Visitors' browsers connect only to operator nodes the control plane knows

When a visitor’s browser fetches your site’s files from other machines, those machines should be operator nodes we know. Until now, that wasn’t always so. A page that arrived without a list of nodes to use could look for them through the control plane’s tracker, and take pieces from any client that answered there, whether or not it was an operator node.

From 20 October, browsers no longer use the tracker at all. A page with no node list is served by the Regional Gateway instead. The tracker now admits only operator nodes, our Regional Gateways and our own operations tools, and refuses everyone else.

No incident of this has occurred. This is a proactive security fix.

What this did and didn’t expose

• Your content couldn’t be altered. Every piece was already checked against a digest recorded when the site was uploaded, and a piece that didn’t match was thrown away.
• The exposure was the connection itself. A visitor’s browser could connect to a party that wasn’t an operator node.

What changes for you

• Site owners: nothing. Pages that come with a node list work as before. Pages without one now come from the Regional Gateway.
• Operators: nodes on v0.0.122 or later send their own credentials to the tracker and stay connected. Nodes on older releases are refused by the tracker and keep retrying. Nothing they do for visitors is affected, because browsers no longer find nodes through it.

What you need to do

Nothing for site owners. Operators should update to v0.0.122 or later to keep their tracker connection.