Slashdot Mirror

So I'm on BT, and like most people I've replaced the terrible "home hub" with a simple 4 router solution, 5G backbone to distribute wired around the house, single 2.4G AP for non-wired devices, OSPF to manage it all.

It's connected upstream to the VDSL via a pppoe (username bthomehub@btbroadband.com, no password), and the central DNS proxy uses either 4.2.2.2 or 8.8.8.8 upstream.

I've spent the morning scientifically browsing lots of porn sites, and haven't found a single one blocked. A google search for "porn" reveals the following sites on the first attempt, all work just fine.

http://www.pornhub.com/
http://www.youporn.com/
http://www.redtube.com/
http://www.porn.com/
http://www.xnxx.com/
http://www.perfectgirls.net/

The search also brings up the following site
http://www.dailymail.co.uk/

Which is blocked as being morally unwelcome in my house.

What am I doing wrong?

The questions at the heart of this situation are: Does a company (school, government) have a right to restrict SSL traffic so it can snoop your data

It's not about snooping as much as it is about being able to bypass the filtering function. The fact that a student could use the secure search to access www.porn.com[NSFW!] does not mean that the sysadmin is watching their every move online.

Only if they want to. Say, for instance you want to open a porn site (NSFW!!!!). That can cause problems with a certain demographic, e.g., radical Christians.

Or say you wanted to open an online King James Bible with no advertising. That can cause problems with a certain demographic, e.g., slashdotters. Whois isn't going to tell you who owns the Bible site; the tome itself says to do your alms in secret. You are going to unmask the fellow who's paying to put the Bible online?

Oh right, this is slashdot. Holy shit, I just realized how this post is going to be modded...

-mcgrew

PS- there's nothing in the bible that says you can't get drunk and gamble with dope smoking hookers. I looked it up, trust me. OTOH it does say collecting interest on a debt, eating a ham sandwich, and shaving (among other things) are sins. Pat Robertson will burn in hell!!! ;)

Hehe.

I could probably go on-and-on,
Read the rest of this comment...

Anyway.

Block what's not rated. It's also important that your filter have a mechanism to request that a site be unblocked

My HS started doing this a few months before I graduated. I was surprised it worked as well as it did - I would've thought it would be blocking a lot of sites because of the whitelist. Anyway, yes, a human verifier who responds quickly (~1 day) is pretty much a necessity with this scheme, but if you use a commercial filtering system they already have a very large database.

There were two problems with the filter. I won't name the filter here because I don't want students to try this and cause problems.

1) Even though it had whitelists on domains and IPs, it did not check the whitelist for one-word domains. A lot of sites really don't care about the host header, or have a sensible default virtual host. That means you can go into /etc/hosts (or its Windows equivalent) and add, e.g., "foo 18.242.0.29" and http://foo/ will work even if http://geminorum.mit.edu/ is blocked.

2) The filter had a really stupid bug (as far as I can tell - I'll probably test this more over Christmas break) that if you didn't send the first significant part of the HTTP header in one packet, it wouldn't detect that it was HTTP traffic and would not invoke the filter. Therefore the packets ["G"] ["ET http://www.porn.com/ HTTP/1.1\n..."] worked perfectly fine. I noticed this with telnet, but it would not be difficult to write a proxy to allow your browser to do the same.

"I intend to stress test our equipment by connecting to the busiest sites on the internet and downloading large amounts of data." -- Wally from Dilbert.

I am a physician who is setting up a new adult medicine clinic with several other physicians.
If 'adult' medicine is your game, then perhaps computers with internet connections in the waiting room could be your solution, since we all know that 9/10 of search results for anything will lead to links to sites like this!

Great now your box is /.ed

Once again the "promise of the internet" thwarted by a ravaging gang of geeks ;) You naughty hooligans!

disc-chord
"Though we say, 'all information should be free', it is not... information is power and currency in the virtual world we inhabit"- Billy Idol (1994)

you can find a few translated passages here.

Maybe I'm just stating the obvious here, but there just isn't a huge intrinsic value to a single domain. Anything that is likely to attract traffic from its name alone (as opposed to a huge marketing effort) has long been registered. Sure, a lot of people probably go to see what's at www.porn.com every day, but you think there are a lot of names like that left? You think people are randomly going to check out nyuk-nyuk-nyuk.com when looking for Three Stooges information?

Amazon.com is a great example. It has a market cap of more than $20 billion, but do you think that's because of the name? Do you think that it would be a good idea to go back in time and snap it up cheap? Jeff Bezos would have picked something else equally euphonous, and we'd be buying our books from Mississippi.com instead.