Russia Starts Blocking VPN Protocols • Hacker News Board

Re: Russia Starts Blocking VPN Protocols

#101

Post by coldtea » Thu, Aug 10, 2023, 1:01 PM UTC

plxx7733 wrote: post #58

brabel wrote: post #51

Earlier quoted context omitted.

What do you mean by "unsafe Java"?? Do you mean Java as a language is somehow unsafe? I beg to disagree - it's one of the most scrutinized platforms you can find and widely used in all sorts of security critical software everywhere.

Java has soooo many security vulnerabilities - just browse around a bit...

"sooo many" is a technical term?

"Sooo many" compared to what? Did you scrutinize the equivalent of Java's SDK in Rust + extra crates to get the same functionality?

Do you include things like unrelated package bugs, like log4j bugs?

Re: Russia Starts Blocking VPN Protocols

#102

Post by fnordpiglet » Thu, Aug 10, 2023, 1:01 PM UTC

Aerbil313 wrote: post #84

lifty wrote: post #60

Earlier quoted context omitted.

This isn't about cracking down on piracy or anything of that sort. It's about slowly getting control of the media and information channels that Russian people have access to. The same playbook that China has been using since forever. Authorities have been encouraging popular Internet celebrities to start posting their content on local networks/apps, so in time Western media sources like Youtube and Twitter will be bl…

I don't live in China. Yet I'd very much like my country having its own national software stack (OS, search engine, browser, social media apps). All is fine for you guys in the US, but you forget when our national interests conflict with yours or big tech corporations or when the privacy of our citizens is concerned, it happens to be a national security issue. I trust my own government to not spy on me unnecessarily,…

I don’t disagree with this, but it would be better to have a stack that’s not controlled by any government but is based on technical standards - not governmental dictates or corporate control.

I would also note that in your country the US agencies have no authority. However your own government can use that information to imprison you or otherwise exert its jurisdictional control. I think that’s generally what people worry about. It’s hard to imagine a reason the US government would care about you as a citizen of X country, whereas there are lots of governments who oppress their citizens for being themselves and for who they associate with.

Re: Russia Starts Blocking VPN Protocols

#103

Post by anthk » Thu, Aug 10, 2023, 1:02 PM UTC

dontdoxxme wrote: post #69

dijit wrote: post #47

Earlier quoted context omitted.

SOCKS5 SSH has been my go-to for years. ssh -D9050 ; point your browser to localhost:9050 and bobs-your-uncle.

That approach, while convenient is not safe. It does not guarantee non-TCP traffic will be proxied. (You can test with a “WebRTC leak tester”.)

Using Links+ to proxy all info into that not leaking everything should be mandatory. TOR, I2PD, anything.

If you are using a JS based browser, you don't deserve security in first place.

If any, you can always use torosocks and yt-dlp to fetch all media.

If I had time I could set up a tutorial not to use SSH as a proxy, but as a client to a remote VPS/tilde to use the offpunk client there to browse web/gemini and gopher sites anonymously. OFC you won't get images, but at least you could be able to read news nicely formated either from gemini://gemi.dev or natively from offpunk.

Non-techie Russians can use Lagrange in Android and gemini://gemi.dev to read most media through an HTTP->Gemini proxy which makes a great job on reformatting the sites and cutting down the bandwitdh.

Basic English it's required, but if you can read "News Waffle" and copy the URL into that dialog box, you can get lots of interesting sites.

Re: Russia Starts Blocking VPN Protocols

#104

Post by ytch » Thu, Aug 10, 2023, 1:02 PM UTC

Multrex wrote: post #24

Can someone ELI5 how they identify VPN at the protocol level?

For the case in China, they use statistics, entropy of packets (may not an accurate term) and other DPI-like methods[1],

also HN discussions of it[2]:

[1] https://gfw.report/publications/usenixsecurity23/en/

[2] https://news.ycombinator.com/item?id=36531485

Re: Russia Starts Blocking VPN Protocols

#105

Post by tialaramex » Thu, Aug 10, 2023, 1:06 PM UTC

miki123211 wrote: post #78

0xDEF wrote: post #18

Earlier quoted context omitted.

I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?

Go and Rust are better at different things. Go uses garbage collection, while Rust uses manual memory management with borrow-checking to ensure safety. Both are just as safe, but garbage collection is slower while Rust's manual memory management requires a lot more effort on the part of the developer. In particular, the performance of garbage collection is less predictable, making Go unsuitable for things like audio…

> Both are just as safe

With a single execution context this is true. But, whereas you simply can't write data race bugs in Safe Rust† in Go you can write them and they blow up your safety guarantees. If you race something trivial Go promises (unlike C or C++) that this doesn't immediately set fire to the world, the raced trivial object (say, an integer) is ruined and you must not touch it, but if you stay away from that object your program has clearly defined behaviour. Unfortunately non-trivial objects (say, a slice) are immediately Undefined Behaviour when raced.

† This falls out of the mutability rules. A data race is when somebody else modifies something at "the same time" as you're using it, e.g. thread A changes actor to "Steve Buscemi" from "Susan Sarandon" at the same moment thread B is printing the actor out and oops, we write "Susan Sarcemin" or crash or something different happens, who knows. Rust says you can't have multiple aliases and mutability, so this never happens.

Re: Russia Starts Blocking VPN Protocols

#106

Post by bluGill » Thu, Aug 10, 2023, 1:06 PM UTC

plxx7733 wrote: post #58

brabel wrote: post #51

Earlier quoted context omitted.

What do you mean by "unsafe Java"?? Do you mean Java as a language is somehow unsafe? I beg to disagree - it's one of the most scrutinized platforms you can find and widely used in all sorts of security critical software everywhere.

Java has soooo many security vulnerabilities - just browse around a bit...

That is because it is popular. Any language that was as popular as java for nearly 30 years will have a large collection of problems. Java avoids a large number of possible problems by being memory safe, but it doesn't avoid them all.

Re: Russia Starts Blocking VPN Protocols

#107

Post by anthk » Thu, Aug 10, 2023, 1:07 PM UTC

coldtea wrote: post #101

plxx7733 wrote: post #58

Earlier quoted context omitted.

Java has soooo many security vulnerabilities - just browse around a bit...

"sooo many" is a technical term? "Sooo many" compared to what? Did you scrutinize the equivalent of Java's SDK in Rust + extra crates to get the same functionality? Do you include things like unrelated package bugs, like log4j bugs?

Hyperbola GNU/Linux ditched OpenJDK becasue either bugs or patents. The list on Java CVE's it's atrocious. Java should've died long ago with Golang and some cross-plaform (basic) GUI libraries promoted from Google. Nothing fancy, something like plan9/9front UI's, but enhanced.

Java exists today because of corporateware. Outside of it, it's dead. De-ad. No one uses Java seriously for emulators, browsers, or basic software. Just ad-hoc company-graded enterprise, live VB6 back in the day.

Re: Russia Starts Blocking VPN Protocols

#108

Post by sidibe » Thu, Aug 10, 2023, 1:09 PM UTC

Aerbil313 wrote: post #84

lifty wrote: post #60

Earlier quoted context omitted.

This isn't about cracking down on piracy or anything of that sort. It's about slowly getting control of the media and information channels that Russian people have access to. The same playbook that China has been using since forever. Authorities have been encouraging popular Internet celebrities to start posting their content on local networks/apps, so in time Western media sources like Youtube and Twitter will be bl…

I don't live in China. Yet I'd very much like my country having its own national software stack (OS, search engine, browser, social media apps). All is fine for you guys in the US, but you forget when our national interests conflict with yours or big tech corporations or when the privacy of our citizens is concerned, it happens to be a national security issue. I trust my own government to not spy on me unnecessarily,…

> Yet I'd very much like my country having its own national software stack

The question is would you take that at the expense of blocking the big American corporations? That's probably really how the Chinese have developed their own to this degree. For example they weren't ubiquitous but Google was starting to make headway in China and Chinese in the late 00s when gmail hack/Google ban/GFW started. Baidu is not a quality service (though maybe because of government restrictions)

Re: Russia Starts Blocking VPN Protocols

#109

Post by Aerbil313 » Thu, Aug 10, 2023, 1:11 PM UTC

goda90 wrote: post #94

Aerbil313 wrote: post #84

Earlier quoted context omitted.

I don't live in China. Yet I'd very much like my country having its own national software stack (OS, search engine, browser, social media apps). All is fine for you guys in the US, but you forget when our national interests conflict with yours or big tech corporations or when the privacy of our citizens is concerned, it happens to be a national security issue. I trust my own government to not spy on me unnecessarily,…

Why would you need a national software stack when there's open source solutions for everything?

Tech nerds often don't realize how much the world of software is subject to the real world. You can be cut off access to any technology if your country is not willing to give its natural resources to another. No different from trade sanctions. Open source is a bunch of individuals helpless in the face of orders from Pentagon to close it all up.

* You won't have the expertise to quickly build your own solutions when this happens you are cut off access to a certain technology. A browser is a beast to implement as we all know.

* You can't trust that e.g. Chromium as audited by American "experts" is really not phoning home if it detects the IP is from e.g Turkish defense corporation A's RD center.

* You need to have that software-skilled workforce anyway to ensure technological progress of your country.

Re: Russia Starts Blocking VPN Protocols

#110

Post by bluGill » Thu, Aug 10, 2023, 1:11 PM UTC

simfoo wrote: post #27

0xDEF wrote: post #18

Earlier quoted context omitted.

I have noticed many new security and privacy oriented projects use Go and even C/C++. Wasn't Rust supposed to be the language that should be used to write all security-critical software? What happened? Are crates like rustls/ring still intentionally sabotaging Rust's cryptographic ecosystem with their "we will always be pre-1.0.0 and never have a stable API" philosophy?

What if "C/C++" is not actually a thing and modern software engineering practices is what actually makes software safe? Writing modern C++ with good test coverage, sanitizers deployed and wrapping critical/unsafe parts into safe interfaces gets you _very_ far.

Unfortunately far too many people writing C++ are not writing modern C++. Most writing C with classes.

You can write memory unsafe code in rust, including memory management if you want - you just have to wrap it in unsafe which at least clues others in to watch this area carefully. In C++ you can put unsafe code anywhere. Sometimes unsafe is really needed, rust makes it hard enough to write unsafe code that you will only do that where you must and then jump back to safe code. In C++ you are likely to mix safe and unsafe code all over and that makes audits harder.