Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Domain fronting to be blocked on Azure

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 132 posts

Re: Tell HN: Domain fronting to be blocked on Azure

#81

Post by matheusmoreira »

toast0 wrote: post #71
counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

Domain fronting leads to collateral damage in terms of blocking. If I really want to block X and X is using domain fronting to blend in with traffic on a given CDN, that CDN is going to get blocked. CDN customers that are having their stuff blocked because of that are not going to be happy, in general.

The goal is to get people to stop wanting to block X in the first place. Alternatively, make it so they have to block the entire internet along with X.

Re: Tell HN: Domain fronting to be blocked on Azure

#82

Post by jgrahamc »

FiloSottile wrote: post #76
jgrahamc wrote: post #74

Earlier quoted context omitted.

The insinuation is that somehow we had to stop domain fronting because “China”. That’s false. What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get. And what made it even weirder was that the domain fronting was connecting to other proxy s…

As I said above, I was not involved in the deliberation, so I don't know the reason domain fronting was blocked. I clearly remember it being an explicit decision though, not a bug mitigation, and Matthew's explanation on HN makes no mention of a technical issue. I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due…

I clearly remember it being an explicit decision though, not a bug mitigation

To be clear, that's not correct we did do this to mitigate the bug.

We were facing the bug that I described (the cross stream thing) showing up when Lantern was used. It was causing disruption to our service and customers were writing in. We were trying to understand what was happening and needed to stop it. One of the things we did to stop it was disable domain fronting. As we were seeing the customer reports we didn't know if this was an OpenSSL bug, something in NGINX, something in our code, but we did know that Lantern was somehow causing it and they were doing domain fronting which wasn't the standard use of our service and so we dropped it.

Re: Tell HN: Domain fronting to be blocked on Azure

#83

Post by FiloSottile »

jgrahamc wrote: post #82
FiloSottile wrote: post #76

Earlier quoted context omitted.

As I said above, I was not involved in the deliberation, so I don't know the reason domain fronting was blocked. I clearly remember it being an explicit decision though, not a bug mitigation, and Matthew's explanation on HN makes no mention of a technical issue. I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due…

I clearly remember it being an explicit decision though, not a bug mitigation To be clear, that's not correct we did do this to mitigate the bug. We were facing the bug that I described (the cross stream thing) showing up when Lantern was used. It was causing disruption to our service and customers were writing in. We were trying to understand what was happening and needed to stop it. One of the things we did to stop…

Maybe domain fronting was initially disabled as an unsuccessful attempt to fix that bug, that's possible and as I said I was not involved in that decision. Still, if that's the case, there was a policy decision afterwards to leave it disabled, because disabling it did not fix the bug, as you seem to agree. (Again, not elaborating on the bug publicly without permission, but I remember it turned out to have nothing to do with the SNI.)

My point is that disabling domain fronting (or leaving it disabled after finding the bug's root cause) was a policy decision, not something necessary to mitigate the bug or prevent it from re-occurring.

Re: Tell HN: Domain fronting to be blocked on Azure

#84

Post by mapgrep »

jgrahamc wrote: post #74
FiloSottile wrote: post #33

Earlier quoted context omitted.

It's been many years, and I am still angry and disappointed by Cloudflare's decision to block domain fronting and drop Lantern as a customer. Lantern was one of the most effective Great Firewall bypass proxies at the time, and Cloudflare was expanding in China. (I was at Cloudflare at the time, but I don't have private information on the deliberation. I strongly considered quitting over it, maybe I should have, but I…

The insinuation is that somehow we had to stop domain fronting because “China”. That’s false. What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get. And what made it even weirder was that the domain fronting was connecting to other proxy s…

…he says, as his company eagerly does business with Xi in China.

No organization I am part of will ever do business with you if I can stop it.

You fought for Turing but I suppose the Uyghur concentration camps mean nothing to you. They are not British so how could their lives be worth fighting for when there is money to be made (for yourself) without regard to morality or any sense of decency.

But good job doing Cloudflare PR.

Re: Tell HN: Domain fronting to be blocked on Azure

#85

Post by vbezhenar »

counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

I guess that they're afraid for entire Azure to be blocked by Russia or Kazakhstan. They can't afford such losses.

Re: Tell HN: Domain fronting to be blocked on Azure

#86

Post by dilyevsky »

remram wrote: post #62
lzooz wrote: post #5

Earlier quoted context omitted.

Well if they didn't do this the entire Azure would get banned which is even worse.

Banned by whom and why do you think that?

Spanish isps for example. Did you know that in Spain there’s a deal between rightholders and isps to block any domains/IPs they don’t like? See: https://torrentfreak.com/spanish-isps-blocked-869-domains-su...

I’ve personally seen domains on a shared provider banned without notice even though alleged pirate content was taken down within minutes. Very difficult to unban

Re: Tell HN: Domain fronting to be blocked on Azure

#87

Post by 5e92cb50239222b »

throwaway0x7E6 wrote: post #27
616c wrote: post #19

Earlier quoted context omitted.

Separate of whether the correlation is correct do you or anyone have info on the Telegram minitrue issue? I was unaware and don't really use Telegram.

they've attempted to block it several years ago, likely due to its popularity among dissidents and/or refusal to cooperate with russian Disinformation Governance Board. they've botched it and a lot of unrelated services got blocked as well. they gave up and stopped trying.

They went one step further after that fiasco — it's heavily used these days to spread pro-Kremlin propaganda (definitely automated — very similar messages get posted to thousands of channels pretty much simultaneously⁰). Comment sections on other channels are filled with bots (you can see them a mile away — the nicknames are generated using the same pattern, the names don't feel right if you intimately know how Russian names are supposed to look, and the message style is obvious once you get to know it).

0: https://twitter.com/sobollubov/status/1567152744812740610

Re: Tell HN: Domain fronting to be blocked on Azure

#88

Post by ianlevesque »

hoppla wrote: post #69
psychphysic wrote: post #26

Lack of SNI encryption is the Achilles heel of modern web when it comes to oppressive regimes blocking access. Between encrypted SNI (Or domain name fronting), encrypted DNS and of course HTTPS. The biggest legitimate use case of Tor would vanish.

It will still be possible to correlate IP addresses and hostnames. You can only hope for plausible deniability provided that the site you are visiting share IP address with a bunch of other sites.

While true, I feel this reasoning has been used to delay improving the situation for far too long. There's a big difference between "accessed this CDN IP used by thousands of websites" and "deliberately connected to example.com"

Re: Tell HN: Domain fronting to be blocked on Azure

#89

Post by cryptonym »

counttheforks wrote: post #30

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

Let's say customer A got a server cert on Azure for bank_example.com and customer B got a cert on Azure for nsfw_example.com

With domain fronting you may get 'nsfw_example.com' content from a TLS connection negotiated with 'bank_example.com'.

This can be a security threat (not able to properly filter outbound traffic) and customer A may be unhappy about Azure allowing nsfw content to be distributed over a channel secured under the name of their bank.

Re: Tell HN: Domain fronting to be blocked on Azure

#90

Post by _8j50 »

denton-scratch wrote: post #68
_8j50 wrote: post #43

Earlier quoted context omitted.

Well then hopefully tech people will soon wrap their head around the fact that political problems are best solved politically. You can't write tech that overrides the authority of governments but you can override or change governments.

> You can't write tech that overrides the authority of governments Really? Tor springs to mind.

Same. What's your point? VPNs also bypass government blocks. It's a cat and mouse game, they block vpns and guards as they see fit when they have a good reason to. Look at tor, if a country tls decrypts everything and blocks connections that can't be decrypted can it still bypass their blocks? Just because not every government is doing it does not mean Tor can't be blocked. Hell, countries allow-list connections to allowed sites if they want. Breaking their laws may make you feel edgy but that sort of "revolution exporting" many in other countries consider it a form of neo-colonialism where you undermine their sovreignity and self-determination.
Post reply on HN