Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.
Amazon threatens to suspend Signal's AWS account over censorship circumvention
31–40 of 519 posts
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#32[deleted]
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#33Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#34Can someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what? EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org"). Also how can they possibly…
TFA explains it in detail.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#35So they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?
You can’t really stop someone from domain fronting on any CDN. This is like “maybe you should have not talked about this on HN”. :)
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#36Misleading headline? > Signal plans to make its traffic look like traffic from another site, (popularly known as “domain fronting”) by using a domain owned by Amazon -- Souq.com
The part you're missing is: ... to third parties. They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties creating the SSL connection are not lying to each other, though.
But they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#37They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
It is not that much of an interpretation. When us-east has problems a huge proportion of Internet sites that people actually use goes down.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#38Misleading headline? > Signal plans to make its traffic look like traffic from another site, (popularly known as “domain fronting”) by using a domain owned by Amazon -- Souq.com
The part you're missing is: ... to third parties. They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties creating the SSL connection are not lying to each other, though.
But the result may be Amazon getting blocked in those countries, which could cause Amazon financial and logistical harm.
I'm all for Signal helping people bypass state censorship, but they're attempting to bring third parties into the fold and use them as fodder for the cause.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#39Can someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what? EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org"). Also how can they possibly…
They aren't serving content on that domain. They just make requests look like they are going to that domain in the outer layer (by using it as the TLS server name), but the actual request inside the encryption is for a different domain they own. The load-balancer in front of the cloud service accepts the connection for souq.com (since it is responsible for that too it has the matching server certificate), decrypts the request, sees in the request that its for "signal.org" or whatever and delivers it there.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#40Can someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what? EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org"). Also how can they possibly…
Even with GET request you can pack all sorts of stuff in the headers --- such as a message.