I do remember one terrifying bug that Lantern was tickling which caused responses to cross streams, and I was involved in debugging that, but it was not due to the Host/SNI mismatch. It just happened around the same time that domain fronting was blocked. (I am going to respect my confidentiality agreement here, but if you want I can share what I remember here or in private.)
To be clear, that's not correct we did do this to mitigate the bug.
We were facing the bug that I described (the cross stream thing) showing up when Lantern was used. It was causing disruption to our service and customers were writing in. We were trying to understand what was happening and needed to stop it. One of the things we did to stop it was disable domain fronting. As we were seeing the customer reports we didn't know if this was an OpenSSL bug, something in NGINX, something in our code, but we did know that Lantern was somehow causing it and they were doing domain fronting which wasn't the standard use of our service and so we dropped it.
My point is that disabling domain fronting (or leaving it disabled after finding the bug's root cause) was a policy decision, not something necessary to mitigate the bug or prevent it from re-occurring.
Filippo: You, sadly, fall in the later camp and have for some time. You’re wrong here. You’re wrong most times you post uninformed speculation. It’s tiresome.
I wish you luck in whatever you’re doing post-Google and hope you find the success you’ve desired since our first conversation that will, I pray, stop you from your latent and seemingly unpatchable personality bug of making shit up and making yourself a more important figure in every story than you actually are or ever have been.
If you'd please review and follow the site guidelines, we'd appreciate it: https://news.ycombinator.com/newsguidelines.html.
No organization I am part of will ever do business with you if I can stop it.
You fought for Turing but I suppose the Uyghur concentration camps mean nothing to you. They are not British so how could their lives be worth fighting for when there is money to be made (for yourself) without regard to morality or any sense of decency.
But good job doing Cloudflare PR.
What actually happened was we started to get reports from customers that we were serving content from unrelated sites under their domains. Wasn’t happening a lot but for a reverse proxy that’s terrifying and about as bad as it can get.
The issue was domain fronting where SNI didn’t match Host causing us to handle the traffic incorrectly sometimes (infrequently but not zero). Since standard use of the Internet doesn’t need SNI and Host: to not match we blocked the use of domain fronting very fast to ensure the integrity of our service.
Lantern was domain fronting tickling this bug and causing our customers trouble. Hence we dropped domain fronting.
I remember this well because I actually debugged it myself and reported the problem in Jira. You weren’t involved and inventing a story about “China” is dead wrong.