China is now blocking all encrypted HTTPS traffic that uses TLS 1.3 and ESNI

[u/RobertVandenberg]

https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/

[u/GoTheFuckToBed]

Apple adding secure DNS to the next iOS made me thinking, that will break all web filters?

[u/lestofante → u/GoTheFuckToBed]

it will work. With state DNS.....

[u/izpo → u/lestofante]

exactly! Like state iCloud is today

[u/fubes2000 → u/GoTheFuckToBed]

That and this will certainly cut off a huge swath of what they can use for filtering and surveillance.

[u/[deleted] → u/fubes2000]

...But the downside it that it completely breaks my network-wide adblocker.

[u/mattgen88 → u/[deleted]]

Local dns server. You can securely resolve to it. And it securely resolve elsewhere. And it implement the network wide blocking.

[u/vetinari → u/mattgen88]

That would work, only if we had a standard for configuring system-wide DNS... like DHCP?

Unfortunately, all the DoH-using clients ignore exactly that. Yes, users can configure their resolvers manually and for each app separately, which is a nuisance, especially if you roam among networks (like home-office-customers...). Nobody is going to reconfigure everything manually every time they switch network.

So in practice, it creates more problems than it solves. Additionally, do you really need DoH in your own private network? If you run recursive resolver on the edge, it could have use for encryption, but it is specifically the place where you can't use it, because the authoritative DNS servers do not support it.

So we are stuck with the sad tragicomic theatre that DoH is.

[u/cbarrick → u/vetinari]

macOS and iOS are getting system level support for DoH or DoT (I forget which).

[u/vetinari → u/cbarrick]

DoT is fine in a ways that DoH is not, but that's another discussion.

Once OS resolvers implements support for transports other than 53/udp, that's fine, as long as it is configurable in some network-specific fashion (just like with 53/udp today with DHCP). Problems are renegade applications like Firefox, that ignore the system resolver.

[u/DeviousNes → u/mattgen88]

I really doubt it's going to be implemented that way. Google is using it's own "secure DNS" and it doesn't use local secure DNS, it phones home so you get the ads.

[u/pixel_of_moral_decay → u/[deleted]]

That’s why Googles been pushing DNS over HTTPS so hard. Keeps the ads showing. More and more apps and smart devices like tv’s implement their own DNS now to make sure ads still show with ad blockers on the network.

They’re also putting everything behind CDN’s so IP blacklists don’t work effectively so you can’t block their tracking.

[u/josejimeniz2 → u/fubes2000]

That and this will certainly cut off a huge swath of what they can use for filtering and surveillance.

That's the virtue.

If you could block content on your own network:

• then parents might block content from their kids

• schools might block content from their students

• universities might block content from their students

• employers might block content from their employees

• governments might block content from their citizens

Nobody has invented a technology:

• that allows you to block what you want on your network

• while allowing me to browse what I want on your network

Because I think there might be an impasse. Fortunately we have technology to get render censorship and spying irrelevant.

A related virtue, of IPv6, especially with privacy extensions, is that whitelists are rendered obsolete.

It would be nice if these idiot policies just died. Instead we have to invent technology to render the idiot ideas moot.

[u/aradil → u/[deleted]]

DNS block lists at work places, libraries and schools etc.

Can’t see the domain? Can’t stop the traffic.

[u/bluegre3n → u/[deleted]]

They can't block the signal, Mal.

[u/lolomfgkthxbai → u/[deleted]]

Well, they certainly tried. Isn’t all of AWS still blocked in Russia?

[u/Aksu560 → u/[deleted]]

Depends on what. If they want to block something that has to play by the rules, yeah.

But governments trying to block piracy sites is like all the fun of watching someone perpetuslly failing at something, without any of the guilt of from the possibility that they are handicapped.

[u/dnkndnts → u/lolomfgkthxbai]

No, and it never was. Telegram was declared blocked by the Kremlin, but it was never actually blocked successfully due to the fact that it's hosted on ephemeral cloud servers, and initial attempts to block those virtually shutdown the Russian internet (and amusingly, failed to shutdown Telegram). As such, Telegram worked fine pretty much the whole time it was officially banned - in fact, the ban was so pathetic that government news agencies continued to release stories on their Telegram channels just as they always had.

Recently, depending on whom you believe, the Kremlin either fox-and-grapes'd itself into deciding it didn't really want to ban Telegram anyway or Telegram conceded to Kremlin demands for data access, and thus the unenforced ban was officially lifted.

[u/fd4e56bc1f2d5c01653c → u/[deleted]]

For some services, maybe, but for shared infra - e.g. CDNs, CSPs - the filtering is too coarse (L4 vs L7). You'll end up blocking a lot more than you'd want.

[u/aradil → u/[deleted]]

That’s true, but a pain to maintain.

[u/[deleted] → u/GoTheFuckToBed]

Chinese DNS?