41–50 of 55 posts
Earlier quoted context omitted.
I'm confused. Is GFW built by Apple or Microsoft?
Yes. Otherwise they couldn't operate in China. https://www.theverge.com/2018/11/2/18053142/china-internet-p... https://www.businessinsider.com/tech-companies-censoring-con... https://www.npr.org/2022/12/26/1145509265/apple-airdrop-chin... https://www.bloomberg.com/news/newsletters/2024-03-07/how-mi...
This project is like an open-source missile for regimes like Iran and North Korea. I do admire it, but some governments could abuse it to suppress freedom.
Maybe it's European countries need such projects to be on par with them
I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…
I wonder if you can run this in observe only mode to analyze/log that traffic.
I been seeing people on Twitter mocking the project, but I need it... You have no idea how much time I've wasted trying to block some products from pinging their home server with curious data stream, but failed to do so because I can't be bothered to sit my ass in front of Wireshark to sniff out all their DoH servers. With this project, it's hopeful that in the future I can just not putting their domains in the TLS w…
TLS 1.3 with cert pinning and end-to-end encryption is making life hell for corporate compliance. Our Palo Alto firewalls are about as good as it gets but it's a constant battle to de-obfuscate traffic. Google loves to mix traffic types (ad, telemetry, biz app) across protocols basically creating their own overlay which is a huge pain. For Apple, we basically have to exempt the entire 17.0.0.0/8 as that is theirs and…
Earlier quoted context omitted.
TLS 1.3 with cert pinning and end-to-end encryption is making life hell for corporate compliance. Our Palo Alto firewalls are about as good as it gets but it's a constant battle to de-obfuscate traffic. Google loves to mix traffic types (ad, telemetry, biz app) across protocols basically creating their own overlay which is a huge pain. For Apple, we basically have to exempt the entire 17.0.0.0/8 as that is theirs and…
How about the whole Zero Trust concept where network is assumed hostile and every service is properly authed?
Earlier quoted context omitted.
I've had luck finding pi-hole blocklists on github for various products, if it's something quite common like a branded smart TV someone will have already done the hard work of figuring out what IP's they're trying to dial home to.
But pihole is dns only, any requests directly to ip address will still pass.
Earlier quoted context omitted.
I briefly read a paper, I suspect it's more complex than "high entropy".
The strategy used to detect "Fully Encrypted Traffic" is indeed complex, but the protocols investigated by the paper (at least Shadowsocks, VMess. Not really sure about Obfs4) works by transforming the traffic to make it "look like nothing". So I still believe "High Entropy" is a better description than "Fully Encrypted Traffic". I mean, you can pack the entire data stream in Base64 after sending them through a SHA25…
Earlier quoted context omitted.
I briefly read a paper, I suspect it's more complex than "high entropy".
The strategy used to detect "Fully Encrypted Traffic" is indeed complex, but the protocols investigated by the paper (at least Shadowsocks, VMess. Not really sure about Obfs4) works by transforming the traffic to make it "look like nothing". So I still believe "High Entropy" is a better description than "Fully Encrypted Traffic". I mean, you can pack the entire data stream in Base64 after sending them through a SHA25…