6 ms·

I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite rea

I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.

gue5t 8y ago
Hardly reasonable. Domains are (in reality, if not in legislative fantasy) property of ICANN and merely rented by everyone else.
- CoryG89 8y ago
  So? If we qualify it to preventing unauthorized use of one of their rented domains does that make it any less reasonable?
  - caf 8y ago
    The conceit here is that you must be "authorized" in order to write an app that puts the domain in question into the SNI field of a TLS connection that it initiates. I don't think that's reasonable. It is of course up to Amazon what their servers then do when presented with such a connection, in particular whether they ensure the Host: header later presented matches the SNI data.
- bdcravens 8y ago
  So have they obtained the permission of ICANN? I rent my home, but I still call the police if there's a trespasser.
mpartel 8y ago
Amazon and Google are certainly within their rights to refuse this. Allowing domain fronting is likely to put quite a lot of their money at risk, so this outcome is unsurprising, but it's still the less ethical one. This might be the only possible outcome given a corporation's legal responsibilities to its shareholders etc, I don't know all that well enough, but I think it's still justified to lower my opinion of Google and Amazon because of this.
- mpartel 8y ago
  I realized I glossed over the fact that this would put other AWS/GAE customers's money at risk too. This complicates matters somewhat, and some (I believe a negligible number of) customers might switch to an unblocked competitor. Personally this weakens my view a little, but is not enough to change it substantially.
  - nerpderp83 8y ago
    The ethical choice is for AWS and Google to collude and both allow signal to continue to using domain fronting.
    - toomuchtodo 8y ago
      Great PR opportunity for Cloudflare to pickup the torch. EDIT: Not supported by Cloudflare.
      - komuW 8y ago
        Cloudflare is against domain fronting https://arstechnica.com/information-technology/2018/04/google-disables-domain-fronting-capability-used-to-evade-censors/ https://arstechnica.com/information-technology/2018/04/googl...
      - illumin8 8y ago
        Despite the use case for censorship circumvention, many malware command and control bots use domain fronting to bypass corporate web filters that otherwise might block their traffic. CloudFlare, being a security-focused CDN, most definitely does not want to help enable malware authors to bypass security.
    - s73v3r_ 8y ago
      Russia had no problem whatsoever blocking both of them when blocking Tether a couple weeks ago.
      - 8y ago
iforgotpassword 8y ago
the problem I'm having is that I'm not even sure this qualifies as 'use' really. sure they're putting the domain name in the tls handshake from the client side instead of their own. the handshake itself works the same, everything that happens after is the same. the tls enpoint on googles/amazons servers just makes sure the domain is in its list of known domains, nothing else depends on it.
jasonmp85 8y ago
Because they are the bad guy.

I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.

gue5t 8y ago

Hardly reasonable. Domains are (in reality, if not in legislative fantasy) property of ICANN and merely rented by everyone else.

CoryG89 8y ago
So? If we qualify it to preventing unauthorized use of one of their rented domains does that make it any less reasonable?
- caf 8y ago
  The conceit here is that you must be "authorized" in order to write an app that puts the domain in question into the SNI field of a TLS connection that it initiates. I don't think that's reasonable. It is of course up to Amazon what their servers then do when presented with such a connection, in particular whether they ensure the Host: header later presented matches the SNI data.
bdcravens 8y ago
So have they obtained the permission of ICANN? I rent my home, but I still call the police if there's a trespasser.

mpartel 8y ago

Amazon and Google are certainly within their rights to refuse this. Allowing domain fronting is likely to put quite a lot of their money at risk, so this outcome is unsurprising, but it's still the less ethical one. This might be the only possible outcome given a corporation's legal responsibilities to its shareholders etc, I don't know all that well enough, but I think it's still justified to lower my opinion of Google and Amazon because of this.

mpartel 8y ago
I realized I glossed over the fact that this would put other AWS/GAE customers's money at risk too. This complicates matters somewhat, and some (I believe a negligible number of) customers might switch to an unblocked competitor. Personally this weakens my view a little, but is not enough to change it substantially.
- nerpderp83 8y ago
  The ethical choice is for AWS and Google to collude and both allow signal to continue to using domain fronting.
  - toomuchtodo 8y ago
    Great PR opportunity for Cloudflare to pickup the torch. EDIT: Not supported by Cloudflare.
    - komuW 8y ago
      Cloudflare is against domain fronting https://arstechnica.com/information-technology/2018/04/google-disables-domain-fronting-capability-used-to-evade-censors/ https://arstechnica.com/information-technology/2018/04/googl...
    - illumin8 8y ago
      Despite the use case for censorship circumvention, many malware command and control bots use domain fronting to bypass corporate web filters that otherwise might block their traffic. CloudFlare, being a security-focused CDN, most definitely does not want to help enable malware authors to bypass security.
  - s73v3r_ 8y ago
    Russia had no problem whatsoever blocking both of them when blocking Tether a couple weeks ago.
    - 8y ago

iforgotpassword 8y ago

the problem I'm having is that I'm not even sure this qualifies as 'use' really. sure they're putting the domain name in the tls handshake from the client side instead of their own. the handshake itself works the same, everything that happens after is the same. the tls enpoint on googles/amazons servers just makes sure the domain is in its list of known domains, nothing else depends on it.

jasonmp85 8y ago

Because they are the bad guy.