Eventually that leaves the load to the source event if it’s differed. And the load would still grow along the growth of the fediverse. So this would likely be pushing the issue to tomorrow. Signing content checksum isn’t exactly like reinventing a wheel, it’s something done in many contexts. And it removes the load from the source entirely.

Yeah there must be some trust indeed of the og instance. A scoring system could help with that.

Add metadata with a checksum of the og one with signature and let each client check that up.

I’m still waiting for Bright 2….

why would one do either? By whitelisting you entirely prevent traffic. API auth takes processing. How wrong is it? Maybe for your home usage it’s good enough but layering measures has value…

any users experience traffic shaping (throttling) when their ISPs detect heavy UDP traffic (like torrenting or IPTV) via standard VPN ports, whereas standard HTTPS traffic is generally left alone.

We don’t do shaping at our side bar some specific temporary instances to mitigate DDOS attacks. Even IPTV we won’t shape otherwise we stop being mere conduit and no one at ISP side wants that for very obvious juridic reasons.

Furthermore, even if the ISP only keeps metadata for internal routing and infrastructure management, those databases still exist. In an era of constant data breaches, many privacy-conscious users prefer that their connection logs simply show them connecting to standard CDNs (via TLS obfuscation) rather than persistent connections to known VPN datacenters.

As stated we don’t store that information relative to our customers (unless they us to do so) but from the perspective of our border routers so there should be no concerns.

See we have this wonderful GDPR thing that keeps me fed and allows me to enforce a whole lot of privacy practices at work.

I apologize if the post came across as fear-mongering; that wasn’t the intention. Your perspective from inside the ISP infrastructure is highly valued here!

Maybe start with another title then? Something more at content provider side who are absolutely not bound to our european regulations and have commercial interests in shaping, geoloc & other…

As someone responsible for this exact topic in a european ISP you are absolutely wrong on most accounts.

And that’s not even touching the purpose for which we collect connection metadata ; the collections containing this level of details is not provided to authorities on a global level, They would need a warrant to force us to do any disclosure on an individual level. We use some of that sort of data internally for the management of our infrastructure for which I fail to see how anyone would take offense in given it’s from the perspective of our border routers and not on an individual basis.

Maybe you want to take your fear mongering and related advertisement to elsewhere?

Are we legally required to log connection metadata to the level allowing general identification of VPN usage?? where are you getting that from?

I had more fun opening loot boxes than using AI at work though

Maybe that’s not the most popular content on my Plex config but all my fishing session recordings are on it and those belong to me :)

Neat. Is the author of that piece of engineering known? What subcontractor company made this?

Let’s celebrate this victory… even though it’s concerning that it is a recurring topic :-/

There’s nothing of the sort in OP’s post. Maybe you have such a use-case?

Also it’s literally implemented where I am from and the government isn’t the worse party yet for us.

Private from the service side, not from the trust provider obviously.

It works well enough across Europe with many of such systems being compatible enough for things like petitions at EU level.

Not perfect but much faster than the notary system… and way cheaper as well if your notaries are the same as mine.

I’m not advocating blind trust. Nor being too trusty. The specific point here is service access with need of proof of age.

The threat I was addressing in this instance is the service provider not the trust provider.

Other patterns apply for scenarios in which government is a threat a well.

Let’s not let perfect be the enemy of good enough.

In Belgium we have « it’s me » which is government - backed.

Based on configuration you can integrate a service with it and, if the service is respectful and not greedy, you can get a flag indicating majority of a person without the full PII.

The user sees on its screen what data will be provided to the service.

So it’s rather transparent and honestly not bad from a privacy perspective.

Personally I’m fan of ROA.

Now from being involved on providing said right to our beloved customers I have to say that weaponizing gdpr is definitely happening and that’s… not cool. And the weapon isn’t always aimed at said company : something it might be aimed at past love interests or worse I would imagine.

Still I believe the benefits outweigh the risks.

They don’t provide you any equipment ? Then good. It’s very typical for them to do so.

On top of client VPNs you might consider the possible other freebies from yr ISP such as router, WiFi access points and other network elements they provide you with. Set-op-boxes as well. All those equipments are absolutely ratting you as much as possible. Also any software including mobile apps they provide for support / billing / whatever.