Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Two days ago the police came to me and wanted me to stop working on this”

github.com

Post reply on HN
Print view View original

61–70 of 559 posts

Re: “Two days ago the police came to me and wanted me to stop working on this”

#61

Post by hipaulshi »

hipaulshi wrote: post #46
verroq wrote: post #40

Earlier quoted context omitted.

Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.

SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or t…

@olalonde GFW is known to tighten the control on national holidays or any event they see fit. The day after Tianjin explosion, IKEV2 stopped working for 1 day on my network (I was in Beijing). PPTP from time to time suffer the same issue though I couldn't say when. Also check your ip location, I found out one provider was having reliable PPTP connection about a week ago, and it turned out they were just relaying traffic in a data center in China. Those traffic are not blocked by GFW as long as it is domestic and I could only imagine that data center simply forwarded the traffic onward using other means.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#62

Post by gilgoomesh »

x0 wrote: post #47
comex wrote: post #34

Earlier quoted context omitted.

If you have some malware that actually needs to modify system files, that still significantly ups the ante. Sure, if you have a kernel exploit, you can do it, but currently malware does not need any exploits to take over a system if it can convince a user to download and type in their password to install - Gatekeeper is one mechanism to prevent this, but I've personally been served multiple ads offering malware with…

what if some os x malware finds a way past the limitations on editing system files? the malware would become undeletable

It wouldn't be undeletable, it would just involve booting into a recovery volume (either the automatic Apple recovery partition or a user supplied volume).

Since all System locations will now be signed (as part of the move to SIP), it means that the basic Apple recovery partition will be able to purge any such malware by a simple signature verification.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#63

Post by bitinn »

hipaulshi wrote: post #27

For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characteristics in network traffic so that GFW cannot easily block it by deep traffic analysis. clowwindy is the original author.

And to add more context: Shadowsocks isn't just a tool nowadays, it's a group of applications that target both developers and common folks.

People have built successful VPN services using Shadowsocks, and they are available on many platforms, like routers and embedded systems.

And the iOS version is more or less the author's recent efforts to build a VPN client that can run on non-jailbroken iPhone, much like Cisco AnyConnect.

I think shadowsocks' popularity as a whole concerns the chinese government, so they do their usual rooting out the leader thing: now that shadowsocks org is headless in the literal sense (no owner, no main repo), they hope its development will die out.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#64

Post by gilgoomesh »

conradev wrote: post #60
eridius wrote: post #45

Earlier quoted context omitted.

But that's the thing, you can't disable SIP from userland. It can only be disabled when booted into recovery mode. So yes, it absolutely does verify integrity, because it makes it so malware cannot embed itself into the system. Your last sentence there is 100% pure grade A FUD. You may as well just say "every security measure is bullshit, because if malware were to figure a way around it, then it wouldn't work". It's…

It's a boot argument to the kernel, stored in NVRAM. These arguments are normally mutable. Apple had to write code to prevent modifying said arguments. Said code can have flaws. But lets say you don't find a vulnerability in SIP userland detection, and instead find a kernel exploit to get around the protection: If malware were to figure a way around it, then even antivirus software can't uninstall it. Only Apple can.…

It is FUD since it is not impossible to make these changes, it's just (intentionally) more difficult than casually supplying a sudo password. Anyone can detect signature changes in a system directory and anyone can boot to a recovery volume (either the default Apple one or one provided by an anti-virus company, if desired) to make whatever corrective change they want.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#65

Post by orph4nus »

xiaq wrote: post #22
smilekzs wrote: post #17

From Wikipedia: > The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet.

If you control virtually every aspect of media in a country, I don't see how Streisand effect works...

Because hackers will always find a way.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#66

Post by somerandomone »

4684499 wrote: post #26
Rangi42 wrote: post #10

This wasn't a thorough deletion. The shadowsocks-iOS project has been switched to the 'rm' branch, but the 'master' branch still contains all the source code: https://github.com/shadowsocks/shadowsocks-iOS/tree/master There's also a downloadable 2.6.3 release with a built .dmg and source code: https://github.com/shadowsocks/shadowsocks-iOS/releases Even if it does get completely removed, a duplicate exists on GitLab:…

Years ago, news said China "banned" bitcoin, years later miners in China live just fine. I guess this is not going to be so different.

This is different. China(ese government) has a much, much stronger incentive and political resolution to reinforce their Internet speech control than crackdown a couple of bitcoin miners.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#67

Post by usaar333 »

mrb wrote: post #54

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w" tunnel. Oh boy, I was wrong. If you try this, or even a basic OpenVPN setup, you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out. After some research I read onlin…

How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?

Re: “Two days ago the police came to me and wanted me to stop working on this”

#68

Post by [deleted] »

usaar333 wrote: post #67
mrb wrote: post #54

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w" tunnel. Oh boy, I was wrong. If you try this, or even a basic OpenVPN setup, you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out. After some research I read onlin…

How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?

[deleted]

Re: “Two days ago the police came to me and wanted me to stop working on this”

#69

Post by hipaulshi »

usaar333 wrote: post #67
mrb wrote: post #54

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w" tunnel. Oh boy, I was wrong. If you try this, or even a basic OpenVPN setup, you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out. After some research I read onlin…

How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?

As far as Microsoft office in Beijing, I think they VPN to their Tokyo office first. Their traffic is ensured by negotiating directly with the big telecom company. Disclaimer: I do not work for them.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#70

Post by verroq »

hipaulshi wrote: post #46
verroq wrote: post #40

Earlier quoted context omitted.

Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.

SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or t…

So looking at the code for the Go implementation, it appears to be just a stream cipher encrypted version of SOCKS5 [1,2].

1. https://github.com/shadowsocks/shadowsocks-go/blob/master/sh...

2. https://github.com/shadowsocks/shadowsocks-go/blob/master/cm...

(Not the best code, a couple of race conditions in there)

Post reply on HN