News for hackers. Stuff that matters.
Re:BlueCoat and other proxies hang up during TLS 1.3 by x1798DE on Monday February 27, 2017 @09:49PM (#13750730)
They should lobby the school board not to do this nonsense.
Re:BlueCoat and other proxies hang up during TLS 1.3 by bgc on Monday February 27, 2017 @10:07PM (#13750803)
The Board doesn't have a choice, under CIPA[0], content filtering is a requirement for the FCC's E-Rate program[1] in which the government pays some of the cost of the school's internet connection.

[0]https://www.fcc.gov/consumers/guides/childrens-internet-prot...

[1]https://www.fcc.gov/general/universal-service-program-school...

Re:BlueCoat and other proxies hang up during TLS 1.3 by pluma on Tuesday February 28, 2017 @04:25AM (#13752477)
Seems like some people disagree with this interpretation: https://twitter.com/N805DN/status/835945815227138048

AIUI CIPA doesn't require MITM but most schools interpret it that way.

Re:BlueCoat and other proxies hang up during TLS 1.3 by discreditable on Tuesday February 28, 2017 @08:12AM (#13753455)
Most (private) schools in my area do not interpret it to require MITM. We specifically want to avoid MITM because it's a can of worms we don't want opened. We rely instead on SNI-based filtering systems, which work well for the most part. I'm using TLS 1.3 in Firefox Nightly with no issues.
Re:BlueCoat and other proxies hang up during TLS 1.3 by bradleyjg on Tuesday February 28, 2017 @01:04AM (#13751633)
>> content filtering is a requirement for the FCC's E-Rate program in which the government pays some of the cost of the school's internet connection.

I'd be interested to see the cost of compliance versus the subsidy. The federal government puts an awful lot of strings on financing for schools given the relatively low percentage of overall funding they pay.

I'd like to see some state somewhere turn down the money and see what they can do with the extra flexibility.

Re:BlueCoat and other proxies hang up during TLS 1.3 by trome on Tuesday February 28, 2017 @04:33AM (#13752501)
IIRC the E-Rate program is a high double digit by percentage subsidy, such that Wireless ISPs will lose business by not having an E-Rate certification because the school will just stick with polky, 6mbps DSL for their 200+ kids at a rural school.
Re:BlueCoat and other proxies hang up during TLS 1.3 by fulafel on Monday February 27, 2017 @10:47PM (#13750991)
Of course they have a choice. It's not very princinpled to sell your children's online privacy in exchange for some "grant" money going to an oppressive-dictatorship supporting company like BlueCoat.

(Also it's possible can do server address based blocking without MITM)

Re:BlueCoat and other proxies hang up during TLS 1.3 by akx on Tuesday February 28, 2017 @03:52AM (#13752337)
Sure, it's possible, if you're willing to blanket block all sorts of elastic IP ranges such as all of AWS.
Re:BlueCoat and other proxies hang up during TLS 1.3 by fulafel on Tuesday February 28, 2017 @11:46AM (#13755060)
You can do it based on DNS.
Re:BlueCoat and other proxies hang up during TLS 1.3 by schoen on Monday February 27, 2017 @10:35PM (#13750932)
Could they try to find an alternative source of funds (as the San Francisco Public Library did), or adopt an interpretation of CIPA under which they don't have to use this particular feature?
Re:BlueCoat and other proxies hang up during TLS 1.3 by acdha on Monday February 27, 2017 @10:05PM (#13750792)
Think about how that conversation would go. They're driven by concerns that kids will look at porn – and remember that if they don't try to stop that, the local Fox News applicate will be running a loop 24x7 saying they're trying to force godly children to watch it – or that someone will breach a staff member's computer and steal PII, compromise the security cameras, etc.

Against that, making life hard for Chrome engineers’ aggressive upgrade campaign is pretty hard sell. “Buy a better box” perhaps but I don't see a viable argument for “don't monitor”.

Re:BlueCoat and other proxies hang up during TLS 1.3 by habitue on Tuesday February 28, 2017 @01:05AM (#13751644)
Just an FYI, local fox affiliates don't have the ideological bent of the cable station. They're often run by entirely different companies
Re:BlueCoat and other proxies hang up during TLS 1.3 by acdha on Tuesday February 28, 2017 @09:35AM (#13753971)
True. In the areas where I've lived they were reliably the most breathless of local TV news cycle but that's a limited sample size.