Cloudflare Developers•10mo ago

it has to lookup the https record to see ech support/etc

Aaz ignore nvidia in the middle but both of the subdomains have it enabled for me to...

D5•3/16/25, 12:39 AM

Weird. No idea why in some cases it's enabled and others not

CChaika it has to lookup the https record to see ech support/etc

D5•3/16/25, 12:40 AM

I did. Still showing without ECH

ChaikaOP•3/16/25, 12:40 AM

chaik@ash:~$ dig inicio.dh-sw.net https +short
1 . alpn="h3,h2" ipv4hint=104.21.16.1,104.21.32.1,104.21.48.1,104.21.64.1,104.21.80.1,104.21.96.1,104.21.112.1 ech=AEX+DQBBOwAgACBbqnLeAhRhhU0+EDxnIOla6O7FndMj8smocxf663njTwAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700:3030::6815:1001,2606:4700:3030::6815:2001,2606:4700:3030::6815:3001,2606:4700:3030::6815:4001,2606:4700:3030::6815:5001,2606:4700:3030::6815:6001,2606:4700:3030::6815:7001

ChaikaOP•3/16/25, 12:41 AM

I meant more in the implementation of Firefox though (or whatever browser you're using)

ChaikaOP•3/16/25, 12:41 AM

sometimes I hard refresh/visit for the first time and it isn't ech until reload

Erisa•3/16/25, 12:41 AM

seems counter-intuitive to the purpose of ech lol

ChaikaOP•3/16/25, 12:41 AM

FF docs say

Firefox retrieves this data simultaneously with performing a DNS lookup when connecting to a website, ensuring there's no extra delay during the connection.

wonder what happens if the https record lookup takes longer then the A/AAAA, if it just doesn't use it or something, they specifically say "no extra delay"

D5•3/16/25, 12:43 AM

Okay, then I don't understand why some ISPs are able to find what's the hostname or the website you're visiting and other not

az•3/16/25, 12:44 AM

tls 1.3 is a requirement of ech right?

ChaikaOP•3/16/25, 12:44 AM

looks like there's a firefox config setting to make it wait for the https record lookup

network.dns.force_waiting_https_rr Whether to wait for the HTTPS RR lookup to complete before starting a connection. Boolean True True

https://wiki.mozilla.org/Security/Encrypted_Client_Hello
It kinda looks like it's on by default though, so maybe my theory is wrong, will try forcing it...

ChaikaOP•3/16/25, 12:50 AM

ech's always been a little weird. Used to need DoH for a while, only later was relaxed

ChaikaOP•3/16/25, 12:50 AM

looks like for me turning on DoH made it much more consistent, still seems to revert on hard refresh weirdly but meh

Original message was deleted

ChaikaOP•3/16/25, 12:52 AM

part of the reason why DoH is pushed with it

Original message was deleted

ChaikaOP•3/16/25, 12:52 AM

I believe a bunch of CDNs stop that now, I forget if CF does

ChaikaOP•3/16/25, 12:57 AM

Azure's Front door adverts not supporting "Domain Fronting" like it's a feature lol

ChaikaOP•3/16/25, 12:57 AM

doesn't really work for security either of course

Original message was deleted

az•3/16/25, 12:57 AM

ChaikaOP•3/16/25, 12:58 AM

one of a few Microsoft Cdn options lol

az•3/16/25, 12:59 AM

azure is crazy expensive

az•3/16/25, 12:59 AM

my work computer is an azure vm

Original message was deleted

ChaikaOP•3/16/25, 12:59 AM

you're forgetting you pay monthly a base fee for the privilege to use it

ChaikaOP•3/16/25, 12:59 AM

$35 for standard, $330 for premium

ChaikaOP•3/16/25, 1:00 AM

I use it at the place I work, it's super slow to update but has mostly been fine, needed something within Azure to do lb

ChaikaOP•3/16/25, 1:01 AM

I love the random errors you get while navigating it lol

ChaikaOP•3/16/25, 1:01 AM

it's stupidly spotty and errory

ChaikaOP•3/16/25, 1:01 AM

and at times super slow

ChaikaOP•3/16/25, 1:02 AM

some new stuff doesn't work in Firefox like all the new billing views

ChaikaOP•3/16/25, 1:02 AM

only displays in Chrome

ChaikaOP•3/16/25, 1:04 AM

ehh, I think the aws panel can still be pretty bad

ChaikaOP•3/16/25, 1:05 AM

quicker and less errory from my limited experience, but pretty convoluted

CChaika looks like there's a firefox config setting to make it wait for the https record...

az•3/16/25, 1:21 AM

from my testing firefox sends atleast 3 querys of type 28, 65, 1 seemingly in any order

Aaz azure is crazy expensive

D5•3/16/25, 1:22 AM

Like AWS. The only cloud service with a reasonable price I've found is Cloudflare

az•3/16/25, 1:22 AM

however if it doesnt send the https question first it still managed to use ech

Aaz however if it doesnt send the https question first it still managed to use ech

az•3/16/25, 1:23 AM

the order of the querys could be completely wrong as im trusting workers real time logs to put them in the right order

Original message was deleted

D5•3/16/25, 1:23 AM

Depends on the price. If it costs the same as a Hetzner instance, yes

Original message was deleted

az•3/16/25, 1:24 AM

like running docker containers on cf servers ?

az•3/16/25, 1:24 AM

really

D5•3/16/25, 1:24 AM

I just hope they're cheap and have spending caps/limits

D5•3/16/25, 1:24 AM

And not affected by LaLiga

Original message was deleted

az•3/16/25, 1:25 AM

interesting

az•3/16/25, 1:25 AM

i never actually used containers for any of my projects i always end up using a vm

az•3/16/25, 1:26 AM

i could probably save some money using a container though

az•3/16/25, 1:26 AM

are cf containers going to be persistent ? or request based

Original message was deleted

az•3/16/25, 1:27 AM

are you some kinda secret cloudflare insider

Aaz i never actually used containers for any of my projects i always end up using a ...

D5•3/16/25, 1:28 AM

I use them for all projects

They can do anything

az•3/16/25, 1:28 AM

i used a container for a new service i deployed at work

az•3/16/25, 1:28 AM

but that was not very fun

az•3/16/25, 1:28 AM

if the container crashes it doesnt release a lock on an external file

Aaz if the container crashes it doesnt release a lock on an external file

valkyrie_pilot•3/16/25, 1:34 AM

why are you using file locks

valkyrie_pilot•3/16/25, 1:34 AM

horror

it has to lookup the https record to see ech support/etc

Similar Threads

Similar Threads

Similar Threads