6 ms·

Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.

monochromatic 9y ago
If they were self-hosted, it would be even easier for Iran to block them.
- notyourday 9y ago
  If they hosted on VMs they would simply hop from one place to the other. The problem is that all of this stuff is "difficult" and no one would be writing stories about how great signal is if it could switch between thousands of companies that provide VMs to masses. We do not have these thousands of companies because AWS/GCS/Azure are the go to. Well, guess what? That means that objectively there are three kings of the world and the lieutenants of those kings get to decide what is and is not allowed.
  - tedunangst 9y ago
    Iran is probably sophisticated enough to make some DNS queries...
  - goatsi 9y ago
    Egypt and Iran block their domain, so they would have no method of directing users to the current IP.
  - notriddle 9y ago
    > If they hosted on VMs they would simply hop from one place to the other. No, that isn't a good enough solution. Signal needs to be reliable, or it's not worth having at all. The fundamental problem is node discovery: allowing the users to discover the IP address of the mothership (or, if you prefer, other members of the P2P network, but Signal is a centralized network) without the oppressive regime finding those IP addresses. Domain fronting was supposed to be a "cut the knot" solution, but CDN providers are shutting it down. Tor's approach has been to use a La Resistance approach, where Dave in the US runs an obfsproxy node for Yasim and his twelve trusted friends, that's how node discovery works, and as long as Dave is a good sysadmin and nobody squeals it's reliable. Personally, I think that's the only sustainable solution, but it's not very user-friendly, because you need to have trusted confidants on the other side of the firewall that your government doesn't know about. Signal can't be that trusted confidant, though I imagine Signal works over Tor just fine if you set it up.
jessaustin 9y ago
That's a real problem, but I don't think it's related to this situation. We have to assume that censors can inspect apps, and can inspect some app traffic before it gets encrypted. This means that they'll know all about your servers and their IP addresses.
- notyourday 9y ago
  It takes longer to inspect applications that it takes to deploy into yet another VM provider and do push notifications or discovery. If censors had enough skills to handle it those countries would have been producing innovations leaving US and Western companies in the dust.
  - jessaustin 9y ago
    Push notifications? How do these work, when the app can't rely on access to any particular domain or IP? Your posts in this thread seem to include a great deal of hand-waving.
    - notyourday 9y ago
      Here's a simplest push notification ever: email It was used by Akamai to do automated billing from the edges in the nineties when it was the first network that billed per byte delivered at the edges with multiple tiers. It is very easy to kill an annoying mosquito in a room if it can hide in 3 places. It is much more difficult if it can hide in thousands.
      - jessaustin 9y ago
        Sure that could work for a while, even if it's a bit inconvenient for users. Eventually the bastards will filter emails too. Spam filters could certainly be trained to find these notifications.

monochromatic 9y ago

If they were self-hosted, it would be even easier for Iran to block them.

notyourday 9y ago
If they hosted on VMs they would simply hop from one place to the other. The problem is that all of this stuff is "difficult" and no one would be writing stories about how great signal is if it could switch between thousands of companies that provide VMs to masses. We do not have these thousands of companies because AWS/GCS/Azure are the go to. Well, guess what? That means that objectively there are three kings of the world and the lieutenants of those kings get to decide what is and is not allowed.
- tedunangst 9y ago
  Iran is probably sophisticated enough to make some DNS queries...
- goatsi 9y ago
  Egypt and Iran block their domain, so they would have no method of directing users to the current IP.
- notriddle 9y ago
  > If they hosted on VMs they would simply hop from one place to the other. No, that isn't a good enough solution. Signal needs to be reliable, or it's not worth having at all. The fundamental problem is node discovery: allowing the users to discover the IP address of the mothership (or, if you prefer, other members of the P2P network, but Signal is a centralized network) without the oppressive regime finding those IP addresses. Domain fronting was supposed to be a "cut the knot" solution, but CDN providers are shutting it down. Tor's approach has been to use a La Resistance approach, where Dave in the US runs an obfsproxy node for Yasim and his twelve trusted friends, that's how node discovery works, and as long as Dave is a good sysadmin and nobody squeals it's reliable. Personally, I think that's the only sustainable solution, but it's not very user-friendly, because you need to have trusted confidants on the other side of the firewall that your government doesn't know about. Signal can't be that trusted confidant, though I imagine Signal works over Tor just fine if you set it up.

jessaustin 9y ago

That's a real problem, but I don't think it's related to this situation. We have to assume that censors can inspect apps, and can inspect some app traffic before it gets encrypted. This means that they'll know all about your servers and their IP addresses.

notyourday 9y ago
It takes longer to inspect applications that it takes to deploy into yet another VM provider and do push notifications or discovery. If censors had enough skills to handle it those countries would have been producing innovations leaving US and Western companies in the dust.
- jessaustin 9y ago
  Push notifications? How do these work, when the app can't rely on access to any particular domain or IP? Your posts in this thread seem to include a great deal of hand-waving.
  - notyourday 9y ago
    Here's a simplest push notification ever: email It was used by Akamai to do automated billing from the edges in the nineties when it was the first network that billed per byte delivered at the edges with multiple tiers. It is very easy to kill an annoying mosquito in a room if it can hide in 3 places. It is much more difficult if it can hide in thousands.
    - jessaustin 9y ago
      Sure that could work for a while, even if it's a bit inconvenient for users. Eventually the bastards will filter emails too. Spam filters could certainly be trained to find these notifications.