The Iran Firewall: A preliminary report • Hacker News Board

Re: The Iran Firewall: A preliminary report

#21

Post by dweekly » Fri, Oct 28, 2022, 4:26 PM UTC

aorth wrote: post #19

dweekly wrote: post #15

The snooping of unencrypted SNI in the TLS handshake is a known weakness that is still mostly unresolved despite four years of standardization effort. The encrypted SNI work has been revised and updated to encrypted ClientHello and is still technically an IETF draft and not yet formalized in an RFC: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ That said, CloudFlare, Firefox, and Chromium teams have all been…

Wait I'm confused. I remember reading a bunch of reports about how China started blocking TLS 1.3 because of encrypted SNI (eSNI) years ago?

I don't know anything about that (and I'm pretty sure TLS 1.3 doesn't mandate ECH since ECH isn't even finished standardizing!) but you can check to see if your browser supports ECH by visiting https://tls-ech.dev/

Re: The Iran Firewall: A preliminary report

#22

Post by throwaway894345 » Fri, Oct 28, 2022, 4:27 PM UTC

LastTrain wrote: post #10

I almost stopped reading at "neo-liberal", man that term is getting boring, especially when used in non-sequitur fashion like "The most severe disruption is when the regime turns off all cell towers and all local Internet. They just pull the plug and it's game over for any neo-liberal smart-arse that thinks v2ray/tor/shadowsocks is the solution". WTF does that even mean? What does the author think it means?

Eh, I don't like neo-liberal either, but its usage here made me chuckle. I'm probably a "neo-liberal" since I generally believe in human rights (including free speech) and also that capitalism (for all its faults) has a dramatically better track record than socialism or communism.

Re: The Iran Firewall: A preliminary report

#23

Post by hot_gril » Fri, Oct 28, 2022, 4:28 PM UTC

> Instead, the TCP 3-way handshake won't complete (the syn-ack is dropped).

Sounds like my internet connection in grad student housing about 10% of the time, except the initial SYN is dropped. Pings and everything else are fine.

Re: The Iran Firewall: A preliminary report

#24

Post by xhevahir » Fri, Oct 28, 2022, 4:32 PM UTC

LastTrain wrote: post #18

dmix wrote: post #13

Earlier quoted context omitted.

I'm not sure what he means by that. Is it just a tongue-in-cheek description for the opposition to the Iranian party? Is it used by the party to describe pro-western people locally? Or is this just another overused Redditism?

It is a play on neo-con, which is a term that was used to great affect in American conservative political circles to ostracize those who would cooperate with the opposition party - a.k.a. moderates. It is now used with similar goals by the American far left (to the extent that such a thing exists..). Both terms are often coopted by the the opposition party to demonize moderate counterparts. That said, it sounds cool…

That sense of "neoliberal" is peculiar to American politics, as far as I can tell. I'd say it's more likely the blogger means a person who wants free trade, deregulation, etc.

Re: The Iran Firewall: A preliminary report

#25

Post by hot_gril » Fri, Oct 28, 2022, 4:32 PM UTC

technoooooost wrote: post #16

LastTrain wrote: post #10

I almost stopped reading at "neo-liberal", man that term is getting boring, especially when used in non-sequitur fashion like "The most severe disruption is when the regime turns off all cell towers and all local Internet. They just pull the plug and it's game over for any neo-liberal smart-arse that thinks v2ray/tor/shadowsocks is the solution". WTF does that even mean? What does the author think it means?

Pretty sure he's joking around using iran's regime terms to describe its dissidents

The top says this, which doesn't sound like a joke.

> The Internet is easily censored. The neo-liberals got their arses kicked. The big players like Google/Apple/AWS are partly to blame. China runs the GFI as a service.

Re: The Iran Firewall: A preliminary report

#26

Post by tenebrisalietum » Fri, Oct 28, 2022, 4:38 PM UTC

ghostpepper wrote: post #20

"All blacklisted domains resolve to 10.0.34.35" I guess this would require everyone to use a government-sanctioned DNS and that would require traffic on udp 53 to non-gov-dns servers blocked? I felt like this was glossed over a bit too quickly in the article

More like the whole country is behind a giant CGNAT. NAT is good for security, eh?

Re: The Iran Firewall: A preliminary report

#27

Post by neither_color » Fri, Oct 28, 2022, 4:43 PM UTC

On bad days:

Key word is bad days. Expats in China have noticed the same thing, with VPNs sporadically not working during summits, around certain holidays, etc but resuming afterwards. Also, for some reason certain VPNs work more consistently than others even though they use the same protocols as blocked services. Some speculate that the ones that continue to work are either honeypots or the companies behind them have (social) connections

Also, it's kind of poor taste to call those who want free(dom) internet there as "neo liberals"

Re: The Iran Firewall: A preliminary report

#28

Post by LastTrain » Fri, Oct 28, 2022, 4:45 PM UTC

xhevahir wrote: post #24

LastTrain wrote: post #18

Earlier quoted context omitted.

It is a play on neo-con, which is a term that was used to great affect in American conservative political circles to ostracize those who would cooperate with the opposition party - a.k.a. moderates. It is now used with similar goals by the American far left (to the extent that such a thing exists..). Both terms are often coopted by the the opposition party to demonize moderate counterparts. That said, it sounds cool…

That sense of "neoliberal" is peculiar to American politics, as far as I can tell. I'd say it's more likely the blogger means a person who wants free trade, deregulation, etc.

I would say, given the sum total output we've seen by the author (a blog with two articles), they have no idea what it means, other than a vague sense that it is some kind of sick burn. [Edit - look, I know the term has an academic origin, but we aren't discussing academic papers, I'm talking about how it is abused everyday in the vernacular]

Re: The Iran Firewall: A preliminary report

#29

Post by hot_gril » Fri, Oct 28, 2022, 4:47 PM UTC

LastTrain wrote: post #18

dmix wrote: post #13

Earlier quoted context omitted.

I'm not sure what he means by that. Is it just a tongue-in-cheek description for the opposition to the Iranian party? Is it used by the party to describe pro-western people locally? Or is this just another overused Redditism?

It is a play on neo-con, which is a term that was used to great affect in American conservative political circles to ostracize those who would cooperate with the opposition party - a.k.a. moderates. It is now used with similar goals by the American far left (to the extent that such a thing exists..). Both terms are often coopted by the the opposition party to demonize moderate counterparts. That said, it sounds cool…

I've heard neocon many times, always in a different context. As far as I'm concerned, the word has no meaning.

Re: The Iran Firewall: A preliminary report

#30

Post by justsomehnguy » Fri, Oct 28, 2022, 4:50 PM UTC

ghostpepper wrote: post #20

"All blacklisted domains resolve to 10.0.34.35" I guess this would require everyone to use a government-sanctioned DNS and that would require traffic on udp 53 to non-gov-dns servers blocked? I felt like this was glossed over a bit too quickly in the article

DNS is running on udp/53. It's beyond trivial to absolutely transparently NAT it to anything you want.

Block tcp/853 and most common public DNS servers and you can control resolving on 98% of devices.