6 ms·
OpenGFW: an open source implementation of China's Great Firewall
- eckelhesten 3y agoI wonder if this could be used to block ads on TV apps, Youtube app etc.
- pmontra 3y agoFor YouTube if you use Android you can install NewPipe from F-Droid. Not only there are no ads, you can even bookmark videos and subscribe channels without having an account on YouTube or without being logged in.
- elia_is_me 3y agointeresting
- m00x 3y agoMy kids are about to learn the consequences of hurting my feelings by calling me a buttface on the internet.
- out-of-ideas 3y agoare you going to wear a mask of one of the dudes from star trek and set your phaser to stun?
- tenlp 3y agoWell...it's very suitable for people outside of mainland China to experience what Chinese people experience online.
- est 3y agoNah it's an interesting piece of technology of double-edged sword, like any other technology. A firewall can be used to censor information, but can be also used to block ads or malicious traffic.
- darkwater 3y agoIt's always "malicious traffic". It is just the definition of "malicious" that varies ;)
- Havoc 3y agoThe traffic classifier sounds interesting
- kavalg 3y ago> Help you fulfill your dictatorial ambitions This bullet on their features list made my day LOL :)
- nusl 3y agoIt is funny but let’s hope someone doesn’t take it seriously or use it in that capacity else they’re gonna have to explain it in court
- M95D 3y agoI'm shocked that nobody is worried that this lowers the barrier to implementation for other dictatorial governements.
- passwordoops 3y agoAsk Apple or Microsoft if they have trouble selling to dictatorial governments
- M95D 3y agoI'm confused. Is GFW built by Apple or Microsoft?
- passwordoops 3y agoYes. Otherwise they couldn't operate in China. https://www.theverge.com/2018/11/2/18053142/china-internet-privacy-censorship-apple-microsoft-google-democracy-report https://www.theverge.com/2018/11/2/18053142/china-internet-p... https://www.businessinsider.com/tech-companies-censoring-content-for-china-apple-microsoft-2019-10 https://www.businessinsider.com/tech-companies-censoring-con... https://www.npr.org/2022/12/26/1145509265/apple-airdrop-china-censorship-criticism https://www.npr.org/2022/12/26/1145509265/apple-airdrop-chin... https://www.bloomberg.com/news/newsletters/2024-03-07/how-microsoft-s-bing-search-engine-censors-content-in-china https://www.bloomberg.com/news/newsletters/2024-03-07/how-mi...
- JackSlateur 3y agoIt does not.
- luke-stanley 3y agoHaving a model of how something works is really helpful to explore mitigations.
- nirui 3y agoI been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS whitelist, even when they use DoH. --- Off topic but BTW: "Fully Encrypted Traffic" is really a confusing term that can only be understood correctly if the context is correct too. How about calling those protocols "High Entropy" (HighE)? Which IMO is more specific than calling it "Fully Encrypted". It's just my two-cents suggestion.
- luke-stanley 3y agoI briefly read a paper, I suspect it's more complex than "high entropy".
- nirui 3y agoThe strategy used to detect "Fully Encrypted Traffic" is indeed complex, but the protocols investigated by the paper (at least Shadowsocks, VMess. Not really sure about Obfs4) works by transforming the traffic to make it "look like nothing". So I still believe "High Entropy" is a better description than "Fully Encrypted Traffic". I mean, you can pack the entire data stream in Base64 after sending them through a SHA256 pipeline, and it will still be "Fully Encrypted", but the entropy (in terms of traffic classification by content scanning) is not the same compare to doing it without the Base64 step.
- luke-stanley 3y agoYes, "High Entropy" or even "HighE" is a more accurate than "Fully Encrypted Traffic". It's interesting that the filter was observed to operate at specific ranges of entropy in the paper, and the repo has it mostly reproduced here: https://github.com/apernet/OpenGFW/blob/1dce82745d0bc8b3813aea147954ba3a2294ef30/analyzer/tcp/fet.go#L46 https://github.com/apernet/OpenGFW/blob/1dce82745d0bc8b3813a... But presumably to keep people on their toes, the real filter, only operates some of the time. It be a cursed, "hex ensemble".
- haunter 3y agoWould be funny if this ends up like War Thunder. Some random chinese official making a pull request out of spite because some implementations are not as how the real GFW is doing it.
- est 3y agothe gfw was not built by some random "chinese officials", it's powered by the IT industry with contractors all the way down. There isn't a monolith wall either. There are multiple generations of TCP/IP middle boxes sold to various levels of ISP over many years.
- s_m_r 3y agoThis project is like an open-source missile for regimes like Iran and North Korea. I do admire it, but some governments could abuse it to suppress freedom.
- eunos 3y agoUnless your government is technically inept they don't really need this project to have their own GFW and inept government won't be able to maintain it anyway.
- Ingaz 3y agoIran and North Korea don't need open source missiles. Maybe it's European countries need such projects to be on par with them
- bluish29 3y agoThe publishing industry will probably now demand using this to block sci-hub and anna archive /s.
- ksajadi 3y agowonderful. now the Iranian regime can stop their payments to China for their use of this tech to block Iranians from accessing open internet. funny how open source can do a full circle to prevent the very thing it set out to open.
- bzmrgonz 3y agoI agree, there are some genuine use-cases for such a product. SCHOOLS.. to keep distractions at minimum for instance. I worry about malware tho, anyone can vet the team behind this??
- inemesitaffia 3y agoAny alternatives?
- lucubratory 3y agoSo it's like a souped-up PiHole?
- supriyo-biswas 3y agoThe focus here is on detecting the usage of VPN protocols based on signatures, entropy, and other characteristics (especially the ones that try to make themselves look like TLS traffic) rather than having a blocklist of hostnames as Pi-hole does.
- Animats 3y agoAh. Not on content analysis, though.