41–50 of 124 posts
Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?
Wireguard solves this, no need this
Looking at the circumvention techniques GoodbyeDPI uses makes me want to cry. Is this really the state of DPI in 2022: changing Host to hoSt, or adding white spaces between method and URI actually works?
> TCP-level fragmentation for first data packet
> TCP-level fragmentation for persistent (keep-alive) HTTP sessions
> Replacing Host header with hoSt
> Removing space between header name and value in Host header
> Adding additional space between HTTP Method (GET, POST etc) and URI
> Mixing case of Host header value
> Sending fake HTTP/HTTPS packets with low Time-To-Live value, incorrect checksum or incorrect TCP Sequence/Acknowledgement numbers to fool DPI and prevent delivering them to the destination
DPI middleboxes are truly terrible. They're incompatible with even basic TCP without any good reason. I wonder if these ISPs use the same vendors as your average "enterprise" network.
Earlier quoted context omitted.
Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.
Or perhaps some good talent somehow ending up working there made sure the system is full of plausibly deniable holes.
Wireguard solves this, no need this
Earlier quoted context omitted.
"secure boot must be disabled" is the equivalent of "in case of permissions error, just chmod 777". secure boot literally protects the user first, and is configurable with user provided keys on the vast vast majority of open platform computers (i.e. amd64) "prevent injection of a driver that can divert all my shit at the kernel level" is exactly what you want secure boot protecting you from. there is no limitation of…
secure boot literally protects the user first No it doesn't. It's merely a convenient excuse to divert attention away from the truth, which is that it prevents users from doing things like defeating DRM and modifying the system to not be so hostile to themselves in other ways. secure boot fear mongering is bullshit nonsense Your position is the corporate propaganda.
Earlier quoted context omitted.
Censorship companies probably can't hire good talent. I'm actually glad to see this, however it might get patched if this tool becomes too widespread.
Or perhaps some good talent somehow ending up working there made sure the system is full of plausibly deniable holes.
Worth reading Deep Packet Inspection is Dead: https://security.ias.edu/deep-packet-inspection-dead-and-her... This tool is great, but I religiously route all my traffic through a VPN that I own and control. I’ve hardened the box I use to have zero logs and I don’t need to blindly trust a commercial provider whether they’ve been audited or not. There’s no way of really knowing they’re not logging in some capacity bar…
(Depending on yourISP and provider this can be a good trade-off)