4 ms·

There's no feasible way of blocking circumvention tools without causing massive collateral damage. If they block SSH tunnels for instance no sysadmin will be a

• straight_talk_2 13y ago
  You're kidding yourself. It's fully possibly to establish complete control over the Internet. If these power hungry sociopaths have it their way, there will soon be no free network to run a VPS on.
• sneak 13y ago
  If you restrict unfiltered access to the web to only those who know how to ssh, your hopes for a free society are doomed.
  • tomjen3 13y ago
    If the ability to use ssh stands between horny teenage boys and lots of pictures of naked ladies, the boys will be profficient in ssh in no time.
• vidarh 13y ago
  I don't think they care about it enough to want to go even that far, unless VPNs become totally mainstream. But you can tunnel encrypted data over anything that can carry a signal, and stuff IP datagrams inside it. This will only stop people that are "casually" looking for stuff and don't really care. Latency might suck. But if the filters become a problem, you'll start seeing VPN applications with "UK filter modes" that use whatever the current simplest circumvention method is. Heck, I'm in the UK and I'd go into business selling VPN solutions like that myself if the filters get obnoxious enough for that (through suitable shell companies somewhere more favourable). The trouble with a business like that, of course, is that the market will be limited as long as the filters are not mandatory. But just as an illustration of how ludicrously infeasible turning this into full censorship is: If they allow HTTP through at all, you could easily create a VPN were the packets are exchanged by ensuring every Xth character is lowercase for 0 and uppercase for 1, and serialise your packets by downloading / uploading hacker news comments to the VPN server, with the case changed. Or you could use a thesaurus on both ends, with an algorithm for assigning 0/1 to words, and rewrite the text by looking up the next word and deciding whether (and if so what) to rewrite it to. Of course that'd also be ludicrously slow and waste tremendous amounts of bandwidth, but it's an example on the far extreme end. More likely if they ever try to make this mandatory and actively filter, it'd likely start out with just be a matter of changing port numbers. The next step up in escalation would likely be wrapping the data in something that looks like you're talking to a DNS or mail server or similarly slightly massaging the data. It'd only be somewhat tricky if they get to the point of trying deep packet inspection and validating that the contents matches expectations from the protocol and doesn't look "too random" for every protocol people might use. (As a last resort we'll just have to implement IP over Avian carriers: http://tools.ietf.org/html/rfc1149 http://tools.ietf.org/html/rfc1149 )
  • cdjk 13y ago
    You can do IP over DNS today: http://code.kryo.se/iodine/ http://code.kryo.se/iodine/
  • kevcampb 13y ago
    I lived in China for 4 years. It's amazing how everyone there knows what a VPN is. Really, everyone.
  • foobarqux 13y ago
    The Tor project is already dealing with these issues using obfsproxy in places like China where VPNs are blocked.
• Nursie 13y ago
  I guess sysadmins will be put on the "Persons who requested porn be unblocked" list. Dirty, filthy sysadmins :)