Analysis of information sources in references of the Wikipedia article "防火长城" in Chinese language version.
全国人大代表、北京邮电大学校长方滨兴曾担任国家计算机网络与信息安全管理中心名誉主任,被誉为中国国家防火墙(GFW)之父。
防火墙是中国实现互联网管理一整套技术系统的民间叫法,官方在正式场合从不这么叫它。
Outlook users in China accessing their email through an email client saw a pop-up message saying “Cannot Verify Server Identity” and asking if they wanted to continue anyway
中国互联网蓬勃发展,为各国企业提供了广阔发展空间。中国吸引外资的政策不会变,保护在华外企各方面合法权益的政策不会变,为外企在中国创造良好经营环境的政策也不会变。我们希望各国尊重其他国家自主选择的互联网发展道路、管理模式、公共政策以及参与国际互联网治理的权利。
第四十一条 国家建立数据跨境安全网关,对来源于中华人民共和国境外、法律和行政法规禁止发布或者传输的信息予以阻断传播。
Greatfire.org是境外反华组织创办的反华网站,长期对中国政府进行无端攻击。此次炒作选在国家网信办宣布依法关闭一批违法违规网站、栏目和微信公众账号之时,蓄意引发不满情绪,污蔑指责中国网络空间治理制度。
全国人大代表、北京邮电大学校长方滨兴曾担任国家计算机网络与信息安全管理中心名誉主任,被誉为中国国家防火墙(GFW)之父。
We demonstrate that HTTP HTML response filtering was likely discontinued on many routes between August 2008 and January 2009, and that the apparent ineffectiveness of this form of filtering, which results from its distributed nature, was likely a cause for this.
According to a paper published by its designers, GFW relies on null routing (see figure 1) to block IP packets by blacklisting destination addresses. By peering with the gateway routers of all Chinese ISPs, GFW injects routing information into BGP (Border Gateway Protocol) and hijacks all traffic to blocked websites—such as twitter.com.
Inspired by initial work on the Great Firewall of China (GFC)’s keyword filtering mechanism, we sought a better understanding of its implementation and found it to be not a firewall at all, but rather a panopticon where the presence of censorship, even if easy to evade, promotes self-censorship.
数据跨境安全网关是指阻断访问境外反动网站和有害信息、防止来自境外的网络攻击、管控跨境网络数据传输、防范侦查打击跨境网络犯罪的重要安全基础设施。
他也认为透过方滨兴和李开复的微博对话,基本可以确认网友早前的判断,既方滨兴本人已经不再直接负责中国政府防火长城项目。据毛向辉透露,目前防火墙项目已经交给一家叫"启明星辰"的技术公司和一些管理成熟的团队。德国之声也了解到,这家 "启明星辰"为一家上市公司。
Astrill claimed in a Wednesday notice that since this year, VPN protocols used on iOS devices, including IPSec, L2TP/IPSec and PPTP, are not accessible in China in almost real-time.
Fang Binxing, president of Beijing University of Posts and Telecommunications, attributed the interruptions to Internet service providers' economic concerns.
"Service providers have to pay the bill of the international Internet flow for their users. So there is incentive for the companies to discourage users to visit foreign websites," he said.
…
An anonymous official with the Ministry of Industry and Information Technology declined to explain why foreign websites were frequently inaccessible a telephone interview with the Global Times, and instead urged users to "check their own technology problems and with the websites' servers on the first place."
这次黑客攻击发生在Gmail被封锁之后的一个月之内(Gmail到现在仍然处于完全无法使用状态)。由于这次中间人攻击与之前对谷歌、苹果、雅虎等的攻击存在诸多相似之处,Greatfire再次怀疑,中国国家互联网信息办公室精心策划了这次袭击,或者有意允许袭击发生。
防火墙是中国实现互联网管理一整套技术系统的民间叫法,官方在正式场合从不这么叫它。
We demonstrate that HTTP HTML response filtering was likely discontinued on many routes between August 2008 and January 2009, and that the apparent ineffectiveness of this form of filtering, which results from its distributed nature, was likely a cause for this.
Although TLS 1.3 [I-D.ietf-tls-tls13] encrypts most of the handshake, including the server certificate, there are several other channels that allow an on-path attacker to determine the domain name the client is trying to connect to, including:…
Cleartext Server Name Indication (SNI) [RFC6066] in ClientHello messages.
All handshake messages after the ServerHello are now encrypted. The newly introduced EncryptedExtensions message allows various extensions previously sent in the clear in the ServerHello to also enjoy confidentiality protection.
中国互联网蓬勃发展,为各国企业提供了广阔发展空间。中国吸引外资的政策不会变,保护在华外企各方面合法权益的政策不会变,为外企在中国创造良好经营环境的政策也不会变。我们希望各国尊重其他国家自主选择的互联网发展道路、管理模式、公共政策以及参与国际互联网治理的权利。
经过18个月的调查研究后,北京大学和斯坦福大学两名经济学家今年得出了结论,中国大学生对于获取未经审查的政治敏感信息漠不关心。他们给北京两所大学的近1000名学生提供了能够绕过审查的免费工具,但发现近半数学生并没有使用它。在那些使用了的学生中,几乎没人花时间浏览遭到屏蔽的外国新闻网站。
外有国家网关的防火长城,内有遍布全国的网络警察,那些论坛和网志自然也不是什么共产党的辖外飞地。
李建軍:由於中國的電訊公司都是國有企業,他們一定會執行黨的政策,因此,他們必然會在UDP上動手腳。現時大部分中國電訊公司的做法,都是在網絡QoS(中文或者可以稱為服務質素控制)上作出調動,對UDP通訊包的流量和速度作出限制,那麼當你用以UDP為本的技術翻牆時,就會十分之慢,慢至一個不可忍受的程序,那很多人就會放棄使用這種方法。
当美国和智利的用户试图访问流行社交网站如facebook.com、youtube.com和twitter.com等域名,他们的域名查询请求转交给中国控制的DNS根服务器处理,由于这些网站在中国被封锁,结果用户收到了错误的DNS信息。
First, "garbage binary" probes, containing nothing more than arbitrary (but sometimes repeated in later probes) binary data, were experienced by the non-China side of any connection that originated from China to TCP port 443 (HTTPS) in which an SSL negotiation was performed. This probe was performed in near-real-time after the connection was established,
…
The second type of probe, on the other hand, is aimed quite directly at Tor. When a Tor client within China connected to a US-based bridge relay, we consistently found that at the next round 15 minute interval (HH:00, HH:15, HH:30, HH:45), the bridge relay would receive a probe from hosts within China that not only established a TCP connection, but performed an SSL negotiation, an SSL renegotiation, and then spoke the Tor protocol sufficiently to build a one-hop circuit and send a BEGIN_DIR cell.
之前用+tcp的方式强制tcp查询域名是可以获得正确的结果的。但是据twitter上的@chengr28 报告已经会触发tcp rst了。
We demonstrate that HTTP HTML response filtering was likely discontinued on many routes between August 2008 and January 2009, and that the apparent ineffectiveness of this form of filtering, which results from its distributed nature, was likely a cause for this.
Inspired by initial work on the Great Firewall of China (GFC)’s keyword filtering mechanism, we sought a better understanding of its implementation and found it to be not a firewall at all, but rather a panopticon where the presence of censorship, even if easy to evade, promotes self-censorship.
“The rule was supposed to be, ‘Block everything going to this IP address,’” said Nicholas Weaver, a researcher at the International Computer Science Institute, which is affiliated with the University of California at Berkeley. “Instead, they screwed up and probably wrote the rule as ‘Block everything by referring to this IP address.’”
外有国家网关的防火长城,内有遍布全国的网络警察,那些论坛和网志自然也不是什么共产党的辖外飞地。
第四十一条 国家建立数据跨境安全网关,对来源于中华人民共和国境外、法律和行政法规禁止发布或者传输的信息予以阻断传播。
A computer engineer in his late 30s, Comrade X...is overseeing efforts to build a digital equivalent to China's Great Wall. Under construction since last year, what's officially known as the "firewall" is designed to keep Chinese cyberspace free of pollutants of all sorts
Although TLS 1.3 [I-D.ietf-tls-tls13] encrypts most of the handshake, including the server certificate, there are several other channels that allow an on-path attacker to determine the domain name the client is trying to connect to, including:…
Cleartext Server Name Indication (SNI) [RFC6066] in ClientHello messages.
We demonstrate that HTTP HTML response filtering was likely discontinued on many routes between August 2008 and January 2009, and that the apparent ineffectiveness of this form of filtering, which results from its distributed nature, was likely a cause for this.
All handshake messages after the ServerHello are now encrypted. The newly introduced EncryptedExtensions message allows various extensions previously sent in the clear in the ServerHello to also enjoy confidentiality protection.
All handshake messages after the ServerHello are now encrypted.
之前用+tcp的方式强制tcp查询域名是可以获得正确的结果的。但是据twitter上的@chengr28 报告已经会触发tcp rst了。
当美国和智利的用户试图访问流行社交网站如facebook.com、youtube.com和twitter.com等域名,他们的域名查询请求转交给中国控制的DNS根服务器处理,由于这些网站在中国被封锁,结果用户收到了错误的DNS信息。
“The rule was supposed to be, ‘Block everything going to this IP address,’” said Nicholas Weaver, a researcher at the International Computer Science Institute, which is affiliated with the University of California at Berkeley. “Instead, they screwed up and probably wrote the rule as ‘Block everything by referring to this IP address.’”
Astrill claimed in a Wednesday notice that since this year, VPN protocols used on iOS devices, including IPSec, L2TP/IPSec and PPTP, are not accessible in China in almost real-time.
First, "garbage binary" probes, containing nothing more than arbitrary (but sometimes repeated in later probes) binary data, were experienced by the non-China side of any connection that originated from China to TCP port 443 (HTTPS) in which an SSL negotiation was performed. This probe was performed in near-real-time after the connection was established,
…
The second type of probe, on the other hand, is aimed quite directly at Tor. When a Tor client within China connected to a US-based bridge relay, we consistently found that at the next round 15 minute interval (HH:00, HH:15, HH:30, HH:45), the bridge relay would receive a probe from hosts within China that not only established a TCP connection, but performed an SSL negotiation, an SSL renegotiation, and then spoke the Tor protocol sufficiently to build a one-hop circuit and send a BEGIN_DIR cell.
李建軍:由於中國的電訊公司都是國有企業,他們一定會執行黨的政策,因此,他們必然會在UDP上動手腳。現時大部分中國電訊公司的做法,都是在網絡QoS(中文或者可以稱為服務質素控制)上作出調動,對UDP通訊包的流量和速度作出限制,那麼當你用以UDP為本的技術翻牆時,就會十分之慢,慢至一個不可忍受的程序,那很多人就會放棄使用這種方法。
Fang Binxing, president of Beijing University of Posts and Telecommunications, attributed the interruptions to Internet service providers' economic concerns.
"Service providers have to pay the bill of the international Internet flow for their users. So there is incentive for the companies to discourage users to visit foreign websites," he said.
…
An anonymous official with the Ministry of Industry and Information Technology declined to explain why foreign websites were frequently inaccessible a telephone interview with the Global Times, and instead urged users to "check their own technology problems and with the websites' servers on the first place."
这次黑客攻击发生在Gmail被封锁之后的一个月之内(Gmail到现在仍然处于完全无法使用状态)。由于这次中间人攻击与之前对谷歌、苹果、雅虎等的攻击存在诸多相似之处,Greatfire再次怀疑,中国国家互联网信息办公室精心策划了这次袭击,或者有意允许袭击发生。
Greatfire.org是境外反华组织创办的反华网站,长期对中国政府进行无端攻击。此次炒作选在国家网信办宣布依法关闭一批违法违规网站、栏目和微信公众账号之时,蓄意引发不满情绪,污蔑指责中国网络空间治理制度。
他也认为透过方滨兴和李开复的微博对话,基本可以确认网友早前的判断,既方滨兴本人已经不再直接负责中国政府防火长城项目。据毛向辉透露,目前防火墙项目已经交给一家叫"启明星辰"的技术公司和一些管理成熟的团队。德国之声也了解到,这家 "启明星辰"为一家上市公司。
Inspired by initial work on the Great Firewall of China (GFC)’s keyword filtering mechanism, we sought a better understanding of its implementation and found it to be not a firewall at all, but rather a panopticon where the presence of censorship, even if easy to evade, promotes self-censorship.
经过18个月的调查研究后,北京大学和斯坦福大学两名经济学家今年得出了结论,中国大学生对于获取未经审查的政治敏感信息漠不关心。他们给北京两所大学的近1000名学生提供了能够绕过审查的免费工具,但发现近半数学生并没有使用它。在那些使用了的学生中,几乎没人花时间浏览遭到屏蔽的外国新闻网站。
A computer engineer in his late 30s, Comrade X...is overseeing efforts to build a digital equivalent to China's Great Wall. Under construction since last year, what's officially known as the "firewall" is designed to keep Chinese cyberspace free of pollutants of all sorts
All handshake messages after the ServerHello are now encrypted.
According to a paper published by its designers, GFW relies on null routing (see figure 1) to block IP packets by blacklisting destination addresses. By peering with the gateway routers of all Chinese ISPs, GFW injects routing information into BGP (Border Gateway Protocol) and hijacks all traffic to blocked websites—such as twitter.com.
Outlook users in China accessing their email through an email client saw a pop-up message saying “Cannot Verify Server Identity” and asking if they wanted to continue anyway