News for hackers. Stuff that matters.
Re:Tell HN: Domain fronting to be blocked on Azure by codetrotter on Saturday November 12, 2022 @08:26AM (#33572832)
For anyone else wondering what domain fronting is:

> Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than is discernable to third parties monitoring the requests and connections.

https://en.wikipedia.org/wiki/Domain_fronting

Cool, so we are bowing down further to oppressive regimes now.

Re:Tell HN: Domain fronting to be blocked on Azure by badrabbit on Saturday November 12, 2022 @08:52AM (#33573042)
That definition is incomplete. Threat actors also abuse this to hide their command and control infrastructure.
Re:Tell HN: Domain fronting to be blocked on Azure by lzooz on Saturday November 12, 2022 @09:08AM (#33573161)
Threat actors use knives to stab people - we have to stop selling those.
Re:Tell HN: Domain fronting to be blocked on Azure by tialaramex on Saturday November 12, 2022 @09:40AM (#33573465)
In the UK if you're under age and you decided to buy a knife you will have a lot of difficulty unless it's a little folding (but non-locking) pocket knife, like the small Swiss Army type utility knives. Indeed legally as old as 17 you can't even buy a steak knife in England although you can in Scotland.

Once you've bought a knife, it will usually be illegal to carry it in public unless you have a good reason, and "self defence" is not a good reason.

Some particular knives, which have no apparent purpose except as weapons, are just illegal automatically except in some cases if you're a museum. In particular almost all swords (if they have a working blade) are in this category, and most things designed as concealed weapons (e.g. blade hidden in an umbrella, combs that are actually knives, push daggers)

Re:Tell HN: Domain fronting to be blocked on Azure by rovr138 on Saturday November 12, 2022 @10:22AM (#33573881)
I'm not trying to be an asshole, but we don't get much info from UK here besides things like the Queen dying, so I have to ask, Does it work?

I mean, are instances of kids <=17 year olds with knifes down? What about shivs and other things?

The reason I'm asking is because as a kid, if I had been told to not do something, I'd just find a way to do it. Not to use it, but to find loopholes and just say, _so what?, I can do x_

Re:Tell HN: Domain fronting to be blocked on Azure by voakbasda on Saturday November 12, 2022 @10:30AM (#33573970)
It absolutely does not work. Violence finds a way.
Re:Tell HN: Domain fronting to be blocked on Azure by metiscus on Saturday November 12, 2022 @11:45AM (#33574713)
The mind is humanity's most lethal weapon. With the "right" mindset the entire universe can become a weapon. Efforts to reduce violence tend to focus on the presence of concrete weapons (because this is easier to quantify and measure etc) with much less focus on violent ideation and the root causes of the various forms of interpersonal violence.

Reducing violence is a tricky thing because to a large extent it seems to me to be a symptom of broader and nearly intractable societal malaise. Not that it isn't worth removing nuclear weapons from circulation but the returns diminish quicker than most public policy folks seem to want to admit.

Re:Tell HN: Domain fronting to be blocked on Azure by bombcar on Saturday November 12, 2022 @03:44PM (#33576865)
Also ever since “driving while black/poor/not liked” became something you couldn’t arrest on they need another excuse.
Re:Tell HN: Domain fronting to be blocked on Azure by bluehatbrit on Saturday November 12, 2022 @11:20AM (#33574453)
I don't know enough about when various laws were passed to say whether the introduction of the laws have had an impact. In 2021 the Office for National Statistics published a reasarch breifing on the topic with some top level numbers [1]. I can say I don't walk around expecting people to have a weapon on them, even in some of the higher crime areas of my city (Bristol). But that's just anecdotal and it'll greatly depend on where you live.

[1] https://commonslibrary.parliament.uk/research-briefings/sn04...

Re:Tell HN: Domain fronting to be blocked on Azure by denton-scratch on Saturday November 12, 2022 @12:04PM (#33574880)
Speaking for myself, I own a Buck Hunter knife that I used to carry as a pocket knife. When I learned that it's not street-legal (it's blade locks, and is 1/2" too long) I stopped carrying it. So that's one anecdatum. I'm not particularly unusual; I imagine many people that once carried a locking pocket knife no longer do.

There was a spate of stabbing reports, about a decade ago. That seems to have died down. My guess (and it's only a guess) is that only drug dealers and people bent on mayhem carry guns or knives that aren't street-legal these days; what's the point in getting busted for carrying a penknife?

Incidentally, I don't get the point of the ban on locking knives. If you stab someone with a knife that doesn't lock, then I suppose there's a risk to your own fingers; but the dude you stabbed won't care if it was a locking knife or not. I do get the blade-length restriction though. You don't need a 3" blade to sharpen pencils.

My straight razors are street-legal, though, and I think they're quite a lot more dangerous than a 3" knife that locks. The sharpened edge of a razor is only about 2" long, so I assume it's street-legal; but you could really make a mess of someone's face with a razor (the preferred weapon of Pinky, the gangster from Brighton Rock).

Re:Tell HN: Domain fronting to be blocked on Azure by azalemeth on Saturday November 12, 2022 @12:29PM (#33575143)
Another piece of anecdatum: a vague friend of mine once had a routine traffic stop by the police as he'd renewed his car insurance on the day it expired and the change hadn't made it onto the database they use yet. The police officer asked something like "just as a routine question, do you have anything on you that you might think you shouldn't have, like knives etc". He was (at the time) a professional chef and had a large roll of huge, high end kitchen knives on the back seat of the car. He also had chef's whites and was driving to work. The policeman said that apparently a few smarter drug dealers had started doing that (keeping them in a roll) as it was more plausible that they'd be cooking with them rather than stabbing their mates. The give away, apparently, was that they'd just have one massive one and not bother with the chef's job and still end up with a few years in prison.

My friend "got" a nice chat, and went on with his day, but did later comment that had he not had the outfit to go with them, and a vast array of obvious kitchen tools, he thought that they'd probably look at it a lot more seriously.

Re:Tell HN: Domain fronting to be blocked on Azure by xeromal on Saturday November 12, 2022 @09:23AM (#33573290)
There's an argument to be made for that. See, the UK.
Re:Tell HN: Domain fronting to be blocked on Azure by chitowneats on Saturday November 12, 2022 @09:27AM (#33573328)
Sure. Might be hard for people to do certain manual labor jobs without access to sharp objects. I'm sure they'll figure it out.

We'll have to ban rocks next though.

Re:Tell HN: Domain fronting to be blocked on Azure by oneplane on Saturday November 12, 2022 @09:35AM (#33573422)
It's pretty hard to stab people with rocks, especially multiple people.
Re:Tell HN: Domain fronting to be blocked on Azure by notadev on Saturday November 12, 2022 @09:40AM (#33573467)
But pretty easy to cause blunt force trauma to the head
Re:Tell HN: Domain fronting to be blocked on Azure by hedora on Saturday November 12, 2022 @09:51AM (#33573583)
Generations of Native Americans beg to differ.
Re:Tell HN: Domain fronting to be blocked on Azure by oneplane on Saturday November 12, 2022 @10:12AM (#33573784)
The native-american generations population probably doesn't intersect with the population of teenage knife-wielding attackers in london, which is what we're talking about.

Then again, if you want to argue stone-age semantics: we can't ban anything and should just resort to continuous murder since rule-based society is too hard.

Re:Tell HN: Domain fronting to be blocked on Azure by exedore6 on Saturday November 12, 2022 @10:49AM (#33574149)
We just need to watch out for teenagers learning flint-knapping.
Re:Tell HN: Domain fronting to be blocked on Azure by badrabbit on Saturday November 12, 2022 @10:15AM (#33573817)
Talk about a strawman. Knives have utiltiy which is a feature. Domain fronting is a bug not a supported feature.
Re:Tell HN: Domain fronting to be blocked on Azure by brookst on Saturday November 12, 2022 @10:44AM (#33574100)
You’re mixing up definition and policy.

If airlines banned knives and someone posted a definition of “knife” that suggested they are only used for eating food, it would be perfectly reasonable for a reply to point out that there are dangerous uses which might have led to the bad, and that it’s disingenuous to suggest that the ban was obviously motivated by a desire to make eating difficult.

It’s still fair to debate the balance of use and the merits of the ban, but IMO it is not reasonable to be upset over a more complete definition and context.

Re:Tell HN: Domain fronting to be blocked on Azure by hsdropout on Saturday November 12, 2022 @09:05AM (#33573137)
Re:Tell HN: Domain fronting to be blocked on Azure by weberer on Saturday November 12, 2022 @09:08AM (#33573169)
They've been waging this war for a couple years now. I guess they finally got to every cloud provider. Some related reading:

"Amazon and Google bow to Russian censors in Telegram battle"

https://www.fastcompany.com/40568177/amazon-and-google-bow-t...

"U.S. Cloud Providers Face Backlash From China’s Censors"

https://www.wsj.com/articles/u-s-cloud-providers-face-backla...

https://archive.ph/qhFQ5

>China’s Internet censors have strengthened content screening in recent months, creating difficulties for businesses and disrupting more commonly used firewall-circumvention software called virtual private networks, which connect users to the Web through a proxy server overseas. President Xi Jinping has ordered tighter control of online content that may undermine the ruling Communist Party, with bloggers facing jail for spreading what the government says are false rumors.

Re:Tell HN: Domain fronting to be blocked on Azure by deepsun on Saturday November 12, 2022 @09:34AM (#33573407)
I still see Cloudflare.
Re:Tell HN: Domain fronting to be blocked on Azure by FiloSottile on Saturday November 12, 2022 @09:41AM (#33573477)
It's been many years, and I am still angry and disappointed by Cloudflare's decision to block domain fronting and drop Lantern as a customer. Lantern was one of the most effective Great Firewall bypass proxies at the time, and Cloudflare was expanding in China. (I was at Cloudflare at the time, but I don't have private information on the deliberation. I strongly considered quitting over it, maybe I should have, but I was junior back then.)

The CEO even came on HN to try to frame it as an abuse mitigation, accusing Lantern of exploiting Cloudflare and arguing that they were not a customer. That was obviously false because you need to have a Cloudflare zone configured for domain fronting to work. They were a customer as much as the targeted hate websites they strenuously defend.

https://news.ycombinator.com/item?id=9234367

Companies show their color in selecting who they will stand up for.

Re:Tell HN: Domain fronting to be blocked on Azure by jgrahamc on Saturday November 12, 2022 @12:34PM (#33575190)
The insinuation is that somehow we had to stop domain fronting because “China”. That’s false.

What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get.

The issue was domain fronting where SNI didn’t match Host causing us to handle the traffic incorrectly sometimes (infrequently but not zero). Since standard use of the Internet doesn’t need SNI and Host: to not match we blocked the use of domain fronting very fast to ensure the integrity of our service.

Lantern was domain fronting tickling this bug and causing our customers trouble. Hence we dropped domain fronting.

I remember this well because I actually debugged it myself and reported the problem in Jira. You weren’t involved and inventing a story about “China” is dead wrong.

Re:Tell HN: Domain fronting to be blocked on Azure by FiloSottile on Saturday November 12, 2022 @12:51PM (#33575319)
As I said above, I was not involved in the deliberation, so I don't know the reason domain fronting was blocked. I clearly remember it being an explicit decision though, not a bug mitigation, and Matthew's explanation on HN makes no mention of a technical issue.

I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due to the Host/SNI mismatch. It just happened around the same time that domain fronting was blocked. (I am going to respect my confidentiality agreement here, but if you want I can share what I remember here or in private.)

Re:Tell HN: Domain fronting to be blocked on Azure by jgrahamc on Saturday November 12, 2022 @01:35PM (#33575692)
I clearly remember it being an explicit decision though, not a bug mitigation

To be clear, that's not correct we did do this to mitigate the bug.

We were facing the bug that I described (the cross stream thing) showing up when Lantern was used. It was causing disruption to our service and customers were writing in. We were trying to understand what was happening and needed to stop it. One of the things we did to stop it was disable domain fronting. As we were seeing the customer reports we didn't know if this was an OpenSSL bug, something in NGINX, something in our code, but we did know that Lantern was somehow causing it and they were doing domain fronting which wasn't the standard use of our service and so we dropped it.

Re:Tell HN: Domain fronting to be blocked on Azure by FiloSottile on Saturday November 12, 2022 @01:52PM (#33575858)
Maybe domain fronting was initially disabled as an unsuccessful attempt to fix that bug, that's possible and as I said I was not involved in that decision. Still, if that's the case, there was a policy decision afterwards to leave it disabled, because disabling it did not fix the bug, as you seem to agree. (Again, not elaborating on the bug publicly without permission, but I remember it turned out to have nothing to do with the SNI.)

My point is that disabling domain fronting (or leaving it disabled after finding the bug's root cause) was a policy decision, not something necessary to mitigate the bug or prevent it from re-occurring.

Re:Tell HN: Domain fronting to be blocked on Azure by hungryforeggs on Saturday November 12, 2022 @04:09PM (#33577113)
I think maybe it's not the best approach to air out grudges with former employers in public. And apparently incorrect ones at that.
Re:Tell HN: Domain fronting to be blocked on Azure by tptacek on Saturday November 12, 2022 @11:43PM (#33580164)
Just for the record, there are very few people on the Internet I would trust more about this kind of stuff than Filippo.
Re:Tell HN: Domain fronting to be blocked on Azure by hungryforeggs on Sunday November 13, 2022 @07:44AM (#33582535)
That just indicates poor judgement on your part.
Re:Tell HN: Domain fronting to be blocked on Azure by tptacek on Sunday November 13, 2022 @12:35PM (#33585222)
I'm extraordinarily comfortable with how my comments here reflect on my judgement.
Re:Tell HN: Domain fronting to be blocked on Azure by eastdakota on Saturday November 12, 2022 @08:33PM (#33579044)
There are former employees who are honorable. There are others who are blatant, self-promotional liars.

Filippo: You, sadly, fall in the later camp and have for some time. You’re wrong here. You’re wrong most times you post uninformed speculation. It’s tiresome.

I wish you luck in whatever you’re doing post-Google and hope you find the success you’ve desired since our first conversation that will, I pray, stop you from your latent and seemingly unpatchable personality bug of making shit up and making yourself a more important figure in every story than you actually are or ever have been.

Re:Tell HN: Domain fronting to be blocked on Azure by dang on Sunday November 13, 2022 @01:46AM (#33580688)
Commenters aren't allowed to attack others like this on HN, regardless of how wrong the other person is or it feels like they are.

If you'd please review and follow the site guidelines, we'd appreciate it: https://news.ycombinator.com/newsguidelines.html.

Re:Tell HN: Domain fronting to be blocked on Azure by mapgrep on Saturday November 12, 2022 @02:11PM (#33576051)
…he says, as his company eagerly does business with Xi in China.

No organization I am part of will ever do business with you if I can stop it.

You fought for Turing but I suppose the Uyghur concentration camps mean nothing to you. They are not British so how could their lives be worth fighting for when there is money to be made (for yourself) without regard to morality or any sense of decency.

But good job doing Cloudflare PR.

Re:Tell HN: Domain fronting to be blocked on Azure by mindslight on Saturday November 12, 2022 @04:13PM (#33577151)
Could you not make domain fronting only work when the inside Host contains a specific component like start-frontin.example.com ? Then it will never work for a naive browser wanting to reach www.customer.com, but will work for non-browser clients deliberately trying to front.
Re:Tell HN: Domain fronting to be blocked on Azure by adamfisk on Sunday November 13, 2022 @06:33AM (#33582092)
Fascinating, Filippo. We stayed silent on it at the time primarily because we were keeping a low profile particularly as more and more Chinese were using Lantern, but there was also back channel pressure through various contacts, to be honest related to the pending Cloudflare expansion in China.

There was also a prelude to all of this that I think made things stickier and bizarrely personal. Prince and I share a mutual friend who introduced us just a few weeks prior. Prince said he supported what we were doing, but asked that I not talk about it publicly, presumably because of the pending China deal. The problem was that literally moments after our friend had introduced us via email, and before he made that request, I had a call with the WSJ where I talked about precisely this. I did everything I could to walk back the article, but Prince didn't buy it and seemed to go ballistic over it. After the WSJ piece, we pulled back from talking more publicly in general.

Oh, I forgot! We also partly stayed silent because they didn't actually shut down what we were doing at all =). They matched the SNI to the Host header, sure, but they missed a little detail: we weren't using SNI. Hehe. Lantern worked for another six months or so, and then, through a similarly bizarre sequence of events, we essentially tipped them/you off to what was happening. We remained a customer throughout, and we're a customer to this day.

Either way, though, Cloudflare does great work, and everyone has their faults, so I'm generally sympathetic over the whole thing with the one caveat that I am truly unclear how much ultimately did relate to China, most clearly in terms of any public support for these internet freedom techniques.

Oh, and I've wanted you to work on Lantern forever btw -- could get the band back together with @benjojo. Oooh actually if you're not aware of it, the uTLS Go TLS fork is a hugely impactful project that's in widespread use (I would guess maybe 50 million monthly active users rely on it in censored regions via various projects) but needs updating - https://github.com/refraction-networking/utls

Oh, and if you think we were effective in China then, you should see what we're doing in Russia and especially Iran now!

Re:Tell HN: Domain fronting to be blocked on Azure by adamfisk on Sunday November 13, 2022 @06:47AM (#33582171)
Oh it's also worth noting that Cloudflare is actually more aggressive in blocking domain fronting than almost anyone else. Lots of folks match the SNI to the Host header, but Cloudflare takes it a step further and also makes sure that TLS connections without SNI have a Host header that's scoped to the IP/server they're actually visiting. That means you can't, for example (not that we would ever, ever do this hehehe), scan the whole Cloudflare IP space for IPs to front through without SNI.
Re:Tell HN: Domain fronting to be blocked on Azure by Avamander on Saturday November 12, 2022 @10:08AM (#33573748)
We have ECH (previously known as ESNI) now, is that not just domain fronting in a new form?
Re:Tell HN: Domain fronting to be blocked on Azure by theCrowing on Saturday November 12, 2022 @10:15AM (#33573814)
Only for the legal stuff... so you will still get complaining comments.
Re:Tell HN: Domain fronting to be blocked on Azure by cesarb on Saturday November 12, 2022 @01:23PM (#33575580)
No, because with ECH/ESNI the hostname in both layers (the TLS connection and the HTTP Host header) still matches. The only difference is that the hostname on the both layers is no longer visible on the wire, while without ECH/ESNI the hostname on one layer (the HTTP Host header) is hidden but the hostname in the other layer (the TLS connection) is visible. And you could still do domain fronting even with ECH/ESNI (making the hostname on each layer differ), though it would be kind of pointless.
Re:Tell HN: Domain fronting to be blocked on Azure by pmontra on Sunday November 13, 2022 @03:41AM (#33581237)
I was wondering that, thanks.

What I'm wondering now is why one should use that instead of a proxy server that maps some.domain.com to something.else.com