12 ms·
The Iran Firewall: A preliminary report
- johnklos 4y agoThis is difficult to read. The author confuses nouns and proper nouns and isn't clear about who it is they're referring to (who are the neo-liberals, for instance?). I understand that not everyone is as good at writing as others, but it really doesn't take much effort to ask someone to proofread. Otherwise, this is a good start, even though it lacks details and examples.
- deusum 4y agoConceptually, it was interesting. I can forgive it for lacking details, as a "preliminary report", too. But the whole, "neo-liberal arses" bit gave it the sense of an unhinged author or untrustworthy narrator.
- LastTrain 4y agoConceptually, I clicked it and thought I would learn something about the Iranian firewall, but instead I ended up at "The Hackers Choice" blog, a blog with exactly two articles, and read a confusing rant along with a laundry list of firewall techniques talked about in vague enough terms that I learned absolutely nothing, other than to be skeptical about this source going forward.
- noAnswer 4y agoIDK. Not knowing THC is like not not knowing the CCC or 2600. It is more on you ;-)
- nibbleshifter 4y agoEnglish isn't the writers first language, for a start. The weird use of the term neoliberal is pretty common in European liberal-as-in-freedom left leaning circles.
- computerfriend 4y agoI have never heard the term "neoliberal" outside of US politics.
- rocketbop 4y agoI've lived in three European countries including the one I was born in and I've never heard that term being used in that way.
- gbarut 4y agoSomebody should post this to Google contacts. They just had this claims about security and working for the ppl with the Hacking Google series on yt.
- arbitrage 4y agoGoogle knows already. They just don't care.
- deleted 4y ago[deleted]
- whatsthatabout 4y agoPretty crazy that a country can just completely block all internet outside of what they want to be accessible... One app that came to my mind reading this is Briar [1] - no real internet required, can connect to other briar participants via bluetooth and WiFi. Sadly only for Android... [1] https://briarproject.org https://briarproject.org
- Thaxll 4y agoIt's not crazy, internet is like public roads, they can decide to close them anytime they want.
- culi 4y agoWho's "they" and why are we paying to uphold their power to make this decision whenever they want
- vkou 4y agoWe aren't doing anything, The Iranian government chooses to control what happens to electricity within their borders. It's one of the fundamental points of state sovereignty.
- culi 4y agoThe example given was "public roads"
- bobthepanda 4y agoStates can, and do, maintain the power to maintain or close public roads. In fact, they do so daily at border checkpoints, and do so locally in cases like local natural disaster risk (e.g. hurricane or wildfire evacuation).
- vkou 4y ago
- throwaway0x7E6 4y ago>Some operators use a whitelist and block all other websites. the ultimate fate of the internet
- deleted 4y ago[deleted]
- LinuxBender 4y agoFWIW here [1] is an option that should still work. I would be curious to hear from people in Iran if this no longer works and they are blocking SSH to VPS nodes. [1] - https://news.ycombinator.com/item?id=33025954 https://news.ycombinator.com/item?id=33025954
- LastTrain 4y agoI almost stopped reading at "neo-liberal", man that term is getting boring, especially when used in non-sequitur fashion like "The most severe disruption is when the regime turns off all cell towers and all local Internet. They just pull the plug and it's game over for any neo-liberal smart-arse that thinks v2ray/tor/shadowsocks is the solution". WTF does that even mean? What does the author think it means?
- dmos62 4y ago> What does the author think it means? A detestable person that thinks he can circumvent the regime? Presumably a paleo-conservative (or whatever the opposite of neo-liberal is in the mind of the blogger) would not be so naive and would look at real "solutions", as opposed to the neo-liberal, who is interested in non-solutions. Pretty awful ideas floating around in this guy's head.
- dmix 4y agoI'm not sure what he means by that. Is it just a tongue-in-cheek description for the opposition to the Iranian party? Is it used by the party to describe pro-western people locally? Or is this just another overused Redditism?
- LastTrain 4y agoIt is a play on neo-con, which is a term that was used to great affect in American conservative political circles to ostracize those who would cooperate with the opposition party - a.k.a. moderates. It is now used with similar goals by the American far left (to the extent that such a thing exists..). Both terms are often coopted by the the opposition party to demonize moderate counterparts. That said, it sounds cool to mouth-breathers so they often use it completely out of context, like this author did.
- xhevahir 4y agoThat sense of "neoliberal" is peculiar to American politics, as far as I can tell. I'd say it's more likely the blogger means a person who wants free trade, deregulation, etc.
- dweekly 4y agoThe snooping of unencrypted SNI in the TLS handshake is a known weakness that is still mostly unresolved despite four years of standardization effort. The encrypted SNI work has been revised and updated to encrypted ClientHello and is still technically an IETF draft and not yet formalized in an RFC: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ That said, CloudFlare, Firefox, and Chromium teams have all been working toward the evolving spec so one can hope that soon with eCH and DNS-over-HTTPS we will be able to have clients securely connect to servers without broadcasting the hostname to which they are connecting.
- dweekly 4y agoFollow along on Chromium support here: https://bugs.chromium.org/p/chromium/issues/detail?id=1091403 https://bugs.chromium.org/p/chromium/issues/detail?id=109140...
- aorth 4y agoWait I'm confused. I remember reading a bunch of reports about how China started blocking TLS 1.3 because of encrypted SNI (eSNI) years ago?
- dweekly 4y agoI don't know anything about that (and I'm pretty sure TLS 1.3 doesn't mandate ECH since ECH isn't even finished standardizing!) but you can check to see if your browser supports ECH by visiting https://tls-ech.dev/ https://tls-ech.dev/
- tialaramex 4y agoSome people interested in the Great Firewall wrote up weirdness they saw with one particular prototype of eSNI years back. A game of Telephone later this became nonsense like "China blocks TLS 1.3" but actually if you do that what you get isn't web sites stripped of protection but connection errors. Which is indeed what happens for some sites from the other side of the Great Firewall, but we just say China blocks those sites, because that is what they do. Protocol versions are not crucial to them. The current iteration of ECH is designed to be GREASEd which means browsers might just always do ECH with dummy values regardless, so either you block or you don't, you won't be able to selectively block ECH. This doesn't magically prevent the Great Firewall from working but does mean specifically host matching is degraded as intended.
- ghostpepper 4y ago"All blacklisted domains resolve to 10.0.34.35" I guess this would require everyone to use a government-sanctioned DNS and that would require traffic on udp 53 to non-gov-dns servers blocked? I felt like this was glossed over a bit too quickly in the article
- tenebrisalietum 4y agoMore like the whole country is behind a giant CGNAT. NAT is good for security, eh?
- justsomehnguy 4y agoDNS is running on udp/53. It's beyond trivial to absolutely transparently NAT it to anything you want. Block tcp/853 and most common public DNS servers and you can control resolving on 98% of devices.
- vel0city 4y agoProbably more like all the local ISPs DNS servers resolve that, or that there's potentially some DNS rewriting going on. Its not too hard to rewrite basic DNS traffic. DNS is not encrypted, its payloads are very structured, and quite small.
- hot_gril 4y ago> Instead, the TCP 3-way handshake won't complete (the syn-ack is dropped). Sounds like my internet connection in grad student housing about 10% of the time, except the initial SYN is dropped. Pings and everything else are fine.
- ilyt 4y agoI remember one guy in my company had hard-on on blocking every way to tunnel out of our network (...that was not required by anyone, he was just security nut). We had sites blacking out because he decided DNS tunnelling bad so he blocked anything with low TTL. Meanwhile simple POC DNS tunnel worked fine..
- neither_color 4y agoOn bad days: Key word is bad days. Expats in China have noticed the same thing, with VPNs sporadically not working during summits, around certain holidays, etc but resuming afterwards. Also, for some reason certain VPNs work more consistently than others even though they use the same protocols as blocked services. Some speculate that the ones that continue to work are either honeypots or the companies behind them have (social) connections Also, it's kind of poor taste to call those who want free(dom) internet there as "neo liberals"
- nibbleshifter 4y agoNeoliberal is usually used as a pejorative towards "liberals" who prioritise economic growth/profit over human dignity/freedom. Think: the Blair administration in the UK.
- computerfriend 4y ago> but resuming afterwards. This is a common and natural misconception. When the firewall gains a feature (i.e. the ability to block certain traffic) the VPN providers then have to figure out some technique to bypass it. This happens over and over again. The firewall isn't relaxing after the event, it is staying the same and the VPN provider has improved. On your second point, I can't comment for all providers, but I've heard this rumour in a more specific context and can say that it is definitely at least sometimes false.
- neither_color 4y agoThanks for clarifying. I admit it's anecdotal but was wondering if these new features are rolled out automatically or with humans deploying them? If the latter it might explain why expats in China have said it [access to VPNs] gets worse at times. Years ago one provider that rhymes with krill was pretty consistent, but in the end it seemed one could get the most mileage(err uptime) by rolling their own v2ray instances on a VPS provider that had "Hong Kong" servers in Hangzhou.
- another_story 4y agoI'm not sure this is entirely the case, though probably partly so. I think they do track known VPN servers, or suspected therein, and closer to congress sessions cut those off. I had a number of self hosted setups used by a few people that would get cut off at those times only to come back on later.
- meitham 4y agoI recollect few years ago when the US ordered all western services to be blocked to Iranian citizens, it was a big outcry when Gitlab and Github published blogs confirming their implementation of the Iran blockade. To me the west lost all moral arguments criticizing Iran for doing the same within their own country.
- arcticbull 4y agoOne is used as punishment to correct behavior, one as control. [edit] This is the same way that if I go out and throw someone into my basement it's 'kidnapping' but when the police do it to me, it's an arrest. Jokingly this comment has the same vibes. [1] [1] https://twitter.com/dril/status/473265809079693312?s=20&t=gD17XWeqF_APTaCGuVIdzw https://twitter.com/dril/status/473265809079693312?s=20&t=gD...
- thiagoharry 4y agoIts good to be the self-proclaimed global policeman.
- arcticbull 4y agoI don't think anyone's a self-proclaimed global policeman, and America has become of late increasingly reluctant to extend their influence. I'm not American. My personal position is that the world would be worse off if America were to cede their influence because the vacuum would be filled by China, Russia or both. These forces all keep each other in balance and maintain the current detente. This is one of the most peaceful times in world history, after all. With that in mind, no, I don't support the Iranian regime. Positions should be evaluated piecemeal, it doesn't matter what you think about America's other positions, it doesn't need your personal 'moral high-ground' sign-off to be in the right on this one.
- deleted 4y ago[deleted]
- konart 4y ago>to correct behavior this is literally trying to control, just on a different level.
- buzzwords 4y agoI tried helping my Iranian friend to get around the internet restrictions. I have to agree with the author most big players could not give a flying f*ck. Even signal can't be bothered to address verification SMS issue.
- deleted 4y ago[deleted]
- keyme 4y agoAir dropping starlink terminals onto protesters is the solution. In fact, if you live anywhere outside of the US, owning one "just in case" is good for future proofing your freedom, IMHO. Kind of like being armed. Edit: in fact, starlink v2 global LTE-from-space coverage will be a true game changer for world freedom. We can only hope this comes to be sooner rather than later.
- joisig 4y agoWhy only outside of the US?
- missedthecue 4y agoUntil having a starlink terminal on your roof becomes punishable by death. You can try to hide them visually, but Iran could always detect them electronically if they want to put in the effort.
- keyme 4y agoHalf the households in Iran have an illegal satellite dish on the roof to receive disallowed TV from abroad. This is punishable and does get punished (rarely, I hear). Doesn't deter anyone. Edit: it will also be quite difficult to detect electronically, judging by the fact that even Russia fails to jam these signals on the battlefield.
- 4y ago
- keyme 4y agoAnother idea: create an easy way to set up pirate LTE base stations. Hacked femtocells? SDR? Something more clever? Distribute eSIMs to everyday people. The pirate operator takes all the risk and technical difficulties.
- deleted 4y ago[deleted]
- walrus01 4y agoThis doesn't in any way solve the problem of getting traffic in/out of the country, where all local ISPs are legally obligated to singlehome themselves to the government ASN. Unless we're talking about something like smuggled two way satellite terminals.
- keyme 4y agoIMHO connectivity to the global internet is less important than local communication between protesters in geographic proximity. Having these pirate base stations mesh together is also achieveable. Freeing end user equipment from the requirement to mesh (not achieveable).
- deleted 4y ago[deleted]
- cookiengineer 4y agoWhy go for LTE when Wi-Fi is so much more feasible? I mean, 10 bucks for an AP isn't far fetched whereas LTE antennas alone would explode in budget, even when considering to use OsmocomBB with super old hardware/phones. And every phone these days got Wi-Fi anyways. Most meshnet solutions rely on Wi-Fi so you wouldn't even need to implement much software for peering.
- Roark66 4y agoYou know what is crazy. I recently heard 20% of adult population in Iran is in Revolutionary Guard. This puts things into context for anyone who says "why don't people just overthrow the dictatorship". However, there were dictatorships with an even stronger hold on their population that fell. Usually for economic reasons. I hope Iran's regime will follow.
- blacksmith_tb 4y agoHmm, that seems way too high? They're a branch of the military[1], which is the biggest standing army in the Middle East, but even the whole army comes to about a million for a country of 86M. 1: https://en.wikipedia.org/wiki/Islamic_Revolutionary_Guard_Corps#Size https://en.wikipedia.org/wiki/Islamic_Revolutionary_Guard_Co...
- athinggoingon 4y agoYou're thinking about the Basij: https://en.wikipedia.org/wiki/Basij https://en.wikipedia.org/wiki/Basij
- pyinstallwoes 4y agoThe only real solution long-term is completely peer-to-peer ad-hoc networking that doesn't depend on BGP. A few projects are in similar territory but none I've seen are working at the layer of bypassing BGP. Many are just acting as an overlay; which works to an extent. https://github.com/yggdrasil-network/yggdrasil-go https://github.com/yggdrasil-network/yggdrasil-go It's probably begging for a different model of the "internet" and where data lives. My requirements: 1. Offline-first applications that sync via a pub/sub DHT of trusted peers. More details here but basically allows bypassing BGP. 2. Trusted peers are routable via a determinstic pathing algoritm without exposing the recipient. (content addressable everything). 3. Automatically distribute storage and compute on all local devices a user has and or needs (it's so dumb and wasteful that I only use one computer at a time when I have hundreds at my home at different levels of compute from thermostat to fridge to laptop to desktop). I've thought about this for a long time and planned many requirements out. I was very committed to working on it but then I lost motivation because I don't get along with most humans today and where the world seems to be going. It also sucks to have people think your ideas are crazy. Oh well.
- drummer 4y agohttps://quantumgate.org/ https://quantumgate.org/
- icedchai 4y agoHow exactly are you going to "bypass BGP" on the global Internet? Reaching your trusted peers depends on routing, which means BGP (at least for anything outside of your ASN.)
- zwkrt 4y agoWell if you want to get rid of BGP then it probably doesn't make sense to talk about ASNs since BGP is a way to connect ASNs... That being said, it does seem very pie-in-the-sky to imagine the entire global internet using decentralized routing without some sort of backbone infra that is at least moderately centralized. There is just too much data. I could imagine mesh networks being more feasible if we were still living in an era of html websites and RSS feeds.
- drummer 4y agoPerhaps this might help in Iran: https://quantumgate.org/ https://quantumgate.org/
- animitronix 4y agoAnother day, another way the UN is a failed, pointless institution
- EMIRELADERO 4y agoThe UN's main purpose is to prevent international war by trying to achieve compromises between the member nations. That's it.
- TulliusCicero 4y agoThe UN is mostly just a forum. What do you expect them to do? Issue a sternly worded letter?
- paulcarroty 4y ago> We need help. Join us on Telegram. Nope, thanks, do not promote this shitty KGB-affiliated service. Also if you're talking seriously about privacy - forget about all services hard-locked on SMS or phone numbers.