Hacker News Reader

Comment by kodablah | Hacker News Reader

> that cannot be censored

I am not familiar with IPFS internals, but is there no pattern to the IPFS traffic that the ISPs can shape/block?

Too bad about the entire IPFS domain being blocked, because besides the host, HTTPS traffic has safety in numbers. If only there was a way to proxy through google.com or some other popular domain too important to block.

View on HN

> If only there was a way to proxy through google.com or some other popular domain too important to block.

There is. Domain fronting is used in China to circumvent the Great Firewall. The concept you are talking about is collateral freedom.

https://en.wikipedia.org/wiki/Domain_fronting

https://en.wikipedia.org/wiki/Collateral_freedom

Thanks for mentioning domain fronting! It's also been used by Signal to circumvent communications censorship in Egypt [1]. We want to bring domain fronting to IPFS by making libp2p's websockets transport capable of it. [2]

Fun fact: advanced networking setups like domain fronting are impossible to address in a URL/URI scheme. Check out multiaddr :) [3] A domain-fronted service could be addressed as something like `/dns4/google.com/tcp/443/tls/sni/google.com/http/example.com/ws`

[1] https://signal.org/blog/doodles-stickers-censorship/

[2] https://github.com/libp2p/libp2p/issues/18

[3] https://github.com/multiformats/go-multiaddr

> If only there was a way to proxy through google.com or some other popular domain too important to block.

Host IPFS nodes with http proxies on GCP and point the domain with multiple A records at those instances?

This is basically how Signal avoid being blocked in (IIRC) Saudi Arabia.

More info please

lmgtfy: https://signal.org/blog/doodles-stickers-censorship/

You cheeky bastard... but thank you.

Yup.

The magic term for others to google is "domain fronting". Here is a bit more info:

http://www.geektime.com/2016/12/23/signal-updates-protect-th...

Ah, too late to edit, but it was Egypt and the United Arab Emirates (apologies).

IPFS is P2P and very delay tolerant. It can run on a sneaker-net.

They'd have to block it close to endpoints, because IPFS is a P2P system.

I don't think that's tough if a country has said you need to be able to filter traffic. Assuming it is a simple pattern (e.g. whatever their NAT busting bootstrap is), set of ports, etc they could easily push filter rules to their downstream network devices if the law makes them.

Reply on news.ycombinator.com