←back to thread

259 points the-mitr | 8 comments | | HN request time: 0s | source | bottom
Show context
nesk_ ◴[] No.45048967[source]
What a shameful government!

clicks the link

blocked

Oh right, France government is shameful too.

replies(11): >>45049003 #>>45049143 #>>45049219 #>>45049260 #>>45049381 #>>45049851 #>>45049951 #>>45050019 #>>45050024 #>>45050125 #>>45051123 #
1. Pooge ◴[] No.45049219[source]
Genuine question: won't having your own—or independant—DNS server completely bypass that block?
replies(4): >>45049300 #>>45049782 #>>45049885 #>>45049902 #
2. robinsonb5 ◴[] No.45049300[source]
Depends how it's implemented - once you've found the correct IP address you still have to connect to it, and some ISPs block and otherwise mess with traffic at that stage.

In the early days of the IWF blocklist I had trouble with a Joomla install timing out when using my own ISP but it was fine if I used a proxy. It turned out to be because the Joomla install was on cheap GoDaddy hosting, and something on the IWF list was in the same IP block as my hosting - so my ISP was directing traffic through a filtering proxy which was causing problems with Joomla.

(IP address alone isn't enough to identify a particular site, filtering everything for target websie was too expensive, so IP-based filtering was used to decide which traffic went through the filtering proxy.)

The site seems to be blocked for me in the UK, too, by the way.

3. diggan ◴[] No.45049782[source]
> Genuine question: won't having your own—or independant—DNS server completely bypass that block?

Depends. It seems Spain is doing interception on the data going from/to IPs, as resolving sci-hub.se with my ISP resolver gives me the same IP as I get when doing it externally (186.2.163.219), but when I visit https://sci-hub.se I see a "Certificate not correct" warning, since the certificate belongs to allot.com, which seems to be the party actually implementing the block here.

replies(1): >>45049863 #
4. adithyassekhar ◴[] No.45049863[source]
You can keep refreshing the page and eventually it will work.
5. adithyassekhar ◴[] No.45049885[source]
Most ISPs nowadays use DPI to do these blocks which are actually redirects. And with how ssl certificates work, users will only see an error page instead of the redirected domain.

If you're on Android you can use Intra from google https://getintra.org/intl/en-GB/#!/

Or if you're on Windows you can use GoodbyeDPI https://github.com/ValdikSS/GoodbyeDPI

Both will split up your dns requests into chunks so the ISPs filter won't catch it.

replies(1): >>45049960 #
6. ytch ◴[] No.45049902[source]
Depends on how they implement the censorship:

# poison the DNS: you can use another unaffected DNS to bypass.

# ISP level or country level content filtering (similar to the GFW of China): you need a VPN that won't be blocked, and make sure the exit node is unaffected. (also the police won't care?)

# take down the server: finger cross that they serve the content from safe location.

7. psnehanshu ◴[] No.45049960[source]
If you have DNS-over-HTTPS enabled, then ISP won't be able to interfere with DNS. Right?
replies(1): >>45050811 #
8. adithyassekhar ◴[] No.45050811{3}[source]
Yes that is correct. But some then look into the headers after DNS resolution. They are not blocking ip addresses returned by the dns because everything is on a cdn nowadays.

These tools obfuscates your headers as well.