Comments for /publications/sp25/en/

Comment #613

2025-06-05T12:38:07.846066Z

TCP header length has to be 20 bytes.

Thinks if this is on purpose, exactly what client would behave like this? The first came in my mind is Golang net. Many circumvention tools use this, like obfs4, v2ray, sing-box, and hysteria.

After enabling TCP Timestamp, GFW's censorship of obfs4 is rendered ineffective, Jan 1 2025

Currently tested,

Chrome on Android 14, tcp.hdr_len == 20
Golang net/http program on macOS, tcp.hdr_len == 32
...

Comment #584

2025-05-18T11:01:50.058575Z

ITDOG geo-blocks Tor exits.

Comment #582

2025-05-14T04:46:27.686161Z

You may use websites such as itdog.cn to ping or http request all over china. (province * provider)

Comment #573

2025-05-12T12:21:41.515966Z

"Likely limited by the vantage points we could access in China, we found no evidence of regional censorship in the six provinces other than Henan."

Did you test edition.cnn.com (SNI blocking)?

https://explorer.ooni.org/chart/mat?probe_cc=CN&test_name=web_connectivity&domain=edition.cnn.com&since=2024-05-12&until=2025-05-13&axis_x=measurement_start_day&axis_y=probe_asn&time_grain=week

China Mobile even blocked websites (or proxy servers behind CDN) with 3-tuple (IP, transport layer protocol, port) filtering:

https://explorer.ooni.org/chart/mat?probe_cc=CN&test_name=web_connectivity&domain=www.esjzone.one&since=2025-01-01&until=2025-05-13&axis_x=measurement_start_day&axis_y=probe_asn&time_grain=day

Comment #572

2025-05-12T11:42:51.050920Z

People can trigger DNS injection by sending queries to 220.171.42.239:53/UDP (www.xinjiang.gov.cn)

dig @220.171.42.239 github.com
dig @220.171.42.239 s3.amazonaws.com

Comment #566

2025-05-12T04:47:30.926401Z

The most notable one of regional device is that in East Turkestan (Xinjiang). GitHub was long hijacked to the two Google Beijing IPs, stopped 1 year ago and changed to ordinary Twitter and Facebook's.

Oh, just by searching "新疆 GitHub", what joke did I found?

Apply for open GitHub access to advance local Large Language Model research Xinjiang Autonomous Region Department of Industry and Information Technology: Hello! I am currently learning the deployment and application of local large models. In order to follow the development of science and technology, I tried to obtain Deepseek related resources through GitHub for learning and practice, but due to network restrictions, I was unable to... I urge your department to consider opening relevant network permissions so that we can obtain the necessary resources.

https://web.archive.org/web/20250414055505/https://gxt.xinjiang.gov.cn/hd/hd_xjxq?id=c1a4f13bf070427895b305adf96981ad&site=6500000059&url=/gxt/xjxq/new_hd_xjxq.shtml

And this,

Xinjiang has always been the experimental area of GFW, and even many domestic websites have suffered. Baidu Netdisk sharing links, Kuwo, Changba, and GitHub have all been shut down, followed by CSDN and cnblog. I don’t want to discuss the reasons here, as everyone understands.

I pinged github.com and it resolved to 203.208.39.99. When I connected to the vps, it resolved to 192.30.252.129. Damn, that's so unfair.

https://archive.today/2025.05.12-044600/https://blog.fliaping.com/solving-the-problem-of-github-can-not-be-use-in-xinjaing/