Comment Re:Unsurprising, To Me. (Score 1) 20
The biggest problem is caused by the deficiencies of legacy IPv4 and the various kludges to mitigate those deficiencies instead of using the proper solution.
Early versions of HTTP/HTTPS assumed one site per IP. It was quite easy for a firewall to whitelist and/or blacklist individual sites.
Then they added host headers and SNI to allow multiple sites to share a single IP. This is because legacy IPv4 is expensive and in short supply.
So now in order to whitelist/blacklist sites you need to filter at a higher level as you need to be able to match the host header not just the IP.
Once you add in SSL it gets even worse as your firewall devices cannot inspect the Host header without breaking SSL. Some places implement full SSL interception and MITM, but this then totally breaks with applications that enforce certificate pinning etc.
Yes it's a mess of kludge upon kludge, resulting in security problems, Move to IPv6 with unique IPs per site and these problems can go away.