Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> It may not survive to deep packet inspection

I'd love to hear about your plans for "deep packet inspection" on SSL packets...

> your only S3 machine could get blacklisted

I thought the whole reason the original article was suggesting S3 was so that you could just spin up a random Micro instance, with a new IP address.



You are both confusing S3 and EC2. S3 is just storage.


You could identify it as ssh vs SSL because they have different unencrypted headers. So systems which check that you are speaking SSL on port 443 would block ssh.


Exactly - headers is how SSLH does its "routing".

Sorry about the S3/EC2 confusion, but in the end it's still a better idea to go with a smaller VPS resaler to avoid preexisting subnet blacklists.


Which headers do you believe are sent in the clear over https?


With HTTPS you get a handshake Client Hello packet sent in the clear, which has a TLS version identifier and a plaintext session ID among other things. With SSH2, you get a literal "SSH-2.0" as part of the protocol identifier which appears before the key exchange.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: