4 ms·

A traffic shaper can do that, but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any s

A traffic shaper can do that, but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify. As long as HN and Reddit don't share edge servers with things you want unshaped, it should be straightforward. The "only for certain devices" part would probably mean putting those devices in a VLAN and only shaping that VLAN's uplink. A router like pfsense should be able to do all of that. But I am far from a network engineer, so don't quote me...

Sohcahtoa82 4y ago
> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.
- hunter2_ 4y ago
  Oh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.
  - Sohcahtoa82 4y ago
    > there's no chance that the TCP connection gets shared for both Not a chance. There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.
    - hunter2_ 4y ago
      Oh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!
- 1vuio0pswjnm7 4y ago
  Who is currently using ESNI. Cloudflare disabled it.
  - mavhc 4y ago
    Where has cloudflare disabled it? Can't see anything
    - 1vuio0pswjnm7 4y ago
      They have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH. https://defo.ie/ech-check.php https://defo.ie/ech-check.php
robohoe 4y ago
In addition, pfsense can run pfblockerng which can be used to block ads. It uses the same block lists as pi-hole and others.

Sohcahtoa82 4y ago

> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.

hunter2_ 4y ago
Oh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.
- Sohcahtoa82 4y ago
  > there's no chance that the TCP connection gets shared for both Not a chance. There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.
  - hunter2_ 4y ago
    Oh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!
1vuio0pswjnm7 4y ago
Who is currently using ESNI. Cloudflare disabled it.
- mavhc 4y ago
  Where has cloudflare disabled it? Can't see anything
  - 1vuio0pswjnm7 4y ago
    They have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH. https://defo.ie/ech-check.php https://defo.ie/ech-check.php

robohoe 4y ago

In addition, pfsense can run pfblockerng which can be used to block ads. It uses the same block lists as pi-hole and others.