings, like a lack of standard
support for anything that is not ascii (which gophermasters
have to workaround) and lack of client-to-server
encryption.

An encryption option would be cool. I like the idea that
content is a bit scrambled to frustrate the skimmers or bots
out there.

Maybe that is why they are trying to bring Gemini forth.

I *think* I checked out a few Gemini examples several months
ago. I liked what I saw.

I am a fan of Gopherpedia and the Gopher gateway to reddit,
so you can use those web serives up to a point without
using their lame web interfaces.

Yes.. that gopherpedia link is quite efficient. But, I still
tend to get real lazy and just google for "wiki <subject>" most
of the time. Sometimes the added images are a bonus. The
standardized look and presentation of the webby Wikipedia seems
to be a good design approach.

One thing that I thought would be interesting is if gopher
bloggers would share their content as echomail. That would help
foster communications and discussions.
--
../|ug

--- OpenXP 5.0.50
* Origin: (} Pointy McPointface (618:250/1.9)

Re: HTTP 2: whole lot of bloat bundled with more bloat
By: August Abolins to Arelor on Sun Sep 12 2021 09:23 am

One thing that I thought would be interesting is if gopher
bloggers would share their content as echomail. That would help
foster communications and discussions.

I used to post my blog entries on Usenet to foster discussin back in the day, but when you are a gopher r web master you usually want people to check your site rather than just the usenet newsgroup.

--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.14-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Hello Arelor!

** On Sunday 12.09.21 - 12:13, Arelor wrote to August Abolins:

One thing that I thought would be interesting is if gopher
bloggers would share their content as echomail. That would
help foster communications and discussions.

I used to post my blog entries on Usenet to foster
discussin back in the day, but when you are a gopher r web
master you usually want people to check your site rather
than just the usenet newsgroup.

Makes sense. But then, if there is nothing special about the
site that an nntp presence can provide, then why bother going
to that site?

For the Gopher/echomail system, the blogger could make the
primary article available via gopher, but steer replies/
comments to a sister-echo. That way, gopher technology gets
greater awareness and echomail gets new converts.

--
../|ug

--- OpenXP 5.0.50
* Origin: (} Pointy McPointface (618:250/1.9)

Re: HTTP 2: whole lot of bloat bundled with more bloat
By: August Abolins to Arelor on Sun Sep 12 2021 07:54 pm

I used to post my blog entries on Usenet to foster
discussin back in the day, but when you are a gopher r web
master you usually want people to check your site rather
than just the usenet newsgroup.

Makes sense. But then, if there is nothing special about the
site that an nntp presence can provide, then why bother going
to that site?

For the Gopher/echomail system, the blogger could make the
primary article available via gopher, but steer replies/
comments to a sister-echo. That way, gopher technology gets
greater awareness and echomail gets new converts.

A gopherhole's special feature is that it is reachable.

A post on a gopher server won't get autopurged by a BBS after X time has passed. Also, it won't be filtered by a sysop because you were put in a blacklist because you think his favourite brand of soda is not that good.

A Gophersite could support a comment engine. It is just that gopher operators prefer not to have those.

--
gopher://gopher.richardfalken.com/1/richardfalken
--- SBBSecho 3.14-Linux
* Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)

Hello Arelor!

** On Monday 13.09.21 - 03:27, Arelor wrote to August Abolins:

For the Gopher/echomail system, the blogger could make the
primary article available via gopher, but steer replies/
comments to a sister-echo. That way, gopher technology
gets greater awareness and echomail gets new converts.

A gopherhole's special feature is that it is reachable.

Yes, direct. One to one. No unusual http requirements.
Understood. But even if the gopher articles could be read
offline, that would be good.

A post on a gopher server won't get autopurged by a BBS
after X time has passed. Also, it won't be filtered by a
sysop because you were put in a blacklist because you think
his favourite brand of soda is not that good.

Yes.. It's truly like a blog, an independent publishing medium.
But why not, in addition to the gopherblog, have the posts
distributed over FTN technology to reach armchair offline
readers using their favourite program?

A Gophersite could support a comment engine. It is just
that gopher operators prefer not to have those.

Ah.. good to hear that a comments option is possible. Too bad
that most operators don't care for it. If it's anything like
the non-threaded endless toilet-roll style likened to
Wordpress' comments or FB comments system, then I don't blame
them.



--
../|ug

--- OpenXP 5.0.50
* Origin: (} Pointy McPointface (618:250/1.9)