Hacker News Reader

So they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?

You can’t really stop someone from domain fronting on any CDN. This is like “maybe you should have not talked about this on HN”. :)

Fixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header.

The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).

This also breaks non terminating load balancers.

I’ve used every major CDN on the market and none of them do this.

Some don’t even check that the Host header host is a customer and just proxy it anyway.

I said the fix was easy, not that people were actually fixing it. :/

Exactly, bragging about this hack made them do something about it.

The post that alerted AWS was submitted by HN user hapnin, who I don't believe has anything to do with Signal.

Reply on news.ycombinator.com