Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenGFW: an open source implementation of China's Great Firewall

github.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: OpenGFW: an open source implementation of China's Great Firewall

#31

Post by benterix »

nirui wrote: post #14

I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…

> You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers.

You mean hardware products, right? In this case putting them in a separate VLAN would help. I you mean software running on your machine, you can set up a proxy and block all traffic not coming through it.

Re: OpenGFW: an open source implementation of China's Great Firewall

#33

Post by M95D »

reyqn wrote: post #23
fmbb wrote: post #21

Earlier quoted context omitted.

All they need is money. The global IT industry will sell them what they want.

So if they use this they might need less money. Isn't this lowering the barrier?

^ This. Or no money at all, just a dedicated student.

Re: OpenGFW: an open source implementation of China's Great Firewall

#34

Post by seszett »

M95D wrote: post #12

I'm shocked that nobody is worried that this lowers the barrier to implementation for other dictatorial governements.

Apernet is especially active in enabling circumventing the GFW of China, so I'm pretty sure they are aware, and have thought about the consequences of this project. In fact I assume they developed it in order to test their circumvention methods.

Re: OpenGFW: an open source implementation of China's Great Firewall

#35

Post by M95D »

passwordoops wrote: post #27
M95D wrote: post #12

I'm shocked that nobody is worried that this lowers the barrier to implementation for other dictatorial governements.

Ask Apple or Microsoft if they have trouble selling to dictatorial governments

I'm confused. Is GFW built by Apple or Microsoft?

Re: OpenGFW: an open source implementation of China's Great Firewall

#36

Post by aacid »

kneoghau wrote: post #26
nirui wrote: post #14

I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…

I've had luck finding pi-hole blocklists on github for various products, if it's something quite common like a branded smart TV someone will have already done the hard work of figuring out what IP's they're trying to dial home to.

But pihole is dns only, any requests directly to ip address will still pass.

Re: OpenGFW: an open source implementation of China's Great Firewall

#37

Post by FuriouslyAdrift »

nirui wrote: post #14

I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…

TLS 1.3 with cert pinning and end-to-end encryption is making life hell for corporate compliance. Our Palo Alto firewalls are about as good as it gets but it's a constant battle to de-obfuscate traffic.

Google loves to mix traffic types (ad, telemetry, biz app) across protocols basically creating their own overlay which is a huge pain.

For Apple, we basically have to exempt the entire 17.0.0.0/8 as that is theirs and they pin everything.

Microsoft at least has several dynamic lists but I have my own list of their stuff that ISN'T on their lists (a few hundred IPs).

At this point I don't think there's any way to secure a network. You can't trust or verify much of the traffic.

Maybe using a synthetic NIC at the endpoint that is directly tied to the policy system is the only way forward.

Re: OpenGFW: an open source implementation of China's Great Firewall

#38

Post by passwordoops »

M95D wrote: post #35
passwordoops wrote: post #27

Earlier quoted context omitted.

Ask Apple or Microsoft if they have trouble selling to dictatorial governments

I'm confused. Is GFW built by Apple or Microsoft?

Yes. Otherwise they couldn't operate in China.

https://www.theverge.com/2018/11/2/18053142/china-internet-p...

https://www.businessinsider.com/tech-companies-censoring-con...

https://www.npr.org/2022/12/26/1145509265/apple-airdrop-chin...

https://www.bloomberg.com/news/newsletters/2024-03-07/how-mi...

Re: OpenGFW: an open source implementation of China's Great Firewall

#39

Post by whazor »

est wrote: post #19
haunter wrote: post #17

Would be funny if this ends up like War Thunder. Some random chinese official making a pull request out of spite because some implementations are not as how the real GFW is doing it.

the gfw was not built by some random "chinese officials", it's powered by the IT industry with contractors all the way down. There isn't a monolith wall either. There are multiple generations of TCP/IP middle boxes sold to various levels of ISP over many years.

I am sure this will be used by some government at some point.

Re: OpenGFW: an open source implementation of China's Great Firewall

#40

Post by binary132 »

passwordoops wrote: post #38
M95D wrote: post #35

Earlier quoted context omitted.

I'm confused. Is GFW built by Apple or Microsoft?

Yes. Otherwise they couldn't operate in China. https://www.theverge.com/2018/11/2/18053142/china-internet-p... https://www.businessinsider.com/tech-companies-censoring-con... https://www.npr.org/2022/12/26/1145509265/apple-airdrop-chin... https://www.bloomberg.com/news/newsletters/2024-03-07/how-mi...

amazing
Post reply on HN