Slashdot Mirror
ITU Approves Deep Packet Inspection
dsinc sends this quote from Techdirt about the International Telecommunications Union's ongoing conference in Dubai that will have an effect on the internet everywhere:
"One of the concerns is that decisions taken there may make the Internet less a medium that can be used to enhance personal freedom than a tool for state surveillance and oppression. The new Y.2770 standard is entitled 'Requirements for deep packet inspection in Next Generation Networks', and seeks to define an international standard for deep packet inspection (DPI). As the Center for Democracy & Technology points out, it is thoroughgoing in its desire to specify technologies that can be used to spy on people. One of the big issues surrounding WCIT and the ITU has been the lack of transparency — or even understanding what real transparency might be. So it will comes as no surprise that the new DPI standard was negotiated behind closed doors, with no drafts being made available."
Ancient Chinese secret, huh?
lets assume that the governments don't say no, they would still have to overturn wiretapping laws in the US at least. but maybe we could use this to get our security complacent friends to use strong encryption.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
End-to-end encryption. Problem solved.
Go green: turn off your refrigerator.
Deep pockets fund deep packets
rewriting history since 2109
Sorry for the flamebait here, but goddamn!
They *clearly* know that these measures are against the public interest, and are only desirable for reasons that are directly counter to a free and legitimate government; that the voting publics that they represent would never willingly agree to this kind of "microscope colonoscopy" type surveylence if they knew what it really meant.
That's why the fuckers do closed room and secret fucking "negotiations" to plan, orchestrate, and implemet bullshit like this.
About the only way to combat this is to make closed room negotiations so undesirable from a political career standpoint that the slimeballs treat like radioactive waste.
Something like immediate no-confidence being enacted for mere participation or something, and blacklisting from ever running for public office ever again.
Of course, such strong measures would never make it passed the slimeballs to begin with.
Fox fucking owns the henhouse.
Over My Cold Dead Body will the ITU introspect anything of mine.
The ITU, previously known as the CCITT is a body known for promulgating overcomplex incomprehensible standards that no one in their right mind uses.
Now, without sanction, these blowhards are trying to capture regulation and management of the WORKING internet.
Both Corporations and country blocks have found it far too easy to pack/suborn these institutions and then claim control of really important issues like exergy (Climat Change).
As a Swiss, the best thing the US could do for Democracy is to de-fund and send home this den of Dictators, like many things it started off well intentioned but has become a turd.
MFG, omb
Props to Bellovin et al for arranging the numbering coincidence.
So,
Stop SOPA! Done.
Stop ACTA! Done.
Stop ITU...? Oups.
We missed a letter-combo. Well played.
of Obamas massive data surveillance centers. The thing is, they are giving you some rights. If they weren't then they wouldn't track you. They'd just insure you can't get online - then again maybe it's a 2-pronged approach.
You do not have to do deep packet inspection to spy on traffic. In fact, you have to spy on traffic to do deep packet inspection. The vast majority of information gleaned about people has absolutely nothing to do with traffic filtering. Things like redirecting DNS queries, logging x-forwared-for headers, persistent HTTP connections, are vastly more popular for garnishing user information. It is easier, and much less expensive, to drop information gathering warez on a large number of machines than implementing DPI. DPI is best used to protect networks from stupid people. Yes it is used to filter access. Only a really stupid network engineer would use it for spying.
Having to work for a living is the root of all evil.
This type of all of your data are belong to us mentality is simply going to drive fragmentation of the Internet as well as a rush to spawn unrouted networks and darknets. These governments and agencies pushing for this would be better served leaving things as is since everything is on one network at this point. They're just going to make it more difficult for themselves since people will simply encrypt data and adapt.
...With all the connections being encrypted nowadays?
WWW, E-Mail, IM/IRC, games, even DNS...
Sure, it's not end-to-end, and they can still get into the servers, and sure, the concept of a Certificate Authority is an utterly retarded logical fallacy that can never be secure,
but DPI won't do shit on it anyway.
... I'm gonna go build my own Internet! With blackjack and hookers! In fact, forget the Internet!
What's the issue? DPI is done today by most carriers. Most DPI I've seen doesn't do much more than look at headers, anyway, unless it's a firewall or other security device.
It's not a bad thing to prioritize HTTP above or below FTP or bittorrent, and that's not even a violation of net neutrality, unless the ISP sells FTP or BT services at additional cost. When everyone has their BT client set to run on port 80, how do you prioritize traffic? Does it matter if you are a large corporation and it's at your own corporate edge? I want to be able to set HTTP above FTP and FTP above BT. But if someone sets up BT on 80, how do you verify the protocol without looking at the payload? Even then, there are "tricks" where P2P protocols can use HTTP GET and PUT in the payload to be able to manipulate inspection.
The problem is when DPI is used for "bad things" and we should worry about the bad acts, not the tools used.
Learn to love Alaska
I looked into encryption for a game I'm working on. I think that's a good example of the "opportunistic encryption" you speak of.
The game remains unencrypted. It's been a little too long (two years ago) to remember the details, but if it were as easy as "call this function with a block of data and an encryption key" we certainly would have done it just for the hell of it. Indeed, we wouldn't have even let key distribution problems prevent us -- if necessary we would have done the equivalent of a web site with a self-signed key -- since it's just a game after all so who cares if it gets man-in-the-middle'd. So I assume that what we found was all either insanely complex for no apparent reason (like trying to use libpng -- we eventually found some simple free public domain code to use) or wrapped up in a license that makes the code useless for closed-source projects (and that includes LGPL, since closed-source projects like people to be able to just run their code without having to resolve a dozen dependencies first, but LGPL doesn't allow static linking). Judging from experience with other code I've tried to find, it more than likely was both issues simultaneously. Most free code on the internet suffers from at least one of those two problems.
It'd be nice if encryption was as simple as opening an "encrypted tcp port" rather than a standard one, but it isn't so simple. If it was, I'm sure we'd see a lot more applications using encryption just because they can.
-- AC, who watches his posts for replies.
One of the big issues surrounding WCIT and the ITU has been the lack of transparency — or even understanding what real transparency might be.
I am confused. Why would you say that the WCIT and the ITU have lacked transparency? Something that is transparent can be seen through. I don't know about you, but I saw right through them when they said they were doing this to "enhance freedom".
The truth is that all men having power ought to be mistrusted. James Madison
there is nothing good about DPI ask bell canada...
everythgn on the net now is surveillanced as a standard
once this happens im gona from the net and ill just have a computer with all that i have now
sorry world the govts of this planet are all mental and retarded , and im not one to wish to be spied on.
if i wanted that i would get a website and walk around my room naked and make money at it.
as i wont be making any money off there dpi use and all it does is cost money FUCK THEM YOU AND EVERYONE ELSE that stays and supports the system
i'll buy a solar array kit an ebike and trailor and get a garden going with seeds...enjoy your universe im leaving
Requiring DPI support adds costs to networking hardware.
DPI encourages discrimination on what kind of bits you are sending. Encouraging vendors to do play games like break bittorrent traffic without revealing them to their customers.
What is desirable on over-subscribed links is algorithms like CoDel to solve excess buffering keeping full links running at low latency and not needing special cases for VOIP or gaming.
DPI is only really good for monopolies messing up content.
If we were looking for good reasons to not give Internet governance to ITU, here we are. Of course one could argue that the current Internet steward, USA, is also a spying big player, but at least it does not openly brag about it.
I think ITU's action shows the true colour of the United Nation. I think it is simply too dangerous to pass on the control of the Internet to the United Nation.
But this is actually a good thing...
And anyone who disagrees clearly supports child pornography! :|
Motivation
Packet forwarding and DPI (deep packet inspection) are essential for multi-service delivery in packet-based networks and NGN environment. It is particularly true when handling multi-service (e.g. IPTV/VoIP) traffic because these applications have strict requirements on jitter, delay and packet loss rate. The functionalities of DPI and packet forwarding enhancement can properly identify different type of traffic so as to provide performance guarantees to allow for time-sensitive applications.
Yep. That sounds deeply sinister. They want to improve your Skype call quality. Those sick people.
Isn't this what DNSSEC is supposed to help with? Key loggers and malware aside.... DNSSEC should, in theory, stop MITM attacks, no?
PocketPermissions Android Permission Guide
FUCK ITU, is it possible to overturn such policy politically?
Shame on China, India, Syria, and countries like these
Somehow they have missed that AQM with algorithms like CoDel work and provide a simpler, cheaper, better solution.
It may not be sinister in intent but it sure looks incompetent. It increases the price of equipment and thus the price of service.
It sets the stage for filtering based on the type of data and allowing a premium to be charged for your skype traffic to work or be allowed at all. We have already seen companies like ATT try this maneuver already.
Meatspace is ideal, but even exchanging these keys on the first time between two piers would be enough for most people.
1. All email (and all other communication forms) has a public key attached.
2. You recieve an email from Jane, it has the public key.
3. All email you send to Jane now uses the public key.
4. Likewise on the reverse.
5. If you ever receive an unencrypted email from Jane with a different public key, BIG RED FLAG.
They'd have to be man-in-the-middling EVERYONE, EVERYWHERE, substituting every key and keeping the substitution concealed somehow. It uses the fact that we can't travel back in time.
Apparently the ITU, in its bid to take over the Internet, has decided to adhere to the worst totalitarians it can find as allies. Fortunately what they don't appear realize is that this alienates them with their natural allies inside the US, left-wing anti-DoD (if not outright anti-US) intellectuals.
And there's always the risk that Vint Cerf will take his Internet and go home.
double public key is hard to man in the middle when you exchange public keys in meatspace
Whoever uses the term meatspace should be slapped with a pound of raw bacon.
Also, there should be a xkcd about it.
Americans have had this for a long time. The Patriot Act grants the goverment the rights to listen to citizens communication. You created the echelon network to spy on people. So why do you suddenly care? For over a decade you didnt care enough to change that.
With a warrent (and warrentless wiretap) people are being monitored at this very moment. The only different is that the police of other states can monitor people more efficent. So why do you care now?
Like today, I can not load piratebay.se from any machine on my lan. I can RDC to an offsite machine and it hits find. I can load tor and it also hits fine. Ok this might not be DPI but it is still filtering and is bogus. even changing the DNS servers in my router and on my machines do not help.
The ITU doesn't want to spy on your or disable your internet connection. The companies that are asking you to stand up and stop the ebil UN do - Google watches everything you do, all day, every day, and will delete everything you post and remove your account on a robotic whim. Just like every other large internet company.
You say you don't want decisions made behind closed doors? They already are. Google doesn't give a crap what you think. Neither does Apple, or Facebook, or Twitter.
You say you're opposed to censorship? You already have it. From all those guys.
You say you don't want the internet unduly influenced by "other governments"? Well, as someone who is not an American I should point out that most of the world doesn't want their life influenced by the US government. But the US government is quite clear that they will do whatever they want to whoever they want to do it to, and they don't care if you don't like it.
I applaud your zeal. I applaud your lofty goals. But you're really barking up the wrong tree. Everything you say you hate is already here, and the companies you're fighting for are the ones that are doing it to you for fun and profit.
The ITU isn't perfect by any means. But they're not the bad guys.
...is available for most protocols - use it!
I would not dream of accessing my mail using plaintext protocols for instance; imaps and smtps is the way to go.
And many websites are also available using https instead of http, and there are browser extensions that help you to avoid forgetting, and trying https in vain where not available.
These measures may not be perfect but they do make eavesdropping much more difficult.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
How do you feel about your democratically elected government now? Keep voting, it makes a difference... lol
If the ITU were not involved, would DPI be nowhere?
NO.
Hell, it's being used everywhere at the moment, for fucks sake.
This is just another attempt to pretend the ITU would be worse than the USA in controlling the internet domain name system.
Hey, you know all that DMCA stuff? Was that passed any differently? No. Was that in the USA or in some scary "international thingy" that isn't the USA? In the USA.
Really, merkins, you fucked up the internet and that was fine until someone said you are no longer grown up enough to be trusted with it. Now you're catawauling about how it'll be China or Saudi (odd how Saudi is a baddie here when so very often to the USA it's BFF) doing it all, as if the USA weren't part of the frigging international world community.
And, really, that's the problem: the USA sees the world as "Us" and "Everyone Else".
You know, the ones that drive those politicians.
Your president is also an unelected beurocrat. YOU do not vote for him directly.
Did you vote for PATRIOT? DMCA? UCITA?
ECHELON is a global communications interception system, created by the United States, the United Kingdom, Canada, Australia and New Zealand to routinely and indiscriminately monitor and record all forms of electronic communications worldwide both military and civilian and overseen by the National Security Agency. Designed during the cold-war, ECHELON primarily intercepts worldwide non-military communications, including those from governments, organizations, businesses and individuals. ...and ray of receiving stations collect all international communications carried by approximately 20 INTELSAT satellites. The INTELSATs are used by telephone companies of most countries. Thou they carry primarily civilian traffic, they also carry diplomatic and governmental communications. These INTELSATs are positioned in the stationary orbit around the equator and carry tens of thousands of simultaneous phone-calls, faxes and e-mails.
It could intercept practically any communication between countries anywhere in the world. The project ECHELON receiving system thieves this streams of millions of communications every hours to massive rez of computers. These computers decrypt messages when necessary, than when required utilize optical character recognition or advanced voice recognition techniques to extract words from each message. Every message captured is analysed for keywords or phrases found in the ECHELON dictionary. Keywords include all the names, places, code words or subjects that might be of interest. There are second search lists for each member country. Messages acquired at any of the receiving posts, containing requested keywords are automatically past on to intelligence organizations requesting those keywords. Those messages are flagged for further analysis.
That tech is already used by private party. If it is used and abused by private party then I see no reason to approve it in general.
And, apparently, neither do you.
I didn't see you complain bitterly about your USA requiring DMCA or the TSA or using DPI or Echelon or GITMO or....
No, you respect Merika. BIG FUCKING DEAL.
I'm sorry, but who gives a fuck what the ITU have to say about DPI?
If I invent a new network protocol and people start using it, it gets used. I don't need the ITU to go "Ooh, that's nice. Everybody use Cederic's lovely new protocol"
The ITU didn't design, implement, promote and create a worldwide network based on TCP/IP. It managed perfectly well without them, and its replacement can too.
Let them make up their own little rules. The Internet grew without them, and a new network (with interoperability no less) can too.
Entities works in secret to require that others don't use secret. If there wants transparency, the minimum is that there are already transparent.
http://www.protectinternetfreedom.net/