Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025 • Hacker News Board

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#191

Post by const_cast » Fri, Aug 22, 2025, 2:18 PM UTC

johnisgood wrote: post #164

const_cast wrote: post #109

Earlier quoted context omitted.

But America isn't a place. There's the America s , as in plural, referring to the continents of North America and South America. So America is unassigned, hence why we assigned it to the USA colloquially.

Just for the sake of it I checked Wikipedia. > The Americas, sometimes collectively called America, are a landmass comprising the totality of North America and South America. When viewed as a single continent, the Americas are the 2nd largest continent by area after Asia, and is the 3rd largest continent by population. The Americas make up most of the land in Earth's Western Hemisphere and constitute the New World. Y…

This wikipedia excerpt aligns exactly with what I said.

There's North and South America. These, together, are the Americas.

America is not that typically. Which makes sense, America is singular. But the Americas are two. So which one are we referring to?

Because if we say both, then the correct term is Americas. If we say just one, then it's North America or South America.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#192

Post by rtkwe » Fri, Aug 22, 2025, 2:24 PM UTC

wkat4242 wrote: post #184

rtkwe wrote: post #147

Earlier quoted context omitted.

If you make a dense-ish cloud that cuts across the Starlink orbits you'd eventually intersect them all if you could make the artificial debris field last It wouldn't require that many different counter orbiting fields to cover most of the orbits.

Yes but there's so many starlinks that you're going to get lots and lots of collateral damage to sats from allies and enemies alike. It's going to be a huge footgun.

Not much else uses those orbits right now. Other comms satellites and surveillance birds are all higher up. The debris would in theory also clear pretty quickly and should be fairly contained so the cascade of additional damage might be relatively small too. Hard to know that without a huge simulation budget to see how high the shattered satellite bits might get tossed.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#193

Post by lazide » Fri, Aug 22, 2025, 4:11 PM UTC

AnthonyMouse wrote: post #182

lazide wrote: post #146

Earlier quoted context omitted.

You’re just ignorant of what it does. The GFW autodetects and blocks a truly impressive number of tunnel encapsulation schemes, VPN’s, etc. and blocks a wide variety of proxy attempts. It really isn’t dumb at all, and is quite difficult to get past. It also auto detects ‘problematic’ content in near realtime for a huge swath of things. It does deep packet and content inspection, including of a bunch of encrypted traf…

> The GFW autodetects and blocks a truly impressive number of tunnel encapsulation schemes, VPN’s, etc. and blocks a wide variety of proxy attempts. They made a list of tunnel systems that don't attempt to disguise themselves and then blocked them. That's not really that hard, and it meanwhile causes lots of innocuous things to be blocked. There are uses for a tunnel other than bypassing censorship. The hard thing is…

Sure, that’s why saying things like Tianmen square - over voice audio - in a game with an encrypted connection to the server gets everyone’s connections in China severed, even when the game servers are in another country and the game company has nothing to do with it.

The GFW is run by the definition of a Nation State Actor/NPT. They’re not perfect, or omniscient, but they aren’t fools or incompetent either.

And knowing all the people taking the ‘totally secret’ backdoor is not even a complex trick.

Folks like the NSA in the US have to stay in the shadows, and have a tiny budget and population to draw experts from. What do you think happens when they get to be direct, obnoxious, AND somewhat public in a national pride kind of way?

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#194

Post by billy99k » Fri, Aug 22, 2025, 9:43 PM UTC

kotri wrote: post #90

molticrystal wrote: post #61

Earlier quoted context omitted.

Well for starters recreate the situation and test out different approaches. Thanks to the detailed analysis that can be attempted. If I understand right, a good next step would would be with eBPF or some type of proxy ignore the forged RST+ACK at the beginning. Then it would come testing to see if sending a bunch of ACK packets, perhaps with sequence numbers that would when reconstructed could complete the handshake.…

> ignore the forged RST+ACK See in 2006. That won't work if RST/ACK was injected to both sides. > Then it would come testing to see if sending a bunch of ACK packets, perhaps with sequence numbers that would when reconstructed could complete the handshake. Trying to send them alongside the SYN+ACK or even before if it can be predicted. Maybe try sending some packets with sequence id 0 as well to see what happens. Thi…

I've been using Astrill to bypass the GFW for almost a decade. It's a bit expensive, but worth it.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#195

Post by AnthonyMouse » Sun, Aug 24, 2025, 3:29 AM UTC

lazide wrote: post #193

AnthonyMouse wrote: post #182

Earlier quoted context omitted.

> The GFW autodetects and blocks a truly impressive number of tunnel encapsulation schemes, VPN’s, etc. and blocks a wide variety of proxy attempts. They made a list of tunnel systems that don't attempt to disguise themselves and then blocked them. That's not really that hard, and it meanwhile causes lots of innocuous things to be blocked. There are uses for a tunnel other than bypassing censorship. The hard thing is…

Sure, that’s why saying things like Tianmen square - over voice audio - in a game with an encrypted connection to the server gets everyone’s connections in China severed, even when the game servers are in another country and the game company has nothing to do with it. The GFW is run by the definition of a Nation State Actor/NPT. They’re not perfect, or omniscient, but they aren’t fools or incompetent either. And know…

> Sure, that’s why saying things like Tianmen square - over voice audio - in a game with an encrypted connection to the server gets everyone’s connections in China severed, even when the game servers are in another country and the game company has nothing to do with it.

You're describing something that seems like an urban legend/coincidence. What technical means are you suggesting they're using to determine the contents of a voice chat over an encrypted connection?

> And knowing all the people taking the ‘totally secret’ backdoor is not even a complex trick.

That's assuming it can be distinguished from ordinary traffic.

If your device goes direct when you want to read the Wikipedia article on the Streisand Effect but you also have a browser that proxies traffic through a random AWS VPS in Virginia when you want to read about something they don't want you to know, how are they supposed to tell that the latter is that and not just a regular arbitrary third party webserver?

> Folks like the NSA in the US have to stay in the shadows, and have a tiny budget and population to draw experts from. What do you think happens when they get to be direct, obnoxious, AND somewhat public in a national pride kind of way?

It becomes easier to find way to thwart what they're doing because any random device can be used to determine if or how something is being blocked instead of only the devices of high-risk people who can't afford to test the fences.