Recommended Posts

Do you ever plan on becoming a network engineer or network manager at a larger corporation with network management as you main responsibility ? If so you might want to use the Cisco, however in that case you'd probably be better of using it as a learning tool and experiment with it. and you probably don't want to experiment to much with your main route to the internet :p

Do you have plans to work in the IT field as network guy? Are you going for your CCNA? If not knowing the IOS of cisco gets you nothing. And again lets learn the basic concepts before jump into the inner workings of cisco's ios.

And a 2600 is just that a router - does it have the firewall feature set installed?

http://www.cisco.com...ide/fw3600.html

Again your looking to be dropped off in the middle of the ocean without so much as even some floaties let alone a life vest.

Here is the other point - wanting to play with the inner workings of iptables or pf or ipfw on freebsd or any of the other firewalls on linux/bsd that is great - but not sure I would use it as my gateway to the internet and firewall between these other machines on the .0 while your on a steep learning curve.

Why not play with those things inside the safety of your own network. You can quite easy split your network up as much as you want once you have isolated it from the hostiles on .0 network ;)

If you don't have real hardware - you can play with using any linux/bsd distro as router/firewall all you want just on a few VMs. Same goes for cisco, if you know someone that can get you the images (hmm wonder who might be able to help you there?<grin>) you can setup fairly extensive cisco lab just using http://www.gns3.net/

Do you ever plan on becoming a network engineer or network manager at a larger corporation with network management as you main responsibility ? If so you might want to use the Cisco, however in that case you'd probably be better of using it as a learning tool and experiment with it. and you probably don't want to experiment to much with your main route to the internet :p

Oddly enough I do have long(ish) term aspirations to get into networking, not just as a field of study but as a career path also, I have my CCNA self study guided here at home and was working on this a little until a friend recommended that if I wish to break into the IT industry I should probably take the short route initially and get into helpdesk work first as a 'foot in the door'. I already have an MCTS qualification and am some way towards gaining an MCITP certificate, hope to take exam next month :laugh:

You are correct though that messing with my main route to the internet is probably not the most recommendable option, I like my internet! :D

Do you have plans to work in the IT field as network guy? Are you going for your CCNA? If not knowing the IOS of cisco gets you nothing. And again lets learn the basic concepts before jump into the inner workings of cisco's ios.

And a 2600 is just that a router - does it have the firewall feature set installed?

I'm unsure if it does have the firewall feature set installed though would have been prepared to do this myself, of course with some guidance from online walkthroughs and how-to's (the source of a good portion of my current knowledge)... :rolleyes:

Here is the other point - wanting to play with the inner workings of iptables or pf or ipfw on freebsd or any of the other firewalls on linux/bsd that is great - but not sure I would use it as my gateway to the internet and firewall between these other machines on the .0 while your on a steep learning curve.

Why not play with those things inside the safety of your own network. You can quite easy split your network up as much as you want once you have isolated it from the hostiles on .0 network ;)

Fair point, though as before mentioned I would like to make sure that my web/FTP server is as secure from potential attacks as possible and I figured a hardware firewall between me and the outside world would be the best way to achieve this. If you could offer any alternative solutions that would give me the security and piece of mind I would like I'm quite open to suggestion...

If you don't have real hardware - you can play with using any linux/bsd distro as router/firewall all you want just on a few VMs. Same goes for cisco, if you know someone that can get you the images (hmm wonder who might be able to help you there?<grin>) you can setup fairly extensive cisco lab just using http://www.gns3.net/

I have a real, hardware based Cisco lab at home compliments of an old friend when I bought my CCNA study guide comprising of 2x 2600 series routers, 1x 2500 series router and a Catalyst 2900 XL series switch to 'play' around with (complete with crossover cables, and rollover cable with DB9 adapter to access the console), also have a copy of Cisco Networking Academy, though would still be quite interested in getting hold of those images... (cough, cough...) :rolleyes:

VMs also sound like a reasonable idea for experimentation, I do have VMware with VIX and VSphere too, would be interesting to play with some virtualized environments, particularly considering that it seems to be a much more common standard for large businesses to use these days than individual, physical hardaware.

From what I remember of cisco, only the catalyst series of devices had firewalls.

I understand that the Cisco IOS Firewall feature set IS available for the 2600 series routers though does not come pre-installed, this can be downloaded from Cisco here:

http://www.cisco.com/en/US/docs/ios/12_0t/12_0t1/feature/guide/fw3600.html

"though would have been prepared to do this myself"

Just so you know - updating those would not be free ;) Cisco is not cheap!! You can pick up older hardware from 3rd party for not all that much. But the images they have installed is where lots of cost comes from.

Now (cough, cough) you might have alternate sources for your images?? Now some people might be ok with (cough, cough) sharing images if they know its only going to go on VM for learning.. Putting on actual hardware is a different matter, and brings into question other concerns of trust and where that hardware might end up in the end, etc.

As to securing your network - any of the distros out there will be good. Keep in mind you made no mention of an application firewall or reverse proxy. If you looking to secure web/ftp applications a normal firewall does not promise any extra security for flaws/exploits into those applications.

Your firewall to will allow you to secure it from who you don't want to access it - but if you open that up to the public net, then the security of the application comes down to that application. Not the firewall that just provided access - if that is your concern then you need to look for a reverse proxy, etc. that can filter for application exploits and block them, etc.

edit: that is info about the feature set, not the actual feature set image. Again (cough, cough) actual purchase of the feature set is NOT CHEAP!!

"though would have been prepared to do this myself"

Just so you know - updating those would not be free ;) Cisco is not cheap!! You can pick up older hardware from 3rd party for not all that much. But the images they have installed is where lots of cost comes from.

Now (cough, cough) you might have alternate sources for your images?? Now some people might be ok with (cough, cough) sharing images if they know its only going to go on VM for learning.. Putting on actual hardware is a different matter, and brings into question other concerns of trust and where that hardware might end up in the end, etc.

Of course, I wouldn't even dream of promoting the unauthorized use and sharing of proprietary images for illegitimate purposes, even if the hardware were only to be used for study purposes and will not be sold or passed on to anyone else after use. I fully understand and adhere to strict proprietary software licences, after all, all of my software is entirely legit and paid for... :rolleyes: (or open source in accordance the GNU General Public License Agreement)

As to securing your network - any of the distros out there will be good. Keep in mind you made no mention of an application firewall or reverse proxy. If you looking to secure web/ftp applications a normal firewall does not promise any extra security for flaws/exploits into those applications.

Your firewall to will allow you to secure it from who you don't want to access it - but if you open that up to the public net, then the security of the application comes down to that application. Not the firewall that just provided access - if that is your concern then you need to look for a reverse proxy, etc. that can filter for application exploits and block them, etc.

Could you recommend a 'free' solution of this manner for Server 2008 R2?

edit: that is info about the feature set, not the actual feature set image. Again (cough, cough) actual purchase of the feature set is NOT CHEAP!!

My mistake, this was a link someone else sent me...

If you want you could do what I did, keep the NAT setup on debian and get SNORT/Suricata and put that on it and run it in IPS which will protect your servers and clients :)

Nice idea though sadly this still leaves me with the issue of my improperly configured NAT not allowing me access the FTP server from outside of my .1 network and vice/versa :/ and thus back to the beginning of my problem...

Or you could just run pfsense and install the snort package.

Who do you want to be able to access your ftp server?? People on the .0 or people on the internet? Cuz people on the internet is not going to happen unless you have control or access to the nat router between the .0 and the internet to create the forward to your .0 address.

Or you could just run pfsense and install the snort package.

Who do you want to be able to access your ftp server?? People on the .0 or people on the internet? Cuz people on the internet is not going to happen unless you have control or access to the nat router between the .0 and the internet to create the forward to your .0 address.

People on the internet mostly, though accessing the the router that connects to the internet is no problem, the first thing I did when I moved in was demanded the admin password to the router configuration setup from the landlord so am able to forward ports no problem :laugh: Was able to access my web server via the internet before I introduced my Debian nat gateway to the scenario...

many routers do not like a double nat scenerio. esp soho routers. You would have to forward the port to your debian from your router then forward the port from your debian to your computer.

Makes sense, though was having trouble forwarding ports using IPtables due to unfamiliarity with the correct syntax, found a great deal of guides on the web though none of them really explained in detail exactly how to correctly construct the syntax of the tables and as such any attempt I made to do so broke the nat routing on the Debian box. I am beginning to sway towards the idea of installing pfsense and setting this up as this would allow me to configure the route properly and as such I would be able to see what correct IPtables and configurations should look like for my purposes.

"I would be able to see what correct IPtables and configurations should look like for my purposes."

Not if you go with pfsense it wouldn't it would allow you to see the correct PF syntax - since pfsense runs on freebsd, and freebsd uses PF not iptables.

You could go with a router/firewall disto that uses iptables though if that is your ultimate goal. I do believe ipcop using iptables since it is linux based. If you goal is to be able to use a simple gui to admin iptables, and then look at the underlying actual iptables rules then something other than pfsense should be your choice.

If your goal is to have a very stable, secure and very well supported and developed distro to use as your gateway/firewall then I would highly suggest pfsense.

As sc302 stated if you have access to the .0 nat router to the internet - then yeah you just need to create the forward to whatever your router .0 wan interface is. Good idea to set this as static outside the .0 routers dhcp servers scope, or setup dhcp reservation in that router for your routers wan interface mac so it always has the same IP if your going to do this.

My question is what if some user on the .0 wants to forward ports to their IP - do they also have access? Only 1 person would be able to forward port 21.

Also keep in mind with ftp, and double nat you can run into some issues. Are you going to be doing active or passive connections? Now many soho and router distros do have ftp helpers to work through the data port to be open and changing the IP to the public one that the ftp server might send, etc. But with a double nat you can have problems, etc. You can make it work if you have access to both routers, but its more complicated to be sure.

As with anything its a good idea to fully understand the protocol in question to get it to work through a firewall - here is a great reference for ftp active vs passive, etc.

http://slacksite.com/other/ftp.html

When I was doing the iptables for my two snort IPS systems, I searched and searched the net and found virtually nothing, some examples that didn't really work, had to spend ages looking at how iptables worked and eventually (after many attempts) got my own syntax and rules to work fine.

  • 2 weeks later...
Not if you go with pfsense it wouldn't it would allow you to see the correct PF syntax - since pfsense runs on freebsd, and freebsd uses PF not iptables. You could go with a router/firewall disto that uses iptables though if that is your ultimate goal.

Once again my mistake, at this point I am not too concerned about getting to grips with IPtables specifically, just making a working configuration is my current goal...

My question is what if some user on the .0 wants to forward ports to their IP - do they also have access? Only 1 person would be able to forward port 21.

Fortunately no one else in the building has any requirement, desire or technical know-how to forward ports so access to port forwarding configuration is entirely in my hands and the entire port range is available for my use. :D

Also keep in mind with ftp, and double nat you can run into some issues. Are you going to be doing active or passive connections? Now many soho and router distros do have ftp helpers to work through the data port to be open and changing the IP to the public one that the ftp server might send, etc. But with a double nat you can have problems, etc. You can make it work if you have access to both routers, but its more complicated to be sure. As with anything its a good idea to fully understand the protocol in question to get it to work through a firewall.

Thanks for the link, I will look into it later today before I set up my pfsense, you are correct that I should understand what I am going to do before I set it up, with regards to potential issues with double NAT with FTP I am quite happy to explore my options and do a little experimentation...

  • 2 weeks later...

Ok, so I have installed pfSense as my router/firewall OS and am rather happy with this, the web based configuration is wonderful and very feature rich and now, happily, NAT is working correctly and proving a smooth connection with no issues. It's certainly more than I could have hoped for and any previous reluctance I had regarding using this has now evaporated though, sorry to say, I do still require some further advice...

I am having some issues with port forwarding, to be quite honest I am unsure of how to make double port forwarding work correctly, I have been testing this with my soulseek client as it allows for the option of testing if your port forwarding configuration is working correctly and am repeatedly being told that the port is closed. here are some details that may help:

ADSL router IP is still 192.168.0.1

WAN interface on pfSense box is 192.168.0.20 (provided by DHCP on .0 subnet, statically assigned)

LAN interface on pfSense box is 192.168.1.1 (providing DHCP to .1 subnet)

Soulseek client is running on .1 subnet on workstation 192.168.1.100

Soulseek port 40069

Could anyone please advise on how to correctly set a firewall rule on my pfSense to forward this port correctly? I have already opened port 40069 on the ADSL router to 192.168.0.20, it is from here on I am having issues.

Thanks again all :)

What to you mean opened it? You need to forward it as well, if your going to run in a double nat setup. It going to be easier to just put the ip address of pfsense wan into DMZ, or exposed HOST of your adsl router - now ALL unsolicited traffic will be sent to pfsense wan IP.

But if not that port tcp from what quick google says for soulseeker needs to be forwarded to the pfsense wan IP on that port. Double check your settings, did the IP of pfsense wan change? Post up your settings and we can take a look.

Do you have anyway to put that adsl router into bridge mode so that pfsense gets public IP!

Then just forward whatever ports you want to whatever IPs behind pfsense you want to see the traffic.

So I would for a test, sniff on your pfsense wan interface - do you test, do you see the packets?? If not then pfsense is never seeing anything to be able to forward. If you see the traffic then you have something wrong in pfsense forwards. Under diag menu the packet capture item.

Thanks again for the response.

What to you mean opened it? You need to forward it as well

My apologies, yes, port is forwarded...

For the record I have now managed to successfully forward this port via the double NAT setup, it appears that I was missing quite a crucial stage in forwarding the port I required on my pfSense via a NAT forwarding rule as apposed to just a firewall rule, upon creation of the NAT rule a firewall rule was automatically created to accommodate and now the port forwarding is working as needed.

This is beginning to make much more sense to me now. :D

It going to be easier to just put the ip address of pfsense wan into DMZ, or exposed HOST of your adsl router - now ALL unsolicited traffic will be sent to pfsense wan IP.

Hmm, please elaborate further, is this not a little bit of a security flaw?

Do you have anyway to put that adsl router into bridge mode so that pfsense gets public IP!

Sorry, no, my ADSL router is installed with default firmware from Virgin and has limited control over the routers capabilities.

So I would for a test, sniff on your pfsense wan interface - do you test, do you see the packets??

Upon sniffing on the WAN interface I appear to have captured an awful lot of packets from a variety of different global IPs to a widely varying range of ports! Is this ok?

Anyways, now that I have the port forwarding issue resolved I have one more question:

I have an SMB server running on the .1 subnet and would like to allow other machines on the .0 subnet to be able to access and use these resources, is there any special way to allow this level of communication across different subnets? A friend of mine told me that by default SMB is distributed across the broadcast address, is this correct? If so is it just a matter of creating an appropriate NAT/firewall rule or is there some particular method to allow hosts outside of .1 to 'see' hosts within it?

Why do you have boxes on the 0 network? Are these wireless clients to your isp router?

Are boxes on the 0 network to be considered hostile? Why do you want to run boxes behind pfsense and then have your own boxes on its wan side?

No smb does not go over broadcast, but broadcast can be used as a way to resolve a netbios name box with a smb share.. You could allow SMB or CIFS or whatever other file sharing you want to allow be it ftp, webdav, scp, sftp, AFP, etc.

But if these wireless boxes are under your control and you want them to be able to broadast for names and access your other boxes on the .1 network.. I would change out your setup.

Before we talk about that - its a Firewall yes there will be lots of noise/traffic on the WAN side.. And if you have clients on wireless clients on the 0 network you would be seeing that traffic as well.

Forwarding all ports, ie dmz, exposed host on your isp router to your pfsense would just mean pfsense would working as designed and seeing all the internet noise and then firewalling it, etc.

But I would prob suggest you change your config a bit and remove clients off the 0 and everything should be on the .1 behind pfsense.

So I would turn off wireless on your isp router, then get a wireless router and put it behind your pfsense as AP.. Then since you can not put your isp gateway into bridge mode. Set pfsense wan as dmz or exposed host on it - nothing would need to be on the 0 network now other than pfsense.

All your wireless and wired boxes behind pfsense would have access to file shares, could broadcast for names, etc. Now you wouldn't have to worry about doing forwards on 2 devices, isp router and pfsense when you want to allow unsolicited traffic inbound to one of your boxes behind pfsense. And the double nat can almost become mute - until you run into something that doesn't like double nats - ftp can be a bit of a pain as one example.

Yes, hosts on the .0 network are wireless clients using the ISP router, these machines do not belong to me, they belong to other housemates, 2 of which I would like to share my media with over the network. It would be totally feasible to add a wireless access point to my .1 network and allow these users to directly access these resources though it would cause problems disabling the wireless on .0 as other people in the building that I do not know would then be unable to access the internet, besides, I would prefer to have these users outside of .1 and safely on .0, my mum always told me not to let strangers into my private place...! :laugh:

I'm assuming that it will cause no issues allowing the others to stay wirelessly connected to .0 and allowing the 2 people I do want to access my resources a wireless connection to my .1 network?

Sure you could add another wireless AP to your .1 network - and then the wireless on .0 would be guests and hostile.

But if your really wanted you could allow specific IPs into your .1 from .0 for file shares.. They could just use IP vs name because your going to have issues with resolving name for pfsense wan IP.. They could always setup lmhost or host file on their boxes. I doubt your isp router allows you to manipulate dns for your own records?

If you wanted you connect your wireless AP on your private side of pfsense to different interface on the pfsense box and then bridge the interfaces to your wired interface and have some firewall controls and still allow for broadcast resolution, etc..

Other than that if you want to allow from 0 network you would have to forward the ports your using smb/cifs can be done over 445 you could allow 139 as well and you should be good. This would be a port forward to your box hosting the share..

So for example your pfsense sense wan is 192.168.0.20, and your private box hosting the share is 192.168.1.110, create a port forward for 139 tcp and 445 tcp to 192.168.1.110, then from your box on the 0 access \\192.168.0.20\ and you should see the shares.. Keep in mind they would have to auth to the box hosting the shares unless your allow guest type access, etc.

You might want to lock down these rules to only allow access from specific IPs on the 0, say 192.168.0.42 or something.. Hard part might be knowing which IPs on the 0 to allow? I would assume you wouldn't want to allow ALL, and don't do such a thing if you forward all traffic into pfsense wan port from isp router without a source IP restriction. I would assume other boxes on the 0 use dhcp and could change IPs, etc.. This will be the hard part about setting secure rules to only allow the 0 IPs you want to allow.

It would be better to setup your own wireless on .1 and secure that via PSK to people you want to access stuff on your network, you let them use your wireless network. Then they would use pfsense as their internet gateway as well in this setup. Or you could block them from using internet when on your wireless and only be able to access your shares and services on your .1 vs internet access, etc.

I've just been doing some testing further to the suggestions you made and have discovered that my pfSense box WAN interface is not visible in 'Network' from Windows clients on .0, I assumed that this should be visible? Could this be part of the reason why (or at least some explanation for), despite creating apparently correct forwarding rules, I am still unable to access my file sharing resources regarding that I am using IP vs hostname? I also tried created a hostname for my pfSense WAN interface for DHCP resolution on the .0 network and still no show...? I assume these are the issues you were referring to regarding name resolution for my WAN IP...?

I've also been having thoughts about creating a network mountable filing system of sorts instead of an SMB share as a possible workaround, I am assuming that this sort of service would prove to be somewhat less problematic than my current line of thought? What are your thoughts on this and could you possibly suggest any preferable protocols to use for this type of setup, bearing in mind the host for the present SMB share is running Server 2008 R2. (This will also eventually be my FTP/IIS7 etc. server...)

Other than that if you want to allow from 0 network you would have to forward the ports your using smb/cifs can be done over 445 you could allow 139 as well and you should be good. This would be a port forward to your box hosting the share..

So for example your pfsense sense wan is 192.168.0.20, and your private box hosting the share is 192.168.1.110, create a port forward for 139 tcp and 445 tcp to 192.168.1.110, then from your box on the 0 access \\192.168.0.20\ and you should see the shares.. Keep in mind they would have to auth to the box hosting the shares unless your allow guest type access, etc.

Just for clarification, I hope I am correct in assuming that this forward requires to be set as a rule on pfSense and not on the ADSL router otherwise I can see where I am going wrong with this suggestion...

Your not going to see pfsense wan in any browselist no.

If you forwarded 139 and 445 tcp to your 2k8r2 server and its sharing and allowing guest then you should be able to access via \\ipaddressofpfsensewan from 0 network. Use the run box and go directly there your never going to be able to use a browselist for this sort of access.

But no I would not think smb or cifs is a good protocol to use - I would use ftp or sftp, where sftp is much easier since its only 1 port. But 2k8r2 does not natively support ssh, so you would have to install that. So sure ftp would work.

This topic is now closed to further replies.
  • Posts

    • Write to your MP 😄 Like believing in Santa. Total surveillance IS the goal. Wake up.
    • This whole dumb age verification thing needs to die and be replaced by giving parents tools to control devices. Why am I required to plaster my ID all over the internet to prove I'm old enough when parents should be the ones dictating what their kids are doing on their phones. Apple released great set of tools for iPhones coming to iOS 27 that do just that. Why are governments not mandating that kind of control to phone makers to built them into phones. This whole thing is so absolutely idiotic it's wild.
    • Remeber this decade, when the free internet died... tell your grand kids about this, record there reaction and post it on InstaTwitBook.com
    • UK nudity blockers are a looming privacy disaster, we must be able to see the source code by Paul Hill Image via Pexels The UK government, just like many state governments in the US and national governments around the world, has begun going on a bit of a power trip when it comes to digital safety. The major step taken so far is the introduction of the Online Safety Act, which requires users to prove their age to access adult websites (it includes more than this, too). Now, UK PM Keir Starmer is calling on Apple and Google, and presumably other mobile OS makers, to scan phones for explicit images to protect children. This potentially mandatory on-device scanning by vendor-controlled software will create unacceptable harms to individual freedoms and transparency, and introduce massive surveillance risks. In a statement on June 8, the Prime Minister stated that big tech companies, such as Apple and Google, must add features to their platforms, such as iOS and Android, that will detect and block sexually explicit or nude images involving under-18s on phones or tablets. Adults who want to take or send nudes would be required to hand over some form of identification to stop their phone from blocking these pictures, creating unnecessary privacy risks. According to the government, it wants to see these measures implemented within three months; otherwise, the government will introduce legislation to force them to introduce such technology. The legislation will include fines for companies and maybe even criminal liability for tech bosses who do not comply with the measures. In its announcement, the government said that stopping users from taking, sending, or receiving nudes without verifying their age is technically feasible, and pointed to a British firm called SafeToNet, which has made proprietary, closed-source, uninstallable software called HarmBlock and is actively selling a device with it enabled and is working with other OEMs. The fact that this software is closed source is a huge problem because it’s a black box; you do not know what it is doing on your device. The fact that it is unremovable is also a problem because you lose control of a phone that you own. Laughably, the government, just before highlighting SafeToNet, says that companies must introduce such measures “without threatening privacy or collecting any data.” It then says over-18s will still be able to view adult content by providing proof of age… Which sounds to me like data collection. SafeToNet makes some debatable claims about HarmBlock The government’s example software, HarmBlock, is a hugely alarming choice to espouse the virtues of this type of software. SafeToNet claims that HarmBlock is “ethically developed,” but this is the opposite of the truth. This black box software puts digital handcuffs on you if it’s installed in your device, taking away your freedom to control what software runs on your device, as it cannot be removed. It is not even free software, so we cannot inspect the source code to see what it is doing. For all we know, it could be acting maliciously. While that’s unlikely, we can’t verify that it’s not doing that. When Google and Apple do inevitably integrate these features on devices in the UK, they are very likely to be closed-source binaries, which will also be non-auditable. They will also have identity services built into them, which will require at least temporary collection of sensitive identity documents to verify your age. One saving grace for Android users is that this nudity blocker will very likely be implemented within the Google Play infrastructure that’s deeply tied into commercial Android devices. However, anyone with enough determination to throw out Google apps from their phone by flashing a custom ROM could find they regain control over their phone again without these digital handcuffs. Obviously, this is only how I expect Google to implement the feature; if it bakes it into the open-source Android somehow, that would be bad news for anyone looking to escape it. Outside of stripping mobile phone users of their freedom and sovereignty over their devices, these proprietary on-device machine learning or hash-matching solutions cannot be independently audited. This means that hackers could potentially exploit them because security researchers can’t investigate the code, and they could overstep their intended use case and collect even more user data without anybody knowing. We also wouldn’t know if the code is prone to detecting false positives or biased classification, because we can’t see the code. In the government’s announcement, contributing comments from the Internet Watch Foundation keep talking about “on-device protections” as if to say that users don’t need to worry about server-side processing; however, this is misleading, as data could flow from devices for the purpose of updates, remote model changes, telemetry, or server-side matching. We’ve also seen with the Online Safety Act that the government is never content with the laws it introduces; it always wants to expand the controls. If this scanning functionality arrives on devices, it might only block nudes initially, but later governments could pressure vendors for expanded access or use mandated features for other surveillance aims. The introduction of on-device scanners opens the door to massive risks in the future. Once nude blocking becomes normalized, regulators like Ofcom or politicians themselves could push for more controls over people’s devices. Very possible candidates for blocking include hate speech, misinformation, or undesirable political content. Also, there is a chance that once Apple and Google have developed this software, they might attempt to reuse the infrastructure for commercial or foreign requests, putting customers in greater danger. Just the UK's demand for this sets a precedent. What if a dictatorship decides to spy on activists by demanding that Google or Apple implement similar controls? Another concern with this scanning is that it adds compliance costs for businesses looking to get into the mobile operating system space. While Google and Apple dominate the space right now, there are lots of smaller companies creating mobile operating systems too, including community projects with very shallow pockets. How are these smaller competitors supposed to implement sophisticated nudity detectors? Simply put, they can’t. Then the government goes after them, causes them to shut down, and Google and Apple have less competition. Image via Aurora Store For us users who value sovereignty over our technology, this development will force us to seek freedom-respecting alternatives. The simplest path forward will likely be to install a custom ROM on an Android device; however, kicking Google off the phone with its black box nudity blocker could also make it harder to access apps such as banking apps, which tend to need you to pass Google's integrity checks. Thankfully, Google Play Store apps can still be obtained by storefronts such as the Aurora Store, but it just adds to the friction. To be fair to those pushing this measure to protect children, I think it will be reasonably effective, but people will still try to find ways around it, just as they’ve done with age gates on adult websites introduced under the Online Safety Act. In the effort to find circumvention methods, it could lead users to join riskier platforms that introduce new dangers. This effort also diverts resources from proven interventions such as law enforcement cooperation, targeted investigations, education, and support services to broad technical controls that have uncertain effectiveness (due to their newness). If the government is set on introducing such tools, then there ought to be safeguards in place. Any mandated code should be released as free software so that it can be audited, and the binaries should be reproducible builds so that the public knows nothing has been tampered with in the code used to create the binaries shipped out. Ideally, these tools should also be voluntary, opt-in, and even community-run. This would also allow people to have full control over their hardware while allowing parents to flip a switch to turn on these protections for children, with the knowledge that the code being run is doing exactly what it says on the tin, and nothing nefarious, like a black box solution could be doing. The government should also have a narrow legal scope where this technology stays with blocking nudes and not spreading to blocking political opinions, hate speech, and so on. Ideally, any implementation should avoid identity-linked age verification to keep user data safe, and matching should be done locally with no server telemetry to ensure it is truly on-device. While I do understand that stakeholders such as parents want to keep children safe, the potential for abuse with this type of software is colossal. It would entrench black-box surveillance and take away our freedom to use our devices as we want. There is also the acute risk that the government will demand this surveillance be expanded to block other activities, which could be particularly dangerous. If you are in the UK and don’t wish to see these measures implemented, it is still possible to write to your MP, which could lead to some better safeguards being introduced before it’s too late. Once we get more technical information about how this will be implemented, then we will be able to see if de-Googling Android devices will bypass this measure. For anyone with an iPhone, there is zero chance that you’ll be able to take off these handcuffs because Apple doesn’t let you mess with your software.
  • Recent Achievements

    • Very Popular
      Captain_Eric earned a badge
      Very Popular
    • One Month Later
      amusc earned a badge
      One Month Later
    • One Month Later
      DJC50PLUS earned a badge
      One Month Later
    • Week One Done
      DJC50PLUS earned a badge
      Week One Done
    • Proficient
      Eric Biran went up a rank
      Proficient
  • Popular Contributors

    1. 1
      +primortal
      511
    2. 2
      PsYcHoKiLLa
      220
    3. 3
      ATLien_0
      92
    4. 4
      +Edouard
      90
    5. 5
      Steven P.
      83
  • Tell a friend

    Love Neowin? Tell a friend!