4 ms·

> how do they avoid feeding the firewall with information that can be used to extend the blockage? I'm not sure if this is solvable. How would a network tell t

> how do they avoid feeding the firewall with information that can be used to extend the blockage? I'm not sure if this is solvable. How would a network tell the difference between an iranian citizen and an iranian police? If you allow iranian citizens to connect to some IP address, how would you prevent iranian police from connecting the same way, and then adding the IP to the blocklist? The best solution I can think of right now is for major tech companies (like Google, Microsoft, Apple) to host Matrix servers of their own, on their IPs. This way if the iranian police block those IPs, the country also loses access to these major internet services, which will shut off communication with the rest of the world and cripple their technological development (like North Korea).

Arnt 4y ago
It may be solvable, but it's not simple. The problem is similar to finding paths in a wireless mesh network where links may be obstructed. I've spoken to someone in a team that tried hard, he said that the traffic volume for routing updates grew faster than the size of the network and with their algorithms the limit on the size of the network was disappointingly small. ("Limit" being the approximate size at which the network becomes more concerned with routing itself than with delivering payload traffic.) Now, if Matrix doesn't try to route around blocks, then blocking Matrix is trivial: ① Identify one or a few servers and block them ② check each packet to/from those and assess the likelihood that the peer is another server ③ add to the block list and go to back to step 2. So I assume Matrix does try, and wonder how.
- woojoo666 4y ago
  But if Matrix does try to route around blocks, what's to stop Iranian police from constantly trying to connect to Matrix and getting re-routed to working servers, after which they can add those servers to the blocklist until there are no servers left.
  - Arnt 4y ago
    Matrix is a decentralised network. The word decentralised means something. Decentralised networks can be designed such that servers aren't easily enumerated, and can be designed such that the network continues to work fairly well even if a firewall intercedes. From what little I understand about Matrix, the former is probably the case and the latter might perhaps be but I wouldn't bet on it.
LinuxBender 4y ago
like Google, Microsoft, Apple My preference would be to instead use CDN endpoints without any custom names. Akamai, Cloudflare, Cloudfront, BunnyCDN, KeyCDN, Fastly, etc... all using their templated generic DNS names making it look like image sharding requests.

Arnt 4y ago

It may be solvable, but it's not simple. The problem is similar to finding paths in a wireless mesh network where links may be obstructed. I've spoken to someone in a team that tried hard, he said that the traffic volume for routing updates grew faster than the size of the network and with their algorithms the limit on the size of the network was disappointingly small. ("Limit" being the approximate size at which the network becomes more concerned with routing itself than with delivering payload traffic.) Now, if Matrix doesn't try to route around blocks, then blocking Matrix is trivial: ① Identify one or a few servers and block them ② check each packet to/from those and assess the likelihood that the peer is another server ③ add to the block list and go to back to step 2. So I assume Matrix does try, and wonder how.

woojoo666 4y ago
But if Matrix does try to route around blocks, what's to stop Iranian police from constantly trying to connect to Matrix and getting re-routed to working servers, after which they can add those servers to the blocklist until there are no servers left.
- Arnt 4y ago
  Matrix is a decentralised network. The word decentralised means something. Decentralised networks can be designed such that servers aren't easily enumerated, and can be designed such that the network continues to work fairly well even if a firewall intercedes. From what little I understand about Matrix, the former is probably the case and the latter might perhaps be but I wouldn't bet on it.

LinuxBender 4y ago

like Google, Microsoft, Apple My preference would be to instead use CDN endpoints without any custom names. Akamai, Cloudflare, Cloudfront, BunnyCDN, KeyCDN, Fastly, etc... all using their templated generic DNS names making it look like image sharding requests.