Split TLS ClientHello

Sends the first message of each secure connection in two pieces, cut inside the site's name, to try to get past networks that block sites by name. It's experimental and off by default. While it's on, Dia's network code runs inside Dia instead of its sandboxed helper, so a bug in that code reaches everything Dia can reach. Switch it off and relaunch Dia to bring the helper back. It won't get past every filter.

Why use it

Some networks block a site by reading its name in the first message your browser sends to it. Cutting that message in two, in the middle of the name, means a filter that reads each piece on its own never sees the whole name. The site's server gets the same message.

Turn it on only if a network blocks sites by name and you can't use another way round it. It doesn't help with HTTP/3, DNS or blocks by address, and a few servers refuse a message in two pieces. If you aren't behind such a network, you don't need it.

What it costs

Normally Dia keeps its network code, the part that talks to websites, checks certificates and handles cookies and the cache, in a separate helper process that macOS runs in a sandbox. On Dia 1.58.0 we checked that this helper is refused reading your documents, starting programs, and reaching the clipboard and your windows, and that the main Dia process is allowed all of those.

DiaTweaks can only cut the message from inside the main Dia process, and it isn't loaded into that helper. So while this is on, Dia runs its network code in the main Dia process instead, outside the sandbox.

What that means in practice: if a website or someone on your network ever found a flaw in Dia's network code, it would reach everything Dia can reach, instead of being stuck in the helper. A crash in that code would also take Dia down with it.

It only applies while the tweak is on. Turn it off and relaunch Dia, and the helper and its sandbox are back.

Turn it on

Open Dia → Settings → Patches and switch on Split TLS ClientHello. Or run:

diatweaks enable splitClientHello

Dia asks to relaunch: it can only run its network code in the main process as it starts. Until you relaunch, Dia sends everything whole and keeps its sandboxed helper. Turning it off asks again, because Dia keeps running without the sandbox until you relaunch.

How it works

Dia's network code runs in a helper by default. DiaTweaks asks Dia to run it in the main process instead, with the NetworkServiceInProcess2 feature, which is why a relaunch is needed. In the main process, DiaTweaks sees each message Dia sends on the network.

When a message is a TLS ClientHello with a site name in it, DiaTweaks cuts it into two TLS records in the middle of the name and sends both, so the first record ends partway through the name. Where it cuts is picked at random each time. The two records hold exactly the same bytes as the one, so a server that accepts it puts them back together and the handshake goes on as usual.

It leaves alone everything that isn't a ClientHello for a named site, and anything that isn't sent over a stream connection like TCP. If the connection can't take the whole cut message at once, Dia sends it whole.

FAQ

Does it hide the sites I visit?

No. Your network can still see the address you connect to, your DNS lookups and how much you send. A filter that puts the pieces back together still reads the name. It only helps against filters that read a single piece.

Why does a site not load?

A few servers refuse a ClientHello in two pieces and drop the connection. Switch the tweak off and relaunch to load that site, or leave it off unless you need it.

Does it work with HTTP/3?

No. HTTP/3 uses a different protocol (QUIC), which DiaTweaks leaves alone. A network that blocks it by name isn't helped.

How do I know it's working?

Open Console and search for DiaPatches. Once Dia has made a secure connection with it on, "Split TLS ClientHello is splitting ClientHellos" appears. If it says Split TLS ClientHello is off, Dia kept its network helper and nothing is being cut.

Why did it switch itself off?

Ten seconds after Dia opens, DiaTweaks checks that the network helper really is gone. If a Dia update ignores the setting and the helper is still running, nothing is being cut, so the tweak turns itself off for that run, Settings lists it as unavailable on this Dia version, and Console says why. Your Dia stays sandboxed.

Is the sandbox really gone?

For Dia's network code, yes, while the tweak is on. Web pages still run in their own processes, as before. Only the part that talks to the network moves.