Porn restrictions are leading to a VPN boom

https://en.wikipedia.org/wiki/Server_Name_Indication

Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper. This protocol weakness was exploited by security software for network filtering and monitoring[4][5][6] and governments to implement censorship.[7] Presently, there are multiple technologies attempting to hide Server Name Indication.

Also some countries may mandate users to install and trust government's CA certificate which is then used to MITM HTTPS traffic

https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT.

Think about accuracy, which is correctness, completeness, and consistency:

Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc.

When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb.

In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier).

It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites.

These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.

The argument here is non-consensual. No work is totally consensual, since you need to survive. You accept a life-long inconvenience in exchange for a beautiful house. Can we make sex consensual in exchange for a large enough inconvenience? The response lies in an experiment: Propose a menial job to prostitutes. Even at the same rate, most prefer their occupation. Therefore it’s consensual.

A funny quirk about non-consensual work is that the 1930’s ILO convention against slavery and forced work… excluded able-bodied men in age of working (article 11). Which kind of defeats the purpose of the convention.

This article was only abolished in 1957.

But compulsory military service still exists in probably half of the world countries.