Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

gfw.report

Post reply on HN
Print view View original

181–190 of 195 posts

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#181

Post by chickenzzzzu »

estimator7292 wrote: post #179
chickenzzzzu wrote: post #166

Earlier quoted context omitted.

Thanks for the reply. In order to connect to the VPN, your first call must be over https, from China, to the VPN. How does that circumvent the phenomenon in the article, where a nation state was injecting TCP to cause your connection to hang up, thus no VPN connection?

You do not establish a VPN connection in the clear. You must give your client the encryption key before connecting. All transactions are fully encrypted from the beginning. Besides that, when negotiating a secure connection through unencrypted channels you typically use Diffe-Hillman to establish the encryption keys. As far as I'm aware, this method cannot be broken. Both nodes compute their own private encryption ke…

Awesome thanks for all of that. Then it sounds like the only way a nation state could block VPNs is if they decided to "go nuclear" and do what the person above said-- block anyone who they detect is using a VPN/encrypted channel.

Based on that information, the theory for why a nation state would block https like this for a moment is either an accident, or to only block the low hanging fruit of people who don't use a VPN.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#182

Post by AnthonyMouse »

lazide wrote: post #146
AnthonyMouse wrote: post #137

Earlier quoted context omitted.

Not only that, it seems to be entirely unimpressive: The premise is that they would be able to allow everything except for what they want to censor, which isn't what they're doing. If you allow connections to random websites outside of your jurisdiction then you're de facto allowing everything, because people can proxy arbitrary traffic that way. If you don't, you're effectively disconnecting your country from the gl…

You’re just ignorant of what it does. The GFW autodetects and blocks a truly impressive number of tunnel encapsulation schemes, VPN’s, etc. and blocks a wide variety of proxy attempts. It really isn’t dumb at all, and is quite difficult to get past. It also auto detects ‘problematic’ content in near realtime for a huge swath of things. It does deep packet and content inspection, including of a bunch of encrypted traf…

> The GFW autodetects and blocks a truly impressive number of tunnel encapsulation schemes, VPN’s, etc. and blocks a wide variety of proxy attempts.

They made a list of tunnel systems that don't attempt to disguise themselves and then blocked them. That's not really that hard, and it meanwhile causes lots of innocuous things to be blocked. There are uses for a tunnel other than bypassing censorship.

The hard thing is to block the ones that actively attempt to look like something they're not, and release updates to change their profile whenever the authors notice it being blocked, while still allowing the thing they're attempting to look like.

> It also auto detects ‘problematic’ content in near realtime for a huge swath of things. It does deep packet and content inspection, including of a bunch of encrypted traffic that it really shouldn’t be able to.

All of this is assuming the content is being distributed unencrypted or is otherwise leaking its contents through e.g. having a specific data length, none of which an encapsulation method is required to expose.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#183

Post by johnisgood »

JumpCrisscross wrote: post #178
johnisgood wrote: post #164

Earlier quoted context omitted.

Just for the sake of it I checked Wikipedia. > The Americas, sometimes collectively called America, are a landmass comprising the totality of North America and South America. When viewed as a single continent, the Americas are the 2nd largest continent by area after Asia, and is the 3rd largest continent by population. The Americas make up most of the land in Earth's Western Hemisphere and constitute the New World. Y…

> why down-vote? Baffling It’s a silly side discussion in which nothing new is being said. Complaining that America generally refers to the country is a hobby for some folks, and that’s fine, but it’s only entertaining for them. If someone needs the America you’re talking about specified, i.e. they can’t figure it out from context, the discussion is sort of moot. (Same way one can use the word Europe despite it being…

> Overspecificity comes at the cost of conciseness.

And this is why we have (programming) language wars. Ada or Forth?! :P

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#184

Post by wkat4242 »

rtkwe wrote: post #147
perihelions wrote: post #60

Earlier quoted context omitted.

Not feasible. That would entail putting shrapnel into orbit (unlike extant anti-sat weapons which are short-range suborbital), which would mean a full orbital launch for every satellite target orbit. There's hundreds[0] of Starlink orbital groups already, so that'd require hundreds of independent orbital launches in a short timescale—far beyond China's launch capabilities today. [0] https://planet4589.org/space/con/s…

If you make a dense-ish cloud that cuts across the Starlink orbits you'd eventually intersect them all if you could make the artificial debris field last It wouldn't require that many different counter orbiting fields to cover most of the orbits.

Yes but there's so many starlinks that you're going to get lots and lots of collateral damage to sats from allies and enemies alike. It's going to be a huge footgun.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#185

Post by buckle8017 »

chickenzzzzu wrote: post #122
buckle8017 wrote: post #33

Earlier quoted context omitted.

There is no magic amount of time. If you get a green card and leave the us for any amount of time, on return the border agent makes a determination on the spot if you intended to live abroad. Less than six months is simply less suspicious than more.

And what are you supposed to do if they make a determination against you, return to your passport holding country and hire a lawyer? If the answer is yes, well then it is yet more proof that the US immigration system operates basically extrajudicially just like the IRS and ATF, and only occassionally do the courts pull them back in after much hardship for the plantiff. Words and policies are supposed to have meaning,…

Well yes the actual please has meaning.

Green cards are for people who intend to continuously by resident in the united states.

If you go home for 3 months and get a job and rent a house then you no longer continuously reside in the united states.

It's that's simple, but there's no hard or fast rule on how many days.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#186

Post by LargoLasskhyfv »

outworlder wrote: post #51
kotri wrote: post #2

Terrible, this is Internet curfew. It's not uncommon to imagine they'd shutdown Internet across border during any war (like against Taiwan).

> Terrible, this is Internet curfew. If you think this is bad... You can't even have a blog in China without authorization. It doesn't matter if you pay "AWS" for a machine. It won't open port 80 or 443 until you get an ICP recordal. Which you can only do if you are in China, and get the approval. It should also be displayed in the site, like a license plate. The reason "AWS" is in quotes is because it isn't AWS, the…

> It should also be displayed in the site, like a license plate.

https://de.wikipedia.org/wiki/Impressumspflicht (Mandatory real name & address, not only for business, but private persons with web presence, too.

Same for Domain/DNS(which applies to everything in the European Union))

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#187

Post by LargoLasskhyfv »

perihelions wrote: post #60
therein wrote: post #54

Earlier quoted context omitted.

They follow well defined orbits and propellant limited. You could easily cover their trajectory with some shrapnel and attack it one lane at a time.

Not feasible. That would entail putting shrapnel into orbit (unlike extant anti-sat weapons which are short-range suborbital), which would mean a full orbital launch for every satellite target orbit. There's hundreds[0] of Starlink orbital groups already, so that'd require hundreds of independent orbital launches in a short timescale—far beyond China's launch capabilities today. [0] https://planet4589.org/space/con/s…

Have you ever heard of https://en.wikipedia.org/wiki/Project_West_Ford ?

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#188

Post by spwa4 »

threeducks wrote: post #83
spwa4 wrote: post #66

Earlier quoted context omitted.

No it does not. Against a huge state adversary like China it does not matter. They have satellites looking down so they can quickly locate any starlink users. And then ... The only thing that could bypass is GPS + laser links (meaning physically aiming a laser both on the ground AND on a satellite). You cannot detect that without being in the direct path of the laser (though of course you can still see the equipment…

What makes it so that this kind of precision is required? I have little knowledge of the physics behind it, but a few decades ago, a local university had an open day where they bounced lasers off of a retro reflector on the moon to measure the distance: https://en.wikipedia.org/wiki/Lunar_Laser_Ranging_experiment... The moon is 700 times farther away than the starlink satellites (or twice that, if you consider the bo…

You want to hide, with sufficient guarantees, from someone looking down from above.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#189

Post by nijave »

UltraSane wrote: post #174
nijave wrote: post #171

Earlier quoted context omitted.

The docs say both use HSM. Under "Secure" in the accordion menu https://aws.amazon.com/kms/features/#topic-0

My understanding is that AWS KMS uses AWS designed HSMs and are tightly integrated with all AWS services while while CloudHSM uses LiquidSecurity 2 Cloud HSM adapters and use more conventional APIs https://www.marvell.com/products/security-solutions/liquidse...

>My understanding is that AWS KMS uses AWS designed HSMs

That's my take as well reading about how they handle firmware (sounds like they're using their own chips, presumably similar to how they use other hardware acceleration and offload)

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#190

Post by Alex-Programs »

armchairhacker wrote: post #127

> A Brief, Incomplete, and Mostly Subjective History of Chinese Internet censorship and its countermeasures https://danglingpointer.fun/posts/GFWHistory Posted 6 days ago ( https://news.ycombinator.com/item?id=44898892 )

Thanks for sharing this. I researched this for my A level project a few years ago, and this is a really neat cross reference. I didn't mention V2Ray as much.
Post reply on HN