This is why apple tells you how to block private relay.

https://developer.apple.com/support/prepare-your-network-for...

mask.icloud.com mask-h2.icloud.com

In addition if this service is a problem, consider there could be a thousand providers you have never heard of providing the same kind of service but while going out of their way to make sure you don’t actually have a way to block it.

If you really ‘need’ to block that kind of connection the onus is on you, not on the services.

Absolutely. There are block lists out there that can help but they are unlikely to be perfect. This guy seems to be up to date; https://github.com/oneoffdallas/dohservers

Yea, like enforcing the seemingly obvious “don’t use the fucking office network for torrenting”.

I nearly lost my mind when I got a DMCA notice from our ISP. I never thought I’d need to lecture a team of professionals that the consequences of losing our office internet would be significant to the business.

Sure and that is understandable, but it doesn't really do much. My personal phone is not on my employeers wifi but is still right next to me. There is nothing technical that they can do, short of a faraday cage for the building, to prevent me from going where ever I want on it.

I feel like rules such as yours are a pre smartphone era thing, when I had to use the company laptop to get online away from home.

It does a lot: You aren't exposing our network to security threats or legal liability. I don't care what you do with your phone on your own Internet connection. But if you want to connect it to my Wi-Fi then it has to follow my rules.

If you don't control the endpoints you don't control the network.

It depends. Obviously a lot of effort by certain monopolistic advertising companies have gone into ensuring the web platform is increasingly opaque and difficult to manage or monitor, but it's entirely in the purview of a network owner to disable or block anything that can't be inspected to satisfaction.

Well if you want to block everything that can't be inspected you will block a lot of common functionality.

The question about if it's in the network owners purview to inspect depends on the network and traffic. It could also be illegal privacy violations.

There is no reasonable expectation of privacy on someone else's network, particularly an employer's. Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I understand that ad companies have a vested interest in circumventing this and trying to move internet standards to opaque protocols, but until that particular fiefdom is unseated, we have to make reasonable tradeoffs.

In the meantime, we block a massive amount of malware by blocking their ad domains.

> Arguably network operators have the ultimate authority on what should and shouldn't happen over their networks on their equipment.

I think the point here is you write on their equipment. I was talking about cases where the network owner don't control the endpoints, that is allowing private devices to connect. snooping in that data can be problematic.

> There is no reasonable expectation of privacy on someone else's network, particularly an employer's.

This is a massive [Citation needed]. Do you have a court precendence case where you can prove that admins have the right to snoop through private and sensitive data of users that are just connected to some network?