ISP Restrictions Based on Hardware/Software? 387
An anonymous reader writes "IT Architect magazine is reporting that ISPs are working towards a greater restriction of a customer's right to run what may be 'insecure' software. From the article: 'A greater threat is that ISPs may try to restrict the customer's side by denying access to machines based on their hardware or software configuration. [...] former head of cybersecurity, White House terrorism advisor Richard Clarke even said it should be made mandatory to quarantine malware.' Something that may also come as a surprise to some is that Microsoft is completely against this censorship of internet access. 'According to Chief Privacy Officer Peter Cullen, Microsoft is against ISPs doing anything that would restrict customers' choice of software. And he says this isn't just about the impracticability of demanding that data centers patch everything on the second Tuesday of the month. Laptop and home users also have the right to run an insecure PC.'"
Err.... (Score:3, Insightful)
Anyways, this being the US, such practice will be considered discriminatory especially if poorer families cannot afford the latest M$ tax.
Microsoft is completely against this censorship... (Score:1, Insightful)
Of course MS would object (Score:5, Insightful)
Of course Microsoft would object to this proposal. Any objective analysis (which the ISPs are certain to do) would put Windows high on the list of vulnerable systems. No matter how much Microsoft tries, it's always hard to configure a Windows system to be both secure and capable of easily running the software most users want to run without glitches. Putting a hardware firewall in front of it's just as bad from Microsoft's point of view: you're still telling users they have to spend more money and do more work to use Windows on the Internet. By contrast, many of the competing systems (Max OSX, *nix) are at low risk and would pass most security checks easily out of the box. No way does Microsoft want ISPs making it easier to put a Mac or a Linux box on the Internet than a Windows box.
I don't care why... (Score:3, Insightful)
Anyway, such a law would be pandemonian, it would require international standards etc etc - it would never work...
Problems with this (Score:4, Insightful)
I can see how the White House might deal with this sort of restriction, but an ISP dealing with thousands of customers that don't WANT to cooperate - not to mention, there would be an absurd number of software and hardware iiterations, hacks, etc, all of which they'd have to deal with.
2. It's unfair -
I should be able to run the software I want on the hardware I want, as long as I'm not producing malware. A restriction on rights for security is inconsistent with democractic ideals, especially with the qualifier that the security doesn't necessarily protect rights.
Bend us over and Shape our Bandwidth... (Score:5, Insightful)
Not really that amazing (Score:3, Insightful)
It's because they're for choice right? I mean, every time I turn around I hear about a new Red-Hat exploit which has allowed a worm to spread into millions of computers around the world, causing massive amounts of bogus traffic and driving up costs for ISPs.
Re:Hah (Score:3, Insightful)
How much power does MS wield? How much power does the OS community wield?
Terms of Service (Score:5, Insightful)
Absolutely. But do they have the right to abuse the ISP's network by sending spam/DDoS attacks etc?
Run what you may on your PC, but if you are using the network infrastructure owned and maintained by your ISP, you have to adhere to their Terms of Service, and they should have the right to enforce those terms of service.
If you don't like your ISP's TOS, find a different one. But don't confuse you right to run an insure PC with your right to abuse your ISP's network -- you do not have the latter.
The obvious question (Score:4, Insightful)
Yes, but do they have the right to run an insecure PC connected to the Internet? When their insecure PC, if it gets 0wned, is going to have adverse consequences for others on the Internet?
An analogy: I have the right to drive a car that fails safety inspection - on my own land. I do not have the right to drive it on the public roads, where it can endanger others. (Of course, this analogy breaks down, because the government mandates the safety inspection, and the government owns the roads, and in the Internet case, it's not the government that mandates the safe PC, but rather the ISP... and the ISP owns the "road" that I'm putting the unsafe PC on, or at least the road I use to access it... hmm, maybe the analogy isn't that bad.)
Re:Of course Microsoft is against it... (Score:5, Insightful)
Depending on your definitions, banning malware could mean banning Windows!
Or if the RIAA/MPAA have their way: P2P traffic. Be careful what you wish for.
Re:Of course Microsoft is against it... (Score:5, Insightful)
Well... (Score:1, Insightful)
The real problem is banning those who "might be" infected because they don't run an approved version of Symantec or Norton Antivirus. What software I run is none of their business.
Rights? Huh? (Score:3, Insightful)
On the other hand, an openly competitive market generally won't see companies trying to reduce services or increase fees -- competition is what gives consumers what they want at the price they're willing to pay.
If we allow our government to regulate the Internet, you better believe the market will be disturbed by enough regulations that we WILL see restrictions such as these -- regulations always serve the interests of the now mandated monopolies instead of the end consumers.
If a few big ISPs decide they want to restrict services for certain users -- let them! The little ISPs will gain enough business to give them a nice profit. Seems like a win-win to me.
Re:Of course Microsoft is against it... (Score:3, Insightful)
Re: Microsoft's involvement (Score:3, Insightful)
Of course, our idiotic "security" bureaucracy would probably put Windows on the short list of approved systems, since it's a Legitimate Product (tm) from a Legitimate Business (tm).
The two sides of this issue: (Score:5, Insightful)
Side #2: The TRUE result of this will be that lazy ISPs (read: most ISPs) will just lock out anything that doesn't match some piece of shit filter they put in place. So, a fully patched Microsoft or Apple box will probably be able to connect, but my Slackware box will NOT. And when I call tech support, the retard who takes my call will say "SlackWHAT? You can't run that on our network, for, uh... SECURITY reasons. Why don'cha run Winders like everyone else?" And I will be forced to resort to cruel, mocking language, upsetting his supervisor and getting me absolutely NOWHERE.
So, naturally, I'm against this bullshit too.
Even if... (Score:5, Insightful)
The other concern Microsoft may well have is that if you can only run "approved" OS' on the Internet, it will kill their beta programs and may well make it harder to roll out service packs. After all, it changes the version ID, so won't be an "approved" OS any more. If nobody patches their system, for fear of being disconnected from the Internet, it will be Microsoft that suffers.
What about Linux users? Well, there's always the IP Personality patch. This disguises your OS, so that common methods of fingerprinting your computer will return the OS identity that you choose. You can always make a Linux box look like Windows XP or whatever.
That's probably another concern of Microsoft. Linux distributions can be easily modified to fool such restrictions and existing Linux users will likely install the necessary patches. This could make Linux more attractive to the Walmarts of the world (fewer customer complaints) and also to corporations (no risk of unexpected downtime, due to ISPs not keeping up).
I'm all for these restrictions, because they don't apply to Open Source software - masquerading as other software is already quite standard. Only closed-source vendors and closed-minded customers have anything to be scared of, and I've no problem with them being scared silly by Homeland Security.
blah blah blah (Score:5, Insightful)
But this IS a horrible practice? Restricting people's internet access based on their computer? Does anyone see what is wrong with this or are you all going to complain about MS?
Re:Microsoft's involvement (Score:2, Insightful)
R'ing TFA, and a vague FA it was, the whole system would work by running a client agent that spies on the user and reports to the ISP, allowing the ISP to determine how to manage traffic (based presumably on draconian laws that further US govt ends).
Now, Microsoft will, realistically, be opposed to this simply because they don't control it. Absolutely they have every right to tell the govt they're not interested in them bundling software onto every Windows distribution. Only MS is allowed to bundle. But at the same time, MS has been reasonably anti-DRM and reasonably pro-freedom lately (it seems they are on the end of more patent litigation than they're causing lately, for example). A lot of this is simply going to be MS trying to prevent others from controlling the market in the same way they try to. Either way, take it as given that corps are evil, at least don't complain when they do something good.
Likewise, I am amused to think of what the Linux kernel owners would say about a mandatory bundling of a linux client agent to spy on the end user for the government.
Personally, I can't see it being popular anywhere outside the USA. And you try tell an ISP they need to increase their operating costs so they can enforce government policy for the government by running servers to monitor mandatory government spyware installed on client PC's.
Danger to Linux users? (Score:2, Insightful)
Re:Even if... (Score:4, Insightful)
Re:Wow (Score:2, Insightful)
We may be inconveniencing a small minority of our users, but we trying to maintain access for the majority of users. If we allowed our network to be in a perpetual blacklist, we would eventually not have any subscribers since they would transfer to providers that take measures to allow most of the subscribers to use services that the subscriber pays for.
Client-side official spyware (Score:5, Insightful)
Re:Microsoft is completely against this censorship (Score:3, Insightful)
And, as pointed out in the article, how will custom proprietary apps get on?
The whole thing sounds like a ridiculous idea when you start thinking about the repurcussions. ISPs have no way of knowing what percentage of their customers are running software that's not on a particular whitelist --- until the day they implement the policy, at which point all hell breaks loose and some of their best customers run to the competition.
It also isn't obvious how they can really detect all the software on a computer. Are they really going to look at every file foo.bar on my hard disk to see if it would really run if you did a `perl foo.bar'? And remember, malware authors are specialists at hiding their software.
It would make a lot more sense to analyze traffic. If a certain user starts sending 10 million e-mails a day all of a sudden, just shut off his access and wait for him to get on the phone and talk to you. Another, possibly complementary option would be just to impose upstream and downstream traffic limits (maximum peak and maximum monthly?), although a lot of ISPs don't want to advertise that they have limits or reveal what they are.
The article sounds very suspect to me. Lots of vague statements like "the required technologies are now becoming available." Oh yeah? What are they called? Who's selling them? Which ISP's have tested them?
Re:Bend us over and Shape our Bandwidth... (Score:3, Insightful)
It is.
Like it or not, an ISP does own the part of the network you traverse to get to "the rest" of the Internet. So it should be no surprise that they wish to control it, and consider it their right to do so.
And I cannot say I entirely disagree. Vote with your wallet. Where a large enough market exists (i.e. people who want no restrictions placed on their access), there will be an ISP to fill that need.
And besides, I doubt that all ISP's are heading in this direction. I work for an ISP (part of a CLEC) and I know for a fact that we are not considering anything along these lines, and I'd be sincerely surprised if we ever did. Our marketing people, while occasionally dumb, are not nearly stupid enough to try and make it fly.
Re:Of course Microsoft is against it... (Score:2, Insightful)
Re:Microsoft is completely against this censorship (Score:3, Insightful)
The great debate over who's rights are greater: (Score:1, Insightful)
Which raises a great philosophical question, one which has raged since the beginnings of civilization: Where do you draw the line between personal freedom and rights versus the rights and good of the whole of the people?
For example- I'm a car nut and I would LOVE it if I could drive whatever I feel like welding together!! But in my state, and most of the US, cars have to be inspected and insured. It's a filter for what we as a society allow to be on the network of roads and highways. (makes for safer but boring driving...)
Re:Of course Microsoft is against it... (Score:1, Insightful)
Re:This is the real world. (Score:2, Insightful)
Re:Sign me up. (Score:2, Insightful)
Wow, thanks for the heads up. Good thing I'm on the "commie" side of that Great Northern Wall they're planning!
Re:Hah (Score:3, Insightful)
"The real question is, is the open source community against it?"
Actually, I think the real question is 'How could everyone miss the point so completely?'
Look, I think that government does have a place in enforcing standards, especially with regards to safety and security, but those have to be standards of behaviour. The difference between saying 'nobody is allowed to run software that does X' and 'nobody is allowed to run software X' is critical.
Taken to its logical extreme, it's the difference between saying:
and saying:
Another example: I don't give a hoot who made the truck that pollutes my lungs with reeking black clouds of exhaust, nor do I care who the owner is. I just want it to stop. The best way to do this is to set standards for behaviour and punish or reward them as society sees fit.
Gee, when we put it that way, it almost sounds like what laws are for, huh? 8^)
In that sense, I have no objection to making malware quarantine compulsory, provided that malware is defined by its actions and not its name.
Re:Bend us over and Shape our Bandwidth... (Score:3, Insightful)
Suppose a provider like Time Warner decided that they want to increase profits a bit so they make the privilege of using specific ports a five dollar premium fee. Essentially they've created profit where it didn't exist before. Some people will simply have to pay (it's a good deal otherwise, only game in town, and so on) the 'power user' tax.
What fraction of people care? One in fifty? What fraction will just deal with the extra expense? How will this alternative provider get their data to me, on the network we agreed is owned by the original provider?
It's hard for me at least to see a purely free market solution arise that doesn't hurt the power user when the service can be sliced up any way the provider wants inconsequentially. That's why I'm worried. The situation may currently favor us who 'abuse' the system by using ports that the average Joe doesn't for things like FTP, NNTP, and remote administration and I'm not saying that it isn't fair for the ISPs to take what they can, but it certianly would hurt us.
Re:Of course MS would object (Score:3, Insightful)
The government is unlikely to be interested in producing a spyware module compatible with your favourite flavour linux distro, although industry uproar might make a Mac version available. Many linux and BSD clients under this system would be completely blocked from using the net.
Writing spyware for MS is quite easy however and therefore, Windows systems would be the first back on the net when the new wall comes down. Not a bad deal for Microsoft, eh?
So why are they objecting? Because it's a blatently stupid idea. Not, as you suggest, because they might lose market share from it, when in fact they stand on gaining a monopoly on american internet from it.
Re:THE INTERNET IS NOT SECURE (Score:2, Insightful)
Naturally, that means it will be regulated by government and made into whatever they please. You could inform your Congressperson of your simple fact and it simply will be drowned out by so many other interests that want to profit from the Internet.
The most likely candidates that would sell the internet as securable are the media conglomerates, military and law enforcement agencies.
Media conglomerates want it to be a giant sh*t pipe delivering their DRM'd content into your home.
Military want to "secure" it to use special applications as weapons. Spys love it for the same reason.
Law Enforcement wants to catch bad guys on the Internet too. It's like they work with hammers all day and so everything starts looking like a nail.
Re:Wow (Score:1, Insightful)
Might be an inconvience for some of your customers to block smtp but I would think much less of one then trying to certify every single PC from every user on your ISP.
You can fix it once in the network or play cat and mouse with each individual
client.
To clarify once more... You CAN NOT rely on the client for a secure network.
Re:And what about ISP rights? (Score:2, Insightful)
Re: Err.... (Score:3, Insightful)
I wonder how many minutes it would take for someone to write an emulator to send back the "A-OK" signal.
I can't imagine the system working even if people didn't try to jack with it. It would require regular automatic updates as new products came out, and a simple bug could result in shutting down most their customers in one swoop.
More likely it would serve as a conduit for a new class of worms.
This is a good thing. (Score:4, Insightful)
All of these things work in a very good, and non-censoring way: they require the user connecting to the network, to take certain "safe computing" steps. Requiring virus/spyware protection is overkill (I for one have never run spyware or virus protection, and have only had one spyware infection that required a reformat and two viruses -- in 11 years of being connected to networks unprotected. All of those infections were 3+ years ago.) but requiring that computer users, say, don't broadcast worm packets and don't have unpatched security holes, is a very good thing.
It's one thing for the ISP to shut off people for downloading certain types of content, it's another if the user is abusing the network resources. Similar to, a phone company won't cut your line for calling people they might not agree with the opinions of -- but if you, say, wardial your entire neighborhood on a daily basis, they have some recourse against you.
Overall, the ISP restricting access to its network to people who aren't infected and are secure, is only a good thing -- on every possible front. And, from the stand point that Windows updates generally are denied to people using pirate copies, it will reduce software piracy rates as well. There's no excuse for people to still be broadcasting the Sasser worm, other than the fact that it isn't worth their time to fix it. This will make it worth their time, to no longer be a deliberate nuisance to everyone else.
Re:Of course MS would object (Score:2, Insightful)
Re:Of course Microsoft is against it... (Score:1, Insightful)
Now that DSL is an information service (Score:3, Insightful)
Now when we reach the point where there's only a handful of ISP's (esp. if they're regional), we will have a problem.
This may in fact be the case. Now that the FCC has defined DSL as an "information service", this may give the ILEC the right to boot other DSL ISPs off the ILEC's copper. Then you end up with a duopoly, and in that case, "go[ing] elsewhere and find[ing] some other provider" would involve expensive real estate transactions.
Re:Even if... (Score:2, Insightful)
That is ridiculous. Stop being blinded by your hatred of everything Microsoft/closed source and open your eyes. If ISPs get involved in regulating what's on peoples' computers, it's opening up a bag of worms. Besides, who decides what's secure? From what I've seen, nothing is truly secure. Who's to say that in the future, a major corporation with its highly paid lawyers, won't convince some regulatory board that open source software is a security risk? And don't tell me that Linux will just pose as something else. Technology changes, and who knows if it will always be able to do that. For once, Microsoft is on the right side.
Re:This is a good thing. (Score:4, Insightful)
On a corporate network, they most likely own every single device on the LAN, and have an IT staff that maintains what the "standard" images are. In fact, one place I worked would block the port within 30 seconds of a link-up condition if the device connecting to it wasn't running an approved image.
ISPs don't own the users' devices at the edge...and they should _not_ be just given some kind of backdoor to "check on things." Once that exploit gets into the wild, the info could be used to make a much, much more efficient and easy to hide botnet.
Nobody seems to remember that the road to hell is paved with good intentions, such as this.
Re:This is a good thing. (Score:4, Insightful)
The rules change on the open Internet.
Re:isp's blocking p2p traffic (Score:3, Insightful)
Unlimited NationalAccess/BroadbandAccess services cannot be used (1) for uploading, downloading or streaming of movies, music or games,
So "emerge xbill" is right out
(2) with server devices or with host computer applications, including, but not limited to, Web camera posts or broadcasts,
automatic data feeds,
No RSS for you !
automated machine-to-machine connections,
And your box will never have it's clock at the right time either, no ntp !
But you can do some internet browsing. Whatever that is.
Re:Even if... (Score:2, Insightful)
So you are ok with your ISP requiring that you allow their installation tech to pop a CD ROM into your machine and install an agent to monitor your system? Each time you add a PC or reinstall the OS, you'll call them up and have them come out and do it again? How about when you find out their policy is to support RedHat, but not your favorite FreeBSD distro?
On a side note, I don't really understand Microsoft's angle on this. It seems to me they would benefit. Heck they could even bundle the agents with Windows and advertise "internet ready".
AUP Violations (Score:3, Insightful)
Sure, you do have the right to run an insecure PC, run an adware ridden piece of crap to your heart's content, most people seem to think those fifty billion popups and 14 minute boot times are normal. Doesn't mean you should do it....
Its when I start getting spamcop complaints, and reports of intrusion attempts on other people's pc's that we start to have a problem. Then I have to cut you off from the internet (I work for an ISP), acceptable use policy says nothing in it about infesting the internet just because you aren't smart enough to keep your pc a little more secure.
If you owned a house next to mine, and you let it fall into disrepair, and become a huge fire hazard, sure, I guess that is your right to do so. If it actually catches fire, and spreads to my house, then we have a problem, because now, your neglect has caused damage to somone else's property. Same on the internet, if you become a threat to your neighbors, I will simply isolate you until you are no longer a problem.
Bad Implementation. (Score:4, Insightful)
That depends entirely on how you can tell. If the method is your silly Cisco router which checks for this or that piece of Windoze shit, it sucks. If the method is detecting obvious spam and worm broadcasting signatures, great. Detecting spammbots is getting tricker all the time because the spammers are smart enough to not want damage the user's performance enough for the user to want to fix the computer. ISPs have been turning off blatantly broken computers for a while and it is a very good thing.
Windows updates generally are denied to people using pirate copies, it will reduce software piracy rates as well.
How do you equate the two without advocating some really stupid and lazy method of punishing people for not having whatever Bill Gates wants you to have right now? A check which provides that kind of solution will outlaw all the software that's actually secure.
Re:This is a good thing. (Score:3, Insightful)
Re:... and I thought *I* was paranoid (Score:3, Insightful)
No. You are absolutely right that that would be a huge barrier to deplyong such a system. No one would ever buy a computer that cannot run their existing software.
One of the most critical aspects of their Trusted Computing deployment is to ensure that there is NEVER any reason NOT to have a Trusted computer. No reason NOT to take a Trusted computer.
A Trusted computer can do everything and anything a normal computer can do. A Trusted computer can run any and all existing software.
A Trusted Computing *is* a normal computer with all of the capabilites of a normal computer. It just has something extra. A new Trusted mode, or as I call it "handcuff mode". Outside handcuff mode it is a normal computer. Once you turn Handcuff mode on the computer can report to other people what hardware and software you have, and it can unlock "DRM files" on the condition that you are running the EXACT and UNMODIFED software approved to read that file. And of course the DRM software can create locked files that can only be read in handcuff mode by that exact unmodified software.
So old software always runs fine, both in normal mode and in handcuff mode. Old files can always be read no problem, both in normal mode and in handcuff mode. However certain NEW software will refuse to run except in handcuff mode, and certain NEW files can only be read by approved software and only in handcuff mode, and people over the internet can set up new software that refuses to talk to you unless you send a Trust report stating that you are running the software they want you to run.
So normal websites can be viewed on a Trusted computer using any web browser, but NEW websites can be set up that will spit out error messages unless you have a new PC in Trust mode and you run an approved new Trusted browser.
The entire point of Trusted computing is to make people with normal old computers suffer. None of the new stuff works on normal old computers. They increasingly get error messages telling them they need to upgrade to a new Trusted "enhanced" computer. For anyone with a Trusted computer, everything both old and new "just works". The new stuff may only work in DRM-hell handcuff mode on new computers, but that's still "more" and "better" than it not working at all on old computers.
On top of that, your system cannot phone home to ANYONE without software to tell the hardware what to do.
Does the Windows Product Activation process ring a bell?
I expect online activation will be increasingly required for the installation of software, but in fact the entire system can work just off of a single operating system activation. Other software could then undergo a secure Trusted installation with Windows itself handling the encrypted software. It would be impossible to install or decrypt the software without the key loaded into Windows and locked by the Trust chip, and if you make any attempt to modify the Windows software the Trust chip denies you the key. So there'd be no way to decrypt and install the encrypted application without the assistance of the unmodified DRM-enforcing operating system.
On top of that, your system cannot phone home to ANYONE without software to tell the hardware what to do.
Yes. That is why they formed the Trusted Computing Group, which currently contains something like two hundred companies - virtually every signifigant company in the computer industry. And why they have designed in certain "privacy features" and they are advertizing it as a privacy enhancing system. (Hah!) Hyping the fact that there are protections built in to keep your ID number secure unless you "opt-in" to reveal it. They even formed a bogus "grassroots" consumer protection group lobbying for new standards for consumer privacy protections and standards... and they just so happen to be "demanding" the exact protections that
So Microsoft says... (Score:2, Insightful)
What, something like writing web pages to stop a particular browser from viewing them? *cough*Opera*cough*