Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider alternative query string parameter that does not encode domain name in URL #885

Open
rocodes opened this issue Sep 23, 2024 · 2 comments

Comments

@rocodes
Copy link

rocodes commented Sep 23, 2024

Dear OONI team - thank you for all your work on this project.

I am wondering if it would be possible to offer a uuid-based query string parameter in place of (or in addition to, for backwards-compatibility) the domain URL.

Rationale: In some cases, attempting to share a link to OONI probe results can result in the ooni explorer URL itself being blocked/unshareable on certain platforms, because if censorship is being done by domain string matching, the ooni URL contains the target string. The current workaround is to generate and share a short link via a link shortener.

# Current 
https://explorer.ooni.org/chart/mat?since=2024-08-24&until=2024-09-24&time_grain=day&axis_x=measurement_start_day&test_name=web_connectivity&domain=$BLOCKED_DOMAIN  # Trying to share this link can cause problems

# Proposed
https://explorer.ooni.org/chart/mat?since=2024-08-24&until=2024-09-24&time_grain=day&axis_x=measurement_start_day&test_name=web_connectivity&domain=$UUID

Hope I filed this in the right place; happy to answer questions or assist if I can.

@rocodes
Copy link
Author

rocodes commented Sep 23, 2024

(Also, maybe this isn't the solution, eg maybe putting the domain in the request body is an option - but hopefully have explained the problem moreso than presumed the solution :) )

@hellais
Copy link
Member

hellais commented Sep 30, 2024

Thanks for reporting this.

You mention:

if censorship is being done by domain string matching, the ooni URL contains the target string.

How is this possible? The HTTP request, including the HTTP request line that contains the request path, are going to be going over HTTPS so it's not possible for a censor to determine the value of the domain in the request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants