5 ms·

For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characterist

For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characteristics in network traffic so that GFW cannot easily block it by deep traffic analysis. clowwindy is the original author.

verroq 11y ago
Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.
- hipaulshi 11y ago
  SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or through <10 lines of json. On the client side the author and other contributors developed native clients that allow connection by supplying just 1 password and 1 server address. Super simple and highly reliable to this day.
  - deleted 11y ago
    [deleted]
  - hipaulshi 11y ago
    @olalonde GFW is known to tighten the control on national holidays or any event they see fit. The day after Tianjin explosion, IKEV2 stopped working for 1 day on my network (I was in Beijing). PPTP from time to time suffer the same issue though I couldn't say when. Also check your ip location, I found out one provider was having reliable PPTP connection about a week ago, and it turned out they were just relaying traffic in a data center in China. Those traffic are not blocked by GFW as long as it is domestic and I could only imagine that data center simply forwarded the traffic onward using other means.
  - verroq 11y ago
    So looking at the code for the Go implementation, it appears to be just a stream cipher encrypted version of SOCKS5 [1,2]. 1. https://github.com/shadowsocks/shadowsocks-go/blob/master/shadowsocks/conn.go https://github.com/shadowsocks/shadowsocks-go/blob/master/sh... 2. https://github.com/shadowsocks/shadowsocks-go/blob/master/cmd/shadowsocks-server/server.go https://github.com/shadowsocks/shadowsocks-go/blob/master/cm... (Not the best code, a couple of race conditions in there)
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - hurin 11y ago
    Why not just wrap all your SSH packets as HTTPS?
    - verroq 11y ago
      This I wonder as well. stunnel + openvpn used to work. Not sure if it still does.
    - PeterisP 11y ago
      I believe that the traffic patterns (up/down request amount and timing) will still look sufficiently different from a 'normal' https connection to be detected and cut off within an hour.
- jjgod 11y ago
  SSH tunnel is just too easy for the GFW to detect, it's so unstable that you cannot even browse the web with it. Yes, setting up a VPS provider would be the most common way. There are Shadowsocks implementations that supports multiple users so that more than one person can use it simultaneously. There are also commercial solutions for Shadowsocks that you can just purchase an account instead of setting up your own server.
- bitinn 11y ago
  SSH still work, but it's not designed to give a high throughput, so ideally one would not want to watch a youtube clip over SSH. And DPI can identify and kill SSH session when there are too much traffic happening over it (ie. no obfuscation is taking place to hide SSH traffic)
- JonnyGreenwood 11y ago
  There are many import/export companies in China, they are also the target audience of this software. Gmail is important for them.
bitinn 11y ago
And to add more context: Shadowsocks isn't just a tool nowadays, it's a group of applications that target both developers and common folks. People have built successful VPN services using Shadowsocks, and they are available on many platforms, like routers and embedded systems. And the iOS version is more or less the author's recent efforts to build a VPN client that can run on non-jailbroken iPhone, much like Cisco AnyConnect. I think shadowsocks' popularity as a whole concerns the chinese government, so they do their usual rooting out the leader thing: now that shadowsocks org is headless in the literal sense (no owner, no main repo), they hope its development will die out.
- Coding_Cat 11y ago
  What is to stop any non-chinese person from rehosting the old code? I mean, they obviously wouldn't like it and if I was said person I'd never visit China's sphere of influence again...
  - DanBC 11y ago
    I guess nothing. There are plenty of people on HN who are i) wealthy ii) interested in beating censorship. It'd be nice to see some effort going into creating software to beat censorship; having excellent translations of the documentation into a variety of languages; etc.
  - phlyingpenguin 11y ago
    There are tons of forks of it on GitHub, naturally. I had to go to one to figure out what the project was. https://github.com/shadowsocks/shadowsocks-iOS/network https://github.com/shadowsocks/shadowsocks-iOS/network
- njloof 11y ago
  Is this the same? http://liguangming.com/shadowrocket http://liguangming.com/shadowrocket
nialv7 11y ago
I believe GFW doesn't do traffic analysis just yet. Otherwise shadowsocks won't stand a chance either.

verroq 11y ago

Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.

hipaulshi 11y ago
SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or through <10 lines of json. On the client side the author and other contributors developed native clients that allow connection by supplying just 1 password and 1 server address. Super simple and highly reliable to this day.
- deleted 11y ago
  [deleted]
- hipaulshi 11y ago
  @olalonde GFW is known to tighten the control on national holidays or any event they see fit. The day after Tianjin explosion, IKEV2 stopped working for 1 day on my network (I was in Beijing). PPTP from time to time suffer the same issue though I couldn't say when. Also check your ip location, I found out one provider was having reliable PPTP connection about a week ago, and it turned out they were just relaying traffic in a data center in China. Those traffic are not blocked by GFW as long as it is domestic and I could only imagine that data center simply forwarded the traffic onward using other means.
- verroq 11y ago
  So looking at the code for the Go implementation, it appears to be just a stream cipher encrypted version of SOCKS5 [1,2]. 1. https://github.com/shadowsocks/shadowsocks-go/blob/master/shadowsocks/conn.go https://github.com/shadowsocks/shadowsocks-go/blob/master/sh... 2. https://github.com/shadowsocks/shadowsocks-go/blob/master/cmd/shadowsocks-server/server.go https://github.com/shadowsocks/shadowsocks-go/blob/master/cm... (Not the best code, a couple of race conditions in there)
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- hurin 11y ago
  Why not just wrap all your SSH packets as HTTPS?
  - verroq 11y ago
    This I wonder as well. stunnel + openvpn used to work. Not sure if it still does.
  - PeterisP 11y ago
    I believe that the traffic patterns (up/down request amount and timing) will still look sufficiently different from a 'normal' https connection to be detected and cut off within an hour.
jjgod 11y ago
SSH tunnel is just too easy for the GFW to detect, it's so unstable that you cannot even browse the web with it. Yes, setting up a VPS provider would be the most common way. There are Shadowsocks implementations that supports multiple users so that more than one person can use it simultaneously. There are also commercial solutions for Shadowsocks that you can just purchase an account instead of setting up your own server.
bitinn 11y ago
SSH still work, but it's not designed to give a high throughput, so ideally one would not want to watch a youtube clip over SSH. And DPI can identify and kill SSH session when there are too much traffic happening over it (ie. no obfuscation is taking place to hide SSH traffic)
JonnyGreenwood 11y ago
There are many import/export companies in China, they are also the target audience of this software. Gmail is important for them.

bitinn 11y ago

And to add more context: Shadowsocks isn't just a tool nowadays, it's a group of applications that target both developers and common folks. People have built successful VPN services using Shadowsocks, and they are available on many platforms, like routers and embedded systems. And the iOS version is more or less the author's recent efforts to build a VPN client that can run on non-jailbroken iPhone, much like Cisco AnyConnect. I think shadowsocks' popularity as a whole concerns the chinese government, so they do their usual rooting out the leader thing: now that shadowsocks org is headless in the literal sense (no owner, no main repo), they hope its development will die out.

Coding_Cat 11y ago
What is to stop any non-chinese person from rehosting the old code? I mean, they obviously wouldn't like it and if I was said person I'd never visit China's sphere of influence again...
- DanBC 11y ago
  I guess nothing. There are plenty of people on HN who are i) wealthy ii) interested in beating censorship. It'd be nice to see some effort going into creating software to beat censorship; having excellent translations of the documentation into a variety of languages; etc.
- phlyingpenguin 11y ago
  There are tons of forks of it on GitHub, naturally. I had to go to one to figure out what the project was. https://github.com/shadowsocks/shadowsocks-iOS/network https://github.com/shadowsocks/shadowsocks-iOS/network
njloof 11y ago
Is this the same? http://liguangming.com/shadowrocket http://liguangming.com/shadowrocket

nialv7 11y ago

I believe GFW doesn't do traffic analysis just yet. Otherwise shadowsocks won't stand a chance either.