Bitcoin: The slayer of socialist slavery - <AUTHOR> https://medium.com/@jwweatherman/bitcoin-the-slayer-of-socialist-slavery <comment><USER2> Pretty decent article, and makes some good points.

I think a big problem tho is that the definition of the word "socialism" varies wildly depending on who you talk to. When I say, "big problem" I don't mean with the article itself, but rather it will be a big barrier to reaching an audience to which it isn't essentially preaching to the choir.

I have a good friend that is a true Marxist and his definition of socialism is completely different than another friend of mine that supports Bernie and wants single-payer and other things but fundamentally still a "capitalist" society. I tend to side with my Marxist friend (and the author of this post) on the definition tho.

Bitcoin (or generally crypto-currencies) is definitely a game-changer for freedom. I suspect quite soon governments around the world will begin to understand this and there will be a huge push for regulation. All in the name of "stopping the criminals." Whether crypto-currencies can survive this, will have long, long lasting ramifications on the freedom of mankind.

<comment><USER3> I agree. I'd put single payer healthcare in the category of "state monopoly slavery." The distinction being between selective state run monopolies and the State monopolizing everything. Pros and cons for each from the perspective of the predator.

</comment></comment><comment><USER4> Dude your post sounds crazy. I tried to write a nicer version of that comment but sorry I am not smart enough.

1\. Your name is Weatherman. You do realize that refers to a group of socialist protesters in the 1970's?

2 Your profile picture on medium is of a license plate with the word "Bitcoin". I don't know of any "nouveau riche" gesture that more saps someone's creditably than a fucking license plate spelling a word. WTF were you thinking man, that is what shitty real estate investors.

3\. Keep in mind what you are essentially saying is you have reconciled the systems of democracy, fascism, and socialism in one grand unifying theory. That solution has eluded every single human being who has ever been born, so something like 100 billion people. Congratulations, you're now on your way to becoming the most famous and richest person in the world and you can look forward to taking me down when you have enough money to buy YC Combinator, get my IP address, and come after me.

4\. Jesus Christ man get a cat or develop an opioid addiction anything but write more "bitcoin is DEFINITELY the thing that will TOTALLY change EVERYTHING this time" nonsense.

P.S. I upvoted your post but I only did that in hopes my comment would more likely be found

</comment><comment><USER2> Would love to read the post, but it's a 404 atm.

<comment><AUTHOR> Also, some (presumably) socialist-leaning mods censored the first attempt to post this. (So much for viewpoint neutrality...)

<comment><USER5> Moderators didn't touch either submission. Users flagged.

Ah yes the socialist mods. Have a look at [https://news.ycombinator.com/item?id=15307091](https://news.ycombinator.com/item?id=15307091), or [https://news.ycombinator.com/item?id=15366916](https://news.ycombinator.com/item?id=15366916), or [https://hn.algolia.com/?query=13110004&sort=byDate&prefix&pa...](https://hn.algolia.com/?query=13110004&sort=byDate&prefix&page=0&dateRange=all&type=comment) for countless others.</comment></comment></comment>


We need better data privacy self-regulation - <AUTHOR> http://tiamat.tsotech.com/data-privacy-self-regulation <comment><USER2> No. What you need is to be forced, on penalty of imprisonment, to treat all customer data as if they were medical records -- or, better yet, nuclear waste.

<comment><USER3> </thread></comment></comment>


The Elements of Programming Style - b-man http://carma.astro.umd.edu/nemo/pitp/papers/style.pdf

<comment><AUTHOR> here it is as a fortune mod file: [http://db.glug-bom.org/lug- authors/philip/misc/fortune-mod-p...](http://db.glug-bom.org/lug- authors/philip/misc/fortune-mod-prog-style.tar.gz)

</comment><comment><USER2> They are all pretty good but "Avoid unnecessary branches." and "avoiding goto" are top of my list. Usually is a red flag to me that the programmer has conceptualized the program but not taken the second step to split the program into smaller workable parts before starting the project.

</comment><comment><USER3> > 44\. Don't strain to re-use code; reorganize instead.

that's a good one that is easy to forget when you get into re-use mode</comment>


MTuner is a C/C++ memory profiler and memory leak finder - <AUTHOR> https://github.com/milostosic/MTuner <comment><USER2> In case someone is looking for the equivalent on Linux and Mac, there is HeapTrack

[https://github.com/KDE/heaptrack](https://github.com/KDE/heaptrack)

edit: typo

<comment><USER3> I've been looking for something like this. Massif makes it look like my code is reasonably healthy. HeapTrack shows I'm doing absurd number of small heap allocations.

</comment></comment><comment><USER4> I never used other memory profilers than MTuner mainly because not needing it, but also because MTuner works so well (for what I used it) I saw no reason to look for anything else: the combination of the different ways to view allocations/deallocations make for a very detailed yet uncomplicated view of your application's memory managment. E.g. first thing I noticed once was a constructor allocating 20 blocks of 8K and freeing them again just to initialize a vector, so that immediately tells you there's room for improvement there. Possibly other tools work just as well, but I can't compare.

It's also interesting just to look at all the data to figure out how exepensive some things are memory-wise. These days with the more modern C++ it's easy to forget what goes on under the hood. Nothing wrong with that per- se: C++ is usually performant enough that you just don't have to care about it _at all_. But if you have this typcial engineering mindset and like to know how stuff works just for the sake of it, and 'stuff' in this case is 'memory usage', then this is your tool.

</comment><comment><USER5> How different is this from Intel's vtune amplifier? I used vtune amplifier to get the memory profiles for some c++ code I had written before.

<comment><USER6> Is it free? Can the code be verified for backdoors? Does it work on non-intel chips?

<comment><USER5> Thanks. I used vtune sometime ago while I was a student. But I will try to investigate the foss alternatives.

</comment></comment></comment><comment><USER7> Doesn't valgrind do this?

<comment><USER2> Most of it (memcheck and massif), but good luck getting the important data out. Memcheck is fine, but massif is quite restricted as a object-level memory monitor. I can't talk for MTuner, but HeapTrack is very, very useful to track and eradicate temporary allocations (useless C++ object create when using `==` or passing by copy.

<comment><USER8> Sounds cool. Any pointers to useful tutorials on making that idea work?

<comment><USER2> Well, it's not really an idea. It is what HeapTrack and MTuner do. You install them, inspect the result, fix the worst offenders, repeat. There isn't much to it.

</comment></comment></comment></comment><comment><USER9> Did anyone try it with [https://developer.arm.com/open-source/gnu- toolchain/gnu-rm](https://developer.arm.com/open-source/gnu-toolchain/gnu-rm)?

</comment><comment><USER10> Very good. I wish you all the success.

But I have a (side) question. You are using Makefile while targeting non-nix platforms. Why? It seems to me it is the strangest combination ever.

<comment><USER11> For convenience! Make is a powerful software and GNU Make is readily available for Windows, e.g. as part of MinGW. I also actively use it for my projects, because it's just kind of always there when you need a build system and you can put together an initial Makefile real quick.

<comment><USER10> Isn't all of these arguments applicable to CMake?

Considering GNU Make is not itself available in Windows and you should install MinGW for getting make.

<comment><USER12> Windows is a pain to program on, and MinGW alleviates that somewhat. I do use CMake though, but I still want to use "normal" clang, so I have to generate a unix makefile. I don't want to maintain two sets of build systems.

<comment><USER4> _Windows is a pain to program on,_

It's really not, _if_ you know how to do it. But that goes for any OS out there. I mean, put a seasoned visual-studio-on-windows-only dev in front of a linux box and tell him to set up the build of a non-trivial application and watch what happens. Chances are pretty high the answer is 'linux is a pain to program on' :]

 _but I still want to use "normal" clang, so I have to generate a unix makefile_

[https://blogs.msdn.microsoft.com/vcblog/2017/03/07/use- any-c...](https://blogs.msdn.microsoft.com/vcblog/2017/03/07/use-any-c- compiler-with-visual-studio/) it's still relatively young but seems to work quite ok

<comment><USER13> windows not being able to mix and match object files compiled in different ways is really disastrous. On linux and windows I always work in release mode. If I have problems on the linux side I can target compile 1 or 2 object files debug, relink, run and get stack traces if I need. That's all totally independent of programming environment.

<comment><USER14> That has nothing to do with Windows vs GNU/Linux, rather the compilers being used.

UNIX is more than just GNU/Linux, and Windows compilers are more than just Visual Studio.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Is there a binary version of this tool that can be downloaded somewhere? Seems a bit of a pain to install.

<comment><USER16> Follow the link to homepage in readme, there you'll find download link to binary: [http://mtuner.net/index.html#download](http://mtuner.net/index.html#download)

</comment></comment><comment><USER17> How does that compare with the sanitizers in Clang (Memory, Address .. ) ?

</comment><comment><USER18> Impressive work, Mr Tošić! :)

</comment><comment><USER19> 2 Clause BSD! Woop woop!

Seriously this is another good app in the arsenal.

</comment><comment><USER20> Doesn't work on a Mac.

<comment><USER21> Yes, it says that in the README. Plenty of people use other operating systems, though.

<comment> unkown-unknowns > MTuner is a C/C++ memory profiler and memory leak finder for Windows, PS4, > PS3, etc.

I don't see any mention of Mac at all in the Readme, and I find the "etc" part confusing. For example, I use FreeBSD. PS4 is based on FreeBSD. Does FreeBSD go under the "etc" part? If not then what does?

<comment><USER22>
        > MTuner supports Windows, PlayStation 4 and PlayStation 3
        > out of the box. Additionally, any platform with GCC or
        > Clang based cross compiler can easily be supported with a
        > little extra work. Instrumentation API comes with full
        > source code which means it's a matter of porting a few
        > routines to get it up and running on additional platforms.

[http://mtuner.net/doc/overview_compilers.html](http://mtuner.net/doc/overview_compilers.html)

<comment><USER23> It's still not clear to me. I _think_ it means you can use if your host platform is Windows, but you can target other platforms through cross- compiling, but it doesn't say it explicitly.</comment></comment></comment></comment></comment>


Iran Shuts Down Major Websites and Https Protocol - <AUTHOR> I'm writing this to report the serious troubles we have regarding accessing Internet in Iran at the moment. Since Thursday Iranian government has shutted down the https protocol which has caused almost all google services (gmail, and google.com itself) to become inaccessible. Almost all websites that reply on Google APIs (like wolfram alpha) won't work. Accessing to any website that replies on https (just imaging how many websites use this protocol, from Arch Wiki to bank websites). Also accessing many proxies is also impossible. There are almost no official reports on this and with many websites and my email accounts restricted I can just confirm this based on my own and friends experience. I have just found one report here:
http://kabirnews.com/iran-shut-down-gmail-google-yahoo-and-sites-using-https-protocol/202/
The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.
I just wanted to let you guys know about this. If you have any solution regarding bypassing this restriction please help! <comment><USER3> I haven't checked yet whether they're using layer 7 filtering or just blocking ports, but assuming it was a lame combination of the two, you can try tunneling through HTTP on port 80.

Download proxytunnel and follow this guide to set up Apache (or whatever server you prefer) to http proxy ssh connections to port 22: <http://dag.wieers.com/howto/ssh-http-tunneling/>

Then run ssh with proxytunnel as the ProxyCommand (as shown in the guide). It will make a plaintext HTTP connection, request a CONNECT yoursite.com:22, and if they aren't inspecting "too deep" you should be able to get an ssh connection.

If that doesn't work there's always icmp tunneling (hans), dns tunneling (iodine), and various other options. See if you can make a udp connection over port 53 to a remote host and transmit non-DNS packets; if they aren't intercepting DNS traffic, just make an openvpn udp connection over port 53 for your tunnel.

I actually have a whole paper on circumventing captive portals and firewalls and a crappy tool to probe them if anyone wants it.

<comment><USER4> Link? :)

<comment><USER3> Here you go: [http://opensourceandhackystuff.blogspot.com/2012/02/captive-...](http://opensourceandhackystuff.blogspot.com/2012/02/captive- portal-security-part-1.html)

</comment></comment></comment><comment><USER5> I live in Iran.

The fact about the shut down is correct. I would also add that secure connection to servers inside Iran is possible. I've tried some, and they work. But trying to connect to services like Github and PivotalTracker, which we relay on in our starup, results in no response.

Also I will note that the ssh protocol is the same. I can ssh into my university machine (inside Iran) but I can't access my rackspace VPS with ssh for example.

One thing to add is that `Sara70` creator of this thread, mentions some non- related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong.

Here nobody officially said anything about this. But as this shutdown is getting more attention in the media, I suspect this issue to get resolved soon.

<comment><USER6> >One thing to add is that `Sara70` creator of this thread, mentions some non- related reason for this (The reason for this horrible shutdown is that the Iranian regime celebrates 1979 Islamic revolution tomorrow.) which is wrong.

How do you know this?

<comment><USER5> I ask the same. How does she know this?

I know this because, this trend (shutting down secure network protocols) started on and off, like 1 year ago.

<comment><USER7> As I understand it, that was slowing down (like 10x) of SSL, not disabling it completely. It could have simply been a live test of the mechanism they're using right now, and they could be deploying the mechanism right now because of the anniversary. (Or because of Kim Jong-Un's death ;-)

</comment></comment></comment></comment><comment><USER8> I'm grateful for the Tunisian revolution. Internet Censorship (including ports disable) is at 0. The court justice has ordered to censor a few pages (because of some reasons) but the Global Internet provider in the country did not accept. The head of this agency is also working that the law prohibits any kind of censorship for any reasons. He was responsible for censoring content in the Ben Ali era, but he now thinks that it just doesn't make sense.

The problem is, with the people (in the court or the gov.) who don't understand how the Internet works.

<comment><USER9> I'm not seeing much bad news coming out of Tunisia post revolution. I'm tempted to visit it.

<comment><USER8> It's relatively stable. Politically, it's fine. Economically it is struggling, but not much. Prices for tourists should be reduced as Andy mentioned since it's the recession for hotels and agencies.

Internet is pretty slow (I use a 3G which runs on around 1Mb/sec and costs around $20/month), the infrastructure is poor, the people are either struggling or confused how all these structural problems could get solved.

Not a great place to be in, honestly. If you are in Europe and looking for some Sun, then may be it's a deal for you considering the cost.

If you happen to make a travel, I added my phone number. I'm moving to the capital this summer, and if I happened to purchase a car, I'll take you in a free drive around the capital and Hammamet.

</comment></comment></comment><comment><USER10> TOR has a blog post up about exactly what they've been able to determine about what Iran is doing:

[https://blog.torproject.org/blog/iran-partially-blocks- encry...](https://blog.torproject.org/blog/iran-partially-blocks-encrypted- network-traffic)

Regarding HTTPS, it appears they detect and disrupt the SSL handshake.

For those who can't access TOR's site, it may be useful to quote their post in full:

"Over the past two days we've been hearing from, and working with, a number of Iranians having difficulty using Tor from inside Iran. It seems the Iranian government has ramped up censorship in three ways: deep packet inspection (dpi) of SSL traffic, selective blocking of IP Address and TCP port combinations, and some keyword filtering. For instance, they have partially blocked access to Tor's website, torproject.org, via IP address (such as 22.214.171.124) and port 443 (which is the HTTPS port). The third level of blocking is by keywords, such as searching for the word 'tor' via regular, non-encrypted search engine websites.

The blocks on SSL are not complete and not nationwide. Where blocking is in place, initial investigations show they are identifying the beginning of the SSL handshake and simply interrupting the handshake. We continue to research and investigate solutions with the assumption that SSL will eventually be blocked nationwide inside Iran. Our goal is to defeat their dpi signatures and allow tor to work by default.

The Iran Media Program has posted their thoughts on what is happening from a journalist's perspective.

So far, it seems the majority of Tor users are not affected by these blocks. Iran is still the #2 country based on direct usage, [https://metrics.torproject.org/users.html?graph=direct- users...](https://metrics.torproject.org/users.html?graph=direct- users&country=ir#...). This number is on the decline, however.

More details to follow as we have them."

<comment><USER10> "Update 2011-02-10 18:05 UTC: We are working on making our obfuscating proxy more stable and easier to deploy. If you can compile code, following these directions will help. We're also working on Amazon EC2 instances of obfsproxy for point and click deployment."

"these directions" links to an email from Jacob Appelbaum:

[https://lists.torproject.org/pipermail/tor- talk/2012-Februar...](https://lists.torproject.org/pipermail/tor- talk/2012-February/023070.html)

" [tor-talk] Help users in Iran reach the internet

Fri Feb 10 11:41:50 UTC 2012

Hi,

In the last 48 hours a major campaign of filtering has started in Iran - <USER2> started slow and now appears to be that nearly all SSL/TLS traffic is blocked on a few major Iranian ISPs. Details are rather rough but we're working on some solutions - we've long had an ace up our sleeves for this exact moment in the arms race but it's perhaps come while the User Interface edges are a bit rough still.

Here's the deal - we need people to run Tor bridges but a special kind of Tor bridge, one that does a kind of traffic camouflaging - we call it an obfuscated bridge. It's not easy to set up just yet because we were not ready to deploy this for everyone yet; it lacks a lot of analysis and it might even only last for a few days at the rate the arms race is progressing, if you could call it progress.

There are highly technical instructions here: [https://www.torproject.org/projects/obfsproxy- instructions.h...](https://www.torproject.org/projects/obfsproxy- instructions.html.en)

Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it.

Here's a bug report where we're working around the clock to get stuff going in a user friendly manner: [https://trac.torproject.org/projects/tor/ticket/5009#comment...](https://trac.torproject.org/projects/tor/ticket/5009#comment:17)

This kind of help is not for the technically faint of heart but it's absolutely needed for people in Iran, right now. It's likely that more than ~50,000 - ~60,000 Tor users may drop offline.

Watch this graph for an idea of the censorship impact of directly connecting Tor users: [https://metrics.torproject.org/users.html?graph=direct- users...](https://metrics.torproject.org/users.html?graph=direct- users&start=2011-11-12&end=2012-05-10&country=ir&events=on&dpi=72#direct- users)

Here's the same graph but for Tor bridge users in Iran: [https://metrics.torproject.org/users.html?graph=bridge- users...](https://metrics.torproject.org/users.html?graph=bridge- users&start=2011-11-12&end=2012-05-10&country=ir&dpi=72#bridge-users)

We're working on easy to use client software and if you're in Iran or need one desperately, please email help at rt.torproject.org. We'll try to get you a working obfsproxy bridge address and working client software.

All the best, Jacob "

</comment></comment><comment><USER11> FYI, Jacob Applebaum just asked[1] people to set up TOR bridges using a new protocol called obfsproxy[2].

1: <https://twitter.com/#!/ioerror/status/167922546807812096> 2: [https://www.torproject.org/projects/obfsproxy- instructions.h...](https://www.torproject.org/projects/obfsproxy- instructions.html.en)

<comment><USER12> I would be willing to set up a bridge but how can we get the bridge IPs to those who need them?

<comment><USER13> See [https://lists.torproject.org/pipermail/tor- talk/2012-Februar...](https://lists.torproject.org/pipermail/tor- talk/2012-February/023070.html)

 _Currently if you run such a bridge, you'll either need to manually tell us (via email to tor-assistants at torproject.org ) about it or you'll need to share these bridges with people you want to help directly. It's a pain and we're working on it._

</comment></comment></comment><comment><USER14> This is why good old analogue amateur or personal radio should still be a powerful force for people who are rebelling against their governments and corporate overlords.

The Internet is easy to kill, as are digital cell-based radio networks. Proper amateur radio is not.

Jamming is not that effective over a large area before anyone suggests that.

<comment><USER15> but it's easy to triangulate the broadcaster and take measures (imprison, torture, kill).

I lived through the communist era in Poland. Amateur radio stations were banned and prosecuted (you would go to jail), even possession of a CB radio was a crime. Things may be similar in Iran.

<comment><USER14> It's not that easy and there are simple anti-triangulation countermeasures you can use. It's possible to drop decoy transmitters/relays, which are easy enough to knock up and are cheap. You can also use refraction to "bounce" HF radio waves off the ionosphere to mask the source. You can scramble the signals. You can disguise the signals as legitimate but include carrier data. There are lots of ways of hiding what you are doing.

As usual, if you don't take precautions, that will happen.

Pirate radio stations were and still are common in the UK, particularly around London. They move around regularly and broadcast for short periods so it's hard to trace or predict a location.

The same conditions apply here.

<comment><USER16> Umm, you make it look like a trivial problem to solve, which IMHO is not the case when you take the fact you can risk life in prison or death in to the account. I'm from ex-communism country - where a lot of successful broadcastings happened, nevertheless, they got always identified at the end of the day - and then, guess what happened. When you are facing such restrictive conditions, even signal itself is good cause to get you in trouble - no matter whether the information carried is understood/sniffed or not, bounced or not. Anti-triangulation measures you are talking about have IMHO no practical use as long as anyone on the other side is using mobile radio signal detectors. Or if you know about real world application - I'd love to learn about it. Cheers

<comment><USER14> It's not trivial - but it's not unsurmountable.

Regarding triangulation, it's about finding the source. The source is hard to track reliably if it moves, especially away from the detection devices or rapidly out of range. Try tracking a broadcast source from a vehicle driving around you in a circle. If it's omnidirectional you'd have to be in the line of sight. If there is interference across the band, selectivity of the RDF recievers is compromised. Radio direction finding is surprisingly painful.

Hint: The anti-triangulation measures are actively used on Clansman radio sets.

</comment></comment></comment></comment></comment><comment><USER17> They control the physical network. As long as they have that control they will be able to do what they want. The only way to deal with these fuckers (not just Iran) is to start using collectively Ipsec or something similar. All SSL movement is just the beginning. I'm sure every big service will try to encrypt it's traffic more and more to protect itself from governments that try to criminalize their users.

Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks.

It's a shame that we are so paranoid as a species that we need to do that, but I don't see any other way.

I know this is extreme, but I don't want to see the freedom I enjoy right now taken away by these obsolete power hungry entities.

<comment><USER18> >Forcing countries like China, Iran and US to go into dark ages if they don't use the new all encrypted networks.

The problem is some governments would be perfectly happy with that. In fact for the most repressive ones it's long term goal.

China wants to create a separate internet for Chinese users and they're half way there. They have their own local censored versions of Google, Twitter and Facebook. Soon most internet users in China won't care if the rest of the internet disappears. Likewise for Iran, except they have been more open about it [1].

[1] [http://online.wsj.com/article/SB1000142405274870488940457627...](http://online.wsj.com/article/SB10001424052748704889404576277391449002016.html)

<comment><USER19> Maybe but they'll lose the productivity gains from networked organizations and communities. China can grow a long way without those gains, but they'll eventually hit a wall.

<comment><USER18> >Maybe but they'll lose the productivity gains from networked organizations and communities

Absolutely but the effect will be not be huge in my opinion because of the language differences. All my Chinese friends here in the EU still use mainly Chinese language website, most of which are based in China, especially the social networking ones.

<comment><USER19> Companies aren't going to manage inventory, customer relations or finance over open channels. So they'd reduce the gains from networking their own internal communications.

They could try to mitigate by rationing secure channels, or allowing them with backdoors, but this still sacrifices the spontaneous creativity of a truly open system.

<comment><USER18> You make a good point. It certainly would discourage or kill small businesses but, as you suggest, I'm sure larger more powerful ones will get special treatment (native ones particularly so). Considering China was willing to let Google leave the country it appears that the balance of power is shifting already.

</comment></comment></comment></comment></comment></comment><comment><USER20> That sucks, in Pakistan they're banning websites left and right, most of the websites can be accessed with Proxy but I have to use VPN just to upload files now. It's not only the porn websites they're banning, websites like pastebin etc. are getting axed as well.

In short, if any website goes against their stupid and yes effed up ideals they will ban it. The ISP's can't do anything because they're forced to comply.

Forget ACTA or SOPA, these idiots just do whatever they wish.

</comment><comment><USER21> Moreover, SSH has stopped working, too. But, finally I found a way to circumvent it. A simple twist in the client side, could simply bypass the filtering.

I wrote a simple script to do this, and I would like to share it with all of my countrymen:

[https://launchpad.net/~mohammad- sepent/+archive/ppa/+package...](https://launchpad.net/~mohammad- sepent/+archive/ppa/+packages)

To use it, just replace ssh command with issh like this:

issh user@hostname [other-ssh-options]

<comment><USER22> Where is the link to the required changes? Binaries = scary. Also, an SSL link doesn't seem useful?

<comment><USER18> I took a look at it. It's not a binary. It's a python file (easily readable) that acts as a wrapper for ssh. Extract the contents of the tar.gz[1] for example to see it. It's great if it works because it apparently doesn't need changes to the remote ssh server.

[1] [https://launchpad.net/~mohammad- sepent/+archive/ppa/+files/i...](https://launchpad.net/~mohammad- sepent/+archive/ppa/+files/issh_0.0.1.tar.gz)

Edit: Non SSL link: [http://ppa.launchpad.net/mohammad- sepent/ppa/ubuntu/pool/mai...](http://ppa.launchpad.net/mohammad- sepent/ppa/ubuntu/pool/main/i/issh/)

<comment><USER22> Thanks for digging into this.

</comment></comment></comment></comment><comment><USER23> Almost all websites that worth visiting are either blocked by Iranian government or by US export laws (SourceForge, Google Code, ...) so people rely heavily on VPNs and proxies. One of the most used proxies is YourFreedom[1] that offers a special service for Iranian people (a free 512 kbps socks proxy). It sounds great, but unfortunately they have been compromised. About 10 months ago, I contacted them (they didn't respond, which makes me a little worried).

It looks like Iranian government uses a transparent proxy, so all connections to ems01.your-freedom.de (ems01 through ems24) first redirect to iran.ir and _then_ go to YF's servers!

 _(YF is blocked right now, so I can't re-do this test right now. These images are from my email to YF 10 months ago)_

<http://www.imeezo.com/v/images/49229825994939115647.png>

<http://www.imeezo.com/v/images/46490363986030440278.png>

A page accessed without a VPN/proxy: <http://www.imeezo.com/v/images/98155525346546936123.png>

The same page, but with a VPN: <http://www.imeezo.com/v/images/30239946359511647325.png>

In the third image, the response is from iran.ir's transparent proxy, not YF servers...

[1] your-freedom.de

</comment><comment><USER24> I am really passionate about this problem. We are currently working on the VPN solution for consumers and I could dedicate some of our servers for this to develop a VPN that would work when governments shut down encrypted connections. where should we start? it it even feasible to do a secured tunnel hidden in normal traffic undetected?

<comment><USER25> You can tunnel anything over anything. You'd just start with a generic URI to negotiate the secure connection before sending the real requests/responses.

<comment><USER24> Yes - Already looking at this HTTP tunnel (<http://www.nocrew.org/software/httptunnel.html>) that someone else posted here.

I am wondering whether this approach is better than the one someone else suggested - connecting to a streaming server (like OnLive) - I guess streaming server could be made more undetectable, but more expensive to run

</comment></comment></comment><comment><USER26> If you can't believe that governments are using deep packet inspection and block access to popular sites have a look at the 28C3 talk How governments have tried to block Tor \- <http://www.youtube.com/watch?v=DX46Qv_b7F4> it covers different governments and how they tried to block access to the TOR network

</comment><comment><USER27> And here I was, about to ask HN to force SSL on the login page..

<comment><USER23> Please... don't. I have enough trouble with GitHub right now. Those guys enforce SSL not only on login page, but on all pages - yesterday it took me 2 hours to clone a github project (that was only 30k).

</comment></comment><comment><USER28> So its time to grab our steganography handbooks and build a cute little animal picture channel patch for open ssh.

</comment><comment><USER29> We Chinese use VPN or SSH port forwarding.

<comment><USER30> They drop all encrypted connections. Which means you cant even make a VPN or SSH connection.

<comment><USER9> Which basically means you need to do encryption in a manner that doesn't look like encryption, inside of something that's unencrypted. For example over DNS, inside of HTTP, or other protocols designed for moving code like RPC.

<comment><USER19> Maybe embed the cipher text in files for images, video or music?

</comment></comment></comment></comment><comment><USER31> Are there any solutions for web browsing like Onlive (<http://www.onlive.co.uk/>) does for video gaming? It would be significantly harder for them to datamine a video stream..

<comment><USER32> That is actually how the iOS Flash players like iSwifter and Photon works. It's just a video stream (seen from weird MPEG-compression artifacts) to a Linux VM running Firefox.

<comment><USER31> So would this not be ideal for getting through government censors?

<comment><USER24> My impression is that it could be ideal - but it needs much more bandwidth on the client side, as well as server side - making it expensive to run

<comment><USER31> But perhaps for sites which are static (in animation) and not interactive like gmail and other email systems it may perform well.

</comment></comment></comment></comment></comment><comment><USER33> Realise ALL encryption handshake are blocked but _Maybe_ this might work.

<https://github.com/stealth/sshttp>

You do need a server on the 'outside' though. (oh bugger, github uses https)

</comment><comment><USER34> Hello! You can use encrypted Secure SMS for Android. The app is free, and available at: [https://market.android.com/details?id=com.atomcloud.metrobud...](https://market.android.com/details?id=com.atomcloud.metrobuddy)

The instruction manual is at: <http://web.atomcloud.com/apps/metrobuddy- secure-sms>

the app needs no licensing, so can be passed from phone to phone via SD card. Good Luck!

</comment><comment><USER35> Is it possible to bypass their physical network altogether? For example, is satellite Internet available/legal over Iran?

<comment><USER36> Satellite dishes are illegal in Iran.

</comment></comment><comment><USER37> Most posts here are about tunneling, which is akin to whacking a mole and not a solution.

The only solution is in space, or a mesh net run by citizens, <http://www.reddit.com/r/darknetplan/>

</comment><comment><USER38> Maybe <http://m.gmail.com> ?

What about ssh tunneling over an alternate port?

Gosh I cannot believe governments that do this to their people.

I wonder if they are ironically using American engineered equipment and software to do the block too.

<comment><USER30> They drop ALL encrypted connections. You cannot even make a normal ssh connection, since they drop the connection during handshake. (SSH has been disabled for a few months)

<comment><USER39> What about ssh over port 80? I realize that would have to be set up in advance from outside the country, but the question is are they using port numbers to aid in their filtering or deep packet inspection?

<comment><USER40> If they are dropping all encrypted connections, it doesn't matter what port you use for ssh, it'll be dropped.

<comment><USER41> How do they know it's encrypted? I mean would they block something that looks like gibberish but was plain text over port 80?

<comment><USER42> I like that idea. You could encode a block of octets with plain words. "\xC3\x08\x00\x23\xFA" would then actually travel on the wire as "Was named prefer to use the other especially in, every cast a chuckle on neithout getting. Into useful informash speech makes removing a featuring a move or usage actual considered!", and be decoded back at the other end. You'd have to use common words so it looks as innocuous as possible.

<comment><USER43> I doubt you'd need to go to such lengths, otherwise you wouldn't be able to transmit binary data such as images, either.

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> Do SOCKS proxies work at all? One can test if they work. Xroxy.org is a good place to start. Email me at admin(at)alkasir.com to send you free socks proxy servers for testing.

<comment><USER23> No, they don't.

But thanks for the offer.

</comment></comment><comment><USER45> I've tested this as of today (2/10) and have technical details of exactly what filtering is going on, and what isn't.

tl;dr: Iran gov't is the actor, not ISPs; filtering most but not all SSL in a couple different ways; specific targeting of privacy tools & Google.

See here (will be updating it soon w/ more): [https://plus.google.com/u/0/103112149634414554669/posts/PT3e...](https://plus.google.com/u/0/103112149634414554669/posts/PT3eEF4u415)

</comment><comment><USER46> Is Tor still working?

<comment><AUTHOR> I used to use Tor with firefox before but with my internet connection it was very slow.

<comment><USER46> Sadly from what I know, that's because of the lack of nodes. But you can volunteer!

<https://www.torproject.org/getinvolved/volunteer.html.en>

</comment></comment></comment><comment><USER47> Would it be possible to DDoS the deep-packet-inspecting routers with fake SSL handshake requests, or some partial part of it? Sort of like a TCP-SYN attack at the SSL level, and force them to give up DPI?

In other words, if we know that they are cutting off the handshake at the ServerKeyExchange phase, for example, couldn't we generate large amount fake SSL traffic that stops one step before that, cause the router to hang?

<comment><USER48> That would only work if the filter was an endpoint. The filter isn't making SSL connections, so it doesn't care if the other side stops mid-transaction. All it has to do is look at the headers and drop packets with the target SSL handshake header.

</comment></comment><comment><USER49> The invasion of Iran has been planned for many years. The occupation of the two countries immediately to the west and east of Iran were preliminary steps in the same long term military campaign.

I assume that this level of internet censorship will go away because it is playing into the hands of Western imperial propagandists who are working hard to "justify" or motivate the next major invasion.

</comment><comment><USER50> Does anyone know how they "shut down https"?

<comment><USER30> They drop all encrypted connections. This means no https, no IMAP over TLS and no SSH connections. (Im in Iran)

<comment><USER51> So where would one find SSL over http implementation? You know, you send your usual POST to a proxy, only the body would be an actual request. Whole handshake could probably be done like this. Not even the proxy would (wouldn't have to) know the content. Encrypted body could be translated to valid XML for extra effect.

<comment><USER52> I was just googling this and it looks like <http://www.nocrew.org/software/httptunnel.html> could handle that use case. (Another interesting idea I saw was to steg the data in cat pictures sent normally. I'm not sure if cat pictures are as big in Iran as in the US though such that even user-level analysis wouldn't be too suspicious if there's a ton of cats.)

<comment><USER53> I see three problems. The first one is that the Iranians would have to have their own JPEG images to sit in an "uploads" directory on the client, since what you're proposing is a very broad-scale steganography attack. (Or else we'd need a procedural way to generate a great number of images which look indistinguishable from real traffic that you might want to send. In any case we risk that the censors block image uploads and form POSTs.)

Second is, I'm not sure anyone has yet connected steganography with public-key cryptography, but it really does have to be done that way for plausible deniability, otherwise you can just look inside the packets. So, inside the first JPEG linked from index.html there is steganographically hidden a 2048-bit RSA public key, and communication consists of uploading steganographic requests of the form encrypt(public_key, shared_key) | encrypt(shared_key, request). The first segment, the server knows should be 2048 bits = 256 bytes long. My bsencode project (<https://github.com/drostie/bsencode>) might be useful for formatting the data-to-be-encrypted; you need to transmit something like 32 bytes for a key, 16 bytes for a nonce, 32 bytes of predictable plain text so that the server knows that the request is intentional, perhaps 16 bytes of unrelated randomness just to give the RSA packet some extra entropy, and perhaps we could already specify some aspects of the protocol and intended query in the header as well. The 256 bytes would be plenty to contain an entire handshake.

However, you would have to think long and hard about how the public key is encoded, since it's a two-part data structure and either part -- or the glue -- could "leak" the fact to an adversary able to do basic data-processing that there is an RSA key hiding in plain sight. Also the access pattern might leak this info -- how many places do you know which are important enough that Iranian citizens should have access to them, but follow a predictable pattern of "download HTML, download image, upload image"? The last part is the unique part; uploading images and lots of text is relatively uncommon.

The third problem that I see is the interaction problem: Iran can guess at steganography by its access pattern, lots of large HTTP uploads followed by HTTP downloads -- but it can then _confirm_ the guess by sending its own requests to the same server and validating that it gets valid responses back. So you can target the system by simply trying to use it.

This last problem is much harder, I think. One obvious solution is to only handle one client at a time -- but that is dangerous because it paves the way for denial of service attacks from the government; they just take download of index.html followed by a GET request for a JPEG and try to send their own steganographic request, tying that server up with respect to real traffic.

Mounting a good steganographic attack against the people who run the communications infrastructure is going to be very difficult indeed.

</comment></comment></comment></comment></comment><comment><USER54> All the companies who provide censorship knows hows to Iran should be banned for ever.

To download Hotspot Shield, TOR or Ultrasurft

Visit <http://www.unblocker.co.nr> or <http://www.proxysoftwares.co.nr>

</comment><comment><USER55> Shutting down the borders in advance of military action. They don't want sensitive data getting out.

</comment><comment><USER56> Any update from Iranian users on the current situation? Are the blockages still in force? I covered this issue for Ars Technica on Friday: <http://arst.ch/sg1> and would like to be able to provide an update. Thanks.

</comment><comment><USER57> Would running through a socat tunnel (<http://freecode.com/projects/socat>) defeat the DPI?

If yes, you could setup a tunnel on port 80 and then run openvpn through it.

I did this for a friend in China and it worked.

</comment><comment><USER58> Pure speculation here, but would it be possible to use some kind of exotic Content-encoding HTTP header to avoid the DPI checks?

Of course it would also have to be implemented on the server-side but that's another problem.

</comment><comment><USER59> Hi,

Just let you know that I used that when I'm in "not-really-freedom-friendly- country" =)

<http://nihilex.com/obfuscated-openssh>

Slow but works =)

</comment><comment><USER60> Can you get a virtual server with SSH running on port 80?

</comment><comment><USER61> As it so happens, I've spent the last day trying to break in through the technical restrictions of a regime from the outside. There is a country with a very oppressive government that prevents outsiders from observing them. It's a tiny island monarchy that doesn't matter much in the grand scheme of things, but you may have heard of them; it's called the "United Kingdom" or "Great Britain" or whatever.

If you don't live within their control, they don't want you to see the propaganda they put out on their "British Broadcasting Corporation" (BBC) television stations and web site. Needless to say, there are ways around their entirely pointless technical restrictions.

(Note_To_Self: As somewhat dyslectic person, I'll never forgive patio11 for nick-naming his product "BCC").

I would like to say that by-passing government sanctioned Internet restrictions is simple and easy, but it's not true. Doing it safely can be impossible at times, and considering the rather severe punishments for getting caught (i.e. death), it may not be the smartest choice you could make. If you want to take your chances, there are often technically possible ways to by- pass the restrictions. It's not easy, and it may not be entirely safe, but usually, it _is_ technically possible.

There are free solutions out there like Tor ("The Onion Router" <https://www.torproject.org/>), but they mostly suck. If you don't believe me, then just try using them. The other problem with the free solutions is a lot of government filtering knows about them and adjusts accordingly (when possible). There is also a lot of monitoring an profiling done on the traffic on the free solutions like Tor since the traffic _is_ interesting.

If you need a solution that sucks less, you'll need to pay for it. As much as many would like to believe otherwise, bandwidth and servers are not free, so when a service is unable to support itself through advertising, then you'll need to pay for it. The commercial VPN vendors are more reliable and have far better security, privacy and performance than the free alternatives.

I've been a paying customer of <https://www.tunnelr.com> for over a year, and really enjoy their service. I'm on friendly terms through email with the two founders, Daniel and Jared, so I'm probably guilty of some sock puppetry or fanboyism. They also run the "devio.us" free shell provider service which is very impressive.

The thing to realize is the people responsible for controlling the network you are on and enforcing the restrictions probably have a way out of their own. It could be that their "day job" gives them access to the "other" side of their censorship filters, or possibly they've left a few holes here and there that they can use to by-pass their own filtering system. If the latter, it's probably done with a VPN of some sort.

In the case of a good commercial service like tunnelr.com, you don't need to worry too much about figuring out where things were left open.

Typically, if UDP traffic is found going to port 53, most people expect it to be DNS lookups from client systems. Again typically, if TCP traffic is going to port 53, most people expect it to be DNS lookups done by DNS servers. Of course, if you see TCP traffic going to port 80, you'd expect it to be going to a web server...

The common expectations are not "wrong" in most situations, but these expectations _can_ be wrong if things are configured differently.

In the case of good VPN services, things are configured differently!

For example, I can use TCP and connect to port 80 but establish a SSH connection, or use UDP and connect to port 53 but establish an OpenVPN connection.

This kind of trickery will not fool filters with the capacity to do "Deep Packet Inspection" ("DPI" e.g. protocol profiling), but the vast majority of filtering tech out there can't do deep packet inspection all of the time. It requires too much computation to be effective on fully saturated links, so it slows things down terribly. There are a few products out there that can do DPI at "wire-line" speeds, but they are hellishly expensive and fairly difficult to manage properly.

BTW, if you go the SSH route, check out dsocks by Dug Song. It runs on most UNIX systems, on MacOS, and on MS-Windows through cygwin.

EDIT: I totally forgot about countless the payment options you have available in Iran (i.e. none). If that's an issue for you, contact me privately (email address is in my HN profile).

<comment><USER26> But DPI is used in Iran and just using different ports does _not_ help

<comment><USER61> Do you have any supporting data for your statement?

I'm not trying to be an ass by asking; I'm actually curious, but testing it myself (American) is not particularly smart.

Anyhow, if DPI is in place and at wire-speed (rare, but would cover everything), then the answer is obvious; ssh over http. It can be done with gothard [1] and corkscrew [2].

[1] <http://www.nazgul.ch/dev.html> [2] <http://www.agroman.net/corkscrew/>

<comment><USER26> Only from the TOR guys:

\- [https://blog.torproject.org/blog/iran-blocks-tor-tor- release...](https://blog.torproject.org/blog/iran-blocks-tor-tor-releases- same-day-fix) Iran detects ssl parameters and block suspicious connections (they based it on the expiry time of the session certificates)

\- [http://www.telegraph.co.uk/news/worldnews/middleeast/iran/83...](http://www.telegraph.co.uk/news/worldnews/middleeast/iran/8388484/Iran- cracks-down-on-web-dissident-technology.html)

\- [http://www.christopher-parsons.com/blog/technology/is- iran-n...](http://www.christopher-parsons.com/blog/technology/is-iran-now- actually-using-deep-packet-inspection/)

Btw. it is not only Iran running country wide DPI - have a look at <http://www.youtube.com/watch?v=DX46Qv_b7F4> about the different techniques currently used to block/prevent access to VPNs/Tor etc.

(edit: added some additional links)

<comment><USER61> thank you!

</comment></comment></comment></comment></comment><comment><USER62> aaawwwww mannn... :(

</comment><comment><USER63> So no more online banking, no more credit cards? Whatever businesses they have are fucked, when it comes to secure communication.</comment>


Ask HN: Help me on licence pricing of my android app. - <AUTHOR>

One of the chinese android oem manufacturers wants to license my app and they have asked me about my business model for app licensing. The problem is i have no idea how app licensing works and what would be the proper pricing for license of my app. I would be glad if you can give some insights about it.
PS: They have asked business model for both pro and lite version.
Here is the app in question. https://play.google.com/store/apps/details?id=com.lyrebirdstudio.colorme <comment><USER2> I'd say 80 cents up to a dollar on every device sold for the pro version. The lite version should remain free. Both will drive more purchases for your other pro products. It would be better if you could bill the manufacturer for the number of devices produced, just like Microsoft did with DOS. Otherwise you could count only on customers' willingness to upgrade the software to the pro version. The shareware model of reducing functionality after x number of days would motivate them to upgrade.

</comment><comment><AUTHOR> Here is the app in question. [https://play.google.com/store/apps/details?id=com.lyrebirdst...](https://play.google.com/store/apps/details?id=com.lyrebirdstudio.colorme)</comment>