I bet that the recent wave of VPN bans implemented in Russia also uses this tech. For example the mechanism of how suspicious websocket endpoints are being "knocked" by the firewall itself or how suspiciously traffic heavy ssh connections are being dropped suggests that Russian govt simply bought the entire stack from China.

Russia tests it all in Belarus first. In 2020 they blocked almost all Internet, including VPNs, Tor etc (but left some areas connected, like banking). It's somewhat easier in Belarus, as they have a legal monopoly on cross-border Internet.

> At least one Jira support ticket shows evidence of plaintext capture of email

I would be surprised if western governments didn't do the same, and folks should act accordingly.

[dead]

>Once a government taste the powerful liquor of censorship, there's no way that bottle's ever getting corked again.

Seems the youth of Nepal managed to cork the bottle again earlier this month, when after the mass social media ban they burned down the government buildings and chased the parliamentarians out of the country.

You fundamentally misunderstand the battlefield.

> I hope that this GFW leak helps researchers and hobbyists alike find more ways to fight against government erosion of personal dignity.

Dream on. Remember Germany ?

From my own personal experience with an outline server running on the same IP over 3 years, the GFW consistently ends up blocking it around 3 days after I first connect. Outline does use shadowsocks to obfuscate but I suspect the traffic detection is what triggers it after 3 days of observations. Running multiple servers and repeatedly cycling through them is an experiment I want to try the next time I'm there.

I've also observed similar behavior with the vpn I'm using as backup where the server I'm using tends to get blocked in around the same timeframe. It's using openvpn/wireguard as the underlying protocol which doesn't try to obfuscate itself so I suspect traffic pattern analysis plays a larger role in what gets blocked than the protocol itself. The exception was my recent trip week-long trip where I was mostly cycling between two servers without noticing either being blocked.

> I would pass my SSH connecting used for socks5 through ROT13 or any ROTn, then the firewall won't gradually slow it down towards total stall after a few kilobytes. OpenSSH yells its name and version in plain text upon connection.

Could you elaborate on that more? I'd love to dig into an implementation that does this, in case you still have the tools/scripts/programs available.

I'm asking because for the last couple years I've been on and off working on my warps [1] soft router prototype which aims to hide in plain sight using exfil network protocols.

(Think of it like DNS/HTTP smuggling but with the idea to use similar techniques in other network protocols, too)

[1] https://github.com/tholian-network/warps

If you can make money from it, there will always be someone willing to do it. And/or there is always someone you can compel to do it. It sucks but you pretty much have to operate with that assumption for most things.

One man's "affront to fundamental individual freedoms" is another's "essential for the collective good".

The excuse is you are good at tech and there's a gun to your head.

There's a sort of mirror world of academic research happening, where on one side of the mirror, you have people building the tools to censor the internet (typically but not always in Asian venues), and on the other, the tools to circumvent that censorship (typically but not always in Western venues). I know far more people on the latter half of the equation, but have enough exposure to the other side of the mirror to know that most of them earnestly believe they're doing something good. They see massive megacorportaions pushing American interests as an unfair lever in a fight for national sovereignty, and what they do as simply leveling the playing field, and combating misinformation. While I would wholeheartedly agree that they are mistaken in their analysis (reifying systems for people, "The institution I'm supporting may sometimes do bad things, but what I do is supporting the good parts!") and should immediately stop, I wouldn't want to dehumanize them any more than I would someone who works for Palantir, or even Google, Amazon, etc.

I doubt we disagree on ethics here, but I am empathetic to the influences at play for a developer in that situation. I would not demonize them without first knowing more.

"Failed", hah. If you fail, you never even touch stuff like that: https://en.wikipedia.org/wiki/Gaokao

As fucked up as it is, the virtue of individualism is often studied as a capitalist/western phenomenon that causes crime and internal conflict. Many of the people building this likely genuinely believe that they are working for the greater good and repressing a harmful social underclass.

Probably some guy called (C)hen (I)ao (A)n

Yes … while hoping no one ever finds out

Suddenly all leaders are wannabe autocrats, even the great western democratic ones, they just like to pretend about still caring about democracy.

You don't need QUIC, TLS and other encrypted channels have the same protection.

It's not hard to identify those channels and block them. A connection used to interact with websites has completely different traffic patterns compared to a user sending all of their traffic over one specific connection.

Add to that the fact that large video streaming services such as YouTube, where you may see large quantities of data being exchanged over persistent connections, are already blocked in China, and your VPN becomes quite obvious without seeing even a byte of plaintext.

Of course for common protocols like QUIC they have their own custom solution (linked in a sibling comment), but the point is that even with encrypted SNI you will need dedicated anti-GFW protocols to stand a chance against censorship. No protocol that works well for most consumers is going to protect against the analysis a dedicated firewall with decent funding can come up with.

According to https://gfw.report/publications/usenixsecurity25/en/#3 they sniff the SNI out of the handshake like for TLS.

Why would QUIC be any more or less MITM attackable than say HTTP1.1 or 2?

AFAIK, the only thing that stops an MITM attack (where they respond as if they’re the remote server and then relay to the real remote server) are certificates.

If an authority requires you trust their root certificate so they can spy on you, QUIC will not make any difference.

Typically they rely on metadata like the IP you're connecting to, or downgrade attacks. Until every server supports QUIC they can just pretend the server doesn't support QUIC.

You might think IP checks are safe because everything's on Cloudflare and they can't block Cloudflare, but you'd be wrong. Even Spain blocks Cloudflare (yes, entirely) during football games.

That's not true. QUIC's encrypted traffic does not protect against MITM.

As I understand it the idea is not necessarily to stop all dissent / awareness, but that it's useful to be able to slow the spread of "rumours" / incendiary information when it is spreading virally. This gives authorities time to come up with a response if required.

While I personally wouldn't want to live in a country which does this, the flip side of unrestricted virality in countries that culturally might not be prepared for it are events like https://en.wikipedia.org/wiki/Indian_WhatsApp_lynchings

Given that the US controls much of what happens on the Internet, another issue for many countries (not China so much) is that without controls they become extremely vulnerable to US influence campaigns and "colour revolutions".

I predict that all countries will end up with something like the GFW eventually because there's basically no other way for governments to achieve "Internet sovereignty" (enforce laws regarding users and publishers on the web). The US might be last to do this because it is in the doubly privileged position of a) being able to exert significant pressure on other countries and b) being able to apply regulation to major US-based Internet companies using their own legal system.

The original GFW was literally built by Cisco. The west already has the technology. They only need an excuse to deploy it.

China relies heavily on export, so they can't just block everything. There are tons of proxy services to bypass GFW in China, and most of them have government background.

I listened to a British politics podcast the other day called Not Another One and they were discussing that among western governments there is some looking at the UK’s porn block because in general politicians think that things have gone too far in children being able to access to extreme content, and that if 20 years ago it had been suggested this had been where we’d be, it wouldn’t have been seen as acceptable. They used the example that if you want to publish a very explicit book in the U.K., the Obscene Publications Acts would put limits on you doing so, but putting it online would be allowed

> My second thought is how badly Chinese communism must be doing that they need such a massive effort in order to prevent their citizens from accessing information and voicing dissent.

Well, OpenAI and other companies training AI models have shown that the architecture of the model matters less than the quality of data fed into it. Same applies for humans.

I understand that the Great Firewall is mostly about censoring dissent, but it's also to keep Chinese citizens away from junk food media sources. The type of videos you see on Douyin vs Tiktok is a great example of the difference.

Yes, the videos on Douyin are politically censored, but they're also a lot less brainrot than Tiktok videos. The Tiktok algo is optimized for ad impressions and profit, whereas the Douyin algo is more tuned to some nebulous concept of Confucian social harmony, for better or worse.

A more nuanced take is that I don't think it's useful to measure Chinese govt behavior just mapped to "amount of suppressing political dissent". I actually think the level of censorship is above the level required for that. It's more useful to recognize that "suppressing political dissent" is actually a subset of Confucian "promote social harmony"- which is not strongly valued in the USA but is at least important enough to be paid lip service in China- and I suspect a big chunk of educated members of government may truly believe in that ideal. It explains behaviors like "why the Douyin algo is so different from Tiktok" and other overreaches of the Chinese govt, because it's not solely about suppressing dissent.

would copy this to build their own Firewalls.

Just about every company already uses some form of this on their network, especially those in highly regulated sectors like banking and other finance-related industries.

More usefully and perhaps "on the other side", I have a proxy on my network to block and modify requests for ads and other content I want to "censor".

> i still don't think it's a goal anyone is actively working towards and that's a bit of an hyperbolic take

now this is what Pink Floyd meant by "comfortably numb". mass cognitive dissonance and denial

> My first thought was unfortunately whether the UK and other Western nations would copy this to build their own Firewalls

Various western networking companies already sell such products to authoritarian regimes, such as Nokia[1], Blue Coat Systems[2] and Siemens[3]. China, for reasons that are well documented elsewhere, has always wanted to build it with "their tech", the only thing that's new to me is their export of such tech to Chinese-allied nations.

> My second thought is how badly Chinese communism must be doing that they need such a massive effort in order to prevent their citizens from accessing information and voicing dissent.

This is a very controversial opinion, but the overton window has shifted in this respect and many people often like censorship/DPI when done for "altruistic reasons", and it was sad to see Europeans (presumably) asking for blocking of social media sites since Nepal[4] had done the same, disregarding the second-order effects it would have.

Of course, we live in interesting times, with a major western world power embracing economic policies that prioritize government ownership of industries[5], which is typically closer to communism than anything we've seen in the past :)

[1] https://www.wired.com/2011/08/nokia-siemens-spy-systems

[2] https://www.bis.doc.gov/index.php/about-bis/102-about-bis/ne...

[3] https://www.spiegel.de/international/business/ard-reports-si...

[4] https://news.ycombinator.com/item?id=45137363

[5] https://www.intc.com/news-events/press-releases/detail/1748/...

I for one can only access rt.com from a European country if I use a vpn. So that is step 1. The next steps will come. Our government has shown itself willing and (partly) able to block content from its citizens, regardless of their intent. Ie being pro-Putin, or wanting to study what opinions circulate in Russia to try and maintain some level human understanding for our fellow humans on the other side.

Moreover a large part of our government is willing to implement something as egregious as ChatControl. So they are not above animing extremely invasive spying tech at their own citizens.

1+1=2. All prerequisites have been met for a European “firewall”. Hate the word btw, a firewall is supposed to be a defense tool. But these censoring tools are an attack on our agency. Every time I try to access something I am not allowed to access by my overlords I hear in my head "You are not allowed to see this information citizen."

> My second thought is how badly Chinese communism must be doing that they need such a massive effort in order to prevent their citizens from accessing information and voicing dissent.

I don't quite understand why the first impulse is that it covers up government incompetence. There are other incentives for mass social control of discourse and information.

"My second thought is how badly Chinese communism must be doing that they need such a massive effort in order to ..."

China have visa-free visit policy for many countries, you could actually go there to see how "bad" it is

https://www.china-briefing.com/news/china-visa-free-travel-p...

Lolz