7 ms·
How great is the great firewall? Measuring China’s DNS censorship [pdf]
- rastafang 5y agoI want an in-and-out-app-specific firewall on linux and only then, I will be happy... something a lot like https://github.com/evilsocket/opensnitch/ https://github.com/evilsocket/opensnitch/
- Seobaz 5y agohttps://www.enyakindakiservis.com/ https://www.enyakindakiservis.com/
- 2143 5y agoDiscussions about the great firewall would be incomplete without mentioning the great cannon. https://citizenlab.ca/2015/04/chinas-great-cannon/ https://citizenlab.ca/2015/04/chinas-great-cannon/
- senectus1 5y agoi know its a massive PITA for corps trying to secure devices in that country. the state of what's allowed through TGFWC changes constantly.
- infofarmer 5y agoSemi-private under-the-radar solutions are reliable, affordable, and readily available, to anyone who cares to Google for a few minutes. Including Gigabit-size holes and very low [added] latency to Japan, HK, Singapore, and other places.
- zamadatix 5y agoYes, it's always easy to simply not comply with the law. That wasn't in question.
- SerCe 5y agoOne of the details that I found really interesting is that the great firewall blocks any website that matches *torproject.org like the innocuous mentorproject.org. The paper is also accompanied by an excellent presentation on the USENIX channel, https://www.youtube.com/watch?v=nPwsROLZrnc https://www.youtube.com/watch?v=nPwsROLZrnc.
- swinglock 5y agoDoes that mean such domains don't get any spam/traffic from China?
- greenspam 5y agoSo, what's the conclusion? How great? If there is a censorship/surveillance competition, who will win, GFW or NSA?
- Dah00n 5y ago>who will win, GFW or NSA Both. Neither. (Is there a difference for us? I doubt it.)
- blueblisters 5y agoGreat paper! Things that stood while skimming: - Bidirectional DNS poisoning: China can send forged DNS responses if you try to access certain Chinese domains from outside the GFW. This isn't server-side enforced geoblocking. - GFW uses a small space of forged IPs, some belonging to Facebook, Twitter, Dropbox which may be responsible for a non-negligible overhead in server costs responding to HTTP requests for irrelevant hostnames. Can FB sue China in court for damages for the cost of serving these forged requests?
- seniorivn 5y agoyou do realize that a concept of a court is completely country specific? what court do you mean?
- Dah00n 5y agoCourts in China works just as well/bad as in, say, the US. A specific name doesn't change that.
- seniorivn 5y agoi mean that china isn't an entity that you could sue, any foreign court has no power over china, and suing chineese government in chineese court is a joke(much more than doing the same in us, by the way)
- sudosysgen 5y agoSuing the US government in a US court is only possible insofar as the US government agrees to be sued. It's the principle of sovereign immunity.
- sticnarf 5y agoPackets from the China mainland to these forged IPs are routed to blackhole at the international network outlet of China. So, normally there is no overhead for sites like Facebook.
- 5y ago
- anuvrat1 5y agoIs there a paper or article about the economics of China's Great Firewall?
- est 5y agoto access the latest data https://gfwatch.org/ https://gfwatch.org/
- dmos62 5y agoI was setting up a self-hosted VPN to work-around GFW. I tried everything. Some solutions would sort of work, but unreliably, with extremely minimal bandwidth and would suddenly stop working after some time. I can't remember the combinations of transport and obfuscation tech that I tried, but they were considered best bets at the time. I would be very interested in finding out how commercial offerings do it. I'm not comfortable using them, since chances are that they're honeypots. Funnily enough I traveled to another part of China then, and the Airbnb wifi had practically no GFW-type blocking. GFW is made up of local or provider-specific implementations that vary a lot. It was a small, rural town.
- olalonde 5y agoLast I checked, the v2ray project was state of the art for GFW bypass[0]. [0] https://guide.v2fly.org/en_US/basics/vmess.html https://guide.v2fly.org/en_US/basics/vmess.html
- azalemeth 5y agoThat's fascinating -- I'd never heard of it before. How does it compare in effectiveness at evading DPI and FW detection in comparison to, say, tor with the meek-azure obsproxy that reflects traffic off Microsoft's Azure service?
- jokowueu 5y agoV2ray is a plugin used on top of shadowsocs I believe Google's outline uses it
- zertrin 5y agoI had the same experience, trying to self-host my VPN or other evasion solutions only served to get my server and domains banned for all other purposes from inside the GFW. The symptoms were exactly the same as you described (at first, they "sort of work, but unreliably, with extremely minimal bandwidth and would suddenly stop working after some time"). In the end, I'm not going to try that anymore, I haven't been in China for 2+ years now due to COVID, but next time, I'll hope my server is out of the blacklist again and hope I can access my (self-hosted) emails and other normal services that don't try to evade it. The student VPN of another Asian university or the employee VPN of a well established company seemed to work last time. Not sure if that can be counted on reliably though...
- est 5y agoIs there a way to group the "forged IP address" by class-C or class-B ?
- Erlangen 5y agoThe researchers mentioned that they had "controlled machines located in China". Given the number of requests sent by these machines everyday, how did they avoid being detected? Isn't it very suspicious for a machine to send huge amount of requests to blocked domains every day?
- lorentzttt 5y agoWhat is the state of the art in GFW bypass, please?
- jiggawatts 5y agoAs someone living blissfully unaware of the struggles people go through in countries with rampant government censorship -- sorry, control for the public good -- of the Internet, it was a bit a of a shock when I got some first-hand experience. I had a customer that wanted to set up some web servers in China so that they could sign up students for some classes at their school. At first I just assumed that this is a straightforward matter of selecting a Chinese region in a public cloud, deploying a couple of web servers, and we'd be done by lunch. Easy! Turns out... that this is actually technically achievable, as long as: You have a Chinese business registered in China, you have a photo ID that you register with the "local authorities" (in person!), pay in Renminbi from a Chinese bank account, and read and write Chinese. No, really. That's the process. Really: https://docs.microsoft.com/en-us/azure/china/overview-checklist https://docs.microsoft.com/en-us/azure/china/overview-checkl... They want to make sure they have someone by the balls. It's either you personally, or someone willing to step up and take the risk of jailtime on your behalf if you publish anything the Grand Pooh Xi doesn't like. Meanwhile, I can spin up a server in Dubai or South Africa or Brazil like... right now. No paperwork. No prostrating myself in front of the Police to beg for permission to be able to post government-approved content. Meanwhile, on the map of AWS or Azure regions -- or on any CDNs map -- there's just a hole where China is. It's like those photos of Earth from space, where you can see the city lights glowing brightly everywhere except for North Korea, where there's just darkness. Remind me, why do we do business with these people again? Why do we give them our money?
- jabbany 5y agoThis is a rational response if you look at it from a governance perspective. Pre-GFW, the government was basically in a position where if there was anything illegal online (not just political stuff, but everything from gambling to piracy) they had no recourse. If they sent a takedown notice the company can basically say "why don't you make me". So it makes total sense to require a local presence if you want to interact with the local market. The GFW in this case is a tool that the government can hit any company who doesn't comply with... Frankly, the thing that really is worrying is that because this is so rational from an Internet governance perspective we might well see more and more countries follow this path... Not censorship per se but building up mechanisms to create a more fragmented Internet.
- nceqs3 5y agoThe Open Technology Fund is one of the most underrated government agencies out there.
- nikkinana 5y agoEvery government has a great firewall. At least china tells you about it while excluding their bot armies.
- bronzeage 5y agoThink about the fact that behind the great firewall there is probably a big team, of people who are constantly dealing with all the information in the world about what a horrible government they have. They probably know better than us how their government killed people in Tiananmen square, how covid leaked from the lab and got covered up by their government, how their government treats Uyghurs in concentration camps. I can understand people covering up for themselves. But covering up for such a horrible government after having all that information?
- throwaway984393 5y agoIMHO, the most annoying thing about the great firewall is not the censorship - it's the bandwidth. Every single night in China, right around the time Chinese people start streaming, for about 4-5 hours, the bandwidth from anywhere to China goes to complete shit. You can't deploy anything or transfer data, it'll just time out or get corrupted. Interestingly, "time in China" is one time, because China has 1 official time zone. Even though it spans 5 geographical time zones. Unless you're in Xinjiang, in which case if you're talking to a Uyghur or Kazakh, they're using Xinjiang time, which is 2 hours behind Beijing Time. Unless you're watching a non-Uyghur/Kazakh TV channel, in which case the time is back in Beijing Time.