In the UK? Strange browser behaviour? You might be being IWF’d.

http://grimboy.co.uk/blawg/in-the-uk-being-told-youre-already-downloading-or-have-failed-the-captcha-too-many-times-by-file-hosting-sites-for-no-reason-you-might-be-being-iwfd/

by _b8r0 • 15 years ago

182 47 15 years ago

grimboy.co.uk

petercooper• 15 years ago

And transparent proxies being what they are, even when you're accessing legitimate content, you can end up with bizarre failures since cookies aren't working properly. Get quite a lot of "you don't have cookies enabled" errors from file transfer sites which don't occur through non-UK VPNs.

Shoddy transparent proxying and traffic shaping isn't anything new in the UK though. For the past couple of years I've frequently had Google go "down" for blocks of 5-10 minutes several times each week, yet through VPN it's fine. If you want a reliable connection at home in this country, it seems you need to just be permanently hooked up to a VPN located somewhere else.

udp• 15 years ago

Yep, my connection is "IWF'd"... I had no idea this kind of thing was going on. At least when they block a website in China they block it with a clear message instead of just silently breaking its functionality.

dav-id• 15 years ago

In China they do it silently with no message, you see just a 404 from your browser.

dkersten• 15 years ago

In Syria, however, you do get an error page saying the page was blocked. Facebook, for example, is blocked in Syria (or at least, it was when I was there in 2009 - of course, I had a VPN to Ireland, so it didn't affect me at all).

X-Istence• 15 years ago

My friend in China says it isn't a 404, the connection is just RST'ed to both sides and dropped. Simple, and effective. Your browser should display a "connection reset by peer" message or something to such an effect.

tgandrews• 15 years ago

Looking at the IWF website. Only child porn is within their remit. This seems a little crazy breaking parts of the web and effectively assuming everyone visiting a file sharing site is a paedophile.

http://www.iwf.org.uk/hotline/the-laws

cstross• 15 years ago

As is noted in the original article, this is a malfunction: IWF issue a blocklist of URLs, not IP addresses, but the ISPs filter content by proxying. Some of the ISPs have crappier proxy setups than others. Notably, the biggest ISPs (Virgin and BT) are the most aggressive at enforcement; smaller ISPs may not have the resources to waste on nannying their customers. I'm on Be Unlimited -- smaller, aimed at clueful users, features include stuff like static IP addresses and unblocked SMTP access -- and Filesonic.com appears to be accessible.

(I am not-dumpster diving for kiddie porn, however. It's a strict-liability offense: merely having the stuff in your hard drive cache, unlooked-at, is enough to draw a gaol sentence.)

g_lined• 15 years ago

Be Unlimited is a very good ISP (I use it too) but since it is now owned by O2, though it hasn't been merged, I think it's now much more vulnerable to being forced down any route that the more generic O2 broadband takes.

andyking• 15 years ago

There's a page on the Be User Group website about their proxying of the various file-storage sites, with workarounds. I'm with O2, and have found the messages about "failed the captcha too many times" or "you may only download one file at a time" popping up sometimes.

I don't suppose the ISPs are too bothered about the sites being filtered - although there is some legal content on them, they're mainly used to host copied music and TV, so there is little incentive for them to make allowances for access to the non-porn content.

http://www.beusergroup.co.uk/?id=468

_delirium2• 15 years ago

It's a strict-liability offense: merely having the stuff in your hard drive cache, unlooked-at, is enough to draw a gaol sentence.

That's something that comes up periodically w.r.t. to the IWF itself. It's not an agency of the police (or part of the govt at all), so the exception to child-porn laws that permits police to view such photographs in the course of an investigation doesn't apply. Thus, if the law were to be applied as written, it should be strictly illegal for IWF employees to have accessed many of the sites on its blocklist. So either they haven't done so, and their blocklist is of questionable accuracy; or they have done so, and thereby committed a crime.

Fortunately for them, the government supports the IWF and has no interest in prosecuting them.

bodski• 15 years ago

It seems the proxies are filtering by URL but all requests to any part of a flagged domain go through the proxy and so the sites see all subscribers of a particular ISP appearing to come from the same IP address. Hence the "your IP address has failed the Captcha too many times" type of messages. The Wikipedia/IWF 'edit ban' debacle was exactly the same thing due to Wikipedia limiting edits from any given IP address to prevent abuse.

Incidentally, I'm with BeUnlimited and it seems uploading.com always thinks that my IP address has exceeded some download limit:

"Sorry, you have reached your daily download limit. Please try again tomorrow or acquire a premium membership."

This does not happen when browsing from a cheap Linux VPS box, looks like Be/O2 are proxying too, except from curl -I output it looks like it's a fully transparent proxy.

AndyJPartridge2• 15 years ago

I'm on a Virgin Media 50MB connection, and filesonic.com is blocked for me.

papaf• 15 years ago

Is http://78.140.176.180/ blocked? If not then switching to something like OpenDNS will get round the damage.

To be honest though I have no idea on what level their transparent proxying works.

barrkel2• 15 years ago

There's a paper on it I posted above, if you're curious: http://www.cl.cam.ac.uk/~rnc1/cleanfeed.pdf

AndyJPartridge2• 15 years ago

Same :-(

$ curl -I http://78.140.176.180/ [SNIP] HTTP/1.1 301 Moved Permanently

AdamGibbins• 15 years ago

Oddly I'm on their 30MB connection and do not find filesonic.com blocked.

ugh2• 15 years ago

Wow. I didn't know that the UK has a censorship infrastructure.

calpaterson2• 15 years ago

http://en.wikipedia.org/wiki/DA-Notice

http://en.wikipedia.org/wiki/Gag_order#United_Kingdom (These are called super injunctions in the UK)

aj7002• 15 years ago

Didn't know?! Every western Europe country has one for child porn. It's just badly done with wide blacklisting in the UK.

http://map.opennet.net/filtering-soc.html

retree• 15 years ago

DA notices aren't legally enforceable though. Most newspapers comply voluntarily.

They're overseen by a committee of both government representatives and those from the press and news distribution (including Google's Europe head of PR)

see http://www.dnotice.org.uk/

apower• 15 years ago

Censorship is done right when you don't even realize its existence.

nickolai• 15 years ago

Good thing. Looks like we aren't quite there yet.

mattmanser• 15 years ago

This actually took down editing rights for wikipedia for virtually the whole of the UK a year back or so. For wikipedia the whole of the UK looked like it was coming from 6 IP addresses.

Turns out that they'd blacklisted an album cover for having a naked 14 year girl on it, so everyone going to wikipedia got shunted through the system, which makes it appear as if everyone's coming from a handful of IP addresses. Ironically the 70s album cover wasn't censored in the UK when it originally came out.

I can't remember all the details now, I'm paraphrasing a story told by Glyn Wintle from the Open Rights Group[1]. I saw him at a Notts Tuesday event[2], good speech, a whole lot more insidious things going on than you realise.

In the UK the Open Rights Group are the people you need to support/get involved with to help keep things like this in check!

[1]http://www.openrightsgroup.org/ [2]http://notttuesday.com/2010/07/05/tuesday-13th-july-keeping-...

_delirium2• 15 years ago

I believe it was only un-logged-in users (if you log in, in most cases that takes precedence over your IP for Wikipedia's software). But yes still rather strange, and could prevent people who didn't already have accounts from creating them.

As usual, Wikipedia assimilates the controversy into another Wikipedia article: http://en.wikipedia.org/wiki/Internet_Watch_Foundation_and_W...

_b8r03• 15 years ago

Even better still the filter was bypassed by using the HTTPS version of Wikipedia.

mike-cardwell• 15 years ago

If you install the HTTPS-Everywhere Firefox addon, all wikipedia URLs and hundreds of other domains are automatically redirected to their https equivalent.

JonnieCache2• 15 years ago

    $ curl -I filesonic.com
    
    HTTP/1.1 302 Moved Temporarily
    Server: nginx
    Date: Sun, 17 Apr 2011 12:21:29 GMT
    Content-Type: text/html
    Location: http://www.filesonic.com/
    Age: 0
    Via: HTTP/1.1 webcache1-know.server.virginmedia.net (Traffic-Server/5.7.0-59705 [cMs f ])

Note that I can still download from those site at will. It doesnt look like they're actually blocking anything. I'm on the 10mbit service, which is on a different network to the 50mbit+ plans.

Virgin have stiffed me before with deep packet inspection, but this one is new to me. Time to persuade my new housemates that changing to DSL is a good idea...

Or figure some more elegant way around it. Any ideas? Hooking up openDNS at the router level is on my list, but I doubt that will help.

dspillett• 15 years ago

If they are not using a transparent proxy to pick up the HTTP traffic then using OpenDNS or Google's public DNS (8.8.8.8 and 8.8.4.4) will help.

If they are going as far as inspecting http traffic (and selectively editing/blocking some of it) with a transparently proxy rather than redirecting selected domains via DNS poisoning then your only way around this is some sort of VPN which of course requires a host elsewhere for the VPN server to run on (unless you use something like Tor, but that is very slow and may cause the same "many people from a small set of IP addresses" problem itself anyway due to the relatively limited number of exit nodes).

barrkel2• 15 years ago

Customer requests are redirected by ISPs to the transparent proxy on an IP:port basis. DNS is not poisoned; using a different DNS will not affect how it works.

http://www.cl.cam.ac.uk/~rnc1/cleanfeed.pdf

I personally use a cheap VPS located in the US to get around IP geolocation (e.g. occasional Youtube videos, Hulu etc.), and it can also circumvent this, though I have never had cause to - my Be Pro account does not block filesonic.com, for example.

_b8r03• 15 years ago

Get a VPS with an unlimited bandwidth deal and set up openvpn, strongswan or even an SSH vpn (works under linux only). Get your default gateway to connect up permanently and route as much or as little traffic as you want through it. I use this for things like Hulu, so I can watch iPlayer in the UK and Hulu in the US from the same location.

nkassis• 15 years ago

You can use putty and firefox to do sock proxy on windows. When configuring a connection in Putty add a port for dynamic forwarding (under connection -> ssh -> tunnels, put something like 4999 in the source port, select the Dynamic radio button and click add next to the source port)

Then in firefox you can setup a socket proxy (in options, under advanced settings -> connection settings select manual proxy then add 127.0.0.1 and port 4999.) This should be enough to get around it. I use this to secure my connection while on other peoples laptop (work etc..)

donohoe• 15 years ago

Great. They're not just censoring the Internet (poorly), they're also breaking it too. Fantastic.

aj7002• 15 years ago

"Think of the children" wins the day every time.

As it probably should, in this case, because we're not giving up a lot. People think that one child abused is one too many, which is hard to argue. But yes, you can argue that blocking entire domains instead of specific urls is overkill.

Accessing free child porn anonymously doesn't "incentivise" child abuse. But some think that it encourages abuse in real life. But that's a psychological argument, not a technical one.

mseebach2• 15 years ago

> People think that one child abused is one too many, which is hard to argue.

It is hard to argue, but it's also a red herring. The missing bit is the solid link between someone(1) NOT accessing child porn and, somewhere down the line a child NOT getting abused.

1: and that someone is likely to be a small fish, as one must expect the serious guys to be perfectly capable of using any of the hundreds of easily accessible and usable tools (various flavours of crypto) to circumvent the deploy anti-measures.

To a certain extend, this is the war on drugs all over again. We fight (a very small subset of) the consumers because then we are seen to do something (tm), but it's not clear that it puts a significant dent in the production. And this is a harder nut to crack than drugs, because the easy demand-side solution (at least partial legalisation) is not really feasible here.

wzdd• 15 years ago

I used to live in Australia, at a time when most .au ISPs did not censor the Internet. However, transparent proxying was fairly common among ISPs anyway, because it saved them money. I suspect that might be what's happening here (though I guess the cost savings are higher when you do it in Australia, because data charges to Australia are ridiculous).

If the ISPs just wanted to implement IWF censorship, they could do it less invasively by using packet inspection.

cabalamat• 15 years ago

Someone needs to set up an Internet Watch Foundation Watch Foundation.

JonnieCache2• 15 years ago

Transparant HTTP proxying by your ISP isn't all bad. Back when Virgin was NTL, if you didn't pay your bill, instead of cutting you off at the exchange they would just put in place a proxy rule that redirected all HTTP requests to a page telling you to pay.

Some broke friends of mine noticed that their already downloaded torrents still worked. Obviously, all non HTTP traffic worked just fine. They took to going to the pub at the end of the road, grabbing .torrent files and downloading them at home. Pretty resourceful. I considered hooking them up with a SOCKS proxy but never did.

joshu• 15 years ago

Once, delicious was very briefly on the block list. They quickly realized that it didn't host images and unblocked it.

Buuuuut:

Virgin and NTL blocked it for YEARS afterwards. It was a nightmare getting it unblocked. I eventually had to reach out to a friend that knew Branson to get a high enough level connection.

Government blunt weapons plus corporate disinterest are in aggregate bad for everyone.

vabole• 15 years ago

One thing that annoyed me a lot while I was living in China was the extensive censorship of the internet. Seeing the same amount of censorship in the western countries is even more unsettling. The only difference is in the definition of the illegal content used .

tobylane• 15 years ago

Damn that's annoying. They are actually quite good in their package, I shall list the options from memory (ignoring what doesn't apply or is just plain out of mind).

Sky - Broadband, phone, TV. Requires you to pay a Murdoch (hard pill to swallow for one parent)

Virgin - Cable (internet on different unshared fiber), phone, tv. Requires acceptance of this article. (Tbh not too fussed)

BT - Broadband and calls. TV package is an expensive joke. Call centre is shit/Indian (quality of the line and training, not racism)

Talktalk - Broadband and calls. Even worse call centers. My parents are afraid to leave them now...

Anyway, I believe I'm wrong somewhere, I wish I was wrong in more places (everything negative).

In the UK? Strange browser behaviour? You might be being IWF’d.

Related Stories