Comment by steventhedev | Hacker News Reader

Comment by steventhedev | Hacker News Reader

We have servers in HK. Not to reach mainland China, but to service all SE Asia. We chose HK because it has the best balance of latency between all destinations. If PRC decides to move HK behind the great firewall, we'd move our servers, and so would most other companies. Last I checked, Great Firewall DPI takes around 100ms. I don't have exact timing, it's possible it's different for ingress/egress, or that it's only on tcp connect, but 100ms means it's reasonable for us to consider pretty much any other city in SE Asia, and a few outside. For reference, Taipei is around 20ms away from HK, and Manila is around 40ms. Singapore is problematic because they have a tiny number of external cables, and they had an incident a few years back where all but one cable was out of service for months.

Point is if HK moves behind the GFW, I'll have some servers for sale.

EDIT: I'll let my stupidity stand, but for correctness: Singapore has around 15 submarine cables as of 2018, but only 3 landing sites.

Note that this is not the PRC expanding the Great Firewall, but the Hong Kong government mulling its own restrictions under emergency powers. My understanding is that the infrastructure is not in place to just move the city behind the Great Firewall even if that were a goal.

The letter's point is that if they make movement today on attempting to block access through their current means, it can only end in a GFW-like situation because it can't meet PRC standards otherwise. Even if it takes years, it ruins the economic prospects of the city as a technological leader.

> Last I checked, Great Firewall DPI takes around 100ms

How do you check that? The DPI works mostly in async way, mirror traffic to standalone servers to extract key data points, if found a match, send RST to drop the TCP stream and maybe further blacklist the IP indefinitely.

Is there a new mechanism that requires synchronised data stream check? Making a DPI on backbone internet with <100ms latency would be extremely impressive achievement.

> How do you check that?

searched for "Great firewall latency" on my mobile. Took the first result with numbers, and saw mainland latency around 100ms higher than HK.

> The DPI works mostly in async way, mirror traffic to standalone servers to extract key data points, if found a match, send RST to drop the TCP stream and maybe further blacklist the IP indefinitely.

If it works async like you describe then it invalidates my worries about latency. But it doesn't solve the "why the hell is my SSH stream getting a RST?!" because their firewall is dropping SSH by policy or because of a false positive in the traffic.

> searched for "Great firewall latency" on my mobile

Found few blog posts, it looks like network congestion.

Yeah it may well exists, because if DPI servers can't handle all the oversaturated traffic, it may well just cap the backbone bandwidth, dropping packets, etc.

So if your packets has to be retransmitted it creates latency.

So you're talking about moving some servers without having done actual measurements yourself?

I'm talking about "potentially" moving servers based on credible claims of upcoming changes.

In this particular case, we don't have any business interest in mainland china, so I'm willing to speculate based on other people's measurements. Acting on speculation is very different from planning. As smarter people than me have said: "plan for the worst; hope for the best"

Reply on news.ycombinator.com