4 ms·
So they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?
by Tinyyy 8y ago
So they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?
- foobarbazetc 8y agoYou can’t really stop someone from domain fronting on any CDN. This is like “maybe you should have not talked about this on HN”. :)
- dsl 8y agoFixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header. The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).
- Boulth 8y agoThis also breaks non terminating load balancers.
- foobarbazetc 8y agoI’ve used every major CDN on the market and none of them do this. Some don’t even check that the Host header host is a customer and just proxy it anyway.
- dsl 8y agoI said the fix was easy, not that people were actually fixing it. :/
- tzakrajs 8y agoExactly, bragging about this hack made them do something about it.
- goatsi 8y agoThe post that alerted AWS was submitted by HN user hapnin, who I don't believe has anything to do with Signal.
- glogla 8y agoBut he got thousands of people censored. I hope he's happy.
- dogecoinbase 8y agoThis is not useful. The great thing about domain fronting when e.g. Google semi-officially supported it is that it is a non-secret technique which leverages the unique status of a large-scale technical operation that the citizenry demands access to. It allows the citizenry of an oppressive state to engage in collective action via the machinery of global capitalism. Google and Amazon should not only be supporting this practice, but celebrating it. Subverting an oppressive state is a moral good. Specifically cutting off anonymous, safe communication paths for those being oppressed is, to put it mildly, fucking evil.
- s73v3r_ 8y agoMore evil than cutting off all the other users of other services that chose to host with AWS/Google? Cause that's what happened when Russia banned Telegram, and Russia didn't show any problem with doing it again.