Hacker News new | ask | show | jobs
by lukeasch21 1156 days ago
Absolutely - this isn't a VPN replacement, especially with all the limitations it has. It's more of an alternative to cases in which a VPN might not work (or work well) depending on the situation.
1 comments

Russian internet censorship is very simple. They don't seem to be using DPI to target VPN protocols at all, instead trying to block IPs/subnets of known commercial VPN providers. Blocking IPs, subnets, and domains is the primary operating mode of Roskomnadzor.

There allegedly is DPI, but it only comes into play as an extra measure against things like domain fronting, proxies, and plaintext HTTP. It'd look at the SNI and inject a RST packet to drop the connection. As it does not even try to implement TCP, analyzing each IP packet in isolation, there are various interesting utilities[1] that mess with it by, for example, splitting the TLS ClientHello into two TCP packets in the middle of the domain name.

[1] https://github.com/ValdikSS/GoodbyeDPI