Viewing profile — arch-choot

Repeating a prior comment I've made about this[0]: I run a rust webserver on a €4 VPS from hetzner that serves 300M (million) requests a day. From what I can figure out, Vercel cha…

It's a BitTorrent tracker tracker.mywaifu.best:6969/announce Running https://github.com/ckcr4lyf/kiryuu (Disclaimer: I'm the author of kiryuu) CPX11, so 2vCPU/2GB

I run a rust webserver on a €4 VPS from hetzner that serves 300M (million) requests a day. Way cheaper than doing that on _any_ "serverless" request-based platform, I think.

Could you clarify a bit more what you mean by "Domain Fronting is why ECH exists"? Because even with ECH, you (TLS client) can set any public_name you want, but the innerSNI can be…

An example for the hub: ``` echo -e "GET / HTTP/1.1\r\nHost: www.pornhub.com\r\nConnection: close\r\n\r\n" | openssl s_client -connect 66.254.114.41:443 -quiet ``` This works for m…

If i'm not mistaken its because IPs are actually much easier to rotate than domains. E.g. all the users will remember `example.com` , underlying it doesn't matter what IP it resolv…

\> This makes the spec entirely meaningless for small servers and basically requires shifting hosting to shared hosts/massive CDNs to provide any protection against SNI snooping. A…

Should've added this was back in like 2018 or so. Setting up DoH was harder than enabling SNI, and from my testing back then they were hard filtering on SNI (e.g. I used OpenSSL CL…

Glad that it's published, I'd been following it since ESNI draft days. Was pretty useful back when I was in India since Jio randomly blocked websites, and cloudflare adopted the ES…

Those are great domains for this kinda thing! Thanks for the idea

Just bare wireguard on 51820? I think I had tried that but no luck; but I don't remember for sure.

Sorry if its a bit unclear; the first part was HKG -> LHR when I kinda discovered it (9th May), and then the HTTPS proxy test was my flight back LHR -> HKG (18th May)

Ah right, if they also impose IP restrictions this would not work

Yea, I run wireguard & OpenVPN on port53 (different VPS) just in case it works. Unfortunately my experience with the "pay to use" WiFi so far has been they validate that port 53 is…

I think that's essentially what my HTTPS proxy does; except rather than actually being over WhatsApp (i.e. using WA messages or w/ever), the SNI tricks their authorization into thi…

There may not be any "free messaging" or similar offers is my guess. In fact using ECH it is already possible to spoof the SNI but make a real TLS handshake to the underlying domai…

Yep; on my way to LHR I was intrigued by their "free messaging" and wanted to poke around, with the SNI hypothesis I did the actual HTTPS proxy setup on a VPS while in the UK, so I…

So there's no way to get back in if you step out for food?

Interesting! I'd done something similar in Typescript to learn more about BT, and then redid it in rust to learn rust ( https://github.com/ckcr4lyf/kiryuu ). However I decided to j…

Pretty cool! I've been living in HK for 7 years now and not moved past the basic few phrases - mostly because English gets you so far there's no "forcing factor" (vs. in Tokyo you'…

imo BT is not at fault here (if that's what your were implying) - It is a conscious choice by Apple chooses to always listen for these beacons and prompt the user with a pop-up (ev…

If you ignore the last 6 points about cameras and displays, then this is kinda what "Smartcards" are, I think? https://en.wikipedia.org/wiki/OpenPGP_card In fact the Estonian Id-Ca…

I'm not sure how intensive the "backend" is, but I've found stuff like workers to be economically efficient only for hobby tier projects. I operate a BitTorrent tracker I wrote for…

Related: https://news.ycombinator.com/item?id=22995008

I'm pretty sure the default is they can see all the cleartext, since their product is based on TLS interception, for example to evaluate page rules. This is also how they insert ex…