9 ms·
New standards for a faster and more private Internet
- barbazoo 2y ago> New standards for a faster and more private Internet > Zstandard I get "faster" but how does it make the internet "more private". The word "private" only shows up exactly once on that page, in the title.
- java-man 2y agoThey also talk about Encrypted Client Hello (ECH).
- terrelln 2y agoI believe that the "more private" part is referencing the "Encrypted Client Hello (ECH)" section in the later part of the post.
- gwbas1c 2y agoThe title of something should reflect the content. This is an article about a new compression format, and thus the title should say that.
- nicce 2y agoIt is about moving the trust. > This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. So you must use entity which controls the DNS and this entity makes the request further for actual website. Feels like just worse VPN.
- winkelmann 2y ago> It is about moving the trust. Trust isn't being moved, though. Cloudflare could, by design, always see what website you were accessing. The difference is with ECH, there is one less party (someone listening in on your internet traffic) that can see which hostname you're accessing.
- nicce 2y agoI was more like comparing to VPN. My argument was poor. But on high level many do not use VPNs and they have very negative impact for service UX anyway these days, so not a big point.
- ziddoap 2y ago>The word "private" only shows up exactly once on that page, in the title. However, the word "privacy" shows up 10 times in the article.
- java-man 2y agoDoes it mean ECH works only with the Cloudflare since their example ECH contains unencrypted outer layer client hello?
- jgrahamc 2y agoNo, it's am emerging standard. We are just pushing its adoption as fast as we can. Hence, we've rolled this out to all free customers.
- Rushsick 2y agoAnd for non free customers, you can opt-in to ECH via the dashboard
- ameliaquining 2y agoRight now, basically yes. No other major public clouds seem to support ECH yet, and ECH basically only works in public clouds; it can't hide your IP address, so it only provides privacy if you share your IP address with lots of other tenants.
- deleted 2y ago[deleted]
- rkagerer 2y agoECH - if I understand correctly it's effective for sites hosted on big providers like Cloudflare, AWS, etc, but doesn't add much value when it comes to self-hosted domains or those on a dedicated server, as you'd still see traffic going to whatever IP and be able to infer from that which domain the user's browswer is talking to. I'm hoping someone can explain that I missed something. And while we're explaining things... ODoH (indirectly mentioned in the article via the Encrypted DNS link) comes with a big bold warning it's based on the fundamental premise that the proxy and the target servers do not collude. When both are operated by the same company, how can you know they aren't colluding? Is there some mechanic in the protocol to help protect users from colluding servers?
- jeroenhd 2y ago> When both are operated by the same company, how can you know they aren't colluding? You don't. At best the client can check domain names and IP addresses, but that's hardly a guarantee. To solve that problem, you can combine multiple parties. For example, you can use https://odoh1.surfdomeinen.nl/proxy https://odoh1.surfdomeinen.nl/proxy as a proxy (operated by SURF [1]) to use the Cloudflare servers for lookup. I think for ODoH to work well, we need a variety of companies hosting forwarding services. That could be ISPs, Google/Microsoft/etc. or some kind of non-profit. [1]: https://www.surf.nl/en https://www.surf.nl/en
- musicale 2y ago> That could be ISPs, Google/Microsoft/etc. or some kind of non-profit. Or Apple[1,2]. [1] Oblivious DNS over HTTPS, https://www.ietf.org/rfc/rfc9230.txt https://www.ietf.org/rfc/rfc9230.txt [2] About iCloud Private Relay, https://support.apple.com/en-us/102602 https://support.apple.com/en-us/102602
- ekr____ 2y agoYes, that's correct about ECH. In general, there's no real way to conceal your browsing behavior if you are connecting to an IP address that isn't shared. So either you use ECH to something like Cloudflare or you connect to some proxy/VPN/etc. so that the local network can't see the final IP address.
- daveau 2y agore: ECH let the cat and mice game between deep packet inspection (DPI) vendors and the rest of the encrypted internet continue. it’ll be amusing to see what they come up with (inaccurate guessing game ai/ml “statistical analysis” is about all they’ve got left, especially against the large umbrella that is cloudflare). game on, grab your popcorn, it will be fun to watch.
- jeroenhd 2y agoThere's a relatively simple and pain-free solution to legitimate DPI: blocking all requests that don't go through a proxy. Browsers will ignore some certificate restrictions if they detect manually installed TLS root certificates to make corporate networks work. This approach won't work on apps like Facebook or Instagram, but I don't think there's a legitimate reason to permit-but-snoop on that sort of traffic anyway.
- candiddevmike 2y agoPassive DPI/web filtering is pretty much done at this point. There's no way to tell what domain you're connecting to with ECH without doing a MITM and breaking the PKI chain or adding private CAs everywhere.
- 9cb14c1ec0 2y agoNot hard to bypass it at all: https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello#w_can-enterprises-disable-ech https://support.mozilla.org/en-US/kb/faq-encrypted-client-he...
- aaomidi 2y agoECH is going to be huge for people in regressive countries. For example Iran.
- drdaeman 2y agoNah, they're just going to block the whole ECH handshake. Idk about Iran, but Russia and China just block eSNI, QUIC and whatever their DPI firewalls can't really handle on the fly.
- Rushsick 2y agoThe idea is to make ECH too large of a target to make blocking it practical. If you block ECH you end up blocking access to a large portion of the internet in that region. It's why some major browsers have chosen to not gracefully fallback to non-ECH handshakes upon connection failure.
- sroussey 2y agoI think the other poster was implying that the governments don’t care.
- Rushsick 2y agoYeah we shall see - we're monitoring closely
- aaomidi 2y agoDisagree on this take. Blocking services does have an economic impact. This alongside people smuggling in starlink is making censorship useless.
- sroussey 2y agoChina blocks services all the time. I was one of the original 10 blocked by the great firewall of china. And starlink can be traced. It’s only time before some people start getting arrested.
- nialse 2y agoLet me just stress that the effect of Zstandard on individual end-user latency is a rounding error. No user will ever go: “That was a quick loading web site. Must be Zstandard!”. The effect is solely Cloudflare having to spend x% less bandwidth to deliver the content, saving on their network and server resources.
- hammyhavoc 2y agoIf it saves them money, great. That also means resources saved, and that also means it's better for the planet, thus better for humanity. I'm failing to see the disadvantage.
- ozgrakkurt 2y agoGP didn’t say it has a disadvantage. Just explaining what it means
- irq-1 2y agoWhat will ECH mean for places like China or South Korea? Do governments have access to Cloudflare logs? Only with court orders? ECH seems directly opposed to Chinese governments control of the web.
- vetinari 2y agoI think you meant North Korea, not South. It means nothing. Countries always ask nicely first for a domain to be blocked for IPs from their countries. Companies like Cloudflare or Akamai can either honor the request, or find their IP range blocked (yes, including all the other serviced domains). They usually take the first option.
- frankjr 2y ago> I think you meant North Korea, not South. South Korea is infamous for their internet censorship. https://en.wikipedia.org/wiki/Internet_censorship_in_South_Korea https://en.wikipedia.org/wiki/Internet_censorship_in_South_K...
- lifthrasiir 2y agoThere are many more countries enforcing some limitations on the internet, and ECH will just turn passive DPI into active court orders, I believe. At least explictness is better.
- terrelln 2y agoThe latest Zstandard exposes several parameters which are useful for reducing time to first byte latency in web compression. They make Zstandard cut the compressed data into smaller blocks, e.g. 4 KB, with the goal to fit a compressed block within a small number of packets, so the browswer can start to decompress without waiting for a full 128 KB block to be sent. These parameters are described in the v1.5.6 release notes [0]. ZSTD_c_targetCBlockSize is the most notable, but ZSTD_c_maxBlockSize can also be used for a lower CPU cost but larger compressed size. Are you using these features at Cloudflare? If you need any help using these, or have any questions, please open an issue on Zstandard's GitHub! [0] https://github.com/facebook/zstd/releases/tag/v1.5.6 https://github.com/facebook/zstd/releases/tag/v1.5.6
- autoexec 2y agoCloudflare is happy to make it harder for anyone other than Cloudflare to see everything that you're doing on the internet.
- jiggawatts 2y agoAfter examining how scammers and phishers host their sites, I’ve realised that “private” for Cloudflare means protecting the privacy of criminals. ECH makes it hard to block known scam sites at the network layer, for example.
- idle_zealot 2y agoEither it's easy to block sites or it isn't. There's no world in which it's easier for you to block scam sites than it is for others to block vital resources and information.
- sltkr 2y agoNetwork layer blocking is almost never in the interest of the end user. It's typically used to block users from accessing sites they want to visit, like The Pirate Bay, or recently Russian Times and Sputnik News. End users who want to protect themselves can easily install blacklists on their end. All major browsers support something like Google Safe Browsing out of the box, and these blacklists are more likely to be kept up-to-date than those of the average ISP.
- Animats 2y ago"This means that whenever a user visits a website on Cloudflare that has ECH enabled, no one except for the user, Cloudflare, and the website owner will be able to determine which website was visited. Cloudflare is a big proponent of privacy for everyone and is excited about the prospects of bringing this technology to life.' This isn't privacy. This is centralized snooping. It's like Google's approach to third party cookies. Nobody other than Google can have tracking information.
- Shakahs 2y agoAnother HN hot take about the Cloudflare bogeyman. The CDN can't give you content you're asking for without knowing which content you're asking for. This improvement prevents your ISP and the government from reading your packets to get that same information.
- cebert 2y agoWhat makes you believe CloudFlare wouldn’t do this? They may have state actor employees or be compelled by a government to surveil users.
- Shakahs 2y agoSo now the government needs to compel a corporation to hand over some data, because they are no longer able to read it straight off the wire like they could before. That sounds like a significant improvement to privacy.
- naivety 2y agoPeople trafficking drugs into Australia were using a secure, encrypted messaging service developed by a private third party provider. They eventually found out that the third party provider was in fact the Australian Federal Police, reading all their messages in clear and in real time. The government only needs to compel a corporation if that corporation has an adversarial relationship with them. We have tried the centralized model pushed by Cloudflare before, it was called the Minitel.
- casenmgreen 2y agoI use Tor for privacy. CF blocks Tor; you can't get past the captcha.
- naivety 2y agoPffff you think you're edgy and hardcore. I use the elite hacking tool know as FIRE FOX and I get CF gatekept all the time.
- userbinator 2y agoNew standards for easier TLS fingerprinting and user-agent discrimination. Edit: just look at how many sites you're locked out of if you don't have JS enabled or run an uncommon configuration.
- sedatk 2y agoDPI systems in Turkey weren't even checking QUIC packets when I was there, let alone ECH. But, browsers usually start with TCP first to negotiate QUIC support, which prevented bypass of web blocks. If you could force your browser to establish connection directly using QUIC, you could bypass all the blocks. That was last year though. Not sure about the current situation.
- dizhn 2y agoThey usually won't bother with blocking if the site owner just hosts the site under a different domain name. It could be like news.ycombinator1923.com or something. wink
- lifthrasiir 2y agoThe benchmark for Zstandard against Brotli seems to miss a key information---the compression levels used for both algorithms, because both the compression ratio and compression time will depend on them. In fact this had been my long suspicion about introducing Zstandard to the web standard, because lower compression levels for Brotli are not that slow and it was never publicly mentioned whether improving lower Brotli levels deemed infeasible or not. Given Zstandard Content-Encoding was initially proposed by Meta, I'm not even sure they have at least tried. Given we now have two strictly better algorithms than gzip, I also wonder about a hybrid scheme that starts with Zstandard but switches to Brotli when the compression time is no longer significant for given request. We might even be able to cheaply convert the existing Zstandard stream into Brotli with some restrictions, as they are really LZSS behind the scene?
- terrelln 2y agoMeta drove the Zstandard content encoding, but Google drove the adoption of Zstandard in Chrome. The faster Brotli levels could probably be made to match Zstandard’s compression speed. But we’ve invested a lot in optimizing these levels, so it would likely take significant investment to match. Google is also contributing to improving the speed of Zstandard compression. A cheaper conversion from Zstandard to Brotli is possible, but I wouldn’t really expect an improvement to compressed size. The encoding scheme impacts how efficient a LZ coding is, so for Brotli to beat Zstandard, it would likely want a different LZ than Zstandard uses. The same applies for a conversion from Brotli to Zstandard.
- lifthrasiir 2y agoThe conversion is meant to avoid the expensive backreference optimization when it has been already done once by Zstandard, because you can't prepend a Zstandard bitstream with a Brotli bitstream without turning one to another. But well, I think such hybrid scheme is hard to make when the latency is at stake.
- moralestapia 2y agoA very nice feature of zstd is that it is seekable. So you could map that to HTTP Range requests and go crazy about it.
- lifthrasiir 2y agoI don't think so? It's only seekable with an additional index [1], just like most other compression schemes. Having an explicit standard for indices is definitely a plus though. [1] https://github.com/facebook/zstd/blob/dev/contrib/seekable_format/zstd_seekable_compression_format.md https://github.com/facebook/zstd/blob/dev/contrib/seekable_f...
- moralestapia 2y ago>just like most other compression schemes Source?
- lifthrasiir 2y agoUh, I'm confused why you expect most compression schemes to be necessarily seekable after all. I assume the seeking implies a significantly faster way to skip the first N bytes of the decompressed output without the actual decompression. "Significant" is here defined as a time complexity strictly less than linear time in the size of compressed or decompressed data in that skip, so for the RLE sequence like `10a90b`, seeking to the 50th byte should be able to avoid processing `10a` at all; reading `10a` but not actually emitting 10 copies of `a` doesn't really count. Virtually every compression algorithm has two main parts, modelling and coding. Modelling either transforms the input into a more compressible form, or estimates how much is particular portion of the input likely. Those results are then coded into one or more sets of symbols with different probabilities, resulting in a compressed bit sequence. Both parts can be made as complex as needed and will likely to destroy any relation between the input and output byte. Many algorithms including Zstandard do come with some framing scheme to aid with data verification, but such framing is generally not enough for actual seeking unless each frame declares both the uncompressed and compressed size and can be independently decompressed from each other. That's what the Zstandard's seekable format actually does: both sizes for every frame, and an implicit promise that a new frame is generated every so often. (Zstandard frames are already defined to be independent.) There do exist some compression schemes that retain the seekability by design. Texture compression is a good example; a massively parallel nature of GPUs means that a fixed-rate scheme can be much more efficient than a variable-rate and thus inherently sequential scheme. There are also some hybrids that use two interconnected algorithms for CPU and GPU respectively. But such algorithms are not a norm.
- Rhapso 2y agoDon't trust cloudflare with standards control. They do not have anybody else's best interests at heart and are actively centralizing that which was explicitly intended to not be centralized.
- uSoldering 2y agoWhat is the overlap of people who are reading a blogpost about Cloudflare standards and people who need a metaphor to understand what compression is? You have 7 paragraphs of highly technical information then just in case, you need to explain how compression works? Just tell your reader you think they're a moron and save yourself the keystrokes.
- rajnathani 2y ago> Zstandard’s branchless design is a crucial innovation that enhances CPU efficiency Given how branchless algorithms are helping optimize not just network transport (compression) and even OS system libs (no citation for this one, but I’ve heard), that I really wish colleges begin teaching this along with DS/Algo course material.
- catgirlinspace 2y agowhat’s DS stand for? discrete structures?
- SushiHippie 2y agoData Structures probably Data Structures & Algorithms is also sometimes abbreviated as DSA
- rajnathani 2y agoAs the sibling comment mentioned already: Data Structures & Algorithms.