“Two days ago the police came to me and wanted me to stop working on this”

https://github.com/shadowsocks/shadowsocks-iOS/issues/124#issuecomment-133630294

by realfuncode • 11 years ago

1543 428 11 years ago

“Two days ago the police came to me and wanted me to stop working on this. Today they asked me to delete all the code from GitHub. I have no choice but to obey.

I hope one day I'll live in a country where I have freedom to write any code I like without fearing.

I believe you guys will make great stuff with Network Extensions.

Cheers!”

teej• 11 years ago

Not being facetious here - what country do you live in that you think the government can't/won't interfere with your code?

copperx• 11 years ago

Mexico.

brobinson3• 11 years ago

Maybe China? There's a bit of Chinese in the author's other repos: https://github.com/clowwindy?tab=repositories

escape_goat3• 11 years ago

Perhaps I am misunderstanding your use of English, because it is difficult to see how this is not a facetious question.

There are relatively few countries in which the government both could and would interfere with someone's publication of code, and I think only in China is there both widespread computer use and internet access, on the one hand, and state security actors (the civil police, actually) who have the sophistication and funding to intervene with specific projects such as this one.

Did you mean to ask what country he was in?

tajen2• 11 years ago

I find this is a very gentle warning compared to what we hear about secret law enforcement in general and China in particular. Isn't the practice to stage a suicide after deleting his repositories?

brobinson3• 11 years ago

Main site for the software: https://shadowvpn.org

Were the repos mirrored anywhere, or would that present a risk to the original author?

escape_goat3• 11 years ago

It's hard to see how that would present a risk to the original author, given the current circumstances as we know them.

What is described was a visit from the police in which they asked him to take down his own Github distribution. He clearly hasn't been arrested, and although he may be being fined, he doesn't mention it. You will notice that his message encourages others to continue work and is generally unhappy and defiant.

If this was a matter of any seriousness with regards to state security, it seems more likely to me that the repositories would be simply shut down without explanation.

My expectation based on my own few encounters with the regular civil police[1] is that those who specialize in computer matters are unlikely to be idiots; I assume they will know how version control systems work. It would probably be overly cheeky of him to actually contribute to someone's fork, or work on similar software, but there shouldn't be any negative consequences based on what we've heard.

My experience in China is limited, and someone else might offer contradictory insights, but that's what my expectation would be based on that experience so far.

[1] an edit to clarify: "In China."

MarkPNeyer• 11 years ago

what was this?

hglman• 11 years ago

Shadowsocks for iOS Notice: This version is deprecated. Please wait for iOS 9's new VPN API

Features

Shadowsocks is a cross-platform tunnel proxy which can help you get through firewalls.

This iOS version is for non-jailbroken devices. It has two features.

A web browser with all the traffic going through a Shadowsocks proxy A background global proxy, with some restrictions Install

Available on the App Store

Please visit the App Store.

As a web browser

Shadowsocks works as a multi-tab web browser. It's really easy to use.

Tap the + button to open menu. Tap Settings to configure Shadowsocks proxy settings. Tap New Tab to open a new Tab. Tap URL field on the top to input URL. Swipe a tab to scroll the tabs. Hold and press a tab to swap tabs. If you've changed Proxy Mode, a restart is needed to take effect. (Kill the app, then open the app again). As a global proxy

Shadowsocks works as a background global PAC proxy, with some restrictions.

Only works with Wi-Fi network. But we are working on the cellular network. Only works for a few minutes. Due to iOS restrictions, Shadowsocks can't keep running in the background. It's killed after you leave it for a while. To keep it running for an extended period of time, you have to come back to the Shadowsocks app every few minutes. So it's a little tricky to use global proxy.

Set up proxy settings in shadowsocks. Copy this link http://127.0.0.1:8090/proxy.pac Open iOS Settings -> Wi-Fi -> i icon on the right of your connected Wi-Fi -> HTTP Proxy. Choose Auto, paste the link in the URL field. Tap back. Other apps now go through the proxy. If they don't, kill and restart them. Come back every few minutes to keep Shadowsocks running in the background.

xiaq5• 11 years ago

Shadowsocks is the most popular solution for circumventing China's GFW these days. It has the advantage of obfuscating the traffic, thus making it hard for GFW to detect it, unlike say SSH or OpenVPN traffic, which are easy to detect.

smaili• 11 years ago

While I understand what the gov is trying to do, who's to say somebody else that doesn't live in China maintains the project and puts it on GitHub for all the world to see?

xiaq5• 11 years ago

Maybe they are going to block or attack GitHub again until GitHub takes down all clones of it.

mikeokner• 11 years ago

The Chinese government just has to take control of the repo and make a new commit that contains the word "retard" and GitHub will make sure it never sees the light of day again for them.

eli• 11 years ago

Wouldn't be the first time https://en.wikipedia.org/wiki/Censorship_of_GitHub#China

wogong3• 11 years ago

They will, one day. anyway Gmail was gone, which I think is the most impossible site to be blocked.

PS: nice to see you here. :)

Laforet4• 11 years ago

Because it is a lot of hard work without much in the way of rewards or recognition. Hundreds of thousands people use clowwindy's code, some of them even make money by building services using his code, yet very few people are willing let alone be able to contribute. Until a few days ago he was complaining that the user community is now full of leechers and he is pondering when to quit. The police visit was probably the final straw.

vladmiller2• 11 years ago

And there are more than 500 forks. I'd say good luck deleting that :D

Rangi422• 11 years ago

I downloaded the source code on principle. It's good to know there are plenty of online copies.

vladmiller2• 11 years ago

same did I. Seems like it's pretty good written piece of software, so might be good exercise to hack it a little bit and maybe learn something

FredericJ• 11 years ago

In this specific case, DMCA doesn't apply. But it's interesting to read GitHub's policy about taking down forks.

GitHub will not automatically disable forks when disabling a parent repository. This is because forks belong to different users, may have been altered in significant ways, and may be licensed or used in a different way that is protected by the fair-use doctrine. GitHub does not conduct any independent investigation into forks. We expect copyright owners to conduct that investigation and, if they believe that the forks are also infringing, expressly include forks in their takedown notice.

https://help.github.com/articles/dmca-takedown-policy/

Rangi422• 11 years ago

This wasn't a thorough deletion. The shadowsocks-iOS project has been switched to the 'rm' branch, but the 'master' branch still contains all the source code: https://github.com/shadowsocks/shadowsocks-iOS/tree/master There's also a downloadable 2.6.3 release with a built .dmg and source code: https://github.com/shadowsocks/shadowsocks-iOS/releases

Even if it does get completely removed, a duplicate exists on GitLab: https://gitlab.com/mba811/shadowsocks-iOS (No guarantee that it has all the commits prior to deletion, or that it hasn't been modified from the original in some way.)

I can only hope the police in clowwindy's country don't know how to switch GitHub branches.

mullingitover• 11 years ago

I don't know what you're talking about. That repo is totally empty. Nothing to see here, move along.

;)

meric• 11 years ago

What are you taking about? Does not work. Cannot access the code.

46844993• 11 years ago

Years ago, news said China "banned" bitcoin, years later miners in China live just fine. I guess this is not going to be so different.

somerandomone2• 11 years ago

This is different. China(ese government) has a much, much stronger incentive and political resolution to reinforce their Internet speech control than crackdown a couple of bitcoin miners.

noselasd• 11 years ago

The only thing that's "banned" regarding bitcoins in china is that financial institutions arn't allowed to trade them. You can mine them, you can set up companies that mine them, you can trade them if you're not a financial institution.

kordless• 11 years ago

That duplicate will get flushed after they run the 'git pruned' on the 2AM cronjob. Nothing to worry about.

riobard• 11 years ago

That mostly a side effect of GitHub's caching mechanism. It's all gone now.

teraflop• 11 years ago

All of the links in the post you're replying to still work fine for me.

floatboth2• 11 years ago

The last commit on the GitLab mirror is cf485148bd9f4d4520d13e2169997cd72464f3c0. On GitHub, it's not the last one, but it's on the first page (not that much commits since).

Because it's the same SHA, and because of the way git works, we know that all the history before it is exactly the same on GitHub and GitLab.

i336_• 11 years ago

http://1drv.ms/1MLKiTr

Someone in this subthread mentioned something about a commit hash. This is important.

smilekzs• 11 years ago

From Wikipedia:

The Streisand effect is the phenomenon whereby an attempt to hide, remove, or censor a piece of information has the unintended consequence of publicizing the information more widely, usually facilitated by the Internet.

xiaq5• 11 years ago

If you control virtually every aspect of media in a country, I don't see how Streisand effect works...

orph4nus• 11 years ago

Because hackers will always find a way.

natch• 11 years ago

It works in your theoretical scenario unless you also take away word of mouth, international communication, and international travel. I don't see China banning any of those any time soon.

babuskov• 11 years ago

I find this comment amazing:

https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is...

Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.

conradev2• 11 years ago

This is the result of a recent change in OS X 10.11, called System Integrity Protection.

It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes).

If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing short of disabling SIP could uninstall it.

userbinator3• 11 years ago

Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too?

(I have limited experience with OS X - only briefly played around with driver development and bootloaders in the 10.4 era with osx86 - and I did have to boot from the DVD a few times when I made the system unbootable.)

This raises the question, what good is root if it's not really root anymore?

comex3• 11 years ago

If you have some malware that actually needs to modify system files, that still significantly ups the ante. Sure, if you have a kernel exploit, you can do it, but currently malware does not need any exploits to take over a system if it can convince a user to download and type in their password to install - Gatekeeper is one mechanism to prevent this, but I've personally been served multiple ads offering malware with a valid Developer ID signature, so it's tricky... (though I don't know how aggressively Apple is working to revoke their certificates). The difference in skill required between just writing an installer disguised as legitimate software on one hand, and continuously coming up with working exploits on the other, is pretty huge. And in any case, the easiest-to-exploit OS X privilege escalation vulnerabilities are things like rootpipe that don't compromise the kernel.

However, this argument falls down a little if malware doesn't actually need to modify system files, which it doesn't for most typical evil stuff I can think of.

nailer• 11 years ago

How do SIP and dtrace interact?

beedogs• 11 years ago

Not really surprising, though: Apple has been making OS X a little worse with every iteration.

eridius5• 11 years ago

But that's the thing, you can't disable SIP from userland. It can only be disabled when booted into recovery mode. So yes, it absolutely does verify integrity, because it makes it so malware cannot embed itself into the system. Your last sentence there is 100% pure grade A FUD. You may as well just say "every security measure is bullshit, because if malware were to figure a way around it, then it wouldn't work". It's a meaningless statement.

superuser23• 11 years ago

nothing short of disabling SIP could uninstall it

At the very least, the OS needs to be reinstalled from an off-disk source, and that's assuming you haven't been hit by something sophisticated enough to put itself in firmware. We're fast approaching an era where you need to trash the hardware. You should never trust an OS install that was ever compromised, and making it more difficult to do so is a good thing in my book.

elcct• 11 years ago

Windows 10, now OS X... and meanwhile I have installed Linux on all my workstations. Looks like big corporations are shooting themselves in the foot.

rsync• 11 years ago

Wow. OSX ... it was nice knowing you.

eridius5• 11 years ago

This is an iOS app, not a Mac app.

geofft• 11 years ago

Yes, but from the same commenter earlier: "I want to try this api on MAC OS 10.11. I understand the reason why I need to ask apple for some permission to publish the app with this api to app store, but I can't believe that I have to ask them for permission to run this api on my development machine."

MagerValp3• 11 years ago

I think you have that backwards. You, as the person with physical access, is in full control as SIP can be controlled from recovery mode. Processes running as root are no longer trusted to have full access to the system. This is definitely a step in the right direction.

hipaulshi6• 11 years ago

For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characteristics in network traffic so that GFW cannot easily block it by deep traffic analysis. clowwindy is the original author.

verroq3• 11 years ago

Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.

hipaulshi6• 11 years ago

SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or through <10 lines of json. On the client side the author and other contributors developed native clients that allow connection by supplying just 1 password and 1 server address. Super simple and highly reliable to this day.

jjgod• 11 years ago

SSH tunnel is just too easy for the GFW to detect, it's so unstable that you cannot even browse the web with it.

Yes, setting up a VPS provider would be the most common way. There are Shadowsocks implementations that supports multiple users so that more than one person can use it simultaneously. There are also commercial solutions for Shadowsocks that you can just purchase an account instead of setting up your own server.

bitinn4• 11 years ago

SSH still work, but it's not designed to give a high throughput, so ideally one would not want to watch a youtube clip over SSH. And DPI can identify and kill SSH session when there are too much traffic happening over it (ie. no obfuscation is taking place to hide SSH traffic)

JonnyGreenwood2• 11 years ago

There are many import/export companies in China, they are also the target audience of this software. Gmail is important for them.

bitinn4• 11 years ago

And to add more context: Shadowsocks isn't just a tool nowadays, it's a group of applications that target both developers and common folks.

People have built successful VPN services using Shadowsocks, and they are available on many platforms, like routers and embedded systems.

And the iOS version is more or less the author's recent efforts to build a VPN client that can run on non-jailbroken iPhone, much like Cisco AnyConnect.

I think shadowsocks' popularity as a whole concerns the chinese government, so they do their usual rooting out the leader thing: now that shadowsocks org is headless in the literal sense (no owner, no main repo), they hope its development will die out.

Coding_Cat• 11 years ago

What is to stop any non-chinese person from rehosting the old code? I mean, they obviously wouldn't like it and if I was said person I'd never visit China's sphere of influence again...

njloof5• 11 years ago

Is this the same? http://liguangming.com/shadowrocket

nialv72• 11 years ago

I believe GFW doesn't do traffic analysis just yet. Otherwise shadowsocks won't stand a chance either.

somerandomone2• 11 years ago

I hope one day I'll live in a country where I have freedom to write any code I like without fearing.

Can the author reach the US by whatever mean and apply for political asylum? That 'fear that they will suffer persecution due to: ... Political opinion'[0] seems legit.

[0] http://www.uscis.gov/humanitarian/refugees-asylum/asylum

hkmurakami2• 11 years ago

I hope one day I'll live in a country where I have freedom to write any code I like without fearing.

Frankly I don't know if we are that country. :(

brillenfux• 11 years ago

In the context of a Chinese hacker fearing prison this is awfully cynical hyperbole.

59nadir• 11 years ago

Yes, he should move to the US, where he'll be forced to use NSA approved (read: cracked) or no encryption.

mozumder• 11 years ago

US citizens can use any encryption they wish.

Kim_Bruning• 11 years ago

Seeing the position of the US and UK governments on encryption is coming in-line with china, I would be careful of traveling to those countries.

mrb• 11 years ago

I was visiting China recently (my first time there). I thought bypassing The Great Firewall was going to be as simple as an "ssh -D" SOCKS setup, or a "ssh -w" tunnel. Oh boy, I was wrong. If you try this, or even a basic OpenVPN setup, you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out. After some research I read online the government does deep packet analysis and uses machine learning to find heuristics to guess which TCP connection or UDP stream is likely being used as a VPN. When they think there is a high probability a VPN is detected, they simply start dropping all the packets.

Encryption is not enough. You need to disguise your VPN traffic to make it look like standard HTTPS sessions (since they don't block HTTPS). For example in a traditional HTTPS session, if the client browser downloads, say, a 500kB image over HTTPS, it will send periodical empty TCP ACK packets as it receives the data. But when using a VPN that encrypts data at the IP layer, these empty ACK packets will be encrypted, so The Great Firewall will see the client sending small ~80-120 bytes encrypted packets, and will count this as one more sign that this might be a VPN.

That's why people in China have to use VPN tools that most westerners have never heard of: obfsproxy, ShadowVPN, SoftEther, gohop, etc. All these tools try to obfuscate and hide VPNs. I have a lot of respect for all these Chinese hackers like clowwindy who try to escape censorship, as it takes more technical prowess than you think to design a VPN that works in China.

usaar333• 11 years ago

How do multinational companies' china offices get through the firewall? For example if my company uses Google apps, how do I ensure that my china office has access?

hipaulshi6• 11 years ago

As far as Microsoft office in Beijing, I think they VPN to their Tokyo office first. Their traffic is ensured by negotiating directly with the big telecom company. Disclaimer: I do not work for them.

bitinn4• 11 years ago

Not all VPN services are censored, and not all VPN protocol triggers the reset. But you can bet whatever you get for free (thus likely popular), will get banned soon enough.

OpenVPN is like a prime suspect of a police procedural novel, it gets hunt down no matter what.

Personally experience: I did work for Microsoft Shanghai and VPN works just fine. You need to have the right set of tools, and better, have a good channel of negotiation with the government.

mcbridematt• 11 years ago

Pay one of the telcos (i.e China Unicom) for an MPLS circuit out of the country.

Also, international performance in general can be quite bad at peak times (i.e 30% packet loss), I suspect due to Comcast-style management of international transit. But if you buy a transit circuit from Unicom, no problem!

Edit: to add to the grand parent, I've actually found ssh -D/-w0 (for a TUN device) quite reliable from China. What I really want to do is run multiple connections from different end points with a routing protocol to do fast-failover.

mirimir2• 11 years ago

I've heard that commercial DCs and high-end hotels are less censored.

a-saleh2• 11 years ago

We have colleagues in china and generally speaking, you find an alternative, and host it on premise.

I believe this is the reason why they use Atlassian[1] products, where rest of us would use trello, e.t.c.

[1] company that created jira

chefkoch4• 11 years ago

liquidcool• 11 years ago

I'm curious, what is the risk of getting caught, and what is the penalty?

imaginenore• 11 years ago

Spending on what you do, detainment, torture, death.

thaumasiotes• 11 years ago

I have a good amount of recent experience with this. I found that it wasn't just a matter of your connection getting blocked; if you leave it up you'll experience some unreliable good periods (so, say, a torrent would download through the VPN overnight without a problem, but if I wanted to use the internet at any particular time, my connection was unlikely to be working). But yeah, I ended up signing up with Astrill.

loser777• 11 years ago

Very interesting... I was just in China recently and was sshing into a box I had in the states for an impromptu SOCKS proxy. I did notice that things would work fine for up to an hour or so before things started bogging down. I would start seeing "channel x: open failed..." errors. However, closing the session and reconnecting would fix the problem... until it started lagging out again.

I thought it was just a consequence of being on spotty < 5mbps(ADSL?) connections. The internet situation was barely tolerable for a few weeks stay; I can't imagine what living in these conditions 24/7/365 is like.

halfelf3• 11 years ago

Working in such network 24/7/365 means I have to spend about $90 per year on my vpn service, and keep vpn connection all the time when working. (otherwise google and SO will not come to save me from problems.)

auganov2• 11 years ago

Yea, in my most desperate I wrote a script that opened ~10 connections and kept restarting them and used HAproxy as a frontend. It was maybe helping, but honestly, I couldn't tell. Luckily I discovered shadowsocks soon after that.

ColinWright6• 11 years ago

I'm always brought up short when someone says/writes "24/7/365" because it really doesn't make sense.

"24/7" means 24 hours a day, seven days a week.

"24/365" means 24 hours a day, 365 days a year.

"24/7/365" means 24 hours a day, 7 days a week, 365 weeks a year?

I know, I know, it's become an idiom, and it's like "I could care less", and you can't try to understand it except as an atom that caries a meaning, but it just looks wrong to me.

Sorry - I'll now return you to your regular programming.

sdm3• 11 years ago

I thought it was just a consequence of being on spotty < 5mbps(ADSL?) connections.... I can't imagine what living in these conditions 24/7/365 is like.

In my experience splitting my time between North America and China, the difference is not terribly noticeable once you invest in a solid VPN -- which everyone does.

The network speeds here are generally far better than NA -- in tier 1 and tier 2 cities at least. If you're accessing site in China, i.e., not going through the GFW, the average is far better than you'd find in the US. However the GFW slows everything down. However, there are a handful of VPN providers that specialize in getting through the GFW: notably Astrill and ExpressVPN. This those on my phone, tablet, and laptop it's easy, you'd never know you were in China -- expect the odd day when you have to hunt for a different server. Most experienced developers here subscribe to one of them.

Also, a lot of tech companies subscribe to "international lines". Pretty much all the ISPs offer them to business customers. They are expensive but they work very well. Usually about US$1k/mo to US$3k/mo on contract. The international lines are just hard lines to Hong Kong.

rahimnathwani7• 11 years ago

Were your DNS queries going over SOCKS?

captainmuon• 11 years ago

I've had almost the opposite experience. VPN sort of worked, but I could not open a single HTTPS connection. The VPN problems I had I could trace to a bad WiFi connection (I had to lower my MTU and it worked fine).

Now, on previous trips I experienced what you mentioned. It seemed really like there was some machine learning going on, and after using a VPN for a while the connection would get bad. But I guess it might not be machine learning, there might just be a huge number of humans watching your traffic - which would explain why it is so inconsistent.

The thing that worked best for me is just using ssh -D (on most days). Our workplace uses ssh a lot for secure communication with outside china, so that couldn't possibly be blocked without hindering our work (and I believe 'they' have no interest in that). So whenever I had to access something for work that was sillily blocked (argh gmail), I just used the ssh connection that was open anyway.

bitinn4• 11 years ago

Actually this is classic daily life of a chinese netizen: you are never quite sure what the cause of your network woes is (not without spending time digging into it). Is it due to ISP QoS, or is it reset by GFW, or is it just mere network failure?

And what most ppl do when facing this? They choose a local service instead of Twitter, Facebook, Youtube, Google. See, censorship is only a part (though a vital part) of the grand scheme.

berkut• 11 years ago

Back in 2006/2007 when I was doing web development, I knew a few people at F5 and Zeus Technology (developers of application firewalls at the time), and they said The Great Firewall was using loads of F5 tech with deep packet inspection for all data.

I assume 9 years later (don't know what the modern tech for web stuff is these day, but I assume encryption plays a key part) they're doing just as intrusive inspection and filtering of data.

Laforet4• 11 years ago

This might sound a bit counter intuitive but they really hate OpenVPN and SSH tunnels - not to mention they are trivial to detect and the process is highly automated.

Traditional VPNs such as PPTP/IPsec as well as various forms of obfuscated proxies are generally not interfered with unless something major happens. A lot of the alleged "censorship" are actually symptoms of high latency and packet loss on home connections.

kijin• 11 years ago

I suppose that means OpenVPN and SSH are too secure for the Chinese government to eavesdrop on. PPTP, on the other hand, has been known to be insecure for ages.

So... could you avoid detection by passing an SSH tunnel through a PPTP VPN? Add enough layers, and the censors might not bother to unwrap all of them.

chefkoch4• 11 years ago

IPsec is blocked now.

rahimnathwani7• 11 years ago

I currently use a mixture of PPTP and Shadowsocks. Shadowsocks (even to the same servers) seems to successfully connect a little more often, and drop a little less often. Otherwise, performance seems similar, and goes up and down.

edwinyzh• 11 years ago

"Thanks" to the Great FireWall by one of the evilest governments, I might have to finally give up Gmail after many years struggling using it with the help of a wide variety of GFW-fighting tools. My deepest respect to all the authors.

aosmith• 11 years ago

Spoofing GGP tends to work very well in these situations.

Aoyagi2• 11 years ago

What is this supposed to mean?

https://github.com/clowwindy/ShadowVPN

"Removed according to regulations."

fredoliveira• 11 years ago

Did you miss the original link?

https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is...

olalonde2• 11 years ago

Encryption is not enough.

I use an unencrypted PPTP VPN and the connection is really fast and stable here (Shenzhen, China Telecom). I have tried OpenVPN and ssh but both were much slower. FWIW, I don't believe using a VPN is illegal in China (though operating a VPN service without a license most likely is) and pretty much every single foreigner I know uses one.

oliwarner• 11 years ago

Per the other comment, MS-CHAP2 is crackable. The PRC govt is probably happy to encourage people to think they're secure using it.

Bromlife• 11 years ago

PPTP is not secure. You need to open another, more secure, tunnel within your PPTP session.

caiych• 11 years ago

According to a recent file. Using a VPN isn't illegal. But hosting an unregistered VPN service in China is illegal. And the right of using an unregistered VPN service is not guaranteed.

0xFFC6• 11 years ago

I am in Iran , you cannot believe it , same here , They use deep packet inspection too, they will shut every package down. every open vpn , cisco vpn , etc connection will lose connection every 2-3 min . Connection to outside web is almost impossible.

I have noticed they have multiple situation, for example when everything's quiet internet is not so bad (despite the fact bandwidth is extremely low for huge amount of people), but when some news came out about government corruption, guess what ? some vpn does not work . In 2009 green movement they closed every https connection.(maybe that was red alert situation)

p.s : https://en.wikipedia.org/wiki/Deep_packet_inspection

p.s. : I use vps from netherlands for bypassing firewall. but It takes huge amount of time and a little money.but the point is 99.999% people don't have this option (I use shadowsocks, sometimes another tunnels) so they use internet the way is or some software like freegate and other but with extremely low speed unbearable lag.

p.s. : pptp, l2ps and others are closed right now. even president rohani couldn't manage the situation . I have heard he did want to do something but supreme leader and his people stopped him.

yyhhsj05213• 11 years ago

I heard rumors that that before Halal Internet was launched the censorship of Iran was relegated to Huawei, the same company that builds and maintains the Great Firewall...

geff823• 11 years ago

wish you all the best. I pay 5$ for a digitalocean droplet to provide my family in Iran with an OpenVPN connection. This works quite well, we do not have any issues so far.

dujiulun2006• 11 years ago

I'm not sure but I suspect that they got the technology (hardware and software) from China too.

As a Chinese netizen I don't know if I should be proud that we have world-class advanced technology or be ashamed. Possibly ashamed.

aidanhs• 11 years ago

A few years ago I had a friend visiting Iran who wanted unrestricted access to sites. I didn't have any personal Linux servers on the internet at the time, but I did have a Windows one with Remote Desktop licenses.

It turned out that RDP actually worked pretty well. I did hesitate to post this in case it's seen by the wrong people(!), though given it's a while since it was necessary to use, it may be blocked by now anyway.

I wonder if it was available because it was relatively little known and, if so, what other little known protocols might be available.

tokenizerrr• 11 years ago

I have a friend in Iran and I let him use one of my servers as a proxy using the ssh -D flag. This has been working well so far as I know.

fyolnish• 11 years ago

When I was in China last year I had no problems using OpenVPN on my Holland based server.

njloof5• 11 years ago

Hotel WiFi may not be as restricted as the average citizen's connection. Local 3G/4G service may be more restricted than your home provider's roaming service. It's a bit of a crapshoot, but the GFW is definitely targeted more towards locals than visitors.

nly5• 11 years ago

Sounds like an overseas vendor needs to drop a blanket of satellite internet coverage over mainland China.

melling2• 11 years ago

Sounds like you live in a world where you didn't notice that China became the second most powerful economy, and which will become the most powerful economy within a decade or so. Of course they're going to have the military to go with that:

https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_...

ColinWright6• 11 years ago

... usage of which would be detected, and the users arrested and hauled off for "questioning" about spying and/or being a terrorist.

jeremyis• 11 years ago

Weird, was just there a month ago for two weeks and used https://www.expressvpn.com/ with no issue. I mostly cruised reddit / the internet so maybe there wasn't enough volume.

fridsun3• 11 years ago

It depends. I am a bit surprised that reddit is not blocked. Neither is hackernews. Apart from classic Google, Facebook, Twitter, AWS is targeted intensely for its role in "affiliated freedom", to the point releases on github are blocked, others not as much.

MrBra3• 11 years ago

Why go through Internet access providers in first place? Just get a radio transmitter and start broadcasting on short waves with encrypted digital modes... at least for short, critical transmissions.

thaumaturgy2• 11 years ago

At 1.2kbps?

sdm3• 11 years ago

In my experience ... spending a lot of time working in China ... most people use Astrill or ExpressVPN. I'm surprised no one has mentioned them here yet. They own the VPN market in China. Almost every senior developer I've met here subscribes to one or the other -- with Astrill being far ahead in terms of user base. They both champion their "stealth" options and other than the odd day you don't really notice the GFW.

Pretty much all the ISPs sell "international lines" as well. But only as part of their business packages. Usually it will run for about US$1k/mo - US$3k/mo with minimum 1-2 year contract for their "starter" package. Most tech companies in my area have them; they work very well. Essentially they are a hardline to Hong Kong and they ration out to subscribers.

They key thing to understand about the GFW is that it's not about general censorship of the population. Frankly the government doesn't care if someone who is middle class, i.e., invested in the status quo, gets around the GFW. They are more concerned about conservatives in lower classes trying to organize to stop the move towards capitalism. And it's mostly about protecting the market now so local companies can get access to these lower classes as their position improves and they join the middle class.

tripzilch• 11 years ago

I don't understand, who can afford US$1000 per month? I'm assuming only medium-large businesses, so do they divide up these "international lines" among their employees or something? Can these employees also use these lines at home, or only in the office?

vpndada2• 11 years ago

Yes, Astrill and Express VPN has been popular in China. But probably because they are too well-known, their services are not totally reliable. Instead, some smaller VPN providers now offer better services. Check out this test result: http://www.vpndada.com/best-vpns-for-china/

userbinator3• 11 years ago

Encryption is not enough. You need to disguise your VPN traffic to make it look like standard HTTPS sessions (since they don't block HTTPS).

In other words, steganography.

marme• 11 years ago

using ssh tunnel works just fine in china but they detect it and start blocking the ips. You can usually get a few weeks before they block the ip address. It works better if the server is from a legitimate source like an edu.

Most of the detection is focused on blocking vpns and they are very good and disrupting vpn traffic

ausjke• 11 years ago

This was exactly what I experienced in summer at China this year, no openvpn(not even commercial one or Linode self-hosted one), no ssh-tunnel, no other used-to-work vpn solutions.

For ssh it sometimes work for a few days then the whole IP/host is blocked.

I did not have to time try obfsproxy, shadowsock or whatever, but it really really sucked, to make things worse, my Nexus phone could not get any updates etc either, as Google is also _fully_ blocked, I felt I was back to Stone age there.

gonehome• 11 years ago

This is a great talk about some of the methods China and other governments use to block the Tor network: https://www.youtube.com/watch?v=GwMr8Xl7JMQ

It's a pretty sophisticated arms race that's lead to some cool stuff, notably pluggable transports (like the obfsproxy you mentioned): https://www.torproject.org/docs/pluggable-transports.html.en

Unfortunately the companies that enable this deep packet inspection are often American companies working overseas. My friend who used to work at Cisco said they had internal slide decks about the improvements they could make to the Chinese firewall. Then there's Bluecoat in Sunnyvale (https://www.bluecoat.com/) building the censorship systems for the middle east.

Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong.

jefurii• 11 years ago

Why do American companies sell this kind of stuff to China and non-democracies in the middle east? They must rationalize it in someway, but I think it's wrong.

Pursuit of the almighty Free Market without regard for scruples or morality. Basically, public corporations base success only on money. If you as an executive refuse to bow down before Mammon[1,2] then you are replaced by someone who will. Seealso Charles Stross' excellent Invaders From Mars[3]. The Chinese government and other regimes pay big money for these tools.

[1] https://en.wikipedia.org/wiki/Mammon [2] https://en.wikipedia.org/wiki/Mammon_%28Dungeons_%26_Dragons... [3] http://www.antipope.org/charlie/blog-static/2010/12/invaders...

rahimnathwani7• 11 years ago

Note: that video is from 2011, and in my experience China's VPN blocking has changed significantly over that time. In 2011, I could use OpenVPN over UDP reliably, as long as I didn't use the same port for every connection. That is no longer the case, and I'm grateful for Shadowsocks as it's easy to set up (both server-side and Android client) than OpenVPN over stunnel.

gcb02• 11 years ago

which leads me to two questions:

1. if you need custom vpn, why even have apple devices?!

2. why focus on vpn over their network instead of mesh?

lewisl9029• 11 years ago

Some of my friends have had success with VPNGate.

http://www.vpngate.net/en/

It's based on SoftEther VPN, which happens to be open-source and cross platform.

http://www.softether.org/

I'm using it for most of my VPN setups and I've generally found it to be superior to OpenVPN in every aspect (performance, usability, protocol support, obfuscation, etc).

eloy• 11 years ago

The Chinese authorities neither understand how FOSS works nor the Streisand Effect.

task_queue2• 11 years ago

Not having to worry about != not understanding

inguinalhernia• 11 years ago

"you will quickly find out your VPN works fine for about 5 minutes, but then latency increases to 5sec, 10sec, 30sec(!), and then everything times out"

I recall the same thing occurring in Shanghai with many of the popular webmail services, they'd work briefly, usually just long enough to log in and get a glimpse at an inbox, then it would time out endlessly and that'd be it.

vpndada2• 11 years ago

Based on my experience, if you set up a VPN server (such as OpenVPN) by yourself and use it in China, you will see strange behaviours and the VPN server might stop working after some time. As a result, I've given up using my VPN but been using third party VPN service, which works better. Here's a list of VPNs that currently works in China: http://www.vpndada.com/best-vpns-for-china/

superuser23• 11 years ago

How do foreign organizations with email and internal applications inside the firewall do business in China? Do they simply have to make an exception to their security policies for employees based in China? Put them on Baidu email accounts instead? Or are IT departments of big lumbering fortune-500s also dependent on these tools?

zhte4152• 11 years ago

No. Big foreign corporations, like in all countries, VPN back to their home country. The same all over the world.

Internal policy dictates this, all over the world.

Email is usually on self-hosted Exchange.

Corporate firewall blocks stuff like Youtube and Facebook - also the same over the world, but some users with the business need can access whatever the business need dictates.

Some large companies just bypass the national firewall for speed reasons - this is negotiated with the government on an individual basis - pragmatically this makes sense, as the traffic is 100% encrypted back between fixed sources and destinations, and inspecting it just wastes resources for all parties. Some corporations may also have their websites for the public access bypass any filtering, also for speed reasons (for example, internet banking).

medecau• 11 years ago

https://github.com/Long-live-shadowsocks/shadowsocks

The original repositories have been/are being reset. (Some branches were not removed.)

Non-obvious ways to search for forks as the network graph is unavailable for larger projects.

https://github.com/search?utf8=&q=shadowsocks+language%3APyt...

empyrical• 11 years ago

You may not be able to see a list of the forks via the web interface, but you can (albeit less conveniently) see them with the JSON API:

https://api.github.com/repos/shadowsocks/shadowsocks-iOS/for...

And you can paginate like this:

https://api.github.com/repos/shadowsocks/shadowsocks-iOS/for...

misnome• 11 years ago

Can't? https://github.com/shadowsocks/shadowsocks-iOS/network seems to work just fine. It even attributes the code to the original author, despite them not having a copy of it.

kinosang4• 11 years ago

I don't think it's suitable to distribute the backups until shadowsocks is fade from the gov's memory.

foxwoods• 11 years ago

Tags are still in the original repo

https://github.com/shadowsocks/shadowsocks/tags

personjerry• 11 years ago

Oh dear, I hope the clones of this repo on Github don't cause the GFW to block Github altogether.

aianus2• 11 years ago

On the other hand, the more they fall behind the more money and power for us in the west :)

yyhhsj05213• 11 years ago

It was blocked months before.

rxvincent• 11 years ago

Government used to block Github in past few years. Then lots of programmer strongly disagreed with it.

however,browse github has been harder in 2015.

I love my motherland but i really hate what the government has done.

sorry for my poor english

aianus2• 11 years ago

How did/does this tool compare with obfsproxy?

mobutu5• 11 years ago

On this note, we've been trying to upload gigabytes of data via rsync from Europe to China (we are software company who are trying to deliver tools to our Chinese customers..). Connection used to be fast when it was night time in China, but lately the connection has been really slow or unusable. Is there any alternative way to get lots of packages from Western countries to China?

gnur• 11 years ago

Ship it on an usb drive. (use encryption)

JonnyGreenwood2• 11 years ago

And get confiscated by China customs..

M2Ys4U• 11 years ago

The latency with that method is going to suck, though.

halfelf3• 11 years ago

If this happens day to day, you may consider opening a subsidiary in China, with applying for special network. Foreign company in China can have network without GFW.

est• 11 years ago

There's no "special network", it's just plan old VPN.

hipaulshi6• 11 years ago

setup a server with aliyun. the cloud service provider from alibaba. And relay the traffic from there.

mobutu5• 11 years ago

Funny you mention it, we are actually uploading to the server in Aliyun cloud services. Completely unusable :(

xiaq5• 11 years ago

Somewhat anecdotal, but try IPv6.

finalink• 11 years ago

Copy it to an AWS EC2 Japan server, and copy it to China from Japan. I have transferred 1T data from Europe to China with this method.

mobutu5• 11 years ago

Why Japan (as a location) is special? GFW does not affect traffic from Japan that much?

kinosang4• 11 years ago

Use Chinese CDN (such as Upyun, Baidu CDN, Qiniu and Aliyun) for http file downloading (with a subdomain provided by the CDN or you'll need to apply permissions at MIIT as ICP) instead of rsync or ssh tunnel. Or rsync your data to Japanese Servers (Linode, GMO, etc) and ask your customers to download through http or https.

mobutu5• 11 years ago

The problem is to upload data to China, we are not downloading anything from there.

"Or rsync your data to Japanese Servers (Linode, GMO, etc) and ask your customers to download through http or https."

We've used Amazon CDN before even for Chinese customers and they have closest node in Hong Kong - they still(Chinese) have difficulties to download our packages. I doubt using Japanese server would solve our problem. Thanks anyway.

qhwa2• 11 years ago

The recent congestion is caused by the price reducing of ISPs demanded by the government. A lot of customers upgraded their bandwidth without paying additional money. This makes the already busy cables out of bandwidth.

Back to your question, the answer is YES, use a proxy, which is less expensive, or buy a dedicated private virtual line from a Chinese ISP, which is more stable.

You can setup a fast proxy by carefully selecting the routing path. Nowadays, the CN2 cable (http://www.ctamericas.com/content.asp?pl=627&sl=637&contenti...) is a good choice.

jglauche2• 11 years ago

So, isn't the real question how to get you into a more liberal country so you can continue your work?

halfelf3• 11 years ago

That's true. But immigration for Chinese is much more harder than you think. Even in China, it is not completely free to move from one province to another.

jglauche2• 11 years ago

I can imagine that this is not easy. I'd like to hear some ideas to that though, as I lack all the details on what's going on there (just been there once on a business trip - and I know they treat foreigners with money much different)

Ankaios2• 11 years ago

In this case, it seems like there's a reasonable argument for asylum.

djyde• 11 years ago

As a Chinese developer, I got more and more disappointed to my country.

I'd read a book written by LinYutang, called My Country and My People. All my understandings of my country after reading this book are not same as nowaday China.

What's wrong? I don't know. I just wanna have freedom for Googleing. I just wanna the people in this country be happy not only because they get enough to eat.

aikah• 11 years ago

Don't worry, western leaders have figured out one doesn't need democracy or free speech for capitalism to function, China set an example. So with all the spying , ban of encryption , limits on freedom of the press with laws such as "the right to be forgotten" or making illegal to criticize cops or politicians in Spain , we have already entered in a post democratic era . And people in Europe take their freedom for granted forgetting they had to fight to death to win their freedom at first place.

rndn• 11 years ago

The right to be forgotten is actually a powerful mechanism to protect individuals. Though, the law should possibly revised such that it only applies to individuals that are not a public figure, who can prove to have little or no range of responsibilities.

antman• 11 years ago

In what way has that book changed your way of thinking?

mjklin• 11 years ago

+1 for Lin Yutang, he is an amazing writer who sparked my interest in China. I lived there two years and met my wife. Xie xie Lin Xiansheng!

ambrop7• 11 years ago

As the author of tun2socks (which is currently used under the hood in shadowsocks-android and Psiphon3 for system-wide proxying), I wasn't even aware this effort was in progress. Very sad to see it stop.

acd• 11 years ago

But censorship when the citizens can travel in and out of the country carrying USB,SSD and hard drives will not work.

hmage• 11 years ago

Do you honestly think you can carry USB and SSD to China without border officers confiscating it?

gemexe• 11 years ago

Maybe I'm lucky but I've done that many times and so far the customs never bothered

grondilu• 11 years ago

I have no choice but to obey.

Did he ask a lawyer? Because it looks to me there are two possibilities. One, he was not doing anything illegal in which case the police had no authority to stop his activities. Two, he was indeed doing something illegal in which case he can be glad he got out of it with what appears to be only a warning.

0xFFC6• 11 years ago

I didn't get where he/she is from.If I were him and I was in US I would fight back with legal system, but if I were in china and Iran I would run away (sadly because there is no reliable legal system in these countries)

yyhhsj05213• 11 years ago

It's of no use. If he's lucky, he would "receive" a fabricated charge; if he's not, he would simply disappear.

rsy964• 11 years ago

China is not ruled by law.

blackgear• 11 years ago

This is the end of a century. People in China had used 4 kinds of tools to skip the GFW: freegate, openvpn, goagnet, shadowsocks.

freegate is a traditional http proxy or socks proxy built by Falun Gong (https://en.wikipedia.org/wiki/Falun_Gong). They built lots of software with the same technology: freegate gpass freeu dynapass... People share this kind of banned software sending to each others just like teenagers share adult videos. After update of GFW, it become un-available and un-usable.

openvpn turns break GFW as a business, people sells openvpn account at $1.66 a month regularly. They sell this kind of services package including pptp l2tp ssh openvpn to those who need a free network.

goagent is a free software written by Phus Lu. It use Google's application engine as server so you can use it without paying money.So it replaced openvpn since it cost $0. After China banned Google, this way become more and more hard.

shadowsock is a protocol designed by clowwindy. It become a environment. People use python, C, nodejs, golang, rust, obj-c, java to write their own client and server. Some organization share their server for free, some people sell account and provide high speed. shadowvpn works as a VPN while shadowsocks works as a socks5 proxy, but share the same technology.

This is the end of shadowsocks. I means recently more and more evidence shows that GFW has finally find a way to recognize shadowsocks's packets. Then they stopped the development of shadowsocks.

That's all. The winter of China's network comes.

xiaq5• 11 years ago

That's all. The winter of China's network comes.

Is there technical reason to believe that shadowsocks or similar technology is the last stand against automated censorship?

I would just say this is just yet another stage in the censorship/anti-censorship cycle.

spanishgum• 11 years ago

I think that is what he meant. Winter is seasonal after all.

sillygeese2• 11 years ago

You may not be seeing the big picture here. Censorship is about rulers cementing their rule, and may well ultimately lead to complete tyranny.

There's no guarantee that "the censorship arms race" will continue, even in your specific nation-state.

For example, I bet there's not much anti-censorship software being developed in North-Korea, because people don't want themselves and their entire families tortured to death.

The real problem here is not that we might be lagging behind governments with our anti-censorship tools. The real problem is the existence of governments to begin with, because as long as they do, they will want to control their subjects as closely as possible.

Policitians and the real rulers behind the scenes are all psychopaths.

They see us as human livestock, and any one of them would be perfectly happy with a global North-Korea, as long as they personally would be in the tiny ruling elite, with all the riches and power a psycho could ever dream of.

woodchuck64• 11 years ago

I means recently more and more evidence shows that GFW has finally find a way to recognize shadowsocks's packets.

Hmm... okay, so they defeat shadowsocks by recognizing the packets.

Then they stopped the development of shadowsocks.

But if they already had shadowsocks beat, why do they make a public show of shutting it down?

Sounds more like they recognize that they don't have the GFW technology to defeat shadowsocks on-going development over time. Which suggests all you need is a new developer.

fluidcruft• 11 years ago

I don't know if this is the case, but I think it's entirely possible to know that shadowsocks is being used widely without being able to do anything about it at the network level. I think that's plausibly how shadowsocks is designed to avoid the GFW in the first place.

For example, if their capabilities to identify shadowsocks traffic is not particularly specific, filtering would result in undesirable impact on other traffic. They can also have other out-of-band estimates for the extent of shadowsocks use (presence of the software on seized or searched equiment, observed chatter, informants, etc).

Ankaios2• 11 years ago

There's no such thing as overkill.

cyphunk• 11 years ago

actually doing both makes a lot of sense.

a: build a method of detection and prevention and

b: find and coerce developer to stop improving software,

#b is required assuming the developer(s) is considered to be an above average adversary. When there is no silver bullet solution a cat+mouse game is inevitable. That further increases the value of this action.

#a being done at same time as #b has an effect on the collective behavior of the adversary. I'm sure various members for the RIAA and MPAA are wondering how they could have dealt with "filesharing" in a similar manner during the Napster days. But in the end it only buys you time in a cat+mouse games. meh, im sure there is some sun tzu art of war blah blah somewhere saying the same. more poetically of course.

adamfisk2• 11 years ago

Everyone can just use Lantern (https://www.getlantern.org). They already are, but in greater numbers since the Shadowsocks announcement (https://github.com/trending).

sneakOwl• 11 years ago

A lot of people set up shadowsocks on their VPS and then spread it to their circles. It's the growing community and that more people are communicating with each other via means the party can not control that upsets the party. This will not stop, it's our fight for freedom.

diegolo• 11 years ago

I happily bypassed the great firewall using https://github.com/apenwarr/sshuttle

catinred• 11 years ago

I've been using this anti-censorship software for about 2 or 3 years. It's the most stable one of all anti-censorship softwares I've ever used. For those who's not in China mainland, you can not imagine how many breaking-wall softwares we've ever used.From ssh -D,pptp,L2tp/ipsec,to OpenVpn. In order to access twitter,someone even create twitter api proxy such as Twip,btw,the creator was ever forced to "drink tea" with the police ,too. The Chinese gov just blocks any sites they want and frighten anyone who is "troublemaker". Best wishes for the gov,and for the heroes who is creative and brave to develop all these anti-censorship softwares.

lifeisstillgood• 11 years ago

Is this then a sign that the network architecture of back hauling everything to SF in order to send it back to Beijing so one can update ones neighbours wall, that architecture is flawed and needs to fall back to a peer to peer approach - one that truly can route around censorship

seanhandley• 11 years ago

687 forks. Good luck to the authorities!

geff823• 11 years ago

as a sidenote I encourage all people with talent to leave countries with suppressive regimes. I think they should be erased from their position. One way to do that is to encourage everyone to leave their country. One can argue that staying in a bad country may one day help to build it up again, but on the other hand, nothing hurts bad people in power more than complete brain drain.

0xFFC6• 11 years ago

I have plan to leave, I am looking for os research lab to apply in next year or after and I am working on my langauge. quick question , your family does not have any issue with openvpn ? the place where I am we cannot use openvpn.they shut connection down every 2 3 min.

eric_bullington• 11 years ago

Are you using a commercial OpenVPN provider, or bootstrapping your own OpenVPN proxy like the grandparent poster? That may make a significant difference.

e12e• 11 years ago

nothing hurts bad people in power more than complete brain drain.

Well, yes. A noose, for example. I completly sympathise with those the flee - but change in any country csn really only come from within. Often with help from outside - but without a force of change within - a real force - there will be no real change.

geff823• 11 years ago

Yes, the micro and macro levels are contradicting. On the micro level, it is everyones personal best to leave and try to make a good life outside. On the macro level, it is best to stay and work on changing things for the better.

lucagold• 11 years ago

you have to realize that sometimes it is not that easy for people to just leave. it's not like they just quickly buy a plane ticket and fly off to some safe country and the happy ending is complete.

you'll have to to be wealthy enough to afford finding a way out. you'll have to be willing to leave your family/friends. you'll have to be willing to leave the place you might be very attached to. you'll have to be willing to put up with all the bullshit and xenophobia you'll be faced with, once you arrive in your "safe" destination.

jedisct1• 11 years ago

Most importantly, you need a visa, which is not necessarily easy to get, especially if you are a Chinese citizen.

It's not just about being attached to your friends or to a place. A lot of people would love to leave their country, but aren't allowed to.

robbiep• 11 years ago

And nothing hurts a whole country more than a massive brain drain

TazeTSchnitzel• 11 years ago

as a sidenote I encourage all people with talent to leave countries with suppressive regimes.

All countries have oppressive regimes. Some are just moreso than others, and some target different people than others.

This is utterly destructive thinking, anyway. If the only hope, the only spark for change, flees, then there can never be improvement.

jlebar• 11 years ago

All countries have oppressive regimes.

https://en.wikipedia.org/wiki/Nirvana_fallacy

kinofcain• 11 years ago

China is ~20% of the world's population (1.36 billion of 7 billion).

If everyone in China left China, and assuming the rest of the world is living as a family of four (play along), then every home in the world outside of China would have to take in one Chinese refugee.

"Leave" is not a viable strategy at scale.

ctdonath• 11 years ago

You don't need everyone to leave, just a relentlessly growing percentage. At some point the system starts to crack, and either they relent or it breaks.

In the USA, there is the fundamental notion of "consent of the governed" - if enough people won't submit, the government cannot function.

mirimir2• 11 years ago

I've read that it's the wealthy who are leaving China. Or buying second homes, anyway.

dang2• 11 years ago

We detached this subthread from https://news.ycombinator.com/item?id=10101653 and marked it off-topic, since it was a generic tangent that led, as so often happens, to a flamewar.

It happened elsewhere in this thread as well: https://news.ycombinator.com/item?id=10103364. The end state of that one was Hitler, the end state of this one was jingoism. There aren't many end states.

This subthread turned so pathetic that I wonder if we should create overflow pages for these. The bottom of a regular thread seems too good for them.

FooBarWidget• 11 years ago

Any knows a good shadowsocks tutorial for OS X? I'm going to China next week but I need to keep working while I'm there. I need to access Gmail, Github, AWS, etc. I can't get it to work with the few tutorials I found: the connection appears to freeze, and only certain browsers respect the OS X socks settings (no command line tools).

__kaichen• 11 years ago

Hey, you could use a GUI client named GoAgentX on github. You could find the download link at this address.

http://shadowsocks.org/en/download/clients.html

fexy• 11 years ago

I am living in Iran and shadowsocks was by far the best tunneling software I have ever used, and believe me I've used almost ANYTHING!

I appreciate the efforts of clowwindy and it's talented developers and hope the development keep going.

That might be nice if some independent organization take ownership of the project so other individuals feel safer contributing to it.

WalterSear• 11 years ago

It's not like the source code isn't still there, in the initial 'deleted' repo, not to mention several hundred forks.

UserRights• 11 years ago

What an awful government, simply horrible!

Now imagine, one manager coming to you with an idea:

"Hey, here is a great way to make big money: we fire all our expensive US workers and move the whole production chain to China, people are much cheaper there and governement will keep it that way!"

Would you adore such a greedy $$$hole and make him manager of the century?

Just another crazy idea: Imagine we would produce all our hardware for all our communication devices in a country with such an authoritarian neandertal-government! Oh, wait...

auganov2• 11 years ago

Anyone able to verify clowwindy is okay and the encounter with police ended at that? Their twitter seems to be accept-only now.

mclee• 11 years ago

clowwindy showed up on twitter saying he's ok but has to drop maintenance. I guess he's physically alright.

jdenning• 11 years ago

I know there are plenty of copies out there, but in case anyone needs a link, here's my (unmodified, except for the rm branch/removal message) fork:

https://github.com/jasondenning/shadowsocks-iOS

cLeEOGPw• 11 years ago

Any technology can be used for both good and bad. There's nothing inherently wrong with technology.

chronial4• 11 years ago

No, that is not true. Look at the atomic bomb for example. The technology here is not just nuclear fission – the bomb itself has a lot of unique technology.

There can be a lot inherently wrong with technology, and there quite often is.

kjs38• 11 years ago

Name one technology used in a fission device that doesn't have other, non-weapon application.

hobs2• 11 years ago

What about all the Peaceful Nuclear Explosions (PNE)? The nuke is extremely destructive and extremely dangerous, but its not inherently wrong, they have been used to close gas wells by the Russians, and I am pretty sure the US had the plowshares program.

There are definitely some arguments that we could have used conventional explosives for those purposes, but my point is that a nuke is just a tool, its the people who decide to use it admirably or despicably.

andrepd• 11 years ago

But nukes are the reason there haven't been any direct wars between major powers since WWII. Isn't that a good thing?

briandear• 11 years ago

Without the Atomic bomb, millions of more people would have died. Thus the Atomic bomb saved lives as well as created a disincentive for Communist expansion during the Cold War. Western Europe would have been a war zone in 1960 if it weren't for the nuclear threat.

Just a caveman assessment of "atom bomb bad, flower good" is intellectually weak. The atomic bomb created a balance of power, the destruction of which would have resulted in countless wars and deaths.

elektromekatron• 11 years ago

Design can embed intent into an object. Software can embed it very well.

dang2• 11 years ago

This subthread detached from https://news.ycombinator.com/item?id=10102113 and marked off-topic, since it seems to be the root of the flamewar.

We've noticed over and over how generic tangents are the gateway to flamewars. Tangents about something specific ("off-topic, but I once worked with that group...") are often interesting, but generic tangents dilute discussion and not infrequently eventuate in Hitler.

kodisha• 11 years ago

Right about now in China, GFW HQ:

- Hey guys, we are on front page of HN again!

- Yaay, lets upvote!!!

daurnimator• 11 years ago

Holy shit, clowindy was asking me questions related to this issue just last week.

This is a scary wake up.

kinosang4• 11 years ago

Long live the shadowsocks.

People who do not yield to the GFW already made backups of all the repos under github.com/shadowsocks. And new tools to bypass the GFW is under development.

baozi1989• 11 years ago

In China, People give their country another name --- West Korea.

sidcool3• 11 years ago

Knowing as much as I know about China, I somehow feel it was considerate of them not to arrest the person or hack into his computer. They sent some guys to make him stop. May be I have a very bad impression of the Chinese government.

sidcool3• 11 years ago

I seldom wonder; what is that the Chinese government aims to gain from all this oppression? What any government hopes to gain? North Korea, Cuba, Venezuela, China, Russia (?) etc....What exactly do they want?

tired_man2• 11 years ago

They want to remain in control and never be displaced.

You can tell when a country is either totalitarian or when it's heading that way when they begin seeking increased control over the media, when your communications are subject to routine governmental monitoring, when you can become criminally suspect for having cash, when they're afraid of you being able to encrypt anything because it might be Terror/ChildPorn (read as "forming plots against them"), etc.

Most of all, they don't want to end up dead like Saddam and Qaddafi.

They have valid fears of that becoming reality. Just like other politicians....

switch007• 11 years ago

UK is heading this way..

Intermernet2• 11 years ago

Like most governments around the world, they tend to think that "change = defeat". The US, UK, Canadian, and Australian governments are not really any better in this respect. They don't really understand the internet, and are therefore (sometimes justifiably) frightened by it.

Governments, by definition, are meant to "Govern". Most see that the the rules of governance that they, as experts, have defined, should be "The Only Rules". They have a vested (if only intellectual, but rarely is this the case) interest in seeing people follow these rules. Any discussion, or debate, regarding alternative rules, is obviously being pushed by people who don't know what they're talking about.

It's oppression based on consensus and bureaucracy. Sometimes it's nefariously directed, but often it's just pigheadedness and arrogance that lead to decisions like this being made.

Although, sometimes it's just downright manipulative pricks holding the reigns. Hopefully this is less frequent than it actually appears to be. I'm giving these governments the benefit of the doubt, though they haven't done much in recent years to deserve it.

sidcool3• 11 years ago

Spot on! Governments are shit scared of the internet, probably even more than terrorists, probably because internet is a tool for the mind. A free mind has boundless optimism and spirit, and an oppressor cannot reign over such a mind.

jacquesm• 11 years ago

To remain in power a little longer.

nadams3• 11 years ago

This feels rather suspicious to me. Either the police are complete idiots (because people have forked his code and you can still get it from the forks) or there is more to the story.

It would make more sense to just send a DMCA takedown for that plus all forks to ensure that the streisand effect doesn't come into play. Because now I gotta grab a fork and squirrel it away - even though I'm in the US I feel like this is important stuff to keep.

seba_dos1• 11 years ago

And how would DMCA apply in this case?

nadams3• 11 years ago

You should sign up for notifications for the github repo where they post DMCA takedowns. People who release open source sending DMCA takedowns to people who create repos with that code.

I'm not saying it's right. I think there needs to be a stipulation in the DMCA to allow service providers to actually be able to research and think about the take down request. As it stands right now - you can send a DMCA takedown for any github repo and github MUST ASAP disable that repo - no questions asked. Of course - asking to take down a repo filled with material that isn't copyright to you could get you into legal trouble. However, I doubt people in China care about US laws - especially if they are the government themselves. Would you sue the Chinese government for wrongful DMCA takedown of your github repo?

Intermernet2• 11 years ago

If you were a US developer hit by something similar, you may have been sent an NSL, and would therefore be unable to discuss it at all. The DMCA would only apply if you had been accused of copying, or creating a derivative work.

I find it interesting that the Chinese police have told him to shut it down, but have not put any restrictions on telling people he's been told to shut it down.

Who has the greater freedom in this respect?

nadams3• 11 years ago

The DMCA would only apply if you had been accused of copying, or creating a derivative work.

See my reply here [1].

I find it interesting that the Chinese police have told him to shut it down, but have not put any restrictions on telling people he's been told to shut it down.

Don't you think that signals there is more to the story? I doubt some friendly people knocked on his door and asked him nicely to remove the code. Then after he did it - they told him to have a nice day and left him with some tea and biscuits.

My gut feeling is there is more to the story than what is in the one line comment in the issue tracker.

[1] https://news.ycombinator.com/item?id=10102631

Tobu• 11 years ago

The code is still easy to find, but they threatened the main developer so he won't work on it anymore. I think they won this round.

jondubois2• 11 years ago

I don't see the Great Wall of China as inherently evil. I don't think Chinese people would benefit if we (the west) had free reign to impose all our extreme capitalist beliefs on them. Maybe they are not ready for it.

It's arrogant for us to believe that we are on the 'free' side of the firewall. I don't see how one side is more free than the other - Both sides are subjected to constant brainwashing by various media - Be it at the hands of a suppressive government or those of greedy corporations.

alleycat• 11 years ago

Capitalist beliefs? They're just as capitalist as us, even more so these days (especially in Western Europe).

jondubois2• 11 years ago

I am aware of this effect (my wife is Russian) but I would still argue that they are not capitalist in the same way that we are (though they do come across as hyper-capitalist on a superficial level - As in; they are big consumers and they like to show off their social status).

One thing that really surprised me about Russian and Chinese people though is how well they take care of their friends and family (for example, they are often very willing to share their money to help each other) and how genuine they are compared to westerners. I know it's a big generalization but it's something I noticed.

Qualman• 11 years ago

The difference is, we in The West have the right to choose what to consume, or be "brainwashed" by, and China's government chooses for them. Which would you prefer?

rndmind• 11 years ago

This is a very unique and insightful way to look at it. Absolutely the GFW of china is a huge way to block outside cultural influence ( manipulation and many other unwanted foreign influences )

With that said, I'm of the radical belief that no internet communication should be blocked, inspected, or analyzed etc... but thanks for such a piquant response.

geggam• 11 years ago

Have we all forgotten corkscrew ?

http://agroman.net/corkscrew/

SwimAway• 11 years ago

Cancerous governments desperate for control. Swim away.

OJFord• 11 years ago

I'm not American, but still catches the eye that this currently stands at "911 points"!

skynetv2• 11 years ago

I am confused .. did the Chinese police come and ask him to stop working on it? Which country is he in?

syntheticcdo• 11 years ago

China

hachiya3• 11 years ago

So how did the Chinese police find clowwindy?

His contact information doesn't look readily available online.

Did Chinese authorities contact Github, which readily complied with information that led to him being located?

sandyvid• 11 years ago

It's really not that hard for the cops to track down someone in China. Besides, clowwindy didn't take any precautions before. I believe clowwindy once revealed the company he worked for.

hachiya3• 11 years ago

Do you have a reference for clowwindy revealing his employer? I didn't see anything about that.

Cops can do a lot of things, but they don't pull information from thin air. Github would be one source of information.

It's odd that this entire, and very popular, discussion on HN doesn't delve into how this individual was found.

It's also interesting that your reply is from a new account with only this comment.

adamfisk2• 11 years ago

At Lantern (https://www.getlantern.org) we make censorship circumvention software that shares some similarities with Shadowsocks but that also uses p2p. Since the @clowwindy announcement we're the #3 trending repository on GitHub basically because a ton of Chinese coders have been starring it - https://github.com/trending

wolfgke• 11 years ago

Quote: "Two days ago the police came to me and wanted me to stop working on this. Today they asked me to delete all the code from GitHub. I have no choice but to obey.

I hope one day I'll live in a country where I have freedom to write any code I like without fearing."

I claim that the west is hardly better: Just say "copyright law".

aflying• 11 years ago

oh,this seems to be a controversial question.The point is how to regard GFW in China.To be honest,every countries has its censorship.However,the point is GFW in china is opaque,which is not accepted.A man has rights to know what he want to know,and for gov,managing should be public.As for the author of shadowsocks,it is very sorrowful that she is asked to stop his work,which helps many Chinese people.For developers，this is what their work needs;for users,this is chances to see the real Internet.Remember everyone does not want to oppose gov,they just want to see something useful for their jobs,which also includes some politic news against Chinese gov.

Nanshan• 11 years ago

IPv6 is the powerful tools over the GFW

anabis• 11 years ago

Tangential, but the icon is from 星空のメモリア, a Japanese game. It has not been turned into anime, so can he read Japanese decently, or just using random pics?

Joona• 11 years ago

Might be translated in to Chinese.

bakabaka9• 11 years ago

This saddens me personally, as I once worked with this guy; he is very productive and talented developer. Imagine how god-awful he feels now, threatened by police and forced to stop committing to his very own projects.

“Two days ago the police came to me and wanted me to stop working on this”

Related Stories