HTML over DNS: Serving Blog Content over DNS

Post by toxik » Thu, Aug 19, 2021, 9:02 AM UTC

phh wrote: post #23

andai wrote: post #22

Earlier quoted context omitted.

Been wondering about this, how many people are using old browsers? caniuse.com reports [0] 96% support for ES6 classes. The other 4% is divided between Internet Explorer, Opera Mini and obsolete versions of every other browser. So I'm trying to figure out what kind of people are using such ancient technology and why? What kind of unusual visitors would I be missing out on?

You're missing on visitors with disabled (or whitelisted) javascript. On HackerNews that'll be pretty common.

Post by [deleted] » Thu, Aug 19, 2021, 9:07 AM UTC

k4ch0w wrote: post #28

ignoramous wrote: post #6

Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie replacement [2]. [0] https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... [1] https://github.com/Jigsaw-Code/choir (disclosure: I co-develop hard-forks of two other related Jigsaw-Code projects) [2] http://dnscookie.com/

Packet size is a really good detection for this. DNS packets should only be so big ;)

Post by masklinn » Thu, Aug 19, 2021, 9:35 AM UTC

jacobkiers wrote: post #25

masklinn wrote: post #15

> You might not be able to see it immediately Or at all since the content is entirely injected via JS with no fallback (and the JS uses class fields in case you thought an old browser might be able to load it).

I don't know how to do this without JS. Also, since this was mostly a DNS-focused proof of concept, I don't particularly care about that. Not in this case, at least.

Post by masklinn » Thu, Aug 19, 2021, 9:37 AM UTC

andai wrote: post #34

phh wrote: post #23

Earlier quoted context omitted.

You're missing on visitors with disabled (or whitelisted) javascript. On HackerNews that'll be pretty common.

It's true that people with JavaScript disabled won't be able to run any JavaScript, but once they turn it on it should have relatively good feature support -- I suspect the sort of people who know how to disable JavaScript aren't using software more than 5 years out of date.

Post by [deleted] » Thu, Aug 19, 2021, 10:03 AM UTC

ignoramous wrote: post #6

Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie replacement [2]. [0] https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... [1] https://github.com/Jigsaw-Code/choir (disclosure: I co-develop hard-forks of two other related Jigsaw-Code projects) [2] http://dnscookie.com/