So... why are NVIDIA drivers suddenly taboo to download?

Can you show the block web filter entry and also the regex? 

^[A-Za-z0-9.-]*\.download\.nvidia\.com/

I just tried again today, and the only thing I've changed since the original post was the regex, which my original regex is in an above post.

If I add the Shareware/Freeware category, it works.

This time, I did not use GeForce Experience to download the driver, this was a driver update in Linux Mint OS, which is a requirement to update the video driver before I can install my 3d printer program.

You should also take note that the DNS names listed in these two filter logs are both pointing to the same DST IP, so... yeah.

EDIT: Just added the category to this exception, and it's installing. 

Amodin said:

EDIT: Just added the category to this exception, and it's installing. 

I was almost going to recommend creating a FQDN host definition for download.nvidia.com, and then creating a new webfilter policy allowing shareware & freeware, then add a firewall rule that allows this Nvidia FQDN as the destination, using the newly created web filter policy.

convoluted approach???

It's basically doing exactly what I did here.  The point of all this is:  It's not Shareware, it bypasses firewall rules when you apply a category that should otherwise be blocked, and it wasn't ever like this to begin with until recently when someone got the notion to think drivers were shareware.  SMH.

You can't even use the excuse of using GeForce Experience because directly downloading drivers through an operating system has the same issue.

Why is Nvidia not Share/Freeware? Isnt this the definition of Freeware, if you can download it without any restricition and use it? https://en.wikipedia.org/wiki/Freeware 

The issue is that the nvidia drivers are more like Software Updates than shareware and should be categorized as that. The categorization makes no distinction between Freeware and Shareware which are lumped together as an umbrella term in the same category.

The other issue is that even though Amodin was blocking downloads from China, the driver downloads were allowed once the Shareware exception was made, because of your explanation above.

Which is why granularity rules are recommended, and the web exception should now only allow nvidia driver downloads from China/U.S. with no risk of allowing other downloads from China.

Try: ^[A-Za-z0-9.-]*\.download\.nvidia\.com/

Then by your definition, any driver set to update a computer or peripheral should be categorized as Shareware/Freeware and blocked as such, including but not limited to, Microsoft Updates.  Drivers are no different.

LuCar Toni said:

Try: ^[A-Za-z0-9.-]*\.download\.nvidia\.com/

This is exactly the same regex that I posted above, and it doesn't work either.

alan weir said:

Which is why granularity rules are recommended, and the web exception should now only allow nvidia driver downloads from China/U.S. with no risk of allowing other downloads from China.

But that's the thing, today was not a China-based CDN, and frankly neither was the original one, as it went to the same IP address, which is U.S. based on ARIN and ASN number.

How would an actual network admin handle this issue? Do most companies just contact Sophos support, and they remotely administer the firewall? Wanting to know how it is actually handled in a real world scenario, and the correct, recommended method. 

Based on Lucar’s answer all software and firmware updates should be classified as shareware eg XG firmware updates anti whatever to the desktop etc.

ian