Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

gfw.report

Post reply on HN
Print view View original

61–70 of 195 posts

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#61

Post by molticrystal »

technics256 wrote: post #38

How would one get around this if they found themselves in such a situation?

Well for starters recreate the situation and test out different approaches. Thanks to the detailed analysis that can be attempted.

If I understand right, a good next step would would be with eBPF or some type of proxy ignore the forged RST+ACK at the beginning.

Then it would come testing to see if sending a bunch of ACK packets, perhaps with sequence numbers that would when reconstructed could complete the handshake. Trying to send them alongside the SYN+ACK or even before if it can be predicted. Maybe try sending some packets with sequence id 0 as well to see what happens.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#62

Post by SuperMouse »

est wrote: post #43
technics256 wrote: post #38

How would one get around this if they found themselves in such a situation?

In this exact scenario, just use ports other than :443 But GFW certainly had the capability to block all ports. So no one really knew.

[dead]

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#63

Post by jart »

est wrote: post #44
jart wrote: post #22

[flagged]

outage would mean a connection timeout in this case, the connection works fine, some extra RST+ACK packets were delivered to your network on purpose

Which could easily be explained by a buggy rollout to their great firewall. What does China gain from intentionally blocking SSL for one hour?

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#64

Post by bawolff »

UltraSane wrote: post #57
outworlder wrote: post #51

Earlier quoted context omitted.

> Terrible, this is Internet curfew. If you think this is bad... You can't even have a blog in China without authorization. It doesn't matter if you pay "AWS" for a machine. It won't open port 80 or 443 until you get an ICP recordal. Which you can only do if you are in China, and get the approval. It should also be displayed in the site, like a license plate. The reason "AWS" is in quotes is because it isn't AWS, the…

AWS in China also doesn't have the Key Management Service, which leads to me to conclude it must be pretty secure. I added an A record for subdomain and pointed it at Chinese IP addresses. I wonder if I will get that angry email?

Or they just dont want to be put in the position of having to give out keys.

I think the real paranoid people use cloudHSM.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#65

Post by kortilla »

therein wrote: post #54
cyberax wrote: post #52

Earlier quoted context omitted.

One missile for one satellite? This gets expensive really fast.

They follow well defined orbits and propellant limited. You could easily cover their trajectory with some shrapnel and attack it one lane at a time.

Tiny propellant burns turn into thousands of kilometer changes quickly.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#66

Post by spwa4 »

stevage wrote: post #29
wkat4242 wrote: post #11

Earlier quoted context omitted.

Could you bring something like a starlink mini for backup i wonder? Id imagine this would be very worrying being stuck there as a foreigner in such a situation.

Depends a lot whether Starlink decides to let you.

No it does not. Against a huge state adversary like China it does not matter. They have satellites looking down so they can quickly locate any starlink users. And then ...

The only thing that could bypass is GPS + laser links (meaning physically aiming a laser both on the ground AND on a satellite). You cannot detect that without being in the direct path of the laser (though of course you can still see the equipment aiming the laser, so it doesn't just need to work it needs to be properly disguised). That requires coherent beams (not easy, but well studied), aimed to within 2 wavelengths of distance at 160km (so your direction needs to be accurate to 2 billionths of a degree, obviously you'll need stabilization), at a moving target, using camouflaged equipment.

This is not truly beyond current technology, but you can be pretty confident even the military doesn't have this yet.

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#68

Post by ceejayoz »

perihelions wrote: post #42
Helmut10001 wrote: post #31

Earlier quoted context omitted.

Starlink are very low orbit. Easy to bring down.

Very expensive to take down 10-100k at once. No one today has that many antisat-capable missiles stockpiled. Relevant, Chinese domestic media reporting on China's own perspective: https://www.scmp.com/news/china/science/article/3178939/chin... ( "China military must be able to destroy Elon Musk’s Starlink satellites if they threaten national security: scientists" (2022)) > "Researchers call for development of anti-sa…

EMP?

Re: Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025

#69

Post by johnisgood »

chickenzzzzu wrote: post #18
bapak wrote: post #13

Earlier quoted context omitted.

The green card isn't citizenship, you lose it if you don't live in the US. It's not like they don't know when you enter or exit the country.

6 months is a very long time.

Not with my amount of doctor visits it is not.
Post reply on HN