3 ms·
IP address blocking may have been banned, but DPI to block domains based on SNI is alive and kickin'. I've seen people talk about encrypted SNI for a very long
by veave 3y ago
IP address blocking may have been banned, but DPI to block domains based on SNI is alive and kickin'.
I've seen people talk about encrypted SNI for a very long time now and it's still not working; someone must have dropped the ball pretty hard regarding that
- ls612 3y agoECH seems to have been rolled out in browsers as dev features so idk what the real blocker is anymore. Edit: it looks like as of late May if you enable some dev flags in Firefox any site behind Cloudflare should use ECH.
- dilyevsky 3y agothere was a pushback from vendors who drumroll.... sell dpi
- wbl 3y agoThe evolution of ESNI into ECH has been slow but basically encryption of just the SNI would not play nicely with the rest of the protocol. So more had to be encrypted but that meant a deeper interaction to analyze. It's also dependent on a new kind of DNS record and the original design wasn't great for DNS load balancing. Some tweaking had to happen there too.