[drdaeman]

Disclaimer: I work for an ISP and every ISP in Russia is legally required to do the censorship (and mirror all traffic to FSB black boxes, but that's another story). I'm not partucilarly happy with the situation, but can't do anything about that.

Nginx is totally relevant as many ISPs including our use GNU/Linux boxes running Nginx as a highly performant transparent proxy (there are TPROXY patches for Nginx) to dive into HTTP traffic and do URL filtering (obviously, after initial crude IP-based filtering). Costs less than those fancy Cisco solutions, and it's not like we're willing to spend additional money on something that downgrades the service.

Also, there are cases where actual sites are legally forced to remove resources. Well, not really forced, but it's just a sort request too many sites can't really decline. You either comply and remove a single page (blocking for Russian visitors only seems sufficient), or get blocked on ISP level and since many ISPs (including several giant ones) just blacklist a whole IP address, that means your site becomes completely unavailable.

[kintamanimatt]

> I work for an ISP and every ISP in Russia is legally required to do the censorship (and mirror all traffic to FSB black boxes, but that's another story).

I hate the censorship but I like the fact you're not gagged and can talk about the fact traffic is being mirrored.

[gngeal]

OR, he's not allowed to, and he's doing it anyway.

[drdaeman]

Nope, it's codified in the law, in a legalese, but right in the open.

The sad thing is, practically nobody cared about that, for years. The dissatisfaction became visible only when government granted themselves an ability not only sniff on others communications (which is obviously invisible to end user) but also actively censor them.

[Osiris]

Given that Russia appears to be engaged in even broader surveillance and monitoring than the U.S., I find it odd that Snowden would be granted temporary asylum there for speaking out about a similar program in the U.S. It makes the whole situation look more like a political game.

[marcosdumay]

If a russian speaking about Russia surveilance asked for asylum in the US, do you expect the US to deny or grant it?

[jlgreco]

He shouldn't be required to fight that battle as well; he's done more than we could possibly ask of somebody already. Russia is providing him with a certain degree of safety, he shouldn't be obligated to reject that.

[hnha]

could you post some authoritative proof/references for the black boxes?

[drdaeman]

Authorative: http://minsvyaz.ru/common/upload/prikaz_16-01-2008_N6.pdf (sorry, the document's in Russian and I can't find any translation, nor skilled enough to do that myself) - I'm not a lawyer, but in my understanding (as I was explained) this decree contains requirements to networks that ISPs must conform to (otherwise they can't get the license and provide services), and it states (in thick legalese) that all subscriber-generated traffic must be mirrored to operational search activities control ("пункт управления ОРМ"), which is usually (but maybe not universally) a black box sitting in a rack.

Non-authorative reference: http://en.wikipedia.org/wiki/SORM#SORM-2

From what I've heard, SORM-2 hardware is a secured 1U *nix-based server (peer was not sure whenever it was BSD or GNU/Linux variant), running some kind of sniffer (probably pcap-based) software with some FSB's in-house tools. They are supposed to be dormant for the most of time, but nobody except FSB knows what they're actually doing (and they don't have to report when they're doing a lawful intercetion).

[ra]

You can think of this as a blueprint for snoopworthy governments around the world including all US or Russian allies.

Think about that! (and submit a patch to support 451 in your favourite web server / framework).

[hnha]

thank you very much!

[mike_esspe]

Requirement to install them is called SORM-2:

https://en.wikipedia.org/wiki/SORM#SORM-2

[hnha]

cheers!