3xblah

"I believe that privacy policies should describe how the data will be used, not how it could be used."

Google's policy does not tell the user how her data will be used by Google's customers. The policy states Google will use the data to "provide better services". That is deliberately vague. That is the "purpose", but how exactly is the data used to achieve that purpose. There are no specifics with which a user could object.

Google does not only serve the search engine user, the email user, the YouTube user, etc. Its business is not free services. As such the policy is misleading as to what are the "Services" it may use the data to improve. Google's business is providing online ad services.

The truth is that Google collects data to provide better services to advertisers. The policy reads as if it only collects data to provide better services to users. The "free" services are just bait to draw users in. The data is collected to improve online ad services.

The Google employee argues that through UA-CH Google wants to disincetivise "allow" and "block" lists.

After many years of testing HTTP headers, IMO this really is a non-issue. Most websites return text/html just fine without sending any UA header at all.

What is an issue are the various ways websites try to coax users to download, install and use a certain browser.

Another related issue with Google Chrome is users getting better integration and performance when using Chrome with Google websites than they would if they used other clients. ^1 Some make the analogy to Microsoft where it was common for Microsoft software to integrate and perform better on Microsoft Windows whereas third party software was noticably worse to integrate and perform on that OS.

This leads to less user agent diversity. Users will choose what works best.

UA diversity is really a more important goal than privacy, or privacy in Chrome. The biggest privacy gains are not going to come from begging Google to make changes to Chrome. They could however come from making it easier for users to switch away from using Chrome and to use other clients. That requires some cooperation from websites as well as Google.

Those other clients could theoretically be written by anyone, not just large companies and organisations that are dependent on the online ad sales business. It would be relatively easy to achieve "privacy-by-design" in such clients. There is no rule that says users have to use a single UA to access every website. There needs to be choice.

For example, HN is a relatively simple website that does not require a large, complex browser like Chrome, Safari, Firefox, etc. to read. It generates a considerable amount of traffic and stands as proof that simpler websites can be popular. Varying the UA header does not result in drastic differences in the text/html returned by the server.

1. Recently we saw Google exclude use of certain clients to access Gmail.

Right-click in the Name column, select "Save all as HAR with content". Then grep for the headers, e.g.,

   sed -n '/headers\":/,/\]/p' example.com.har

While running Chrome, try

   ps ax |grep -o field-trial-handle[^\ ]*[0-9]

Handle to the shared memory segment containing field trial state that is to be shared between processes. The argument to this switch is the handle id (pointer on Windows) as a string, followed by a comma, then the size of the shared memory segment as a string.

Also, can try typing "chrome://versions" in the address bar

https://superuser.com/questions/541466/what-is-the-variation...

https://www.ghacks.net/2013/04/05/field-trials-in-chrome-how...

Further reading:

https://chromium.googlesource.com/chromium/src/+/master/comp...

https://chromium.googlesource.com/chromium/src/+/master/comp...

"Tor exit node block

Operators of Internet sites have the ability to prevent traffic from Tor exit nodes or to offer reduced functionality for Tor users. ... The BBC blocks the IP addresses of all known Tor guards and exit nodes from its iPlayer service, although relays and bridges are not blocked.^[110]

110. https://www.bbc.co.uk/iplayer/help/questions/playback-issues...

The above is from the Wikipedia page for Tor. If the guard IP was "unpublished", then would that be a way to access sites like BBC iPlayer in spite of their blacklisting known guard IPs. Perhaps in the BBC case some users were trying to use Tor as a "poor man's VPN" to get a free UK IP address.

"The double quotes are of course technically correct, but when ... it's overkill and makes everyrthing ugly."

The only way you know this is being a person who routinely writes shell scripts.

There is no substitute for knowing what you're doing.

Try running shellcheck on configure scripts.

Or try this

    curl -4O https://ftp.netbsd.org/pub/NetBSD/NetBSD-release-8/src/build.sh
    shellcheck build.sh

Or try shellcheck on the build.sh from buildroot.org.

These scripts are "safe" enough for hundreds or thousands of competent users to be running them every day.

Add Google to the list. It is unfortunate that not even one of these companies can differentiate from the others on this practice. They each assume that the user gives them a free pass to make automatic outbound connections, where no consent from the user is required, for whatever purpose they deem "necessary".

"So when you visit HTTPS sites, anyone along the communication path - from your ISP to the Internet backbone provider to the site's hosting provider - can see their domain names (e.g. wikipedia.org) and when you visit them."

Except wikipedia.org does not require SNI.

Most HTTPS sites do not require SNI.

Not every client sends SNI by default. OpenSSL's s_client does not. There are others.

    printf "GET /wiki/MediaWiki HTTP/1.1\r\nHost: en.wikipedia.org\r\nConnection: close\r\n\r\n"|openssl s_client -showcerts -connect mediawiki.org:443 -ign_eof

Some sites "require" SNI, but then do not check it against the Host header. A client can send any SNI.

    The server certificate says *.wikipedia.org.  

But there are numerous websites sharing the IP addresses for wikipedia.org, not all of them serving Wikipedia content. One example is mediawiki.org.

What if a website padded all its pages to be the same size.

As someone else pointed out, the issue is mainly NAT not necessarily just "blocked" ports. What works with your ISP may not work with someone else's.

"No reason to run DNS."

Hmmm, it was a yes or no question. Are you suggesting it work would if you did.

Maybe running dynamic DNS client that keeps logs of IP address changes. Do DDNS clients keep logs. Maybe passive DNS would detect changes.

The point of the comment was that cannot just assume it never changed unless monitoring it contiuously.

Not speaking for all ISPs worldwide.

Finally some truth.

"I have run services on port 443 on Optimum and FIOS for years."

What is Optimum, FIOS.

WG does not work over TCP.

Try running a UDP-only DNS server from home on some random port. If you know the port can you reach it via UDP from the internet.

A TCP service listening on port 443 on an ISP customer's IP address in the US might be reachable from the internet. However, this topic is neither TCP nor port 443 nor is it restricted to just the US.

"This means you can use it to create inbound network tunnels to computers that don't have a public IP, are behind firewalls or get assigned new IPs frequently."

Sure enough, look what appears on HN front page a few hours later...

https://news.ycombinator.com/item?id=22167627

People's home public IP addresses are not universally reachable/accessible^1 from the internet. It varies.

What does "reachable/accessible" mean. It means that transferring a file would be as easy as person A typing something like

    nc -lnp [port] [person A home IP adddress] < file

and person B typing

    nc -w1 -vvn [person A home IP address] [port] > file

where port is not one that is blocked, e.g., 80, 25, etc. and is known by both persons.

Regardless of what anyone says in an HN comment, in the real world, people at home are sometimes behind firewalls, or other software that performs NAT, that are running on computers that do not belong to them and are not under their control.

That's why WG has persistent keepalives. No one answered that question.

Can you be sure that during 4yrs it never changed >1 even for a short time, maybe hours or days, then reverted back

A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested

Can you tell us anything about how you obtained one

1. No ISP firewall blocking unsolicited incoming traffic

Your home has publicly accessible^1 IP address

Or you are using a third party-controlled server with direct internet access to make home IP accessible

1. No ISP firewall blocking unsolicited incoming traffic

Do you configure WG to use persistent keepalives

Seems there is a ever-growing list of Linux bootloaders. Which ones are not satisfactory and why.

I was very satisfied with the BSD bootloaders. Plus the kernels comply with the multiboot specification so it was possible to use other bootloaders. This way I could boot kernels from different BSD projects from the same USB stick using a single bootloader. I do not use GRUB.

"... but impossible to use domain-based adblock like pi-hole since both ads and content are served through the same Google domain."

However, ads and video are not served through the same Google domain.

Further, the ads are not served unless Javascript is enabled.

As such, aside from user comments, it is easy to retrieve the non-video content without retrieving the ads. Just use an HTTP client that ignores Javascript.

Javascript is not needed to view video from the domains that serve the video.

What happens when out of memory on Tinycore.^1,2

1. On NetBSD, I could make RAM-only, no swap distributions that might thrash but would gracefully recover once some RAM was freed.

2. On Ubuntu, when running from a tmpfs root, I have found that running out of memory causes unrepairable filesystem errors.

Long live privoxy.

However, I wonder how privoxy users handle TLS.

I use localhost proxies to decrypt TLS before it reaches destination programs as well as encrypt outgoing plaintext HTTP traffic from non-TLS enabled programs.

Using proxies allows me to edit incoming and outgoing traffic where needed.

From the privoxy FAQ:

4.15. How can Privoxy filter Secure (HTTPS) URLs?

Since secure HTTP connections are encrypted SSL sessions between your browser and the secure site, and are meant to be reliably secure, there is little that Privoxy can do but hand the raw gibberish data though from one end to the other unprocessed.

The only exception to this is blocking by host patterns, as the client needs to tell Privoxy the name of the remote server, so that Privoxy can establish the connection. If that name matches a host-only pattern, the connection will be blocked.

As far as ad blocking is concerned, this is less of a restriction than it may seem, since ad sources are often identifiable by the host name, and often the banners to be placed in an encrypted page come unencrypted nonetheless for efficiency reasons, which exposes them to the full power of Privoxy's ad blocking.

"Content cookies" (those that are embedded in the actual HTML or JS page content, see filter{content-cookies}), in an SSL transaction will be impossible to block under these conditions. Fortunately, this does not seem to be a very common scenario since most cookies come by traditional means.

"I currently have no desire to make minitrd available outside of distri. While the technical challenges (such as extending the generator to not rely on distri's hermetic packages) are surmountable, I don't want to support people's initramfs remotely.

Also, I think that people's efforts should in general be spent on rallying behind dracut and making it work faster, thereby benefiting all Linux distributions that use dracut (increasingly more)."

As described on the website unixsheikh.com recently posted to HN^1 and making the front page^2, I think this illustrates one difference between "Linux" and BSD. Much of what unixsheikh describes has been said before however I think it still remains true today. I am currently using Linux and open to being persuaded otherwise. I want to learn "the Linux way" if there is such a thing.

That said, I always found booting to ramdisk, "root on mfs", "mfsroot", or whatever people might call it, very straightforward on BSD. They maintained and provided all the necessary tools, some of them have no Linux equivalent. Things stayed more or less the same so once the process was learnt, there seemed little chance of the goalposts moving. One did not need to be a contributor to understand these processes. Sometimes I get the feeling I am just not smart enough for Linux, and it seems like these processes are constantly subject to change. (I hope to find the truth is otherwise.)

As a BSD end user, I found it relatively easy to compile a custom kernel and a custom, statically-linked, multi-call binary as a userland, like busybox but using utilities "as is" not pared down with features missing, to be inserted into the kernel. I could boot from USB stick^3 to ramdisk root, pull out the USB stick, e.g., if I needed the USB port, then chroot into any userland. This was extremely flexible and allowed for easy experimentation. Sometimes I might have that userland prepared on internal media, the USB stick, or some other external media, or I might create it dynamically by downloading and extracting binary sets. This "targetroot"^4 userland might be mounted, usually r/o, on HDD or it might just be mfs/tmpfs.

Apparently, the author was inspired to make his own distribution because he found the package installation process too slow for large packages, e.g. qemu.^5 He tried using SquashFS images to speed up the process. I did the same thing in 2012 using cloop2 compressed filesystem images for large packages, e.g. ghostscript, on NetBSD. I would keep them on the USB stick and just mount them over an executable directory as necessary. I was not using these large programs too frequently and I was running entirely from tmpfs, no HDD, so I did not want them occupying space and depleting RAM.

1. https://news.ycombinator.com/from?site=unixsheikh.com

2. https://news.ycombinator.com/front?day=2020-01-20

3. Thanks to the excellent BSD bootloaders I could manually choose the kernel during boot. I would have several kernels on the USB stick. Of course the kernel did not have to reside on the USB stick, I could load it from any connected media. At one point I was able to boot NetBSD kernels using the FreeBSD bootloader.

4. TBH, I still do not know the true story behind targetroot. Things in BSD always have a history behind them. Surely there is a story behind the "targetroot" directory.

5 https://michael.stapelberg.ch/posts/2019-08-17-linux-package...

"How can minitrd be 20 times faster than dracut?

dracut is mainly written in shell, with a C helper program. It drives the generation process by spawning lots of external dependencies (e.g. ldd or the dracut-install helper program). I assume that the combination of using an interpreted language (shell) that spawns lots of processes and precludes a concurrent architecture is to blame for the poor performance."

Interesting that dracut uses bash, not dash for its scripts. Would dash be any faster. Are bash features a necessity for the simple tasks dracut performs.

Also, could dracut use readelf instead of the bash shell script ldd. According to Wikipedia, the Linux man page for ldd asserts it is a security risk.

Does default Ubuntu include a manpage for ldd. Mine is missing.

This and the other stuff described in these discussions relies on Javascript, CSS or certain HTTP headers.

If the results are requested with a simpler HTTP client that does not automatically execute Javascript or CSS, where we can control te HTTP headers, then these manipulations can easily be sidestepped.

This is not "blocking". It is using a client that does not process JS or CSS, where we can easily control the headers sent. This can be done, e.g., with openssl s_client, obsd nc, socat, etc.

They are probably sending different html+css+js based on user-agent.

They have been doing that for many years. The difference this time is people are objecting to the look of what they are sending.

BUGS The -F option is not necessary given the command line variable assignment feature; it remains only for backwards compatibility.

EXAMPLES Print and sort the login names of all users:

            BEGIN     { FS = ":" }
                 { print $1 | "sort" }

The above is from the GAWK manpage. FWIW, the first example under EXAMPLES uses FS not -F.

There is nothing wrong with using FS instead of -F.

"In the end, E-HAWK was able to wrest back its hijacked domain in less than 48 hours, but only because its owners are on a first-name basis with many of the companies that manage the Internet's global domain name system. Perhaps more importantly, they happened to know key people at PDR - the registrar to which the thieves moved the stolen domain.

Dijkxhoorn said without that industry access, E-HAWK probably would still be waiting to re-assume control over its domain."

A different read: It was "humans"-based customer support that saved E-HAWK. A "no-humans" customer suppport system might have left E-HAWK powerless, waiting, hoping.

Analogising to the parent's example, if parent had a serious problem, a "no-humans" customer support system might result in helplessness, waiting, hoping for some human at Google to discover and fix parent's problem, unless parent happened to know key people at Google.

s/EDNS0/& Client Subnet

UTF-8 complexity

In other words, virtual hosting does provide some incidental "privacy". However, looking at the web as whole, not simply focusing on certain large CDNs, most HTTPS websites actually do not require the SNI extension. "Modern" browsers send domain names in the ClientHello plaintext automatically, by default, even though it is not required.

Then there are HTTPS websites who require SNI but do not actually check the name in ClientHello is the same as the name in the Host header.^1 Any name sent in the ClientHello will suffice to retrieve the correct web page. "Modern" browsers again blindly send more than what is required in that situation.

As such, it is the HTTP client, e.g. major browser, that is leaking information in plaintext unecessarily. "Modern" browsers are useful for displaying web content. However when it comes to retrieving it, they are less trustworthy. Too much is happening in these programs outside the user's awareness and control.

1. AWS Cloudfront is one example. It is possible to send a less descriptive, arguably more private, CNAME in the ClientHello whilst sending the known domain name in the Host header. https://news.ycombinator.com/item?id=21977961

What if you set FS with -F but then later in the script want to change FS to something else.

"He is currently Director of Engineering at Netflix, working on Open Connect, Netflix's home CDN also known as the CDN moving about 30% of the total US Internet traffic"

There is something about CDNs and DNS, usually not good. According to Paul Vixie, that is how we ended up with EDNS0 despite the objection of IETF. Wonder if this company gets permission to share data with Netflix. I would read the terms carefully.

Hopefully people will choose to run their own Pi-Holes on their home networks, preferably without pointing them at third party "upstream" DNS providers.