Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/mnordhoff/statuses/113119559223636809">Matt Nordhoff (mnordhoff@infosec.exchange)'s status on Thursday, 12-Sep-2024 01:00:51 JST</a><a href="https://infosec.exchange/@mnordhoff" title="mnordhoff@infosec.exchange"><img src="https://gnusocial.jp/theme/gnusocialjp/default-avatar-stream.png" width="48" height="48" alt="Matt Nordhoff" style="position: absolute; left: 0; top: 0;">Matt Nordhoff</a></section><article><p>Popular controversial hosting company Cloudflare has been reenabling Encrypted Client Hello (ECH) recently. They had announced it with <a href="https://blog.cloudflare.com/announcing-encrypted-client-hello/" rel="nofollow noreferrer">fanfare</a> and then disabled it again with <a href="https://community.cloudflare.com/t/early-hints-and-encrypted-client-hello-ech-are-currently-disabled-globally/567730" rel="nofollow noreferrer">less fanfare</a>.</p><p>Almost all of the popular domains with it enabled look NSFW. :blobshrug:</p>$ dig +short openstreetmap.org https<br>1 . alpn="h3,h2" ipv4hint=104.21.88.66,172.67.173.161 ech=AEX+DQBBswAgACCY/JoV+3cuHZdOgYzHZ0SP9Ms+TN3PN8D8vk10GJU/AgAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:3030::ac43:ada1,2606:4700:3034::6815:5842<br><p>(That domain is not NSFW. Probably.)</p><p>Apparently <a href="https://community.cloudflare.com/t/encrypted-client-hello-ech-are-being-enabled-again/700863" rel="nofollow noreferrer">someone noticed and Cloudflare confirmed it</a> 3 weeks ago.</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/3650902#notice-7153990">In conversation</a><time datetime="2024-09-12T01:00:51+09:00" title="Thursday, 12-Sep-2024 01:00:51 JST">about 2 months ago</time> <span>from <span><a href="https://infosec.exchange/@mnordhoff/113119559223636809" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@mnordhoff/113119559223636809">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: www.openstreetmap.org</div><h5><a href="https://www.openstreetmap.org/">OpenStreetMap</a></h5><div></div></header><div>OpenStreetMap is a map of the world, created by people like you and free to use under an open license.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Matt Nordhoff (mnordhoff@infosec.exchange)'s status on Thursday, 12-Sep-2024 01:00:51 JST Matt Nordhoff
Popular controversial hosting company Cloudflare has been reenabling Encrypted Client Hello (ECH) recently. They had announced it with fanfare and then disabled it again with less fanfare.
Almost all of the popular domains with it enabled look NSFW. :blobshrug:
$ dig +short openstreetmap.org https
1 . alpn="h3,h2" ipv4hint=104.21.88.66,172.67.173.161 ech=AEX+DQBBswAgACCY/JoV+3cuHZdOgYzHZ0SP9Ms+TN3PN8D8vk10GJU/AgAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:3030::ac43:ada1,2606:4700:3034::6815:5842
(That domain is not NSFW. Probably.)
Apparently someone noticed and Cloudflare confirmed it 3 weeks ago.
In conversationabout 2 months ago from infosec.exchangepermalink
Attachments
1. Domain not in remote thumbnail source whitelist: www.openstreetmap.org
  OpenStreetMap
  OpenStreetMap is a map of the world, created by people like you and free to use under an open license.

Public

Embed Notice

HTML Code

Corresponding Notice