Tor – Snowflake Makes It Easy for Anyone to Fight Censorship

I'm confused. The article states that Snowflake uses domain fronting to connect users to forwarding peers. They use Google as an example:

> ... domain fronting lets the client make a request that looks like an ordinary web request for google.com ... To block Snowflake, a network or country would have to block all of Google

But Google disabled domain fronting in 2018. Amazon did as well[0]. Cloudflare disabled it in 2015.

The article even links to this Wikipedia page[1] on domain fronting, which states that all three of these providers have disabled domain fronting.

So... how does it work?

[0] https://signal.org/blog/looking-back-on-the-front/

[1] https://en.wikipedia.org/wiki/Domain_fronting#Disabling

> The security concerns for the Snowflake proxy operator are minimal. The Snowflake client will not be able to interact with your computer in any way or observe your network traffic, and you will not be able to see their traffic. From the perspective of your ISP it will look like you are connecting to a Tor bridge, which if you are running a Snowflake proxy should be legal and unrestricted in your country. There is no more risk running a Snowflake proxy than running Tor browser.

Isn't this a little sugarcoated? Your IP will now be known/knowable as a target to people you may consider bad. Running a Tor browser is between you, your ISP, and the bridge/entry.

Years ago, I ran a tor relay (not exit node!) on my stable home internet connection. I forgot all about it for months and months, and then when I was trying to update a home insurance claim, I kept getting weird site errors. Pages would half-load, I'd get 500 errors submitting forms, etc. I wasn't _using_ tor at all, just normal Firefox like always.

I peeked at the failed AJAX calls and I saw that the site was denying my traffic because I was classified as a high risk endpoint. The name of their WAF/filtering vendor was in the error responses or headers, so I found a free way to query that company's threat database for my home IP. There it was, my IP was marked high risk because it was associated with a tor relay. It's a silly threat correlation, in my opinion, but it was enough of an annoyance that I stopped running the relay so I didn't have to worry about flaky firewalls.

The ironic thing was, I could have probably fired up Tor Browser and tried new exit nodes until I found a fresh one their system didn't know about, just to finish updating my claim! I actually just tethered my laptop to my phone, I think.

PS I forgot to ask: does anyone know if Snowflake is as detectable as a normal bridge or relay node? If so, there's the risk that your home connection gets a risk/reputation strike against like mine did.

I wish there were some sort of monitoring tool for the docker container, so you know if you're actually doing any good (it's working), like the browser extension.

Something like nyx (for tor) but for snowflake.

Interesting choice of name (and logo) given the proliferation of Snowflake DB.