tcp != the web.
Also, most firewall don't break TCP, they break HTTP(S) because they want levels of control.
Also, most firewall don't break TCP, they break HTTP(S) because they want levels of control.
And it's because they want levels of control on the least affordable place. They wouldn't need to break anything if they added the supervising software to the endpoints.
Now, I get that QUIC's developers live in a zero-trust/BeyondCorp model, and expect everyone else to too, and with COVID-19, a lot of businesses are suddenly having to look at thinking that way, it's far from how most companies work at present. And having a single box handle filtering and monitoring is actually the most affordable place to put it. ;)
The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.
Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
See also RFC 7258 (https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.
And they're not. Google, Amazon, Microsoft, etc. have failed to keep the Internet safe. And when they fail they hide behind liability shields like Section 230. So it falls on IT staff, more often than not, to filter, block, and intercept where Big Tech has demonstrated inability to do so.
People trying to make protocols more secure don't need to convince you, they just need to make your job as hard as possible until most users reject what you're offering.
We need a dozen more ideas like Certificate Transparency. We need pervasive end-to-end DNS security, with unencrypted DNS flagged as insecure. We need a means of preventing DNS servers from altering the DNS records of sites they aren't authoritative for. We need browsers to all agree to explicitly flag connections as insecure when they chain to a locally installed certificate, in a way that can't be hidden without rebuilding from source.
And this isn't a purely technical problem, either. We also need legal support to review regulations in certain regulated industries and demonstrate well-supported ways to fulfill those regulations without breaking security (e.g. "if you do XYZ to log the time and endpoints of connections but don't actually MITM their traffic, it's reasonably well-established that you're fulfilling ABC regulation"). We need lobbyists to change regulations incompatible with secure protocols. We need designers to make security as usable as possible, because poor usability is a security problem.
(This is assuming they aren't using pinned certs baked into their firmware, anyhow. I don't have good data on which manufacturers/devices are doing this, but somebody else might know.)
If you want to run those devices in production, put them in a separate network or VLAN where they can't see anything they don't need to see.
As it is, don't Chromecasts refuse to function if they can't reach 8.8.8.8? Add encrypted DNS to prevent inspection and transparency, and people are being asked to have potentially hostile devices in their network with no way to inspect them.
(And the PKI infrastructure is the best thing we have; I'd certainly like to see it replaced with something even better.)
So creating a system where I, as a consumer, have no way to inspect the communication my devices undertake removes my rights and safety in deference to companies that really just want to make it harder to block ads.
I take issue with this entire model. The fact that PKI has had piles of issues with bad actors who are supposedly supposed to be bastions of trust doesn't give any example this is a system we should trust, much less have browsers force people to utilize and scare people off avoiding.
Yet we have one because it's required by law. Wanna take a guess at what companies make sure it stays required by law?
The laws (in the US, at least) are typically written such that some part of the administration is deputized to promulgate technical standards and rules, most of which delegate to the NIST, but sometimes to industry bodies. Laws like this include HIPAA, FERPA, FISMA, and GLB.
There are lots of industry standards you can reference (such as the Cloud Security Alliance Common Controls Matrix), but the government will generally look at things from the perspective of NIST publications, such as NIST 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations". So, basically, what the government thinks private enterprise should be doing to comply with legal requirements to protect sensitive information.
In that document, there are a number of "controls" an organization should have in place, in particular, it should audit any and all data transfers, and ensure such transfers can be traced back to a unique user.
Even within that framework, you aren't going to necessarily find a blanket "read everyone's mail!" edict. Instead, what you are going to do, is make an assessment, as an organization, about what you think you need to do in order to withstand any potential lawsuits that may arise from any kind of disclosure.
If we made software engineers individually liable for these things the way civil and mechanical engineers are, things would look very different.
[Ed: misspelled FERPA]