6 ms·

Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and u

by nrvn 6y ago

Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave up and lifted the ban eventually. https://www.schneier.com/blog/archives/2018/06/russian_censors.html https://www.schneier.com/blog/archives/2018/06/russian_censo...

agnosticmantis 6y ago
I believe telegram itself is blocked in Iran, though.
- smnrchrds 6y ago
  It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress, Facebook, YouTube, etc. and made their jobs much easier. Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.
  - eternalban 6y ago
    > It is indeed. Iran does not shy away from blocking large swaths of the internet > ran would not hesitate to block all AWS IP addresses as a solution DNS will not resolve any .ir (.coms that are iranian) domains here in US, afaikt.
    - whimsicalism 6y ago
      Not at all true. Try http://www.president.ir/en http://www.president.ir/en
      - eternalban 6y ago
        That does not resolve for me. Neither do any of the news sites. I even tried government ministries, such as en.mop.ir. simple$ ping president.ir/en ping: cannot resolve president.ir/en: Unknown host simple$ ping en.mop.ir ping: cannot resolve en.mop.ir: Unknown host simple$ ping tehrantimes.com ping: cannot resolve tehrantimes.com: Unknown host simple$ ping presstv.com ping: cannot resolve presstv.com: Unknown host
        caf 6y ago
        That might be something your ISP is doing. Try dig www.president.ir @8.8.8.8
        eternalban 6y ago
        Thanks. That got me the ip but browser won’t connect to it. So it’s blocked at the ip level. (Why would an ISP do this? Mine is one of the majors. Curious.)
  - sudosysgen 6y ago
    Telegram blocking in Iran is theoretical. There are still a great many Iranians successfully using Telegram (via proxies or modified versions of the app).
sigmar 6y ago
That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way
- windthrown 6y ago
  Correct, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
  - rzz3 6y ago
    What about Cloudflare?
    - capableweb 6y ago
      Answer from Cloudflare team seems to be "No" - https://community.cloudflare.com/t/could-cloudflare-support-domain-fronting/200944 https://community.cloudflare.com/t/could-cloudflare-support-...
      - hanniabu 6y ago
        Surprised by that considering their willingness to work with ethereum on resolving .eth domains through .eth.link domains.
  - aftbit 6y ago
    Gross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well. We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.
    - Craighead 6y ago
      Yes yes, but, when will Verizon and Comcast be broken up?
deleted 6y ago
[deleted]
emptybits 6y ago
Thank you. It's heartwarming to read about successes like this. Immediate recalling John Gilmore (GNU/EFF/etc.) in 1993: "The Net interprets censorship as damage and routes around it."
derefr 6y ago
Feels like there could be a good business in providing this CIDR-hopping push-updating proxy as a service other apps could embed. Like what CloudFlare does for DDoS protection, but as a forward-proxy + client middleware, instead of a reverse-proxy.
- mywittyname 6y ago
  Depends on your definition of "good." Dealing with hostility from government bodies is probably no fun.
Triv888 6y ago
While it worked in that case, it is not an invincible method.

by nrvn 6y ago

agnosticmantis 6y ago

I believe telegram itself is blocked in Iran, though.

smnrchrds 6y ago
It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress, Facebook, YouTube, etc. and made their jobs much easier. Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.
- eternalban 6y ago
  > It is indeed. Iran does not shy away from blocking large swaths of the internet > ran would not hesitate to block all AWS IP addresses as a solution DNS will not resolve any .ir (.coms that are iranian) domains here in US, afaikt.
  - whimsicalism 6y ago
    Not at all true. Try http://www.president.ir/en http://www.president.ir/en
    - eternalban 6y ago
      That does not resolve for me. Neither do any of the news sites. I even tried government ministries, such as en.mop.ir. simple$ ping president.ir/en ping: cannot resolve president.ir/en: Unknown host simple$ ping en.mop.ir ping: cannot resolve en.mop.ir: Unknown host simple$ ping tehrantimes.com ping: cannot resolve tehrantimes.com: Unknown host simple$ ping presstv.com ping: cannot resolve presstv.com: Unknown host
      - caf 6y ago
        That might be something your ISP is doing. Try dig www.president.ir @8.8.8.8
        eternalban 6y ago
        Thanks. That got me the ip but browser won’t connect to it. So it’s blocked at the ip level. (Why would an ISP do this? Mine is one of the majors. Curious.)
- sudosysgen 6y ago
  Telegram blocking in Iran is theoretical. There are still a great many Iranians successfully using Telegram (via proxies or modified versions of the app).

sigmar 6y ago

That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way

windthrown 6y ago
Correct, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
- rzz3 6y ago
  What about Cloudflare?
  - capableweb 6y ago
    Answer from Cloudflare team seems to be "No" - https://community.cloudflare.com/t/could-cloudflare-support-domain-fronting/200944 https://community.cloudflare.com/t/could-cloudflare-support-...
    - hanniabu 6y ago
      Surprised by that considering their willingness to work with ethereum on resolving .eth domains through .eth.link domains.
- aftbit 6y ago
  Gross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well. We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.
  - Craighead 6y ago
    Yes yes, but, when will Verizon and Comcast be broken up?

deleted 6y ago

[deleted]

emptybits 6y ago

Thank you. It's heartwarming to read about successes like this. Immediate recalling John Gilmore (GNU/EFF/etc.) in 1993: "The Net interprets censorship as damage and routes around it."

derefr 6y ago

Feels like there could be a good business in providing this CIDR-hopping push-updating proxy as a service other apps could embed. Like what CloudFlare does for DDoS protection, but as a forward-proxy + client middleware, instead of a reverse-proxy.

mywittyname 6y ago
Depends on your definition of "good." Dealing with hostility from government bodies is probably no fun.

Triv888 6y ago

While it worked in that case, it is not an invincible method.