3 ms·

Does it, really? Have you seen wireshark output lately? (the GUI can be configured to do reverse lookup on all IP address) If I check up right now, form the

Does it, really? Have you seen wireshark output lately? (the GUI can be configured to do reverse lookup on all IP address) If I check up right now, form the top 10 links in HN right now, it is trivial to distinguish the top-level domain from just the IPv4 or IPv6 address. Heck, even _for this website itself_ the current IPv4 reverse DNS points to ycombinator.com. I don't even need to go into packet size heuristics, or the myriad of ad networks, etc. Sure there are some instances where you will share the IP of the CDN. This has been seen recently e.g. in the recent article of the "LaLiga" blocks in Spain. But bigger sites cannot afford for this to happen, and even smaller sites tend to have at least one paid IP address for mail (reputation is a bitch, and Cloudflare doesn't have any).

josephcsible 1y ago
> If I check up right now, form the top 10 links in HN right now, it is trivial to distinguish the top-level domain from just the IPv4 or IPv6 address. Two of the top 10 links in HN right now (https://news.ycombinator.com/item?id=44215603 https://news.ycombinator.com/item?id=44215603 and https://news.ycombinator.com/item?id=44212446 https://news.ycombinator.com/item?id=44212446) are to different subdomains of github.io that resolve to the exact same IP addresses, so reverse DNS doesn't tell you which one is being visited. And you can't even tell the TLD, because the TLD is "io", but the reverse lookup on the IPs will give you a TLD ending in "com". > Heck, even _for this website itself_ the current IPv4 reverse DNS points to ycombinator.com. That's because HN isn't behind the kind of CDN I'm talking about. But a lot are. Is your argument "since your ISP can see some of the sites you're going to, we should remove all protections and let them see all sites you're going to?"
- AshamedCaptain 1y ago
  I said top-level domain. Anyway, you have a better estimate, for the types of sites people here would visit? If HN itself isn't an example, then Github subdomains definitely ain't (not even close to the traffic of the main domain).
  - josephcsible 1y ago
    > I said top-level domain. "io" and "com" are top-level domains, and in the example I gave, you can't even distinguish between them.
    - AshamedCaptain 1y ago
      Well, I appreciate the correction: I meant second level (or whatever is most distinguishing for that TLD). However, even if what you say is true, you really cannot disprove my claim with one nitpick, you need to talk majorities. (And, in case it needs to be said: i really don't think the issue here is distinguishing activity to github.io vs github.com)
      - josephcsible 1y ago
        Okay, how about this then. Here's some of the IP addresses of posts on the HN front page right now: 104.21.3.245 104.21.68.247 104.21.80.31 104.21.95.131 104.21.112.1 104.26.4.133 None of them have reverse DNS records. Can you tell which is which?
        AshamedCaptain 1y ago
        So you take literally the worst possible set of IPs (all of them cloudflare), IPv4 only, and yet Copilot (!) is easily able to reverse 50% of them: 104.21.3.245 -- trebaol.com 104.21.80.31 -- diwank.space 104.26.4.133 -- daringfireball.net 104.21.112.1 -- simonwillison.net , taras.glek.net This was literally the worst example you could possibly do. I hope you kept which one was which, I'd like to know if Copilot was right. In the meanwhile, from the current top #30 articles on HN (also via copilot script, but I removed non-cloudflare IPs): ycombinator.com -- no CDN letsbend.de -- no CDN grepular.com -- no CDN xania.org -- cloudfront github.io -- no common CDN owlposting.com -- AWS, but IPv4 remained static netfort.gr.jp -- no CDN simonwillison.net -- cloudflare, 104.21.112.1 fixed folklore.org -- azure, 13.107.246.1-255 range danq.me -- no CDN nature.com -- fastly, IPv4 remained static daringfireball.net -- cloudflare, 104.26.4.133 ssp.sh -- no CDN trebaol.com -- cloudflare, 104.21.3.245 glek.net -- cloudflare, 104.21.112.1 gov.uk -- AWS, but IPV4 remained static phys.org -- no CDN diwank.space -- cloudflare, 104.21.80.31 free.fr -- no CDN (my French ISP, btw) ericgardner.info -- AWS, but IPv4 remained static ghuntley.com -- fastly, IPv4 remained static paavo.com -- no CDN railway.com -- cloudflare, 104.18.24.53 alloc.dev -- cloudflare , 188.114.96.2 Look at how many of them are self-hosted, have zero CDN, or otherwise return me always the same IP (even when I try from 3 different ISPs) which makes them trivial to reverse address. This is already a pretty huge success rate and all my context is that you browsed HN first (which I know, see first result on the list). Now imagine the tools a ISP will have at its disposal: - IPv6 - Its Geo region will actually match yours - Routing tables - The patience to also include resources fetched from these pages in the analysis (i.e. page X always gets its JS from Y domain which results in a constant Z KB transfer). - The rest of your browsing activity - The rest of everyone's browsing activity including most popular _current_ hosts for each hostname. Do you still claim that it is "impossible" to track your activity because of CDNs? I still bet you your ISP can do it with _100%_ accuracy.

josephcsible 1y ago

> If I check up right now, form the top 10 links in HN right now, it is trivial to distinguish the top-level domain from just the IPv4 or IPv6 address. Two of the top 10 links in HN right now (https://news.ycombinator.com/item?id=44215603 https://news.ycombinator.com/item?id=44215603 and https://news.ycombinator.com/item?id=44212446 https://news.ycombinator.com/item?id=44212446) are to different subdomains of github.io that resolve to the exact same IP addresses, so reverse DNS doesn't tell you which one is being visited. And you can't even tell the TLD, because the TLD is "io", but the reverse lookup on the IPs will give you a TLD ending in "com". > Heck, even _for this website itself_ the current IPv4 reverse DNS points to ycombinator.com. That's because HN isn't behind the kind of CDN I'm talking about. But a lot are. Is your argument "since your ISP can see some of the sites you're going to, we should remove all protections and let them see all sites you're going to?"

AshamedCaptain 1y ago
I said top-level domain. Anyway, you have a better estimate, for the types of sites people here would visit? If HN itself isn't an example, then Github subdomains definitely ain't (not even close to the traffic of the main domain).
- josephcsible 1y ago
  > I said top-level domain. "io" and "com" are top-level domains, and in the example I gave, you can't even distinguish between them.
  - AshamedCaptain 1y ago
    Well, I appreciate the correction: I meant second level (or whatever is most distinguishing for that TLD). However, even if what you say is true, you really cannot disprove my claim with one nitpick, you need to talk majorities. (And, in case it needs to be said: i really don't think the issue here is distinguishing activity to github.io vs github.com)
    - josephcsible 1y ago
      Okay, how about this then. Here's some of the IP addresses of posts on the HN front page right now: 104.21.3.245 104.21.68.247 104.21.80.31 104.21.95.131 104.21.112.1 104.26.4.133 None of them have reverse DNS records. Can you tell which is which?
      - AshamedCaptain 1y ago
        So you take literally the worst possible set of IPs (all of them cloudflare), IPv4 only, and yet Copilot (!) is easily able to reverse 50% of them: 104.21.3.245 -- trebaol.com 104.21.80.31 -- diwank.space 104.26.4.133 -- daringfireball.net 104.21.112.1 -- simonwillison.net , taras.glek.net This was literally the worst example you could possibly do. I hope you kept which one was which, I'd like to know if Copilot was right. In the meanwhile, from the current top #30 articles on HN (also via copilot script, but I removed non-cloudflare IPs): ycombinator.com -- no CDN letsbend.de -- no CDN grepular.com -- no CDN xania.org -- cloudfront github.io -- no common CDN owlposting.com -- AWS, but IPv4 remained static netfort.gr.jp -- no CDN simonwillison.net -- cloudflare, 104.21.112.1 fixed folklore.org -- azure, 13.107.246.1-255 range danq.me -- no CDN nature.com -- fastly, IPv4 remained static daringfireball.net -- cloudflare, 104.26.4.133 ssp.sh -- no CDN trebaol.com -- cloudflare, 104.21.3.245 glek.net -- cloudflare, 104.21.112.1 gov.uk -- AWS, but IPV4 remained static phys.org -- no CDN diwank.space -- cloudflare, 104.21.80.31 free.fr -- no CDN (my French ISP, btw) ericgardner.info -- AWS, but IPv4 remained static ghuntley.com -- fastly, IPv4 remained static paavo.com -- no CDN railway.com -- cloudflare, 104.18.24.53 alloc.dev -- cloudflare , 188.114.96.2 Look at how many of them are self-hosted, have zero CDN, or otherwise return me always the same IP (even when I try from 3 different ISPs) which makes them trivial to reverse address. This is already a pretty huge success rate and all my context is that you browsed HN first (which I know, see first result on the list). Now imagine the tools a ISP will have at its disposal: - IPv6 - Its Geo region will actually match yours - Routing tables - The patience to also include resources fetched from these pages in the analysis (i.e. page X always gets its JS from Y domain which results in a constant Z KB transfer). - The rest of your browsing activity - The rest of everyone's browsing activity including most popular _current_ hosts for each hostname. Do you still claim that it is "impossible" to track your activity because of CDNs? I still bet you your ISP can do it with _100%_ accuracy.