Thread by @juanandres_gs

There are three things you don't want to see made– laws, sausages, and threat intelligence.

Frankly, I'm bummed out at the framing of this issue. It adds fuel to the air-quote 'privacy' debate that keeps eating away at our ability to do security research, as in the case of GDPR.

https://twitter.com/josephfcox/status/1430161392364044292

I've played with Augury before. Netflow can be useful. But for the most part it's spotty, incomplete, and inconclusive. You don't turn into a SIGINT agency because you have visibility into a few hops along a path for a sliver of time. Internet routing doesn't work that way.

You're seeing points connecting to other points at a given time. If the connection is routed a different way, if it takes a hop you don't have access to, if any number of factors changes the connective tissue of the internet, you don't see anything.

While I personally don't care much for netflow (net isn't my specialty), I'm dismayed to see it framed as a burning privacy violation. It reminds me of the nonsense surrounding Whois data that landed us with this overblown GDPR fiasco- the 'thoughts and prayers' of privacy.

The internet isn't a monolithic entity. It's made up of many discreet points connecting many different resources hosted by tons of organizations you know nothing about. A VPN is a choice of where to route some of that along the way (that entails *A LOT* of trust in one org)

I'm not telling you that there's no such thing is a privacy. I'm telling you that realistic privacy on the internet has to take into account the fabric of that medium and the intent of its use. It entails trust in any number of orgs. And along the way it involves bad faith actors

In the absence of effective options to strike at bad faith actors, we are instead focusing regulations, legislations, and public outcry on clawing back the very aperture that allows us to identify, track, and impose costs on those bad faith actors and that's worth reconsidering.