5 ms·

This doesn't make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing. You could already do something ap

This doesn't make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing. You could already do something approximating encrypted SNI using domain fronting. Connect to boring domain A via SSL, then send an HTTP request with a Host header set to your actual target domain B. Load balancing HTTP reverse proxies in the clouds would happily use the encrypted domain in the Host header, ignoring SNI in the TLS headers. This started being widely used to evade censorship and build "unblockable" services, because to block them you'd have to block all of Cloudflare or Akamai or Google. These firms all, as one, banned domain fronting. Turns out the bosses wanted access to big markets more than they wanted censorship resistance. So why do these developers think it'll work out any differently this time, with slightly different packet formats? First company to enable encrypted SNI will get blocked at the national level and will blink. The others will look at it and probably never try. If they're serious about making sites unblockable by domain, the first step is to re-activate support for domain fronting and make a public commitment to keep it.

stingraycharles 8y ago
I don't think this is a correct assessment. Domain fronting / boring domains can still be blocked, and this is precisely what caused the whole Signal / AWS issue recently. This is a commercial risk to the domain holder, and to any organisation with shareholders it makes sense for them not to want their domain to be used for this purpose. The engineers are looking for an alternative solution which pleases both camps: no more domain fronting, and no more possible blocking of domains by adversaries. I think it's a bit idealist to say that if they're serious about making sites unblockable, they should put their commercial interests aside. This will not happen. But they are working on an alternative solution where both parties (engineers and shareholders) are happy, and I can only support that.
- repolfx 8y ago
  It's the same thing. How do you think encrypted SNI will play out? The IP address is still available, so this only helps if the IP address you're connecting to hosts many domains, some of which are desirable to the censors to keep unblocked. In practice this means big CDNs and hosting services, of which there are only a few. The reason they stopped domain fronting wasn't technical, it was business related. If these engineers can't win the internal political battles to keep domain fronting working, what makes them think they can win the exact same battle this time around?
  - stingraycharles 8y ago
    Blocking entire IP blocks is a much more crude weapon and definitely an improvement over the current situation. What you're presenting is a logical fallacy; just because the proposed solution doesn't tackle all the problems you want solved, doesn't mean it's not worth doing.
acdha 8y ago
> This doesn't make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing. When a bunch of well respected people decide to do something which you don’t understand, maybe next time your first instinct should be to ask what you don’t know rather than assuming they’re participating in an IETG process which will be shut down? In this case, you might start by questioning whether there’s any other explanation for not supporting domain fronting in the past other than support for censorship (hint: Google gave it at the time), and whether those sound engineering reasons might in fact have lead to something like this as an official supported alternative.
- repolfx 8y ago
  Google did not give any engineering reasons at the time. That's misleading. Here's what they said: "Domain fronting has never been a supported feature at Google, but until recently it worked because of a quirk of our software stack," a Google spokesperson explained in a statement emailed to The Register. "We're constantly evolving our network, and as part of a planned software update, domain fronting no longer works. We don't have any plans to offer it as a feature." This might superficially sound like domain fronting stopped working accidentally, as part of other changes, but notice how carefully it's phrased. They made an update. It stopped working. Nothing in this phrasing would be false if they made a business decision to kill it and did so. I find this explanation extremely likely for several reasons: 1. It happened just when fronting was being adopted by Signal, a high profile app that would have caught attention. 2. All the other big players made the same change, again, prompted by specific events related to anti-censorship. https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/ GreatFire speculated that the attacks were precipitated by the publication of an article in the Wall Street Journal that described in detail domain fronting and other “collateral freedom” techniques. The interview associated with the article also caused CloudFlare to begin matching SNI and Host header, in an apparent attempt to thwart domain fronting. This explanation turned out to be correct. CloudFlare said: Among other network service providers, it's clear domain fronting could be awkward. "Cloudflare does not support domain fronting," a Cloudflare spokesperson said in an email to The Register. "Doing so would put our traditional customers at risk as it would mask banned traffic behind their domains." Note that their explanation of why they killed it would also apply to encrypted SNI. 3. I worked at Google for a long time and am very familiar with their serving infrastructure. I remember noticing that resolved hostname and host header didn't have to match a decade or more ago. This ability lasted a very long time, right up until the moment people started using it in ways that upset governments. Then it went poof. I can believe that these particular 4 players might have had a change of heart. Mozilla doesn't run any CDN or third party web services of note, and has nothing to lose from implementing this. Nor does Apple. Cloudflare and Fastly are both small firms who might have genuinely changed their minds, although if they have they should state explicitly that they are newly willing to let their "traditional customers mask banned traffic". But I'm also not naive: it's possible some people are thinking, better ask for forgiveness than permission.
Aissen 8y ago
I was thinking the same at first, but let provide a more optimistic view. It has a few advantages over domain-fronting: it has a spec, does not single out a single domain (google.com or souq.com for instance), and has two CDN providers behind it, which means that there will be at least some kind of competition. It can be a differentiating factor when one of the three major cloud providers is losing steam and want to have some privacy-related PR.

stingraycharles 8y ago

I don't think this is a correct assessment. Domain fronting / boring domains can still be blocked, and this is precisely what caused the whole Signal / AWS issue recently. This is a commercial risk to the domain holder, and to any organisation with shareholders it makes sense for them not to want their domain to be used for this purpose. The engineers are looking for an alternative solution which pleases both camps: no more domain fronting, and no more possible blocking of domains by adversaries. I think it's a bit idealist to say that if they're serious about making sites unblockable, they should put their commercial interests aside. This will not happen. But they are working on an alternative solution where both parties (engineers and shareholders) are happy, and I can only support that.

repolfx 8y ago
It's the same thing. How do you think encrypted SNI will play out? The IP address is still available, so this only helps if the IP address you're connecting to hosts many domains, some of which are desirable to the censors to keep unblocked. In practice this means big CDNs and hosting services, of which there are only a few. The reason they stopped domain fronting wasn't technical, it was business related. If these engineers can't win the internal political battles to keep domain fronting working, what makes them think they can win the exact same battle this time around?
- stingraycharles 8y ago
  Blocking entire IP blocks is a much more crude weapon and definitely an improvement over the current situation. What you're presenting is a logical fallacy; just because the proposed solution doesn't tackle all the problems you want solved, doesn't mean it's not worth doing.

acdha 8y ago

> This doesn't make much sense to me, I wonder if the senior management at these firms understand what the engineers are doing. When a bunch of well respected people decide to do something which you don’t understand, maybe next time your first instinct should be to ask what you don’t know rather than assuming they’re participating in an IETG process which will be shut down? In this case, you might start by questioning whether there’s any other explanation for not supporting domain fronting in the past other than support for censorship (hint: Google gave it at the time), and whether those sound engineering reasons might in fact have lead to something like this as an official supported alternative.

repolfx 8y ago
Google did not give any engineering reasons at the time. That's misleading. Here's what they said: "Domain fronting has never been a supported feature at Google, but until recently it worked because of a quirk of our software stack," a Google spokesperson explained in a statement emailed to The Register. "We're constantly evolving our network, and as part of a planned software update, domain fronting no longer works. We don't have any plans to offer it as a feature." This might superficially sound like domain fronting stopped working accidentally, as part of other changes, but notice how carefully it's phrased. They made an update. It stopped working. Nothing in this phrasing would be false if they made a business decision to kill it and did so. I find this explanation extremely likely for several reasons: 1. It happened just when fronting was being adopted by Signal, a high profile app that would have caught attention. 2. All the other big players made the same change, again, prompted by specific events related to anti-censorship. https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/ GreatFire speculated that the attacks were precipitated by the publication of an article in the Wall Street Journal that described in detail domain fronting and other “collateral freedom” techniques. The interview associated with the article also caused CloudFlare to begin matching SNI and Host header, in an apparent attempt to thwart domain fronting. This explanation turned out to be correct. CloudFlare said: Among other network service providers, it's clear domain fronting could be awkward. "Cloudflare does not support domain fronting," a Cloudflare spokesperson said in an email to The Register. "Doing so would put our traditional customers at risk as it would mask banned traffic behind their domains." Note that their explanation of why they killed it would also apply to encrypted SNI. 3. I worked at Google for a long time and am very familiar with their serving infrastructure. I remember noticing that resolved hostname and host header didn't have to match a decade or more ago. This ability lasted a very long time, right up until the moment people started using it in ways that upset governments. Then it went poof. I can believe that these particular 4 players might have had a change of heart. Mozilla doesn't run any CDN or third party web services of note, and has nothing to lose from implementing this. Nor does Apple. Cloudflare and Fastly are both small firms who might have genuinely changed their minds, although if they have they should state explicitly that they are newly willing to let their "traditional customers mask banned traffic". But I'm also not naive: it's possible some people are thinking, better ask for forgiveness than permission.

Aissen 8y ago

I was thinking the same at first, but let provide a more optimistic view. It has a few advantages over domain-fronting: it has a spec, does not single out a single domain (google.com or souq.com for instance), and has two CDN providers behind it, which means that there will be at least some kind of competition. It can be a differentiating factor when one of the three major cloud providers is losing steam and want to have some privacy-related PR.