Defeating China's National Firewall

Bruce Schneier is reporting on his blog that a recent paper is discussing how to defeat China's national firewall. From the article: "However, because the original packets are passed through the firewall unscathed, if both of the endpoints were to completely ignore the firewall's reset packets, then the connection will proceed unhindered! We've done some real experiments on this -- and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall -- just shut your eyes and walk onto Platform 9¾."

Comments

Publish and Perish

[Archangel Michael]

Okay, now that you let the cat out of the bag, how long before the Great Chinese Firewall gets this hole plugged?

On the otherhand, the more they try to squeeze star systems, the more they will slip out of thier han (or something like that).

Re:Publish and Perish

[JesseL]

From reading the article it's not just a hole, it's the primary basis of their "firewall". Their system is apparantly built the way it is because any other method would be too expensive and/or slow. TO prevent this workaround will require enourmous expenditures in reworking their network structure.

Re:Publish and Perish

[Anonymous Coward]

> You cannot tell if a remote host is responding to reset packets from your firewall, at least not directly.

If you had to send multiple resets for the same port pair, they're ignoring you.

Dear Guys,

[bunions]

Thanks for doing the security analysis for us. We appreciate your hard work and excellent documentation.

Your Pal,

Wen

Damn you Mongolians!

[x2A]

That's the last time you break down my shitty firewall!

Jeez, why is it everytime chinese build a wall, those damn mongolians gotta break it down?

Bad example!

[Tribbin]

... and it works just fine!! Think of it as the Harry Potter approach to the Great Firewall -- just shut your eyes and walk onto Platform 9¾.

Or you just type in:

idspispopd = Walk through wall in noclip style

It's not THEIRS

[mrcaseyj]

>No matter how "horrible" Chinese internet policy is by US standards, it's their damned network segment. Let them work it out for themselves.

The chinese internet doesn't belong to the chinese government, it belongs to the chinese people. When they have a real democracy then "they" (the people) can decide how to run it. Until then we shouldn't respect how "they" (the government) want to run the internet any more than we would if some bank robbers were holding hostages and "they" (the robbers) wanted to decide how to run the bank.

Re:Drug Parallel

[Millenniumman]

Most libertarians believe that (currently) illegal drugs should only be legal for adults. Minors don't have the full responsibility of adults to take care of themselves. There are also a lot of more moderate ones who believe that taxing them is okay, especially if it can help lower other taxes. Their main reason for supporting legalization of drugs is that it would lower black market crime, and end up saving lives, although ideology is obviously an important reason.