5 ms·

A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capp

by nullc 7y ago

A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capping damages at nothing). > Mozilla's conundrum is how to protect everyone 's privacy And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.

Aissen 7y ago
Re: the contract, let's hope you're wrong. Re: privacy: by not having lying DNS or no NXDOMAIN, there is also less tracking (say, fingerprinting in ad web pages). And in the ISP's case, you're assuming they already do DPI, otherwise they now see IPs, which might not mean much in the CDN case. But if they do DPI, it will be resolved once ESNI starts being deployed.
- TeMPOraL 7y ago
  > Re: the contract, let's hope you're wrong. Switching from a technical measure of privacy (no data being shared) to hope isn't the right way to go. > But if they do DPI, it will be resolved once ESNI starts being deployed. Once.
  - zzzcpan 7y ago
    > > But if they do DPI, it will be resolved once ESNI starts being deployed. > Once. This underestimates DPI vendors. eSNI can't stop them, they will just move to exploit side channel information (traffic patterns) to identify which websites you are visiting. People need to remember, that DPI industry has been fighting with obfuscation for years, it's a war where Cloudflare and Mozilla are compete newbies.
    - Aissen 7y ago
      These are just unsubstantiated assertions. Fingerprinting does exist, but what you're saying is that there might be methods we haven't foreseen that will be implemented to improve DPI analysis and tampering. So what ? Do nothing in the meantime ?
  - Aissen 7y ago
    It's true hope isn't the proper answer. But IANAL is.
- ti_ranger 7y ago
  > But if they do DPI, it will be resolved once ESNI starts being deployed. What if ISPs block requests with eSNI for all users, in order to be able to remain compliant with legal intercept legislation (e.g. warrant for suspected child porn investigation)? There are conflicting desires with trade-offs, and all Mozilla is doing here is escalating the war, rather than trying to reach agreement with the rest of the industry on how to satisfy two different requirements.

by nullc 7y ago

Aissen 7y ago

Re: the contract, let's hope you're wrong. Re: privacy: by not having lying DNS or no NXDOMAIN, there is also less tracking (say, fingerprinting in ad web pages). And in the ISP's case, you're assuming they already do DPI, otherwise they now see IPs, which might not mean much in the CDN case. But if they do DPI, it will be resolved once ESNI starts being deployed.

TeMPOraL 7y ago
> Re: the contract, let's hope you're wrong. Switching from a technical measure of privacy (no data being shared) to hope isn't the right way to go. > But if they do DPI, it will be resolved once ESNI starts being deployed. Once.
- zzzcpan 7y ago
  > > But if they do DPI, it will be resolved once ESNI starts being deployed. > Once. This underestimates DPI vendors. eSNI can't stop them, they will just move to exploit side channel information (traffic patterns) to identify which websites you are visiting. People need to remember, that DPI industry has been fighting with obfuscation for years, it's a war where Cloudflare and Mozilla are compete newbies.
  - Aissen 7y ago
    These are just unsubstantiated assertions. Fingerprinting does exist, but what you're saying is that there might be methods we haven't foreseen that will be implemented to improve DPI analysis and tampering. So what ? Do nothing in the meantime ?
- Aissen 7y ago
  It's true hope isn't the proper answer. But IANAL is.
ti_ranger 7y ago
> But if they do DPI, it will be resolved once ESNI starts being deployed. What if ISPs block requests with eSNI for all users, in order to be able to remain compliant with legal intercept legislation (e.g. warrant for suspected child porn investigation)? There are conflicting desires with trade-offs, and all Mozilla is doing here is escalating the war, rather than trying to reach agreement with the rest of the industry on how to satisfy two different requirements.