"Additionally, with the ECH extension not yet being widely used [17], [71] and focusing on privacy protection rather than censorship circumvention [60], it can be censored easily by blocking it entirely [14], [76]."
The paper describes various GFW bypass methods that currently work, including removing the SNI extension entirely
It does not mention anyone using ECH to bypass GFW
Perhaps it is too early to conclude "China blocks ECH" because ECH is not in widespread use
> AFAIK the proprietary server can glean your IP, your phone number, who you talk to, and when you talk to them. This type of metadata is valuable information.
To the best of my knowledge, so can matrix.org or whatever servers you connect and federate to. This is required to route messages between users. What is your point?
That was the bigger problem, IMO, in that even once PDO existed and the MySQL extension was "fixed" to have prepared statements, so much of the documentation still did it wrong.
And yet similar classes of bugs still pops up today, even with what I would've assumed to be safe defaults? I'm guessing its non-standard databases or DB clients or something?
This case is more just a pure lack of sanitisation, but it's fascinating to see in 2025 still :)
