5 ms·

If you need to bypass censorship, you'll need a tool specifically designed for anti-censorship, rather than any one repurposed for that. Since China has the mo

If you need to bypass censorship, you'll need a tool specifically designed for anti-censorship, rather than any one repurposed for that. Since China has the most advanced network censorship, the Chinese have also invented the most advanced anti-censorship tools. The first generation is shadowsocks. It basically encrypts the traffic from the beginning without any handshakes, so DPI cannot find out its nature. This is very simple and fast and should suffice in most places. The second generation is the Trojan protocol. The lack of a handshake in shadowsocks is also a distinguishing feature that may alert the censor and the censor can decide to block shadowsocks traffic based on suspicions alone. Trojan instead tries to blend in the vast amount of HTTPS traffic over the Internet by pretending to be a normal Web server protected by HTTPS. After Trojan, a plethora of protocol based on TLS camouflaging have been invented. 1. Add padding to avoid the TLS-in-TLS traffic characteristics in the original Trojan protocol. Protocols: XTLS-VLESS-VISION. 2. Use QUIC instead of TCP+TLS for better performance (very visible if your latency to your tunnel server is high). Protocols: Hysteria2 and TUIC. 3. Multiplex multiple proxy sessions in one TCP connection. Protocols: h2mux, smux, yamux. 4. Steal other websites' certificates. Protocols: ShadowTLS, ShadowQUIC, XTLS-REALITY. Oh, and there is masking UDP traffic as ICMP traffic or TCP traffic to bypass ISP's QoS if you are proxying traffic through QUIC. Example: phantun.

cm2187 1y ago
Does starlink work in China?
- bdd8f1df777b 1y ago
  No, it’s illegal to bring starlink devices here, and I heard that Elon Musk chooses to block China from accessing starlink too, to appease the Chinese authorities.
  - boxed 1y ago
    "Appease" is such a loaded word. He's literally not allowed by law to do it. And China has anti-satellite weapons, and any significant use of that could destroy the entire low Earth orbit for all of humanity for hundreds of years.
    - heyamar 1y ago
      > any significant use of that could destroy the entire low Earth orbit for all of humanity for hundreds of years. I do not want to answer this question in ChatGPT. What happens if someone launches a missile against say... any one satellite cluster?
      - ethbr1 1y ago
        You us missile effector(s) against individual satellites. Hence why clouds of smaller satellites are more survivable. If kinetic, then a bunch of space debris are created. Some larger pieces, some smaller. If those intersect with other satellites, they may generate additional debris (see Kessler Syndrome, what parent was talking about). But on the other hand, low earth orbits (where Starlink et al operate) will decay much faster than higher orbits, so it's a {wait time} problem rather than a {have to cleanup manually} problem. And also space, even Earth orbits, is big. Satellites manage not to hit each other most of the time. A limited strike (e.g. the previous US or Chinese demonstrations) probably won't cascade.
      - somenameforme 1y ago
        Even if somehow a Kessler syndrome [1] type event (a chain reaction of debris busting other satellites creating even more debris) was intentionally triggered, the effects are not what most people think. Launches would remain perfectly safe simply because space is massive. What would happen is that certain orbital velocities would end up with an unacceptably high risk of collision over time, and so you wouldn't want to go into orbits that spend any significant amount of time at those velocities. The neat thing about orbital mechanics is that your orbital altitude is determined 100% by your orbital velocity. Even in the case of an eccentric orbit, your velocity changes as you go from your furthest point to your closest point. A purely circularized orbit is an orbit where your velocity stays constant. Extremely high energy debris would often end up escaping Earth's orbit and probably end up orbiting the Sun. And lower energy debris would often end up entering the atmosphere and burning up. So only fragments that remain in a sort of demented goldilocks zone would end up being dangerous. So in general I think the answer is - not much, especially in strikes of satellites near LEO. US, Russia, China, and India have all carried out live fire tests of anti-satellite weapons. [1] - https://en.wikipedia.org/wiki/Kessler_syndrome https://en.wikipedia.org/wiki/Kessler_syndrome
  - manacit 1y ago
    Does Starlink operate anywhere they don't have regulatory approval to do so? It's not like this is serving a website. There's physical spectrum licensing involved in operating anywhere.
    - Shank 1y ago
      > Does Starlink operate anywhere they don't have regulatory approval to do so? They do not.
      - gizzlon 1y ago
        I believe they do, in Iran: https://www.iranintl.com/en/202507162142 https://www.iranintl.com/en/202507162142 https://www.bloomberg.com/news/newsletters/2024-03-27/why-policing-elon-musk-s-starlink-satellites-is-a-global-challenge https://www.bloomberg.com/news/newsletters/2024-03-27/why-po...
- thedevilslawyer 1y ago
  Tesla sells in china right? This won't be possible
jech 1y ago
Is WebRTC being blocked by China? I'm wondering whether it'd be worthwile to implement an VPN that uses WebRTC as a transport. With cover traffic, it could likely be made to look just like a video call.
- numpad0 1y ago
  Might as well actually make calls. Malformed Opus going up, malformed h264 coming down. It can be multiplexed with something like a livecam feed.
- bdd8f1df777b 1y ago
  WebRTC is not blocked. I do see some protocols trying to masquerade as WebRTC, but for some reason it is not popular. A primitive way to bypass the censor is just to connect to your VPS with RDP or Chrome Remote Desktop (which is WebRTC underlying) and then browse the Internet there. But it needs a very powerful server and is quite slow.
- matfile 1y ago
  Due to the specific ISP environment in China (massive NAT abuse, very limited public IP access, ISP actively dropping anything that does not look like HTTPS to ensure QoS), any P2P based protocol in China is generally unusuable. They are not blocked per se, but they are mostly non-existent. Yes, I know BitTorrent network in China is huge thanks to the weak DMCA law enforcement towards individuals, but having no practical legal consideration does not mean it's enjoyable to use.
tarruda 1y ago
To complement the answer (if the OP or anyone else is looking for a step-by-step guide), ask an LLM: " Give me step by step instructions on how to setup trojan client/server to bypass censorship. Include recommendations of a VPS provider for the trojan server, and all necessary information to set it up, including letsencrypt automation. Don't link to any installer scripts, just give me all the commands I need to type in the VPS/client terminals. Assume Ubuntu 22.04 for both client and server. " ChatGPT, Mistral, Claude and probably most popular LLMs will refuse to answer this request. Funny that DeepSeek (https://chat.deepseek.com https://chat.deepseek.com) will comply despite it being from China. Another option is to use local LLMs. I've tested this with GPT-OSS-120b and Gemma 3 27b(https://huggingface.co/google/gemma-3-27b-it-qat-q4_0-gguf/ https://huggingface.co/google/gemma-3-27b-it-qat-q4_0-gguf/) and both seems to work.
- cft 1y ago
  That applies to only to only San Francisco-based (and French/Chinese) heavily censored communist LLMs. Grok is willing to provide instructions: https://grok.com/share/bGVnYWN5LWNvcHk%3D_a78b768c-fcee-4029-86a4-b4ed4e81e31b https://grok.com/share/bGVnYWN5LWNvcHk%3D_a78b768c-fcee-4029...
  - JCharante 1y ago
    but isn't xAI SF based? https://x.ai/careers/open-roles https://x.ai/careers/open-roles
    - deleted 1y ago
      [deleted]
    - immibis 1y ago
      It is. People will come up with any excuse to glaze Elon.
  - hnfong 1y ago
    Almost all companies developing state of the art LLMs are either based in San Francisco (and the surrounding Bay Area), or French or Chinese... (and as a sibling commenter says, XAI is in the SF Bay Area as well.)
sebstefan 1y ago
>Steal other websites' certificates. Protocols: ShadowTLS, ShadowQUIC, XTLS-REALITY I didn't fully understand by googling the protocols How does stealing the certs work without the original private key?
- mmport80 1y ago
  iirc, the clients use the certs but ignore them. but to the censor they see the certs are well known, so allow them thru
- bdd8f1df777b 1y ago
  Let's say the upstream server is apple.com. The TLS handshake is always performed by the real apple.com servers, and the ShadowTLS server is only a middle man forwarding raw TCP contents. If both sides are ShadowTLS (client & server) holding the same key, they will stealthily switch to a different encryption protocol after the handshake, disregarding the TLS key exchange. The TLS handshake is a facade to fool the deep packet inspection of the censor. In all other cases, such as the censor actively probing the ShadowTLS server, the server will keep forwarding the encrypted traffic to apple.com without anyway to decrypt it (it's not a MitM proxy). To the active prober, it is just apple.com all the way.
- utilize1808 1y ago
  My understanding is that the way it works is that your proxy server pretends to be a server ran by some legitimate entity (e.g. cloudflare, aws, etc.). When setting up the server, you will instruct it respond using the cert from the façade domain. To the censor, it would appear that you are approaching a server ran by the legitimate entity. If the censor becomes suspicious of the IP and decides to probe the server to see if it is a circumventing proxy, it would see valid certs but no actual content (as if the server at the IP is broken/down). However, there is actually a secret path+password that you can use to make the server aware that you are a real client and the proxy server would start proxy your traffic normally.
Shank 1y ago
You really need Vmess / V2ray, now: https://github.com/v2fly/v2ray-core https://github.com/v2fly/v2ray-core
stonecharioteer 1y ago
Responding to this just in case I need this in India one day.
arethuza 1y ago
Apologies for the rampant paranoia but that all sounds great - but how do I know that advice like this can be trusted, after all you could be an agent of a state security service directing people towards services they want people to use. NB Just to be clear, I'm not doubting you, but if I was in a situation where my life or liberty was at threat I would be very worried about whose advice to take.
- pythonguython 1y ago
  He’s giving advice about generic protocols - you could learn about them and make your own decision. The tools he mentioned are open source - you could read the source code or trust in the community. I don’t know what other guarantee you could hope to get. If he told you he’s an anti digital censorship expert he could just be lying to you. Anyone COULD be an agent, but at a certain point you have to choose to trust people, at some potential risk to yourself.
- bdd8f1df777b 1y ago
  If you have the technical knowledge, you can just read the protocols, find out if they make sense, and then implement them yourself. Most of them are quite straight forward so it's not possible to hide a backdoor like Dual_EC_DRBG in the protocol. If you are not so technical then you have to decide who to trust. For example, you may trust that open source software has been vetted enough and build one from source. Or trust that the built artefacts downloaded from github is good enough. Or trust that the software downloaded from a website not marked as fraud by Google Chrome is good enough. Etc. In any case, the more technical knowledge you have, the more confidence you can have by doing due diligence yourself.
- hluska 1y ago
  Wow, someone sent out of their way to write about protocols. Instead of saying “thank you” or being silent or even doing independent research, you decided to talk about your paranoia. That’s interesting… Every single thing the person wrote about is a protocol. Each has been written about extensively and they’re open source. You can read source code if you’d like. Those are the best guarantees you can get with any software. If you’re not technical and not willing to do the research and put in the work, there’s nothing you can do.

cm2187 1y ago

Does starlink work in China?

bdd8f1df777b 1y ago
No, it’s illegal to bring starlink devices here, and I heard that Elon Musk chooses to block China from accessing starlink too, to appease the Chinese authorities.
- boxed 1y ago
  "Appease" is such a loaded word. He's literally not allowed by law to do it. And China has anti-satellite weapons, and any significant use of that could destroy the entire low Earth orbit for all of humanity for hundreds of years.
  - heyamar 1y ago
    > any significant use of that could destroy the entire low Earth orbit for all of humanity for hundreds of years. I do not want to answer this question in ChatGPT. What happens if someone launches a missile against say... any one satellite cluster?
    - ethbr1 1y ago
      You us missile effector(s) against individual satellites. Hence why clouds of smaller satellites are more survivable. If kinetic, then a bunch of space debris are created. Some larger pieces, some smaller. If those intersect with other satellites, they may generate additional debris (see Kessler Syndrome, what parent was talking about). But on the other hand, low earth orbits (where Starlink et al operate) will decay much faster than higher orbits, so it's a {wait time} problem rather than a {have to cleanup manually} problem. And also space, even Earth orbits, is big. Satellites manage not to hit each other most of the time. A limited strike (e.g. the previous US or Chinese demonstrations) probably won't cascade.
    - somenameforme 1y ago
      Even if somehow a Kessler syndrome [1] type event (a chain reaction of debris busting other satellites creating even more debris) was intentionally triggered, the effects are not what most people think. Launches would remain perfectly safe simply because space is massive. What would happen is that certain orbital velocities would end up with an unacceptably high risk of collision over time, and so you wouldn't want to go into orbits that spend any significant amount of time at those velocities. The neat thing about orbital mechanics is that your orbital altitude is determined 100% by your orbital velocity. Even in the case of an eccentric orbit, your velocity changes as you go from your furthest point to your closest point. A purely circularized orbit is an orbit where your velocity stays constant. Extremely high energy debris would often end up escaping Earth's orbit and probably end up orbiting the Sun. And lower energy debris would often end up entering the atmosphere and burning up. So only fragments that remain in a sort of demented goldilocks zone would end up being dangerous. So in general I think the answer is - not much, especially in strikes of satellites near LEO. US, Russia, China, and India have all carried out live fire tests of anti-satellite weapons. [1] - https://en.wikipedia.org/wiki/Kessler_syndrome https://en.wikipedia.org/wiki/Kessler_syndrome
- manacit 1y ago
  Does Starlink operate anywhere they don't have regulatory approval to do so? It's not like this is serving a website. There's physical spectrum licensing involved in operating anywhere.
  - Shank 1y ago
    > Does Starlink operate anywhere they don't have regulatory approval to do so? They do not.
    - gizzlon 1y ago
      I believe they do, in Iran: https://www.iranintl.com/en/202507162142 https://www.iranintl.com/en/202507162142 https://www.bloomberg.com/news/newsletters/2024-03-27/why-policing-elon-musk-s-starlink-satellites-is-a-global-challenge https://www.bloomberg.com/news/newsletters/2024-03-27/why-po...
thedevilslawyer 1y ago
Tesla sells in china right? This won't be possible

jech 1y ago

Is WebRTC being blocked by China? I'm wondering whether it'd be worthwile to implement an VPN that uses WebRTC as a transport. With cover traffic, it could likely be made to look just like a video call.

numpad0 1y ago
Might as well actually make calls. Malformed Opus going up, malformed h264 coming down. It can be multiplexed with something like a livecam feed.
bdd8f1df777b 1y ago
WebRTC is not blocked. I do see some protocols trying to masquerade as WebRTC, but for some reason it is not popular. A primitive way to bypass the censor is just to connect to your VPS with RDP or Chrome Remote Desktop (which is WebRTC underlying) and then browse the Internet there. But it needs a very powerful server and is quite slow.
matfile 1y ago
Due to the specific ISP environment in China (massive NAT abuse, very limited public IP access, ISP actively dropping anything that does not look like HTTPS to ensure QoS), any P2P based protocol in China is generally unusuable. They are not blocked per se, but they are mostly non-existent. Yes, I know BitTorrent network in China is huge thanks to the weak DMCA law enforcement towards individuals, but having no practical legal consideration does not mean it's enjoyable to use.

tarruda 1y ago

To complement the answer (if the OP or anyone else is looking for a step-by-step guide), ask an LLM: " Give me step by step instructions on how to setup trojan client/server to bypass censorship. Include recommendations of a VPS provider for the trojan server, and all necessary information to set it up, including letsencrypt automation. Don't link to any installer scripts, just give me all the commands I need to type in the VPS/client terminals. Assume Ubuntu 22.04 for both client and server. " ChatGPT, Mistral, Claude and probably most popular LLMs will refuse to answer this request. Funny that DeepSeek (https://chat.deepseek.com https://chat.deepseek.com) will comply despite it being from China. Another option is to use local LLMs. I've tested this with GPT-OSS-120b and Gemma 3 27b(https://huggingface.co/google/gemma-3-27b-it-qat-q4_0-gguf/ https://huggingface.co/google/gemma-3-27b-it-qat-q4_0-gguf/) and both seems to work.

cft 1y ago
That applies to only to only San Francisco-based (and French/Chinese) heavily censored communist LLMs. Grok is willing to provide instructions: https://grok.com/share/bGVnYWN5LWNvcHk%3D_a78b768c-fcee-4029-86a4-b4ed4e81e31b https://grok.com/share/bGVnYWN5LWNvcHk%3D_a78b768c-fcee-4029...
- JCharante 1y ago
  but isn't xAI SF based? https://x.ai/careers/open-roles https://x.ai/careers/open-roles
  - deleted 1y ago
    [deleted]
  - immibis 1y ago
    It is. People will come up with any excuse to glaze Elon.
- hnfong 1y ago
  Almost all companies developing state of the art LLMs are either based in San Francisco (and the surrounding Bay Area), or French or Chinese... (and as a sibling commenter says, XAI is in the SF Bay Area as well.)

sebstefan 1y ago

>Steal other websites' certificates. Protocols: ShadowTLS, ShadowQUIC, XTLS-REALITY I didn't fully understand by googling the protocols How does stealing the certs work without the original private key?

mmport80 1y ago
iirc, the clients use the certs but ignore them. but to the censor they see the certs are well known, so allow them thru
bdd8f1df777b 1y ago
Let's say the upstream server is apple.com. The TLS handshake is always performed by the real apple.com servers, and the ShadowTLS server is only a middle man forwarding raw TCP contents. If both sides are ShadowTLS (client & server) holding the same key, they will stealthily switch to a different encryption protocol after the handshake, disregarding the TLS key exchange. The TLS handshake is a facade to fool the deep packet inspection of the censor. In all other cases, such as the censor actively probing the ShadowTLS server, the server will keep forwarding the encrypted traffic to apple.com without anyway to decrypt it (it's not a MitM proxy). To the active prober, it is just apple.com all the way.
utilize1808 1y ago
My understanding is that the way it works is that your proxy server pretends to be a server ran by some legitimate entity (e.g. cloudflare, aws, etc.). When setting up the server, you will instruct it respond using the cert from the façade domain. To the censor, it would appear that you are approaching a server ran by the legitimate entity. If the censor becomes suspicious of the IP and decides to probe the server to see if it is a circumventing proxy, it would see valid certs but no actual content (as if the server at the IP is broken/down). However, there is actually a secret path+password that you can use to make the server aware that you are a real client and the proxy server would start proxy your traffic normally.

Shank 1y ago

You really need Vmess / V2ray, now: https://github.com/v2fly/v2ray-core https://github.com/v2fly/v2ray-core

stonecharioteer 1y ago

Responding to this just in case I need this in India one day.

arethuza 1y ago

Apologies for the rampant paranoia but that all sounds great - but how do I know that advice like this can be trusted, after all you could be an agent of a state security service directing people towards services they want people to use. NB Just to be clear, I'm not doubting you, but if I was in a situation where my life or liberty was at threat I would be very worried about whose advice to take.

pythonguython 1y ago
He’s giving advice about generic protocols - you could learn about them and make your own decision. The tools he mentioned are open source - you could read the source code or trust in the community. I don’t know what other guarantee you could hope to get. If he told you he’s an anti digital censorship expert he could just be lying to you. Anyone COULD be an agent, but at a certain point you have to choose to trust people, at some potential risk to yourself.
bdd8f1df777b 1y ago
If you have the technical knowledge, you can just read the protocols, find out if they make sense, and then implement them yourself. Most of them are quite straight forward so it's not possible to hide a backdoor like Dual_EC_DRBG in the protocol. If you are not so technical then you have to decide who to trust. For example, you may trust that open source software has been vetted enough and build one from source. Or trust that the built artefacts downloaded from github is good enough. Or trust that the software downloaded from a website not marked as fraud by Google Chrome is good enough. Etc. In any case, the more technical knowledge you have, the more confidence you can have by doing due diligence yourself.
hluska 1y ago
Wow, someone sent out of their way to write about protocols. Instead of saying “thank you” or being silent or even doing independent research, you decided to talk about your paranoia. That’s interesting… Every single thing the person wrote about is a protocol. Each has been written about extensively and they’re open source. You can read source code if you’d like. Those are the best guarantees you can get with any software. If you’re not technical and not willing to do the research and put in the work, there’s nothing you can do.