4 ms·

I don't think it's possible to reliably enforce this ban.

by erikj 9y ago

lgierth 9y ago
We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. [1] https://bamsoftware.com/papers/fronting/ https://bamsoftware.com/papers/fronting/ // edit: why the downvotes?
- jerheinze 9y ago
  > We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. The Tor Browser already comes with the meek transport[1] that uses domain fronting, one with Amazon and the other with Azure. There's also a recent PT titled snowflake[2], that uses WebRTC to connect to short lived proxies that people can make by just running some JS code in their browser, it's currently available in the alpha builds for Linux and Mac. Note that meek is expensive, and the Tor Project pays for each byte. It should only be used when no other PT works. [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake
  - int_19h 9y ago
    The problem is that any website that allows domain fronting is itself illegal under this new law, and can be blocked on those grounds.
    - lgierth 9y ago
      The idea of domain fronting though is that the fronting website is "expensive" to block that the censor won't do it. As with everything else, this isn't a 100% technical solution, it has a political component of how expensive the fronting website is to block.
      - codedokode 9y ago
        Many users in Russia use russian social network (Vkontakte), russian email services and russian search engine (Yandex). There is also popular dating service (Badoo). So Google and Facebook can be blocked without causing much trouble. But there is no good replacement for Youtube and Android Store (yet).
  - lgierth 9y ago
    Ah nice, I didn't know meek does domain fronting too, and thanks for mentioning snowflake.
- subliminalpanda 9y ago
  Openvpn over stunnel can somewhat already do this, albeit at a performance hit.
- joshka 9y ago
  One more idea to add to this (that sits on top of the idea that the distributed internet heals itself from attacks) would be to make it super simple for every HTTPS site to donate a portion of its bandwidth to defeating censorship. Imagine a world where VPN traffic was indistinguishable from a normal browsing session.
- y_u_no_rust 9y ago
  that just sounds gross a better idea would be to just ditch the browser/http stack
aleksi 9y ago
I don't think anyone in Russia expects it to be enforced reliably. But this law can be (and will be) enforced selectively against an opposition.
- zzzcpan 9y ago
  It can be enforced reliably enough to make it too hard for most people to keep circumventing censorship. Even with only current capabilities they can gather metadata on everyone's internet usage and see into a bit of data if needed, which is enough to statistically detect most attempts to hide traffic in something else.
- maxxxxx 9y ago
  I don't even think it should be enforced much at all. Quite the opposite. If almost everybody does it you can charge your opposition at will.
int_19h 9y ago
It doesn't need to be enforced reliably. It just needs to be reliable enough that your average person who might want to access one of the blocked resources doesn't manage to do so after spending a couple of hours trying the popular VPNs and such, and gives up because it's not worth the effort.
Elhana 9y ago
The idea is to make it hard for average person to use it - problem solved. Most likely will ban commercial vpn providers that refuse to implement blocklist for users from Russia. If you are able to set up a personal openvpn server, they wont bother hunting you down.
- codedokode 9y ago
  China blocks even private VPNs.

I don't think it's possible to reliably enforce this ban.

by erikj 9y ago

I don't think it's possible to reliably enforce this ban.

We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. [1] https://bamsoftware.com/papers/fronting/ https://bamsoftware.com/papers/fronting/ // edit: why the downvotes?

jerheinze 9y ago
> We need something that tunnels over HTTPS/Websockets, and utilizes domain fronting [1] with e.g. Google Cloud or Azure. Ideally it'd also work over WebRTC in unreliable mode, but I'm not sure that works with domain fronting. The Tor Browser already comes with the meek transport[1] that uses domain fronting, one with Amazon and the other with Azure. There's also a recent PT titled snowflake[2], that uses WebRTC to connect to short lived proxies that people can make by just running some JS code in their browser, it's currently available in the alpha builds for Linux and Mac. Note that meek is expensive, and the Tor Project pays for each byte. It should only be used when no other PT works. [1] : https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek [2] : https://trac.torproject.org/projects/tor/wiki/doc/Snowflake https://trac.torproject.org/projects/tor/wiki/doc/Snowflake
- int_19h 9y ago
  The problem is that any website that allows domain fronting is itself illegal under this new law, and can be blocked on those grounds.
  - lgierth 9y ago
    The idea of domain fronting though is that the fronting website is "expensive" to block that the censor won't do it. As with everything else, this isn't a 100% technical solution, it has a political component of how expensive the fronting website is to block.
    - codedokode 9y ago
      Many users in Russia use russian social network (Vkontakte), russian email services and russian search engine (Yandex). There is also popular dating service (Badoo). So Google and Facebook can be blocked without causing much trouble. But there is no good replacement for Youtube and Android Store (yet).
- lgierth 9y ago
  Ah nice, I didn't know meek does domain fronting too, and thanks for mentioning snowflake.
subliminalpanda 9y ago
Openvpn over stunnel can somewhat already do this, albeit at a performance hit.
joshka 9y ago
One more idea to add to this (that sits on top of the idea that the distributed internet heals itself from attacks) would be to make it super simple for every HTTPS site to donate a portion of its bandwidth to defeating censorship. Imagine a world where VPN traffic was indistinguishable from a normal browsing session.
y_u_no_rust 9y ago
that just sounds gross a better idea would be to just ditch the browser/http stack

aleksi 9y ago

I don't think anyone in Russia expects it to be enforced reliably. But this law can be (and will be) enforced selectively against an opposition.

zzzcpan 9y ago
It can be enforced reliably enough to make it too hard for most people to keep circumventing censorship. Even with only current capabilities they can gather metadata on everyone's internet usage and see into a bit of data if needed, which is enough to statistically detect most attempts to hide traffic in something else.
maxxxxx 9y ago
I don't even think it should be enforced much at all. Quite the opposite. If almost everybody does it you can charge your opposition at will.

int_19h 9y ago

It doesn't need to be enforced reliably. It just needs to be reliable enough that your average person who might want to access one of the blocked resources doesn't manage to do so after spending a couple of hours trying the popular VPNs and such, and gives up because it's not worth the effort.

Elhana 9y ago

The idea is to make it hard for average person to use it - problem solved. Most likely will ban commercial vpn providers that refuse to implement blocklist for users from Russia. If you are able to set up a personal openvpn server, they wont bother hunting you down.

codedokode 9y ago
China blocks even private VPNs.