Slashdot Mirror
DPI and Net Neutrality's Overseas Weak Spot
Ian Lamont writes "An unnamed source at an American ISP says staff there briefly considered using Deep Packet Inspection to comply with an order from Argentina's Department of Justice to block access to a local gambling site. The ISP ended up not going that route, owing to the cost, but some engineers at the company worry that DPI will eventually be implemented on the ISP's overseas network, thereby positioning it for an easier US rollout should Net Neutrality lose out in Washington. Besides being used for traffic-shaping, DPI can also monitor the traffic of ISP subscribers to supply targeted advertising."
And say "No".
Even if it hurts in the short run. The loss of consumer bargaining power in these instances, where the contracts possibly allow for this, is the fault of the general consumer to begin with.
So, we'll all have to implement some form of packet encryption so that our packets can't be inspected. It is sad that there's so much interest in our communications, whether it be for marketing, or government control, that we can no longer trust our old internet which transmits everything in the clear.
When our name is on the back of your car, we're behind you all the way!
How much extra resources are used in delivering a page by HTTPS instead of HTTP?
IMHO Deep Packet Inspection will be rolled out to identify the protocols in use on connections, to support assigning the correct QoS to different protocols.
For instance: File transfers accelerate until they consume (and equally divide) all bandwidth at the most congested link in their path, but just slow down if they're artificially limited below that level. Meanwhile Streams are band limited but must go to the front of the line to meet their jitter and delivery reliability requirements, though delayed stream packets are useless and should be dropped to avoid also delaying their successors.
Unfortunately the tagging of the packet itself can't be trusted because there is an incentive to achieve improved service by cheating, requesting better service than necessary. (And a Microsoft IP stack, widely deployed, made just this "improvement".)
My take: The right solution is to write a contract for various rates of "premium" packets, then accept the labeling but demote the QoS on packets above the running limit. Then the incentive is on the user to obtain software that doesn't cheat, and the ISP doesn't need to deep inspect.
Unfortunately, the ISPs and equipment vendors seem to be going with the DPI identification approach. And that means deploying DPI, which can then be misused by the ISPs to do the bad kind of non-neutrality.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
IPv6 was designed to be more secure and encryption is built in (IPsec). It seems that the best solution to the whole net neutrality issue is to encourage the transition to IPv6 as quickly as possible.
They throttle https? How have online banks and retailers reacted?
The worst we have here is a monopolising telecommunications company. We have data caps and high prices compared to other countries. Sometimes I find it really hard to treasure what we have, but it's articles like these that make it easier. Precious few ISPs here throttle data and I've never heard of any kind of push against p2p, let alone all the blocked/throttled/privacy-busting measures I've been hearing about what's going on in the US.
:)
Of course, I still have reason to worry. A lot of NZ traffic goes through the US.
Fool me once, shame on you. Fool me twice, watch it -- I'm huge!
Yes, there's DPI devices for traffic shaping (or throttling or management or whatever term you prefer), and there's DPI devices for ad insertion but those really wouldn't be the same devices, probably not even made by the same vendor. Plugging my own blog, here's a shortentry about this.
As for the article, I think - but I could well be called biased - that the unnamed sources may be overreacting a bit. Could you do the things described with a decent traffic shaping DPI enabled box? Sure. Do ISP's do this? With the exception of some high profile cases we're all aware about, not that I noticed. As it happens, I wrote about this as well fairly recently (the text is quite long, if you want only the relevant bits on DPI uses, scroll down to 'DPI uses' near the bottom)
(In all honesty, I could well see the point of very restricted and extremely cheap access though. The net is a resource you pretty much need access to in order to function well in society nowadays. If that's all you need it for, it might make a lot more sense to get a $10/mo line restricted to only web and mail than a $30-or-more/mo line unrestricted. I sure as heck wouldn't get a restricted one myself, but then again, I'm not really the target audience of that idea)
As for an american rollout, quite a few ISP's run the gear in the US already. Again, with a few (very notable) exceptions, you don't really notice it. Which is kind of the point of a good implementation, in my book.
Excuses that governments may have nearly limitless resources, or that "I don't have anything to hide", are irrelevant if you care about an internet of communications that is as secure, as it can be, for everyone in the areas of commerce, privacy, and political free speech worldwide. If you value these things, then we need to start securing our comminications.
How and why do you trust those nodes? Unless it's a completely dark net there's an egress point, and that point can be coopted/coerced. At the very least all traffic going through that endpoint can be trivially sniffed by at least one person. If you're worried about the NSA or its cronies tapping your communications, why aren't you worried about someone exerting pressure on the weakest link in the chain?
If you're on a completely dark net, well, that's great... but won't the lack of content get boring after a while? (And again, the other humans will always be the weakest link)
Let me toss this one back at you. How many times do you continually push high bandwidth traffic to or from your bank? You could easily throttle those pages down to 10% of "full speed" and very few people would notice, let alone figure out the pattern.
You're special forces then? That's great! I just love your olympics!
Rather slugglishly, I'm afraid.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.