4 ms·

Just now? I thought all news sites that they can't control are already blocked in some way. Some are keywords-triggered instead of fully blocked though. There

by songgao 13y ago

Just now? I thought all news sites that they can't control are already blocked in some way. Some are keywords-triggered instead of fully blocked though. There are always ways to "unblock" blocked websites. HTTPS (for anti-keyword-filtering), SSH Tunnels, VPNs, Proxies, Tor, they all had their presence in Chinese Internet history. And then the government are always able to either block or weaken methods that unblock blocked websites. It's an endless battle between the officials and citizens, or between dictatorship and freedom of speech. I'm getting really bored. Here in HN, I'd love to see some technical article behind GFW[0] instead of yet another piece of news of some site blocked by it. [0] https://en.wikipedia.org/wiki/Golden_Shield_Project https://en.wikipedia.org/wiki/Golden_Shield_Project

xfs 13y ago
The Golden Shield Project has nothing to do with the GFW. The whole Wikipedia article is a misnomer.
- test1235 13y ago
  Can you explain further for those of us who aren't familiar with either term?
  - xfs 13y ago
    The Golden Shield Project is an internal police network. The "Great Firewall of China" is several systems of very lengthy official names, but basically a dual-use firewall of CNCERT. CNCERT does not report to any police.
chatmasta 13y ago
I wrote a 15 page essay on this for school. Maybe I'll turn it into a blog post.
rahimnathwani 13y ago
The technical method of the blocking is indeed interesting. From my home broadband connection: - I can connect to port 80 on fallback.global-ssl.fastly.net (to which the CNAME entry for www.theguardian.com points). - I can successfully get a 404 page (from that same server) by doing something like this: GET / HTTP/1.1 Host:www.invaliddomain.com - I get disconnected if I specify Host: www.theguardian.com in any HTTP request, even if I'm connecting to some IP address that has no relationship with theguardian.com. So, in this instance, the GFW is not blocking by IP address, nor is it blocking by keyword. It is blocking by the hostname in the Host: header of the HTTP request.
- jychang 13y ago
  This implies that HTTPS would easily bypass it. If only the Guardian had HTTPS support...
  - rahimnathwani 13y ago
    Sadly it's not as simple as that. Facebook has HTTPS support, but TCP connections on port 443 just time out. The GFW is sophisticated. It would be trivial to stop all obvious VPN traffic (obvious = PPTP and L2TP/ipsec on default ports) without affecting other things, but this isn't done, unless many people connect to the same server over some period of time. Unidentifiable TCP/UDP traffic on other ports (e.g. OpenVPN on a port number in the 1000s) again isn't blocked. However, if the same TCP/UDP port on the same server is accessed for long enough, and often enough, it will get blocked. Switching to a different port on the same server will probably fix it, until the next time.

by songgao 13y ago

xfs 13y ago

The Golden Shield Project has nothing to do with the GFW. The whole Wikipedia article is a misnomer.

test1235 13y ago
Can you explain further for those of us who aren't familiar with either term?
- xfs 13y ago
  The Golden Shield Project is an internal police network. The "Great Firewall of China" is several systems of very lengthy official names, but basically a dual-use firewall of CNCERT. CNCERT does not report to any police.

chatmasta 13y ago

I wrote a 15 page essay on this for school. Maybe I'll turn it into a blog post.

rahimnathwani 13y ago

The technical method of the blocking is indeed interesting. From my home broadband connection: - I can connect to port 80 on fallback.global-ssl.fastly.net (to which the CNAME entry for www.theguardian.com points). - I can successfully get a 404 page (from that same server) by doing something like this: GET / HTTP/1.1 Host:www.invaliddomain.com - I get disconnected if I specify Host: www.theguardian.com in any HTTP request, even if I'm connecting to some IP address that has no relationship with theguardian.com. So, in this instance, the GFW is not blocking by IP address, nor is it blocking by keyword. It is blocking by the hostname in the Host: header of the HTTP request.

jychang 13y ago
This implies that HTTPS would easily bypass it. If only the Guardian had HTTPS support...
- rahimnathwani 13y ago
  Sadly it's not as simple as that. Facebook has HTTPS support, but TCP connections on port 443 just time out. The GFW is sophisticated. It would be trivial to stop all obvious VPN traffic (obvious = PPTP and L2TP/ipsec on default ports) without affecting other things, but this isn't done, unless many people connect to the same server over some period of time. Unidentifiable TCP/UDP traffic on other ports (e.g. OpenVPN on a port number in the 1000s) again isn't blocked. However, if the same TCP/UDP port on the same server is accessed for long enough, and often enough, it will get blocked. Switching to a different port on the same server will probably fix it, until the next time.