Re:Block YouTube Ads on AppleTV by Decrypting and Stripping ...
by docmars on Sunday August 27, 2023 @09:18AM
(#37282442)
For any gamers out there, Reshade's installer is another example where TLS istn't implemented properly. It fails to download effect/shader packages for basic setup on up-to-date Windows machines because it requires that you disable TLS 1.3 globally on Windows so it can use 1.1 or 1.2.
[1] https://reshade.me/forum/troubleshooting/8746-reshade-v-5-8-...
Re:Block YouTube Ads on AppleTV by Decrypting and Stripping ...
by ComputerGuru on Sunday August 27, 2023 @02:12PM
(#37285203)
I never heard of reshade before but that is quite crazy. The only explanation I can think of is that the backend they connect to implements TLS 1.3 but in a broken way (because the client crypto lib would otherwise fall back to TLS 1.2 on its own) which really makes you wonder just how broken the crypto impl on their servers is and how many vulnerabilities they’re wide open to.
Re:Block YouTube Ads on AppleTV by Decrypting and Stripping ...
by userbinator on Sunday August 27, 2023 @05:52PM
(#37286970)
TLS 1.3 is IMHO still too new to have stabilised and had all the edge-cases worked out. 1.2 was first released in 2008 and only started becoming a requirement more than ~10 years later. I'm not sure how the situation with 1.2 was but I know there were several draft versions of 1.3, which do not interoperate yet had public implementations. That might be what's happening there.
Re:Block YouTube Ads on AppleTV by Decrypting and Stripping ...
by 1vuio0pswjnm7 on Monday August 28, 2023 @12:55AM
(#37289917)
Here are a few sites one (IMHO) would expect to support TLS1.3 but do not
www.digitalocean.com
arstechnica.com (Amazon)
git.kernel.org
cdn.netbsd.org (Fastly)
Once the requests leave the computer and travel onto the internet destined for another computer, then of course "MITM" makes sense as a concept.
The computer owner controls the proxy and it's the proxy, not the untrusted application, like a "modern" web browser for example, that handles authentication of the remote peer. Compiling and fully controlling a "modern" browser is a PITA. Almost no one does it, even software developers. Instead people beg for an advertising company or their partner to make changes to a browser. That does not seem to work. Sometimes when people complain it stops the company from making undesired changes. But only temporarily.
Whereas compiling a proxy is easy and the user can fully control it.
Having used many different applications that implement support for TLS, I actually trust the proxy's implementation better than most applications. It's arguably easier to audit one program, the proxy, than it is to check every application to make sure the developer didn't make a mistake when adding TLS support. I recall the incident with socat as one example. That mistake when undetected for a long time. Elinks was another.