Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

> Is Digital Ocean more trustworthy than, say Cox Communications?

Dunno about Cox, but I promise you I trust Digital Ocean far more than I will ever trust Comcast or AT&T. Even if they didn't have a history of being bad actors (and they do), a lot of people have exactly one choice of ISP but dozens of choices for hosting in the cloud, so the incentives are much more favorable.

View on HN

Most of these residential ISPs that people hate are also major (T1/T2) upstream providers for companies like DO. If not already, at some point, these providers are going to just sniff VPN traffic straight off of their backbones.

Say your ISP is Comcast... If Comcast knows your are connected to some VPS via VPN, it's likely that anything coming out of that VPN is yours. And if Comcast (or some subsidiary or partner) is also the upstream provider for that VPS, they could pretty easily make some correlations.

This isn't really true. The wholesale networks are operating at speeds that make this kind of sniffing impractical. I'm not saying they don't ever siphon traffic for LEO or other reasons, but not for privacy-violating/ad-targeting reasons. DO probably is running 40gbps alone with each transit provider, plus sending traffic over peering circuits, so it's just way less practical.

So what you are suggesting isn't actually true, and it's hardly hypothetically even possible.

Totally agree and I considered the shear throughput making it impractical. And while it's impractical, my point is that it's still possible, and maybe even practical in the future.

Maybe I misunderstand by why is this considered impossible? Network processors read data from a packet, make decisions based on that, and then rewrite arbitrary parts of the packet. All on the fast path. This sounds doable if you had the custom firmware that did that. It'd just be a huge waste of money considering your very, very expensive network box.

Ahh so maybe it's because the packet, once out of the VPN and heading to it's destination, is (normally - it is 2019 after all!) TLS encrypted so you can't just modify the payload like I said. Fair enough.

Reply on news.ycombinator.com