Hacker News Reader

Comment by hunter2_ | Hacker News Reader

A traffic shaper can do that, but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify. As long as HN and Reddit don't share edge servers with things you want unshaped, it should be straightforward.

The "only for certain devices" part would probably mean putting those devices in a VLAN and only shaping that VLAN's uplink.

A router like pfsense should be able to do all of that.

But I am far from a network engineer, so don't quote me...

View on HN

> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify

Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.

Oh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.

> there's no chance that the TCP connection gets shared for both

Not a chance.

There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.

Oh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!

Who is currently using ESNI. Cloudflare disabled it.

Where has cloudflare disabled it? Can't see anything

They have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH.

https://defo.ie/ech-check.php

In addition, pfsense can run pfblockerng which can be used to block ads. It uses the same block lists as pi-hole and others.

Reply on news.ycombinator.com