jesprenj

Is this just an ad for a non existing commercial service?

PSA: Assume dir="auto" if none provided in browsers you develop.

They could specify in the sitemap how often do old articles change. Or set a indefinite caching header.

Ah, I see!

While I agree with you, having a globaly routable address doesn't help you if you can't accept incoming tcp/udp connections.

My ISP blocks such connections on LTE mobile network. Maybe so you don't pay a lot of money for traffic if people DoS you? It doesn't make sense, since ICMP ping packets are allowed.

Well, it's either my ISP or the android phone I have. Does android have any firewalls enabled by default?

Thats fair, but an enterprise instalation I saw used a transparent proxy and certs on client machines. By transparent proxy I mean a DPI firewall that somehow "hijacked" normal TLS sessions. I don't really know why, a HTTP proxy would be the obvious solution ...

Why? Do you have some black boxes that keep calling some DoH and you can't control that but they accept user CAs?

Interesting, but that means they have to store the hostname somewhere.

So they don't need a server, but they need a server at the same time (:

One could abuse BitTorrent's existing DHT infrastructure (:

Is a similar thing called a window in TCP?

I stand corrected, thanks.

Yeah. Though they have a potential bug with domains that end in a dot.

For example, my website translated with their service:

https://splet-4a-si.translate.goog/?_x_tr_sch=http&_x_tr_sl=...

Clicking on the link "version control" leads to the page

https://ni-xn----ijanec--9jb-eu-.translate.goog/?_x_tr_sch=h...

(note the second label ending with -) and this page can't be reached according to google, but on the real site (http://splet.4a.si), the link is valid: https://ni.xn--ijanec-9jb.eu/

Another pretty bad aspect of their domain handling (replacing dot with -) is that they can't support really long domains that exceed the length of a label. Secondly, this breaks punycode parsers and instead of "šijanec" as a label you get some garbled unreadable punycode.

Label length problem:

Website http://splet.sijanec.sijanec.sijanec.sijanec.sijanec.sijanec... cannot be unambiguously page-translated with their service. -- they remove the first s in the hostname, yielding:

https://plet-sijanec-sijanec-sijanec-sijanec-sijanec-sijanec...

EDIT: they seem to add a get parameter _x_tr_hp=s, so this is probably how they work around the limitation. Nice!

They could've done www.website.example.translate.goog, but that would add issues with TLS, since a wildcard subject alternative name only matches one label. But by getting a CA signed cert, limited to translate.goog (which is possible), they could just issue certs on the fly.

How do they protect against websites stealing cookies and executing javascript on google.com origin? This was a stupid idea altogether. They have the googleusercontent.com domain for thus very reason. Why didn't they host amp on per-remote-origin origins?

https://_https.www.remote-website.com.amp.googleusercontent....

Web proxy service? You browse through a web proxy? I thought this was an obsolete piece of protocol.

Why not? It comments on the presentation of the content. Can't we judge here on HN the font, CSS layout, animations, javascript, popups? Can we only rate raw content, text, presented on a page? Where do you draw the line? It it okay by you to comment on images?

Is this one also written in Word so it automatically loses LaTeX-credibility, as was commented under the first paper? (:

Well bash has a built in TCP client which kind of ruins the fun. libc has a DNS library to query a resolver so no fun banging DNS over UDP required to download from gnu.org (:

That is true, yeah. But the library in question will also eventually break the existing API / stop supporting compatible releases with security patches. I assume this nginx config will still work for many releases in the future.

Sometimes they require 3rd party stuff, hotlinked images, js on frontpage, etc.

I was on a ferry ship with paid sattelite wifi internet once and they only faked DNS responses for gstatic.com, google, etc. But they allowed my domain (DNS queries to it) and stripe.com (because that's how you paid) -- so they only faked responses for a small set of popular domains. IP access to the internet was, apart from stripe, blocked.

And because stripe uses FastlyCDN, they allowed all of fastlycdn network ranges (not useful for iodine), so I could browse reddit (they also use fastly) using stripe's CDN (only html, without i.redd.it image hosting, that's elsewhere).

AFAIR Fastly doesn't have a free plan, so I couldn't tunnel at higher speeds (via HTTP) but only via DNS.

But yeah, sometimes they just outright respond to any query with their IP and you are out of luck.

That makes me think I am also probably addicted to buying stuff from Aliexpress. When I get an idea about something, I usually compulsively buy something from AliExpress and then not finish the project, sometimes not even opening the plastic wrapping the thing came inside. I hope it doesn't transform into an addiction.

For example I bought a digital pH meter for 15€ some weeks ago yet I never used it for a thing. I do not even know basic chemistry.

Enough about myself (: Thank you for posting your story.

needed

Yeah, like a sibling comment replied, the idea of iodine is that you don't use your own resolver but the one that the captive portal provided.

You need a domain name, xxx.example, then you can uplink data yyyyyy through the tunnel by querying yyyyyy.xxx.example and iodined, authoritative for xxx.example, will receive this query by the captive portal's resolver. To downlink data, you read responses (txt, cname or null records) that iodined will send for your queries.

This probably fills up the cache of the captive portal's resolver (:

Quite useful that it returns a newline after the IP address.

My similar setup with nginx (http://4a.si/ip) only returns $remote_addr without the newline, making it ugly for using with `curl`.

I can't say a thing about efficiency, but for maintainability, I have to disagree. This seems to be a rust library, and for maintaining that, you'd need to write a program, compile it every time some updates come by, rerun the recompiled program, ...

With the parent comment example, all you need is nginx, available as a package on all distros, and a single static config file. With an auto-updating package manager and a service manager, one never needs to write anything else apart from that static config file.

Or did you mean something else with "actually maintainable"?

There's also iodine, a C program that tunnels IPv4 packets over DNS. Useful for bypassing captive portals on wifi, since DNS usually isn't restricted.

https://github.com/yarrick/iodine

Regarding cloudflare DNS over HTTPS: It could be that it tries to server data encoded as JSON, which is impossible in JSON. Some control characters and bytes 128-255 cannot be represented as JSON strings.

Opera mini was simply a product of the web being too bloated to display on phones.

It's amazing that the proxy servers are still maintained. How do they profit from proxying? Do they sell user data, include ads?

In Slovenia I remember having had a "smart" landline phone in ~2009 that could send and receive SMS. ISDN?

> You should not log in directly as root.

Why not?

> Supposedly, this is to make sure a browser environemnt can be “trusted”, but it seems Google wants this so they can kill ad blockers.

How would they kill ad blockers this way? I can just use librewolf browser, sites will detect it and not work. But we already have this in form of Widevine DRM. Spotify does not work in my browser without DRM. They can't really force this on google search, because many clients will never support it (older Nokia 3x4 keyboard phones etc).

> Attempts to levy a tax on blank cassettes didn’t get traction in the UK.

In Slovenia, we pay a tax for blank media and audiovisual recorders. The law was put in place in 2020.

Source: https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/20...