Re: filtering HTTPS/CONNECT (summary and continuation of discussion)

On 20.03.2012 07:52, Marcus Kool wrote:
> On 03/19/2012 01:48 PM, Henrik Nordström wrote:
>> mån 2012-03-19 klockan 11:35 -0300 skrev Marcus Kool:
>>> An unfiltered CONNECT (default for Squid) allows (SSH) tunnels.
>>
>> Squid standard configuration only allows port 443, which restricts
>> this
>> to those who intentioanlly want to pierce any network usage policy.
>>
>>> I foresee a change. I foresee an increasing desire to be able to
>>> filter everything because of the need to remove the existing holes
>>> in security.
>>
>> There is undoubtly such environments.
>>
>> The question is if Squid is the right tool for this, or if it's in
>> the
>> target for Squid.
>
> This is an important point.
>
> It is the development team who makes the decision which features
> will be implemented. Surely there is some common idea about
> which direction Squid will go to but it is not clear to me.
> I read the roadmap but it is sort of a wishlist and therefore I
> started this discussion.
> As Alex stated, there is no use in starting work on a pipe
> filter for the filter if there is no Squid developer interested
> in doing the work on Squid.
>
> I am not in the position to actively support pipe filtering,
> so the only thing that I can do is ask for it.
>
> Best regards
> Marcus

Well, "herd of cats" is a term I've seen recently to describe FOSS
project dev teams. Pretty accurate. You yourself are already part of the
team simply by dint of your contribution pushing this discussion far
enough forward to get a work plan out of it.

With the work plan it should be easy to make up quotes and try to get
sponsorship for all or parts of it. Some parts can be crossed between
projects and prioritized by those of us interested in general code
cleanups or proposed to a wider audience of sponsors than would support
the feature you are asking for.

Amos
Received on Tue Mar 20 2012 - 01:29:54 MDT