Thread

1. 1vuio0pswjnm7 · 1790974106 · focus · HN ↗

   "As we've said time and time again: the internet will always route around censorship."

   It won't route around self-censorship that arises out of surveillance

   Nor will it take a stand against SNI which is a dead simple means of implementing censorship that's in widespread use every day for years

   1. 1vuio0pswjnm7 · 1790998791 · focus · HN ↗

      Sometimes HN commenters will try to argue in favor of SNI as if it's not possible to host multiple HTTPS sites on one IP address

      It is possible

      Consider all the sites hosted at 199.36.58.100 for example. Over 1,620 such sites have been submitted to HN in the past few years

      ESNI is "Encrypted SNI", ECH is "Encrypted Client Hello". The Client Hello packet contains the SNI. For a time ESNI was available on all Cloudflare sites. Not anymore. ESNI, whatever its flaws, worked well enough that some censorship regimes blocked connections that used it. IMHO, ESNI and ECH are overcomplicated proposed solutions to a relatively simple problem: gratuitous use of SNI. For example, so-called "modern" browsers will send SNI to those 1,620+ sites even though it's not required

      Alas, the people developing ESNI and ECH are not publishers or readers, the targets of censorship. They are "CDNs", hosting companies, intermediaries in the business of serving multiple HTTPS sites on single IP addresses. SNI has benefits for CDNs and costs for others

      1. devman0 · 1791041223 · focus · HN ↗

         ESNI has been replaced by ECH which Cloudflare supports just fine.
      2. someonebaggy · 1791041790 · focus · HN ↗

         You need to do a DNS lookup to find the ECH key though.
      3. 1vuio0pswjnm7 · 1791080529 · focus · HN ↗

         Cloudflare does not support using ECH with Cloudflare websites

         For example, one cannot use ECH when connecting to www.cloudflare.com

Unofficial Hacker News client; not affiliated with Y Combinator.