The story behind me raising this discussion is the folowing one: I’m facing more and more minor websites being blocked by IP addresses blacklisted due to ongoing attempts to ban telegram (at least the IP addresses are attributed with that court decision). Currently the number of IP addresses banned one-by-one is 1.8M (+150k domains, +several subnets).
I was under impression that the PAC file size is limited by 1MiB in the modern browsers and that was the reason for @valdikss to strip of the attempt of telegramocide from the antizapret PAC.
My requirements for a circumvention tool are:
- to use the PAC file to configure browser and nothing but the browser for the circumvention and leave OS network configuration intact
- to route the minimal required amount of traffic through the proxy due to performance reasons
So my idea was to fill the PAC file with a bloom-filter (or xor-filter) to prevent a separate blocking DNS query for each and every request and bring the “ground truth” knowledge to the browser via the means of DNSBL responding to ${domain}.${ip}.blocklist.rkngov.рф.
Probably, the pre-filter should only be filled with IP addressess responding to 80/tcp and/or 443/tcp and should only include the domains those are alive and responding to http/https queries. But that’s a matter of zgrab/zmap, so that’s trivial.
Yet, I’m still unsure if that’s a useful approach given that @ilyaigpetrov has found a reasonable way to circumvent 1MiB limitation of Chrome.
On the other hand, Firefox plugins can’t update the PAC file (per @ilyaigpetrov words) and dnsbl may be theoretically useful for this case. We still have to update the pre-filter one way or another, and it’s unclear to me what is the practical periodicity of FF updates.
