6 ms·
> Try to access thepiratebay.org or other pirate sites, or other sites that the UK gov deems inappropriate (CP obviously), etc. I don't know about the "other s
by lapser 4y ago
> Try to access thepiratebay.org or other pirate sites, or other sites that the UK gov deems inappropriate (CP obviously), etc.
I don't know about the "other sites", but tpb isn't part of any "Great Firewall". It's just ISPs have been required to update their DNS servers to _not_ resolve the DNS record. Even then, there are still quite a few ISPs that have not implemented it. It's why changing your DNS servers to something like Google or Cloudflare means you can easily access tpb.
So blocked websites in the UK are nowhere near on the same level as the Great Firewall.
My guess is those other sites are a bit more sophisticated, or if not, ISPs are willing to comply easier.
- iLoveOncall 4y agoThat's not true, at least for VirginMedia. I use Cloudflare DNS servers and I can't access ThePirateBay without a proxy or a VPN, it's more than just a blockage at the DNS level.
- kalium-xyz 4y agoI donno about the UKs system but with South Korea they just check the host in the request header and block by that.
- jakewins 4y agoHow can they do that, the HTTP headers are encrypted by TLS?
- ShowalkKama 4y agonot op, no idea how they do it but they COULD look at the SNI in the client hello
- Nextgrid 4y agoUntil encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear. Also, it can still be DNS blocked - just because you use Cloudflare's DNS doesn't mean they can't rewrite the responses as they still transit unencrypted. You'd have to use DNS-over-HTTPS or DNS-over-TLS to work around that.
- foepys 4y agoLuckily, ESNI is being supported by an increasing number of implementations.
- neilalexander 4y agoI believe China's answer to ESNI is just to block all traffic that attempts to handshake with ESNI, so it still won't necessarily get you anywhere.
- foepys 4y agoOnce everything is using ESNI this isn't a problem anymore. It's the lack of implementation that is currently the problem.
- 1vuio0pswjnm7 4y agoIf it's TLS1.2, certificates containing CNs and/or SANs are sent in the clear too.
- robertlagrant 4y agoMaybe it's actually SNI.
- boudin 4y agoWhen I was on virgin, I noticed that ip addresses used by some TPB or similar websites weren't routed to the internet, which is obviously quite bad. I'm not sure if it's still what they do. Better ISPs only do DNS blocking though. Some don't block anything actually.
- ClumsyPilot 4y agooof, this is serious, thanks for letting me know
- PlutoIsAPlanet 4y agoThey can block the IPs or watch for SNI requests. It's far from as complex as the Great Firewall of China.
- denton-scratch 4y agoIn that case it's your ISP (Virgin Media). My niche ISP gives me unfiltered internet. Also, I run my own recursive resolver.
- tenebrisalietum 4y agoTry an SSL DOH resolver, which can't be subject to simple transparent intercepts (at least not without you knowing about it).
- Renaud 4y agoHow he block is implemented is not of any concern to the public at large. Whether it's a simple DNS block or stateful packet inspection, the vast majority of people won't be able to access. Once any blocking requirement is in place, it's only a matter of moving the slider to more technical means of enforcement to plug the holes in the system. So you're right, the UK is nowhere near China in terms of filtering, neither does it need to be to still become a digital island.