Avon wrote (2021-05-14):

Security / Privacy
==================

Binkp secure encryption for all hubs.

Better privacy.

SSH officially supported.

SSH for specific echos.

# More discussion needed around these points. It's only as strong as weakest link and echomail may not have been designed with privacy in
mind. How best to enforce an echomail area only available via SSH?

What nobody mentioned was privacy regarding privacy laws and meta data. I know many (especially people from countries who don't have strict privacy regulations) argue that BBS are all private and stuff or privacy laws don't apply. Unfortunately or fortunately (depends on your point of view) this is not the case.

There are several aspects where the current practice in fsxNet and the BBSs connected to it are not compatible with the GDPR in the EU (General Data Protection Regulation) (I guess there are other countries with strict privacy laws that might apply too).

I see three ways to address it:

1) ignore it
2) refuse service to users from the EU (nodes, points, BBS users)
3) make fsxNet and BBSs adhere to the GDPR


Now we can jump directly to the discussion why BBSs are different and why there is no need to care about GDPR and stuff ... ;)



Regarding security and transport encryption (CRYPT / TLS / SSH): I wouldn't trust collaborative security measures that only try to encrypt the traffic. If you want private conversations that don't leak, you always can setup private feeds between nodes and points and crash netmail. Or use some kind of e2e encryption. Some sysop / BBS / web echomail will offer it unencrypted or feed it to the Google at some point. Encrypt everything (TLS / SSH) is still good practice.

# We could choose to 'secure' the network using something like ZeroTier

I used ZeroTier and it's quite easy to setup and works, but I dislike the idea to use a commercial provider for the basic infrastructure. FTN is DIY.

# We can offer echos and netmail but not privacy

In some countries you are not allowed to offer anything then.

---
* Origin: . (21:3/102)

There are several aspects where the current practice in fsxNet and the
BBSs connected to it are not compatible with the GDPR in the EU
(General Data Protection Regulation) (I guess there are other
countries with strict privacy laws that might apply too).

I don't really understand how european laws are enforcable in
non-european nations? If the BBS was in europe, sure, they must comply to european laws, but if a BBS is in another country.. do we have
international agreements to honour GDPR laws? Am I going to get
extradited from Australia if a European user logs into my BBS?

I don't see any need to block europeans from fsxnet / BBSing, it's up to
them to comply with their own laws. What's to stop a european from
logging into a BBS via a proxy even if we did block them all out?

Ok, now say we care about the GDPR, how do we comply? is it simply a
matter of having a privacy policy?

Personally, I don't care. I'm not in europe, I'm never going to europe,
and I'm kind of offended that europeans think they can enforce their
moronic laws on the entire world?

Andrew

--
|03Andrew Pamment |08(|11apam|08)
|13Happy|10Land |14v2.0|08!|07


--- Talisman v0.21-dev (Linux/x86_64)
* Origin: HappyLand v2.0 - telnet://happylandbbs.com:11892/ (21:1/182)

Re: fsxNet Feedback ("Privacy")
By: Oli to Avon on Fri May 14 2021 08:05 am

# We could choose to 'secure' the network using something like ZeroTier

I used ZeroTier and it's quite easy to setup and works, but I dislike the idea to use a commercial provider for the basic infrastructure. FTN is DIY.

You dont have to use "a provider" with ZeroTier.

I run a ZeroTier network that is independant of "zerotier" (the provider) itself.

While you may argue that you "find" me through their root server (which is the default) - it doesnt "have" to operate that way. I can populate a "moon" that you "orbit" around (their terms, not mine) so that zerotier can be turned off and our connection still works.

I know ZeroTier were working on personal "roots" so that this moon thing has a less of a value (and they are no longer a sudo dependancy). (I havent kept up with it recently though.)

The other good thing, with ZeroTier, you dont necessarily provide anybody on the network (who needs to be authorised if it is configured to do so), to see everything on all ports. You can firewall it to a certain extent (at the network layer), such that only specific ports are permitted on the network. (I did setup the FSX zerotier network this way.) (You could also have your own running firewall as well if you wanted.)

...ëîåï

... MONEY TALKS...but all mine ever says is GOODBYE!
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback ("Privacy")
By: apam to Oli on Fri May 14 2021 05:19 pm

I don't really understand how european laws are enforcable in
non-european nations? If the BBS was in europe, sure, they must comply to european laws, but if a BBS is in another country.. do we have
international agreements to honour GDPR laws? Am I going to get
extradited from Australia if a European user logs into my BBS?

Well, "technically" the GDPR applies to any system that has a european who uses it - including those outside of Europe. But your point is valid - are they going to come after you apam, and fine you because your "BBS" has europeans on it and you are not following the law.

I personally dont care too much about it - european or not. If we in Australia had such a thing I dont think I would behave differently.

My response would be, "you have the choice to login or not - you have no rights here (but I'll do my best to respect you, if you do too)."

...ëîåï

... The purpose of computing is insight, not numbers.
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

apam wrote (2021-05-14):

There are several aspects where the current practice in fsxNet and the
BBSs connected to it are not compatible with the GDPR in the EU
(General Data Protection Regulation) (I guess there are other
countries with strict privacy laws that might apply too).

I don't really understand how european laws are enforcable in
non-european nations? If the BBS was in europe, sure, they must comply to european laws, but if a BBS is in another country.. do we have international agreements to honour GDPR laws? Am I going to get
extradited from Australia if a European user logs into my BBS?

You are free to give a shit, I also don't see that it is enforceable (in the case of a BBS operating outside of the EU). It also will get more confusing, when other countries will introduce similar, but slightly different regulations and laws. I'm not sure how individuals and small organizations will be able to handle it (it's already a problem).

I don't see any need to block europeans from fsxnet / BBSing, it's up to them to comply with their own laws. What's to stop a european from
logging into a BBS via a proxy even if we did block them all out?

You still violating the GDPR, if you don't comply (without any consequences for you). But for sysops / nodes / hubs / bbs who are operating in the EU, it might me a problem.

Ok, now say we care about the GDPR, how do we comply? is it simply a
matter of having a privacy policy?

Personally, I don't care. I'm not in europe, I'm never going to europe,
and I'm kind of offended that europeans think they can enforce their moronic laws on the entire world?

So you don't know the GDPR, but you know it is a moronic law? I wonder how a non-moronic law would look like and work.


The basic rules are:

- don't store and process personal data that are not technical essential
- get informed consent for the storage and processing of personal data in advance
- don't make optional (non-essential) personal data a condition (as in non-optional) for using the service
- don't leak / transmit personal data to third parties (without informed consent)

or something like this.

I privacy policy that says: agree to everything or leave is most likely not sufficient (and harmful to the idea of data protection). On the other hand I would find it acceptable to read the message: this is a private BBS. I'm unable to become an expert in every fucking data protection law in every country in my limited free time. If your not from Australia, disconnect or live with the consequences ... ;).

---
* Origin: . (21:3/102)

So you don't know the GDPR, but you know it is a moronic law? I wonder
how a non-moronic law would look like and work.

Hmm, I'm not a lawyer (are you?), so no I don't know all about it... I
know it's effects though, in that we're even having this conversation
about blocking people in europe from a BBS because "privacy" ....

- don't store and process personal data that are not technical
essential

So no wishing users happy birthday. No last 10 callers that include a "location" no real names? All these things are easily faked by anyone who
is concerned about their privacy.. the only thing technically essential
is a username and password.. and I'm not sure that is personal?

- get informed consent for the storage and processing of personal data
in advance

Ok, so privacy policy... here is a legal mumbo jumbo for you to say yes
too if you want to access the service... who reads those? and those who
don't read them, can they complain they are uninformed?

- don't make optional (non-essential) personal data a condition (as in non-optional) for using the service

Ok. But it's my service. not yours, if you want to access my service why
to you get to dictate the rules?

- don't leak / transmit personal data to third parties (without
informed consent)

This one is good, I like this one.

Andrew
--
|03Andrew Pamment |08(|11apam|08)
|13Happy|10Land |14v2.0|08!|07


--- Talisman v0.21-dev (Linux/x86_64)
* Origin: HappyLand v2.0 - telnet://happylandbbs.com:11892/ (21:1/182)

deon wrote (2021-05-14):

# We could choose to 'secure' the network using something like
ZeroTier

I used ZeroTier and it's quite easy to setup and works, but I
dislike the idea to use a commercial provider for the basic
infrastructure. FTN is DIY.

You dont have to use "a provider" with ZeroTier.

I run a ZeroTier network that is independant of "zerotier" (the provider) itself.

Is it completely independent?

Wikipedia tells me: "Virtual networks are created and managed using a ZeroTier controller. Management is done using an API, proprietary web-based UI (ZeroTier Central), open-source web-based or CLI alternative. Using root servers other than those hosted by ZeroTier Inc. is *impeded* by the software's license.

While you may argue that you "find" me through their root server (which
is the default) - it doesnt "have" to operate that way. I can populate a "moon" that you "orbit" around (their terms, not mine) so that zerotier
can be turned off and our connection still works.

I know ZeroTier were working on personal "roots" so that this moon thing has a less of a value (and they are no longer a sudo dependancy). (I
havent kept up with it recently though.)

root, moons, orbits, ... contr

The other good thing, with ZeroTier, you dont necessarily provide anybody on the network (who needs to be authorised if it is configured to do so), to see everything on all ports. You can firewall it to a certain extent
(at the network layer), such that only specific ports are permitted on
the network. (I did setup the FSX zerotier network this way.) (You could also have your own running firewall as well if you wanted.)

Can I configure the ports or has the admin the power to change the rules at will?

Is it possible to use ZeroTier in a really decentralized way?

---
* Origin: . (21:3/102)

Re: fsxNet Feedback (ZeroTier)
By: Oli to deon on Fri May 14 2021 11:19 am

Is it completely independent?

Yes - https://www.zerotier.com/manual/#4_4

Wikipedia tells me: "Virtual networks are created and managed using a ZeroTier controller. Management is done using an API,
proprietary web-based UI (ZeroTier Central), open-source web-based or CLI alternative. Using root servers other than those hosted by
ZeroTier Inc. is *impeded* by the software's license.

It seems illogical to impede the use of their roots via the software license, when their documentation tells you how to do it (via moons).

Can I configure the ports or has the admin the power to change the rules at will?

The owner of the network controls the ports for the network. But you with a (virtual) interface to the network can apply your OS level firewalling - in the same way you may want to firewall one host from another on the same ethernet network.

Is it possible to use ZeroTier in a really decentralized way?

Yes, I believe so - even though I've not actually tried it with any system not connected to the internet.

The concept is similar to DNS - my DNS server isnt authoritive for .de domains - it finds them via "known" root servers and thus can resolve .de addresses. OR if I configure my DNS server directly with the information of the root .de TLD, it doesnt need to query the known roots to find them.

So I run my own controller, configure my own network on that controller and you as an endpoint can find my network, directly if you configure my "moon" or indirectly via the root servers (aka planets). If zerotier shuts down their root servers, you will still continue to function if you have my moon configured.

...ëîåï

... Elevators smell different to midgets
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback (ZeroTier)
By: Oli to deon on Fri May 14 2021 08:31 pm

Another incredibly powerful feature of ZeroTier is the ability to tap the entire network regardless of how widely distributed its
nodes are. Using the tee ability within a flow rule essentially copies every frame sent/received by nodes on the network and sends it
to a node of your choice such as an IDS or full packet capture solution such as Moloch.
from: https://blog.reconinfosec.com/locking-down-zerotier/

see also: https://www.zerotier.com/2016/08/31/capability-based-security-for-virtual-networks/
headline "Global Rules and Security Monitoring"

Is there a way to prevent this?

I dont see this as an issue, it would be no differnet to tcpdump -ni eth0:

a) You can firewall what goes into the interface (aka the network) - as well as firewall what is coming to you.

b) Communications is peer to peer - the network (like the DNS analogy I gave) provides a way for you to find me. Once you do, you communicate directly to me (not via the planets and moons).

c) Communications between you and me is encrypted - with a key that you an I create once you find me. (This part I may have misread - and in fact the key may be the network key that all members have joined.)

While still a "VPN" - it is still semi public, so you still have obligations. Their are people you dont know on the network - but not *anybody* - the network "admin" can choose to "authorise" (or not) those requesting to join it.

So in the case of a

It's still kind of centralized (your moon).

If you are on "my" network, sure. But if you created your own network you have no dependancy (if you choose so) to use my moon. You could deploy your own.

...ëîåï

... Wait! You have not been prepared! Mr. Atoz, stardate 3113.2.
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback (ZeroTier)
By: deon to Oli on Sat May 15 2021 09:44 am

So crap, hit something and my last message was sent..

While still a "VPN" - it is still semi public, so you still have obligations. Their are people you dont know on the network - but not
*anybody* - the network "admin" can choose to "authorise" (or not) those requesting to join it.

So in the case of a

So in the case of a "network" setup for "fsx" - the network admin would authorise nodes to access the "fsx" network (I would suggest based on their application to join the network) - and de-authorise them when they leave the network.

We are still strangers here, but we are a list of known strangers and we can identify who is doing something in appropriate on the network and take action if that is deemeed the right response. But at the same time, our conversations and traffic is encrypted from the outside world.

Anybody outside of the network cant get to our systems and do stuff (which is the script kiddies reference I made when I started this thread).

...ëîåï

... Committees: A group that takes minutes and wastes hours.
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback (ZeroTier
By: N1uro to deon on Fri May 14 2021 09:22 pm

Hi,

Any VPN has to have some sort of a hub. Even ZeroTier. At least with OpenVPN it's open source, and we could customize it to how we
see fit and we need
not announce which port or which protocol type we decide to use.

So I dont agree with you.

If traffic from A to C must go through "B", then yes, "B" is a hub.

With ZeroTier traffic goes direct A to C. B is only used for A to find C, but traffic does not go through it. (In much the same way you ("A") query a DNS server (aka "B") to find the server ("C"), a web server with your browser.)

B in this example can be ZeroTier infrastructure or your own.

The root nodes in this case would be hubs. There needs to be a central point within each network to host and serve the proper
security certs. Even with OpenVPN, a point/node would still be able to see another point/node within the private IP network. That

So no.

Like web serving - the DNS server has nothing to do with the SSL exchange that occurs when you "A" and the server "C" when you are browsing a secure website.

...ëîåï

... Old age is life's parody.
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback (ZeroTier)
By: deon to N1uro on Sat May 15 2021 01:26 pm

The root nodes in this case would be hubs. There needs to be a central point within each network to host and serve the proper
security certs. Even with OpenVPN, a point/node would still be able to see another point/node within the private IP network.
That

So no.

Like web serving - the DNS server has nothing to do with the SSL exchange that occurs when you "A" and the server "C" when you are
browsing a secure website.

So I'll concede a little here. "B" wont let you find "C" unless you've been authorised (if it is setup that way), and "C" knows you've been authorised, because you have a token that is signed by "B", that "C" can verify with "B"'s public cert.

So from that point of view "B" is a requirement to instigate a conversation, but not to maintain it. As an example, I have a zerotier controller that serves a network for another FTN. Over the last 6 months, that controller has been down more times than its been up (because I forget to start it), but that two systems that exchange mail over that network havent missed a beat.

(Which reminds me, I need to check its running since I've moved stuff around...)

...ëîåï

... Diogenes is still searching.
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

deon wrote (2021-05-15):

So in the case of a "network" setup for "fsx" - the network admin would authorise nodes to access the "fsx" network (I would suggest based on
their application to join the network) - and de-authorise them when they leave the network.

-1

We are still strangers here, but we are a list of known strangers and we can identify who is doing something in appropriate on the network and
take action if that is deemeed the right response.

-1

But at the same time,
our conversations and traffic is encrypted from the outside world.

there are other ways for encryption, which fit the FTN model better.

Anybody outside of the network cant get to our systems and do stuff
(which is the script kiddies reference I made when I started this thread).

So you propose everything should happen within the VPN? No open BBS / binkp ports to the real Internet?

-1

---
* Origin: . (21:3/102)

deon wrote (2021-05-15):

Another incredibly powerful feature of ZeroTier is the ability to
tap the entire network regardless of how widely distributed its
nodes are.

Is there a way to prevent this?

I dont see this as an issue, it would be no differnet to tcpdump -ni eth0:

I was not aware that you can monitor all of my fsxnet traffic with a tcpdump on your side.

For a corporate network this is obviously a feature, but in our use case I would call it a security flaw.

---
* Origin: . (21:3/102)

Re: fsxNet Feedback (ZeroTier)
By: Oli to deon on Sun May 16 2021 03:43 pm

Anybody outside of the network cant get to our systems and do stuff
(which is the script kiddies reference I made when I started this thread).

So you propose everything should happen within the VPN? No open BBS / binkp ports to the real Internet?

No, its not an all or nothing. As an example, my hub is connected to a ZeroTier VPN for another net, but folks can still get to it for FSX.

You can *choose* to connect to the VPN or not. I doubt we would see the day that you are forced to join a VPN for folks to interact with your BBS.

My suggestion was to use the technology to obtain a benefit or two - some of those benefits I think are useful - I'm not suggesting that everybody thinks the same.

The benefits were:

* Securing transmission
* Adding some privacy to connections between systems - which can extend to the user logging in telnet and the EMSI/BINKP exchanges of mail/files.
* By definition of the above, reducing the "script kiddies" from bashing ports * And, to achieve all of the above, is just a client that needs to be installed.

I know I would close my binkp/emsi to public interfaces if access to those services was a "standard" via a virtual network. I just makes sense to me.

So in the case of a "network" setup for "fsx" - the network admin would authorise nodes to access the "fsx" network (I would suggest based on
their application to join the network) - and de-authorise them when they leave the network.

-1

If there was an FSX "VPN", I dont see a reason to allow folks on that VPN if there are not part of FSX - so I dont understand your '-1' thinking.

We are still strangers here, but we are a list of known strangers and we can identify who is doing something in appropriate on the network and
take action if that is deemeed the right response.

-1

Likewise, I dont understand your thinking. It would be easier to identify if somebody was doing something inappropriate on the network, and an easy way to address it. I'm wondering if your concern is to do with the fact that you can be removed from the network by somebody who "manages it" if your conduct was determined to be unappropriate?

there are other ways for encryption, which fit the FTN model better.

Sure, suggest some - since I think this discussion started by your comments around privacy and security.

...ëîåï
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)

Re: fsxNet Feedback (ZeroTier)
By: Oli to deon on Sun May 16 2021 03:52 pm

Another incredibly powerful feature of ZeroTier is the ability to
tap the entire network regardless of how widely distributed its
nodes are.

Is there a way to prevent this?

I dont see this as an issue, it would be no differnet to tcpdump -ni eth0:

I was not aware that you can monitor all of my fsxnet traffic with a tcpdump on your side.

For a corporate network this is obviously a feature, but in our use case I would call it a security flaw.

I didnt say I could see "all traffic" - infact I've been explaining how its peer to peer all along - so there is no way I can see your traffic to another node, since it doesnt come via me.

But I can see any traffic that broadcasts on the network (BAU), as well as any traffic that is destined to me, via a TCPDUMP. (I think from memory that broadcasts can be blocked via configuration, and thus if so, I would see them.)

The interface that ZT creates is similar to a switched ethernet interface - anything that comes down that port I can see.

...ëîåï
--- SBBSecho 3.14-Linux
* Origin: I'm playing with ANSI+videotex - wanna play too? (21:2/116)