HTTPS Exposes Website Hostnames in Plain Text Due to TLS Design

·26 views

Every HTTPS connection begins with a TLS ClientHello message that includes the destination hostname in plain, unencrypted text via an extension called Server Name Indication (SNI). A developer confirmed this by capturing raw TLS handshake data and extracting readable hostnames — such as 'login.mybank.example.com' — without decrypting a single byte. The exposure is not a flaw but an intentional protocol design: servers sharing one IP address need to know which site is being requested before they can present the correct certificate and establish encryption. This creates a chicken-and-egg problem where the hostname must be sent before any encrypted channel exists to protect it. A proposed standard called Encrypted Client Hello (ECH) aims to address this, but it has not yet seen widespread adoption.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Data center power demand is shifting costs onto lower-income and rural residents, study finds

A Cornell University study examines how the growing electricity needs of data centers are affecting household utility bills. The research indicates that lower-income and rural residents are bearing a disproportionate share of the resulting costs. The article discussed on Hacker News links to Cornell's news coverage of the findings. The available text provides only the headline, source link, and discussion metadata, so the specific methodology, figures, and policy details could not be verified from the provided material.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Sources say former Nvidia CEO Jensen Huang had a relationship with a second employee

Reuters reports, citing unnamed sources, that former Nvidia CEO Jensen Huang had a romantic relationship with a second employee. The article is linked from a Hacker News discussion that drew 44 points and 33 comments. The original text available here contains only the link and discussion metadata, so the full details, timeline, and any company response cannot be confirmed from this material. Readers should consult the original Reuters report for the specifics of the allegations and any reactions from those involved.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Node.js Rate-Limited Job Queues: Designing Recovery-First Workers

A DEV Community article argues that rate-limited job processing in Node.js for B2B SaaS should not rely on a web request staying open. Instead, a request or scheduler can enqueue a bounded batch and return, leaving a worker to handle the slow and recoverable steps. The recommended design uses a thin producer, a queue whose worker runs at concurrency 1, and a durable idempotency key claimed before each external call. Transient failures are retried with backoff or nacked, and exhausted jobs are routed to a dead-letter queue. The author stresses that queues are at-least-once, so keys must guard against duplicate deliveries, and that the concurrency limit should be treated as a loop invariant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches All-in-One Project Management Tool for Agile Teams

A developer has built and launched Project Management Tool, a multi-tenant collaboration platform aimed at agile teams, startups, and growing agencies. The platform is meant to consolidate task tracking, team messaging, file sharing, and reporting into a single app, reducing the need for multiple subscriptions. It offers centralized workspaces, detailed task cards with priorities and due dates, real-time workload tracking, and built-in team chat with @mentions. Dashboards provide analytics such as task completion velocity, overdue alerts, and team performance metrics. The tool follows a free-core, add-seats pricing model, and its live demo and source code are publicly available online.

0 comments Read more at DEV Community