10 ms·

32 Bit Real Estate

187 points by craigkerstiens 5y ago

dadrian 5y ago
For what it's worth, this aligns with my experience buying /24's over the last two years.
psim1 5y ago
We recently received a /23 block from ARIN by sitting on the waiting list for about 2 months. If you're not in a hurry and you're not looking for a large block of IPv4, wait. Small companies still have a chance at IPv4 without paying a fortune.
- tptacek 5y ago
  Oh, this is very cool. What is your company doing with the addresses? I wonder if there are applications where it's easier to get addresses than others.
  - mike_d 5y ago
    "Justification" at the RIRs is a little subjective, but it is supposed to be based entirely on technical need not use case. If you want to talk more about getting additional IPs, Mark at your provider is a super smart dude, or you can ping me offline.
- mrkurt 5y ago
  RIPE was handing out /20s to new members about 2 years ago, as well. I'm a fan, it would be nice for more people to have smaller blocks.
  - techsupporter 5y ago
    They were /22 I believe. You can still get a single /24 as a new RIPE member, and no waiting at the moment as their IPv4 waiting list is empty.
mwcampbell 5y ago
> we assign distinct public IPv4 addresses to each app running on Fly.io. Why not charge a premium for even one distinct public IPv4 address? Most applications are HTTP(S)-based and could share a reverse proxy with a thousand other apps, right? You could even spin the lack of distinct public IPs as a positive: zero IPv4 footprint.
- tptacek 5y ago
  The post talks about this (I take your point that we didn't write about it clearly enough). There are two reasons: 1. We don't want to do anything to discourage people from building non-HTTP applications on Fly.io, because we're fans of weird applications. 2. Just giving every app a routable address simplifies our own deployment logic (at the expense of acquiring blocks of IP addresses). Really, the reason we were moved to write about this is (2); specifically: so long as IPv4 addresses are appreciating assets (as current buyers, we can report: they remain appreciating assets), then there is a sense in which holding IPv4 blocks is really just holding money in a different, somewhat less liquid (but potentially profitable) form. We're not saying that's a good thing, just that it's interesting that you can essentially take out a mortgage on a large block of addresses and live in it while it appreciates.
  - kevin_thibedeau 5y ago
    TLS doesn't require HTTP.
    - tptacek 5y ago
      Sure. You take my meaning, I assume. Virtually all of the TLS apps on Fly.io are HTTPS apps.
- mike_d 5y ago
  > Most applications are HTTP(S)-based and could share a reverse proxy with a thousand other apps, right? Try running your SaaS app on an IP address shared with a porn site and you'll quickly discover all the strange ways older middle-boxes try to police network traffic.
deleted 5y ago
[deleted]
mike_d 5y ago
> One last thing: a new 5-digit ASN will cost you about $500 from ARIN, but there are auctions for 4-digit ASNs, and they run into mid-five-figures. If any of you can explain this to us, we'd be grateful. To answer the authors question: lower number ASNs are seen as older more established networks when negotiating peering. It's the equivalent of doing a WHOIS on someone's personal domain and seeing when they started seriously internetting. Obviously shorter numbers are more memorable and easier to type frequently, which is a desirable trait for network operators. You probably spent a few bucks on "fly.io" and applied a mental value to the outward perception of a short memorable domain.
- techsupporter 5y ago
  > It's the equivalent of doing a WHOIS on someone's personal domain and seeing when they started seriously internetting. We have a moderately-sized regional network at my employer (that's not an ISP) and I've seen a snide version of this. Our previous Director of IT who also made day-to-day decisions on things like peering would refer to 32-bit ASN holders as "six-digit trash." In his view, anyone who didn't have a 16-bit ASN was virtually not worth talking to. Not for technical reasons like our equipment didn't support the newer ASNs, just that they were Johnny-come-latelys. He was quite proud of the fact that our employer had and still held a sizeable quantity of legacy, as in pre-RIR, IPv4 address space. I'm fairly sure one of the reasons he quit was because of the decision the board of trustees made to transfer chunks of this space to other entities in our same line of work.
  - hnarn 5y ago
    I'm sorry, but your previous director sounds like an insufferable colleague.
    - techsupporter 5y ago
      No need to apologize, we all didn't like him. If you'd told us that the easiest way to get him to depart in a huff would be to donate some unused IP addresses to other groups that needed them, we'd have deployed NAT64 and heaved the legacy allocations overboard in a long weekend.
p1mrx 5y ago
This is why people have been trying to promote IPv6 for the last couple decades. It is silly that new internet companies should have to pay money to those who got here first. Still waiting for AAAA records on news.ycombinator.com. IPv6-only SIP trunking would also be nice, since an IPv4 address is the main cost of hosting a small PBX.
- CarelessExpert 5y ago
  Yeah, I truly do not understand what's causing Hacker News or Reddit to drag their feet. My guess is they've simply done the calculus and decided the number of impacted users doesn't justify the cost, and meanwhile, they already have their v4 allocation so there's no financial pressure either. I'm starting to think the RIR's should just start charging increasing YoY maintenance fees on v4 address space for companies that haven't rolled out v6. Those companies, who already have an allocation, are really benefiting from a negative externality. Maybe it's time they start paying for the privilege.
- Enginerrrd 5y ago
  IPv6 should have been designed to be backwards compatible and smoothly transition people over. Why not design it so you can just quietly migrate to ipv6 on the infrastructure side by introducing automatic translation of ipv4 packets into ipv6 and back by padding and removing zeros, and automatically reserving all the resulting ipv6 addresses to their ipv4 equivalent owners. This situation is the result of poor design and roll-out decisions, not the fault of everyone else.
  - duskwuff 5y ago
    > IPv6 should have been designed to be backwards compatible Impossible. You can't communicate between two hosts without both hosts being able to address the other -- and there's no way for an IPv4-only host to pack 128 bits of address into a 32-bit host field.
    - seiferteric 5y ago
      I wonder if you could use something like IP in IP (https://en.wikipedia.org/wiki/IP_in_IP https://en.wikipedia.org/wiki/IP_in_IP), basically just slap another IP header on your packet so your IP becomes two 32 bit IPs, one for your ISP and one for you.
jrockway 5y ago
> But if I had to place a bet, it'd be that you aren't using IPv6. And you're nerdy enough to be reading a blog post on how much IPv4 addresses cost! $ dig fly.io AAAA fly.io. 590 IN AAAA 2a09:8280:1::a:791 And looking at the Chrome network inspector, I loaded the page over IPv6. The reality is, pretty much anyone who uses a major ISP in the US has IPv6 (Comcast, Spectrum, etc. hand them out without customers even asking), and it's even more likely in other countries. The big blocker right now is cloud providers. I lost IPv6 on my personal website when I switched from Linode to Digital Ocean (with a load balancer instead of putting them VM directly on the network). At this point, it sounds a lot like "we paid a lot for 3.0.0.0/9 so we're going to drag our feet on IPv6 to hurt competing cloud providers". Cloud customers are somewhat to blame as well -- enabling IPv6 doesn't get you new users today, so nobody does the work to configure things twice. But the ISPs and the users are ready. It's just us, the tech elite, that's slowing everyone down. And it makes sense, because we burned a lot of money on IPv4 addresses and we don't want our imaginary money to become worthless.
- apple4ever 5y ago
  > The reality is, pretty much anyone who uses a major ISP in the US has IPv6 (Comcast, Spectrum, etc. hand them out without customers even asking), and it's even more likely in other countries. But Verizon FIOS does not, long after they should have.
- jfim 5y ago
  I'm not sure it's the sunk cost of IPv4 addresses that's causing this. My guess would be that the "support IPv6" JIRA ticket gets perpetually thrown into the backlog because it won't get any new customers to sign up, so it's clearly not important from a "ship MVP" perspective.
  - est31 5y ago
    Stack overflow's reply to "why do you not support ipv4" is more or less what you describe: > It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future. > This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue. https://meta.stackoverflow.com/a/348224 https://meta.stackoverflow.com/a/348224 Other services sit on giant heaps of ipv4 space and see it appreciate. For them, price increases are wonderful, because it means they can charge higher rents for the ipv4 space.
AtlasBarfed 5y ago
https://www.tutorialspoint.com/ipv4/ipv4_packet_structure.htm https://www.tutorialspoint.com/ipv4/ipv4_packet_structure.ht... The IPv4 packet structure looks like it has a lot of leeway to evolve/handle/crossmap to ipv6. especially with the version and "option" sections. So ipv6 came out almost 24 years ago. And its adoption is a disaster. It's adoption rate was a disaster at the decade mark. I don't understand why ipv4 wasn't evolved to interoperate with ipv6 at whatever level was necessary (servers, OS, routers). I don't understand why there isn't an evolved ipv4 that can route ipv6 and ipv4 traffic to the same application endpoints. I don't understand why there isn't a section of ipv6 address space that is "special" that contains all of ipv4 + possible ports for NAT. I'm sure there are reasons, but I've also seen a lot of dogma from ipv6 people over the years that comes off as my way or the highway. But why you can't get the big boys in the room in the modern corporate-consolidated internet (AWS, MS, FAANG, US government, europeans, mobile carriers etc) and work out how to get ipv6 transitioned. To me, ipv6 was always a lot like the security group at large companies: they dictated a policy, tried to enforce compliance, but never offered solutions. And solutions is what gets your policy or protocol adopted.
- teddyh 5y ago
  IPv6 solves a problem that the big players want unsolved. IPv6 adoption would be a de-centralizing factor, and central powers are therefore against it. I have a hunch that the only reason that IPv6 has gotten any traction is because the absolute largest players needed it internally.
mr_luc 5y ago
This is a hard market to time. Nobody believes the Internet will be IPv6-only within the next few years. There are credible people who believe IPv4 addresses will be scarce and useful indefinitely. We might put money on you getting away with an IPv6-only app 20 years from now. But we'd have said that 20 years ago, too. This was interesting to me, so I looked up adoption metrics. In 5 years (2016-2021) it went from 9% to 35%. Source: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html TL;DR: it's being adopted at 5% of internet traffic per year, over the past 5+ years. Once it gets to 80% or so, some number, there plausibly could be a flood of "we don't support IE6" behavior where adoption accelerate. But that would still be 9 years, if the rate of adoption didn't accelerate at all.
sedatk 5y ago
I once suggested[1] a cryptocurrency that's based on proof of ownership of IPv4 addresses to hasten IPv6 adoption. Is it becoming real? [1] https://twitter.com/esesci/status/1420481364114112513 https://twitter.com/esesci/status/1420481364114112513
1vuio0pswjnm7 5y ago
"But SNI breaks down for apps that don't use TLS, and we want to support all kinds of apps, not just web apps." SNI is nothing but a PITA for users who don't want to send Host headers in plaintext over the wire. It may be a small number of users who are aware of the SNI leak, but it doesn't mean they are being unreasonable for wanting to plug it. https://curvecp.org/addressing.html https://curvecp.org/addressing.html "An ISP or site administrator can easily run a huge number of CurveCP servers on a single global IPv4 address, even if the servers are independently operated with separate long-term public keys. This feature is provided by a simple extension mechanism in CurveCP addresses. CurveCP servers are inherently anti-aliased, providing automatic virtual hosting and fixing some of the deficiencies in the "same-origin" policy in web browsers. This feature is provided by a simple domain-name mechanism in CurveCP addresses. If a site has two server addresses, and one server is down, a CurveCP client will quickly connect to the other address. A CurveCP connection remains fully functional even if the client changes IP address. CurveCP is fully compatible with existing NAT (network address translation) mechanisms; none of the above features require clients or servers to know the global addresses of their gateways." I will keep using CurveCP forwarders on the home LAN because I like it and just in case it ever sees interest from a wider audience, like Curve25519 eventually did. No expectations.
- hamandcheese 5y ago
  If a site doesn't use SNI, therefore serves no more than one HTTPS site from any single IP, don't you still leak the same amount of information simply from connecting to that IP on port 443?
  - 1vuio0pswjnm7 5y ago
    No. SNI sends more information. It sends a "servername" in the ClientHello. With earlier TLS versions the host could also be leaked in the server certificate that is sent to the client to be verified. With TLS1.3 that is fixed. All that remains is to plug the SNI leak. Experimental encrypted ClientHello is available, but not in popular graphical browsers. Popular graphical browsers send a servername in the ClienHello even when SNI is not required! (Most HTTPS site submitted to HN do not require SNI.) To see how SNI leaks host names, https://github.com/kontaxis/snidump https://github.com/kontaxis/snidump # example.com - with no SNI echo -e "GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n"|openssl s_client -connect example.com:443 -ign_eof -noservername # example.org - with SNI echo -e "GET / HTTP/1.1\r\nHost: example.org\r\nConnection: close\r\n\r\n"|openssl s_client -connect example.org:443 -ign_eof -servername example.org You should see "example.org" in the snidump output. Neither the example.com nor the example.org sites require SNI.

For what it's worth, this aligns with my experience buying /24's over the last two years.

We recently received a /23 block from ARIN by sitting on the waiting list for about 2 months. If you're not in a hurry and you're not looking for a large block of IPv4, wait. Small companies still have a chance at IPv4 without paying a fortune.

tptacek 5y ago
Oh, this is very cool. What is your company doing with the addresses? I wonder if there are applications where it's easier to get addresses than others.
- mike_d 5y ago
  "Justification" at the RIRs is a little subjective, but it is supposed to be based entirely on technical need not use case. If you want to talk more about getting additional IPs, Mark at your provider is a super smart dude, or you can ping me offline.
mrkurt 5y ago
RIPE was handing out /20s to new members about 2 years ago, as well. I'm a fan, it would be nice for more people to have smaller blocks.
- techsupporter 5y ago
  They were /22 I believe. You can still get a single /24 as a new RIPE member, and no waiting at the moment as their IPv4 waiting list is empty.

mwcampbell 5y ago

> we assign distinct public IPv4 addresses to each app running on Fly.io. Why not charge a premium for even one distinct public IPv4 address? Most applications are HTTP(S)-based and could share a reverse proxy with a thousand other apps, right? You could even spin the lack of distinct public IPs as a positive: zero IPv4 footprint.

tptacek 5y ago
The post talks about this (I take your point that we didn't write about it clearly enough). There are two reasons: 1. We don't want to do anything to discourage people from building non-HTTP applications on Fly.io, because we're fans of weird applications. 2. Just giving every app a routable address simplifies our own deployment logic (at the expense of acquiring blocks of IP addresses). Really, the reason we were moved to write about this is (2); specifically: so long as IPv4 addresses are appreciating assets (as current buyers, we can report: they remain appreciating assets), then there is a sense in which holding IPv4 blocks is really just holding money in a different, somewhat less liquid (but potentially profitable) form. We're not saying that's a good thing, just that it's interesting that you can essentially take out a mortgage on a large block of addresses and live in it while it appreciates.
- kevin_thibedeau 5y ago
  TLS doesn't require HTTP.
  - tptacek 5y ago
    Sure. You take my meaning, I assume. Virtually all of the TLS apps on Fly.io are HTTPS apps.
mike_d 5y ago
> Most applications are HTTP(S)-based and could share a reverse proxy with a thousand other apps, right? Try running your SaaS app on an IP address shared with a porn site and you'll quickly discover all the strange ways older middle-boxes try to police network traffic.

deleted 5y ago

[deleted]

mike_d 5y ago

> One last thing: a new 5-digit ASN will cost you about $500 from ARIN, but there are auctions for 4-digit ASNs, and they run into mid-five-figures. If any of you can explain this to us, we'd be grateful. To answer the authors question: lower number ASNs are seen as older more established networks when negotiating peering. It's the equivalent of doing a WHOIS on someone's personal domain and seeing when they started seriously internetting. Obviously shorter numbers are more memorable and easier to type frequently, which is a desirable trait for network operators. You probably spent a few bucks on "fly.io" and applied a mental value to the outward perception of a short memorable domain.

techsupporter 5y ago
> It's the equivalent of doing a WHOIS on someone's personal domain and seeing when they started seriously internetting. We have a moderately-sized regional network at my employer (that's not an ISP) and I've seen a snide version of this. Our previous Director of IT who also made day-to-day decisions on things like peering would refer to 32-bit ASN holders as "six-digit trash." In his view, anyone who didn't have a 16-bit ASN was virtually not worth talking to. Not for technical reasons like our equipment didn't support the newer ASNs, just that they were Johnny-come-latelys. He was quite proud of the fact that our employer had and still held a sizeable quantity of legacy, as in pre-RIR, IPv4 address space. I'm fairly sure one of the reasons he quit was because of the decision the board of trustees made to transfer chunks of this space to other entities in our same line of work.
- hnarn 5y ago
  I'm sorry, but your previous director sounds like an insufferable colleague.
  - techsupporter 5y ago
    No need to apologize, we all didn't like him. If you'd told us that the easiest way to get him to depart in a huff would be to donate some unused IP addresses to other groups that needed them, we'd have deployed NAT64 and heaved the legacy allocations overboard in a long weekend.

p1mrx 5y ago

This is why people have been trying to promote IPv6 for the last couple decades. It is silly that new internet companies should have to pay money to those who got here first. Still waiting for AAAA records on news.ycombinator.com. IPv6-only SIP trunking would also be nice, since an IPv4 address is the main cost of hosting a small PBX.

CarelessExpert 5y ago
Yeah, I truly do not understand what's causing Hacker News or Reddit to drag their feet. My guess is they've simply done the calculus and decided the number of impacted users doesn't justify the cost, and meanwhile, they already have their v4 allocation so there's no financial pressure either. I'm starting to think the RIR's should just start charging increasing YoY maintenance fees on v4 address space for companies that haven't rolled out v6. Those companies, who already have an allocation, are really benefiting from a negative externality. Maybe it's time they start paying for the privilege.
Enginerrrd 5y ago
IPv6 should have been designed to be backwards compatible and smoothly transition people over. Why not design it so you can just quietly migrate to ipv6 on the infrastructure side by introducing automatic translation of ipv4 packets into ipv6 and back by padding and removing zeros, and automatically reserving all the resulting ipv6 addresses to their ipv4 equivalent owners. This situation is the result of poor design and roll-out decisions, not the fault of everyone else.
- duskwuff 5y ago
  > IPv6 should have been designed to be backwards compatible Impossible. You can't communicate between two hosts without both hosts being able to address the other -- and there's no way for an IPv4-only host to pack 128 bits of address into a 32-bit host field.
  - seiferteric 5y ago
    I wonder if you could use something like IP in IP (https://en.wikipedia.org/wiki/IP_in_IP https://en.wikipedia.org/wiki/IP_in_IP), basically just slap another IP header on your packet so your IP becomes two 32 bit IPs, one for your ISP and one for you.

jrockway 5y ago

> But if I had to place a bet, it'd be that you aren't using IPv6. And you're nerdy enough to be reading a blog post on how much IPv4 addresses cost! $ dig fly.io AAAA fly.io. 590 IN AAAA 2a09:8280:1::a:791 And looking at the Chrome network inspector, I loaded the page over IPv6. The reality is, pretty much anyone who uses a major ISP in the US has IPv6 (Comcast, Spectrum, etc. hand them out without customers even asking), and it's even more likely in other countries. The big blocker right now is cloud providers. I lost IPv6 on my personal website when I switched from Linode to Digital Ocean (with a load balancer instead of putting them VM directly on the network). At this point, it sounds a lot like "we paid a lot for 3.0.0.0/9 so we're going to drag our feet on IPv6 to hurt competing cloud providers". Cloud customers are somewhat to blame as well -- enabling IPv6 doesn't get you new users today, so nobody does the work to configure things twice. But the ISPs and the users are ready. It's just us, the tech elite, that's slowing everyone down. And it makes sense, because we burned a lot of money on IPv4 addresses and we don't want our imaginary money to become worthless.

apple4ever 5y ago
> The reality is, pretty much anyone who uses a major ISP in the US has IPv6 (Comcast, Spectrum, etc. hand them out without customers even asking), and it's even more likely in other countries. But Verizon FIOS does not, long after they should have.
jfim 5y ago
I'm not sure it's the sunk cost of IPv4 addresses that's causing this. My guess would be that the "support IPv6" JIRA ticket gets perpetually thrown into the backlog because it won't get any new customers to sign up, so it's clearly not important from a "ship MVP" perspective.
- est31 5y ago
  Stack overflow's reply to "why do you not support ipv4" is more or less what you describe: > It's just a lot of work for honestly not a lot of gain just yet. Things like HTTPS and HTTP/2 are far more impactful for users. We'll get to IPv6 eventually, but it's unlikely to happen any time soon. There are simply far more impactful things we can do with our time on the sysadmin front for the foreseeable future. > This is something everyone on our SRE team would like to do. We just don't have the time yet, even more important things are in queue. https://meta.stackoverflow.com/a/348224 https://meta.stackoverflow.com/a/348224 Other services sit on giant heaps of ipv4 space and see it appreciate. For them, price increases are wonderful, because it means they can charge higher rents for the ipv4 space.

AtlasBarfed 5y ago

https://www.tutorialspoint.com/ipv4/ipv4_packet_structure.htm https://www.tutorialspoint.com/ipv4/ipv4_packet_structure.ht... The IPv4 packet structure looks like it has a lot of leeway to evolve/handle/crossmap to ipv6. especially with the version and "option" sections. So ipv6 came out almost 24 years ago. And its adoption is a disaster. It's adoption rate was a disaster at the decade mark. I don't understand why ipv4 wasn't evolved to interoperate with ipv6 at whatever level was necessary (servers, OS, routers). I don't understand why there isn't an evolved ipv4 that can route ipv6 and ipv4 traffic to the same application endpoints. I don't understand why there isn't a section of ipv6 address space that is "special" that contains all of ipv4 + possible ports for NAT. I'm sure there are reasons, but I've also seen a lot of dogma from ipv6 people over the years that comes off as my way or the highway. But why you can't get the big boys in the room in the modern corporate-consolidated internet (AWS, MS, FAANG, US government, europeans, mobile carriers etc) and work out how to get ipv6 transitioned. To me, ipv6 was always a lot like the security group at large companies: they dictated a policy, tried to enforce compliance, but never offered solutions. And solutions is what gets your policy or protocol adopted.

teddyh 5y ago
IPv6 solves a problem that the big players want unsolved. IPv6 adoption would be a de-centralizing factor, and central powers are therefore against it. I have a hunch that the only reason that IPv6 has gotten any traction is because the absolute largest players needed it internally.

mr_luc 5y ago

This is a hard market to time. Nobody believes the Internet will be IPv6-only within the next few years. There are credible people who believe IPv4 addresses will be scarce and useful indefinitely. We might put money on you getting away with an IPv6-only app 20 years from now. But we'd have said that 20 years ago, too. This was interesting to me, so I looked up adoption metrics. In 5 years (2016-2021) it went from 9% to 35%. Source: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html TL;DR: it's being adopted at 5% of internet traffic per year, over the past 5+ years. Once it gets to 80% or so, some number, there plausibly could be a flood of "we don't support IE6" behavior where adoption accelerate. But that would still be 9 years, if the rate of adoption didn't accelerate at all.

sedatk 5y ago

I once suggested[1] a cryptocurrency that's based on proof of ownership of IPv4 addresses to hasten IPv6 adoption. Is it becoming real? [1] https://twitter.com/esesci/status/1420481364114112513 https://twitter.com/esesci/status/1420481364114112513

1vuio0pswjnm7 5y ago

"But SNI breaks down for apps that don't use TLS, and we want to support all kinds of apps, not just web apps." SNI is nothing but a PITA for users who don't want to send Host headers in plaintext over the wire. It may be a small number of users who are aware of the SNI leak, but it doesn't mean they are being unreasonable for wanting to plug it. https://curvecp.org/addressing.html https://curvecp.org/addressing.html "An ISP or site administrator can easily run a huge number of CurveCP servers on a single global IPv4 address, even if the servers are independently operated with separate long-term public keys. This feature is provided by a simple extension mechanism in CurveCP addresses. CurveCP servers are inherently anti-aliased, providing automatic virtual hosting and fixing some of the deficiencies in the "same-origin" policy in web browsers. This feature is provided by a simple domain-name mechanism in CurveCP addresses. If a site has two server addresses, and one server is down, a CurveCP client will quickly connect to the other address. A CurveCP connection remains fully functional even if the client changes IP address. CurveCP is fully compatible with existing NAT (network address translation) mechanisms; none of the above features require clients or servers to know the global addresses of their gateways." I will keep using CurveCP forwarders on the home LAN because I like it and just in case it ever sees interest from a wider audience, like Curve25519 eventually did. No expectations.

hamandcheese 5y ago
If a site doesn't use SNI, therefore serves no more than one HTTPS site from any single IP, don't you still leak the same amount of information simply from connecting to that IP on port 443?
- 1vuio0pswjnm7 5y ago
  No. SNI sends more information. It sends a "servername" in the ClientHello. With earlier TLS versions the host could also be leaked in the server certificate that is sent to the client to be verified. With TLS1.3 that is fixed. All that remains is to plug the SNI leak. Experimental encrypted ClientHello is available, but not in popular graphical browsers. Popular graphical browsers send a servername in the ClienHello even when SNI is not required! (Most HTTPS site submitted to HN do not require SNI.) To see how SNI leaks host names, https://github.com/kontaxis/snidump https://github.com/kontaxis/snidump # example.com - with no SNI echo -e "GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n"|openssl s_client -connect example.com:443 -ign_eof -noservername # example.org - with SNI echo -e "GET / HTTP/1.1\r\nHost: example.org\r\nConnection: close\r\n\r\n"|openssl s_client -connect example.org:443 -ign_eof -servername example.org You should see "example.org" in the snidump output. Neither the example.com nor the example.org sites require SNI.