Which corporate IT policy or firewall rule is being circumvented in this scenario?

Question

The question is being flagged as off topic for violating one of the prohibited questions rules, namely "unauthorized use or misuse of IT systems".

I will explain why this is not about circumventing policy:

If the IT administrator blocks all streaming video at the firewall, we cannot and will not try to work around it. We overnight a DVD to those users. Could we ask the IT administrator to unblock only video from our site? Sure. But we don't have time to do that nor wait for it to happen. We need to get the users trained ASAP.

If the IT administrator blocks Vimeo, we want to serve the video from our site. The moderator that flagged the question suggested this approach himself:

Our server will download the appropriate version of the video from Vimeo on the fly (maybe cache it for an hour) and serve it to the client. The other resources necessary to play the video (JS, JSON) are permanently stored on our server, and are modified to tell the client to request the video from our servers.

This is not about circumventing policy. This is a creative solution to allow us to keep only one Online Video Network solution and almost always be able to deliver the video to our end-users. We have used multiple OVNs in the past, such as JWPlatfom and Kaltura, along with Vimeo, and the application would try all three of them before giving up, but there are situations in which they are all blocked specifically (as opposed to blocking any video streaming). We have now decided to use only one OVN and fallback to our server to serve the videos.

Why don't we straight host it all ourselves? Because aside from stored, online video needs to be transcoded (multiple formats need to be stored + cost/time to transcode), served (bandwidth costs), tracked (we cannot come close to building the analytics infrastructure OVNs have) and CDN'ed (which we can do but it comes bundled more cost effectively in an OVN service). Most importantly, an OVN is the most cost effective way to use these services together.

The question comes to this: what is the difference between self hosting and relaying the video thru our server? The video is coming from our servers either way, but in the opinion of the moderator who locked the question, whether the video sits on our server OR is being relayed thru our server determines whether policy is or isn't being circumvented. Ok then. How about this? My application sits on a server in the Google Cloud. The videos are stored on S3. S3 is blocked by the client's firewall. We only serve the video thru our application server. Is policy being circumvented in this case?

BTW: all of this is OUR content behind password protection in our application. Additionally, we cannot possibly contact IT for all these facilities all over the world - some of them barely speak english. Others have no dedicated staff. Others are buried in bureaucracy. Most importantly, they decided to block Vimeo, which is understandable, and they can't unblock only OUR videos at Vimeo.

I hereby ask for suggestions on how to improve the question so it can be re-opened.

Answer 1

I hereby ask for suggestions on how to improve the question so it can be re-opened.

It cannot.

Our policy is quite simple.

If there is a device that you do not control that is causing you pain then the only solution is to work with the people who control the device to get the access you require.

This is a fairly long standing policy, we apply it consistently.

Answer 2

I'm going go try and lay out my thinking on this in as clear a fashion as possible. To start, I'm going to list out the facts you've provided, those that are truly core to this question:

1. your goal is to reliably deliver video content to users
2. some of these users aren't able to view videos from Vimeo directly
3. you are trying to resolve this problem some way that doesn't require you to self-host the video

Is that an accurate understanding? There is another group of facts you've provided - these are interesting, but are quite orthogonal to the issue of whether or not policy is being circumvented. These are:

1. You need to get people trained as quickly as possible
2. You need to be able to track video views and produce a training log
3. Some IT departments don't block all streaming video, but do block Vimeo for some reason

As I asked in a comment above, and please be honest with yourself here: what is the difference between you serving as a proxy and allowing employees to access blocked data, and that same employee using a proxy site to access blocked data? Both of those are allowing an employee to access data that would otherwise be blocked.

If a corporate IT department has blocked Vimeo access, there's likely a good reason they've done so, and making the assumption that you can should just circumvent that is problematic, and is the reason why your question is off-topic. This is no different than an employee posting a question here asking how they can get around corporate firewall rules to do X. It does not matter that you need to "get people trained as quickly as possible". It does not matter that the IT department has blocked Vimeo, but not blocked other services. It does not matter that you don't want to self-host due to the complexities of running a reliable and feature-filled video hosting service. Honestly. None of those things matter - they are your business matters that you and your users need to wrestle with. They're not technical matters that in any way contribute to this discussion.

The way I see it, you have two options:

1. Bite the bullet and self-host.
2. Engage with corporate IT to get things un-blocked. I know this can be an arduous process - that's not your problem. That is the problem of whomever in the organization is wanting their people to get trained. If that person wants to use your serviced, they need to work with IT to make it happen. That's outside your realm of responsibility.

To conclude - we will not facilitate policy circumvention, whether that's from within or without an organization. Doing so is shooting ourselves in the foot and is doing our fellow systems and network administrators a great disrespect.

Oh, and to directly answer your question:

Which corporate IT policy or firewall rule is being circumvented in this scenario?

The one that blocks access to Vimeo-hosted content.