Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GoodbyeDPI: Deep Packet Inspection circumvention utility

github.com

Post reply on HN
Print view View original

21–30 of 124 posts

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#21

Post by denkmoon »

buwrtgu wrote: post #14
userbinator wrote: post #7

Looks like it uses WinDivert as the filtering driver, which says on its site that "Windows Server 2016 systems must have secure boot disabled"; not entirely surprising and a reminder of what a lot of the "security" stuff is really securing.

"secure boot must be disabled" is the equivalent of "in case of permissions error, just chmod 777". secure boot literally protects the user first, and is configurable with user provided keys on the vast vast majority of open platform computers (i.e. amd64) "prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. there is no limitation of…

Sad to see this downvoted without any response, because as far as I see he's exactly right.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#23

Post by 5e92cb50239222b »

shmde wrote: post #15
NoOn3 wrote: post #13

It's only for Windows. Linux didn't supported. :(

It IS supported on Linux, they have a tar file on the downloads page. https://github.com/ValdikSS/GoodbyeDPI/releases

You mean the source tarball? It doesn't work on Linux, it doesn't even compile — the Makefile hardcodes CC to the MinGW compiler. Almost every .c file includes windows.h.

Looking at the project's issue list, they don't support other operating systems.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#24

Post by userbinator »

buwrtgu wrote: post #14
userbinator wrote: post #7

Looks like it uses WinDivert as the filtering driver, which says on its site that "Windows Server 2016 systems must have secure boot disabled"; not entirely surprising and a reminder of what a lot of the "security" stuff is really securing.

"secure boot must be disabled" is the equivalent of "in case of permissions error, just chmod 777". secure boot literally protects the user first, and is configurable with user provided keys on the vast vast majority of open platform computers (i.e. amd64) "prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. there is no limitation of…

secure boot literally protects the user first

No it doesn't. It's merely a convenient excuse to divert attention away from the truth, which is that it prevents users from doing things like defeating DRM and modifying the system to not be so hostile to themselves in other ways.

secure boot fear mongering is bullshit nonsense

Your position is the corporate propaganda.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#25

Post by taneq »

kevin_thibedeau wrote: post #16
izacus wrote: post #9

Earlier quoted context omitted.

More importantly, it's widely deployed by HNers in US to snoop though everything you do on your phone, tablet and computer if you dare to use their wifi. The ops topics are full of people claiming how critically important it is for them to sniff through everything you do on "their" network for security. You don't need to go to Russia, China or India to have your privacy violated. Just go to work.

Your privacy isn't violated if you avail yourself of someone else's property.

Depends whether you were aware of the consequences of accessing that property. If you walk through my front gate and I pants you, take photos of your junk and upload them, you'll probably be upset unless I had a sign on the gate saying (in clear language, not 14 pages of irrelevant 6pt legalese hiding a link to the actual 'privacy policy' document which admits in obfuscated language that pantsing is an option) that this would happen.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#26

Post by 5e92cb50239222b »

patrakov wrote: post #18
liberia wrote: post #2

Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally compressed), and looks just like another SSH connection.

I've used many other solutions (including WireGuard, etc.) on and off, but always come back to SSH.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#27

Post by 0xedd »

taneq wrote: post #25
kevin_thibedeau wrote: post #16

Earlier quoted context omitted.

Your privacy isn't violated if you avail yourself of someone else's property.

Depends whether you were aware of the consequences of accessing that property. If you walk through my front gate and I pants you, take photos of your junk and upload them, you'll probably be upset unless I had a sign on the gate saying (in clear language, not 14 pages of irrelevant 6pt legalese hiding a link to the actual 'privacy policy' document which admits in obfuscated language that pantsing is an option) that t…

No. When all "gates" in a domain have this sign, it isn't less upsetting.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#28

Post by userbinator »

mmwelt wrote: post #11

Doesn't work in China, though: https://github.com/ValdikSS/GoodbyeDPI/issues/123

For that, you need something more like obfsproxy or some other steganographic tunnel, which of course also requires an endpoint on the other side much like a VPN.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#29

Post by zorgmonkey »

shmde wrote: post #15
NoOn3 wrote: post #13

It's only for Windows. Linux didn't supported. :(

It IS supported on Linux, they have a tar file on the downloads page. https://github.com/ValdikSS/GoodbyeDPI/releases

That source tarball is autogenerated by github when you make a release and it in no way implies linux compatibility, it is simply a way to download the source code without git.

Re: GoodbyeDPI: Deep Packet Inspection circumvention utility

#30

Post by userbinator »

5e92cb50239222b wrote: post #26
patrakov wrote: post #18

Earlier quoted context omitted.

Well, the good point of GoodbyeDPI is exactly so that it preserves your IP address. Normally, when trying to circumvent censorship, you would need a VPN server in a different country. But the downsides are that the bank will deny all transactions and call you (OK, answered, they added the VPN IP to the whitelist), that you will miss local-only content, you won't be able to register for a doctor appointment online (th…

I wonder why a VPN is the default solution (with all complications it ensues, some of which you've listed), when a simple SSH tunnel to any server in a sane location does just fine. `ssh server -D12345`, point your applications to socks5 at localhost:12345, and it's done. It's dead simple to only allow/deny those sites that you (don't) need to go through another server, and the traffic is encrypted (and optionally co…

point your applications to

That's the problem. Not all of them will implement tunneling their own traffic through SOCKS, and there's still other things like DNS that you might also want to go through the tunnel, but can't easily do so. A VPN sits at a lower layer, just looking like a regular network connection, so applications don't need to be aware.

Post reply on HN