Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenGFW: an open source implementation of China's Great Firewall

github.com

Post reply on HN
Print view View original

11–20 of 55 posts

Re: OpenGFW: an open source implementation of China's Great Firewall

#14

Post by nirui »

I been seeing people on Twitter mocking the project, but I need it...

You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers.

With this project, it's hopeful that in the future I can just not putting their domains in the TLS whitelist, even when they use DoH.

---

Off topic but BTW: "Fully Encrypted Traffic" is really a confusing term that can only be understood correctly if the context is correct too. How about calling those protocols "High Entropy" (HighE)? Which IMO is more specific than calling it "Fully Encrypted". It's just my two-cents suggestion.

Re: OpenGFW: an open source implementation of China's Great Firewall

#16

Post by luke-stanley »

nirui wrote: post #14

I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…

I briefly read a paper, I suspect it's more complex than "high entropy".

Re: OpenGFW: an open source implementation of China's Great Firewall

#18

Post by nirui »

luke-stanley wrote: post #16
nirui wrote: post #14

I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…

I briefly read a paper, I suspect it's more complex than "high entropy".

The strategy used to detect "Fully Encrypted Traffic" is indeed complex, but the protocols investigated by the paper (at least Shadowsocks, VMess. Not really sure about Obfs4) works by transforming the traffic to make it "look like nothing".

So I still believe "High Entropy" is a better description than "Fully Encrypted Traffic".

I mean, you can pack the entire data stream in Base64 after sending them through a SHA256 pipeline, and it will still be "Fully Encrypted", but the entropy (in terms of traffic classification by content scanning) is not the same compare to doing it without the Base64 step.

Re: OpenGFW: an open source implementation of China's Great Firewall

#19

Post by est »

haunter wrote: post #17

Would be funny if this ends up like War Thunder. Some random chinese official making a pull request out of spite because some implementations are not as how the real GFW is doing it.

the gfw was not built by some random "chinese officials", it's powered by the IT industry with contractors all the way down. There isn't a monolith wall either. There are multiple generations of TCP/IP middle boxes sold to various levels of ISP over many years.

Re: OpenGFW: an open source implementation of China's Great Firewall

#20

Post by est »

tenlp wrote: post #9

Well...it's very suitable for people outside of mainland China to experience what Chinese people experience online.

Nah it's an interesting piece of technology of double-edged sword, like any other technology. A firewall can be used to censor information, but can be also used to block ads or malicious traffic.
Post reply on HN