3 ms·

Haha that’s cute. Here in china the GFW now simply routes the IPs to blackhole. False positive by virtual host or CDN you ask? They don’t care :)

• laughinghan 4y ago
  That's what domain fronting is for, and even though the GFW attempts to filter by SNI, genetic algorithms like Geneva are able to find workarounds: https://geneva.cs.umd.edu/papers/foci21.pdf https://geneva.cs.umd.edu/papers/foci21.pdf
  • ignoramous 4y ago
    IP Fronting too: https://research.cloudflare.com/publications/Fayed2021/ https://research.cloudflare.com/publications/Fayed2021/
  • Avamander 4y ago
    ESNI/ESH is coming soon, I guess we'll see soon enough how that plays out.
    • grishka 4y ago
      Since the project at the OP link is mostly/initially aimed at Russia, in my own experience, it's not always just DPI — it's often DPI combined with a firewall. Roskomnadzor can order to block access to a domain, but then they can also specify an IP or a subnet instead. For example, that's what happened when they tried to block Telegram, which does not use DNS at all.