5 ms·

> In this case there's not many reasons for it to be a native app instead of a Progressive Web App. This would simplify distribution. The opposite of this is t

by jsn 5y ago

> In this case there's not many reasons for it to be a native app instead of a Progressive Web App. This would simplify distribution. The opposite of this is true. Blocking a web application is very easy for Russian authorities, there are well-established legal and technical protocols for that, it's a routine, it happens every day. The opposition uses apps precisely because they are more difficult to censor.

leppr 5y ago
I see, that makes sense. The advantage of a web app is that it can be distributed in any number of ways though. It's trivial to take it and re-host it on different servers, as an onion service, or go the full decentralized route with IPFS or similar.
- beebeepka 5y ago
  Do you really think going through all that would be trivial to the masses?
  - leppr 5y ago
    Not now, but people adapt when there's an incentive. Already if you go in a country with restrictive internet, you'll find the average working-age person knows how to use a VPN. Regular drug users in western countries know how to use Tor. Hong-Kong protestors were using a bluetooth mesh network app.
- jsn 5y ago
  Yes, you can re-host, but propagating the new URL to your users will take days, and the authorities reaction time is, for high profile cases, measured in hours. Another interesting question is how will you propagate the new URL? To do that, you need some way to reach your users when your website is down. And if you have such a way, do you really need a website?
  - vbezhenar 5y ago
    Just e-mail people an update from random address with GPG signature. That should be the more resilient and hard to block way to communicate information. It's fun when the old proven tech proves superior to new shiny tech.
    - gatronicus 5y ago
      Just as the gov required google to remove the app they can also require the big email providers to block all emails with links to it. 99% of the people are on the big email providers. Also, you will quickly find out that sending many emails from random addresses (ie: spamming) doesn't work these days, they will be blocked by existing anti-spamming techniques, as evidenced by multiple posts on HN of people trying to do that from their own mail server. You need to go through a whitelisted mail service (MailChimp, ...) which is another block point.
      - vbezhenar 5y ago
        > Just as the gov required google to remove the app they can also require the big email providers to block all emails with links to it. You don't need to mail links, you just need to mail required information. Asking Google to filter out some specific e-mail (which could be somewhat randomized for every recipient) probably will not work. > You need to go through a whitelisted mail service (MailChimp, ...) which is another block point. Russia can't ask US service to deny making business with US citizen (for example). It's completely outside of their territory.
        gatronicus 5y ago
        > Russia can't ask US service to deny making business with US citizen (for example). It's completely outside of their territory. Not sure what US citizens have got to do with this. Russia obviously was able to order Google to block relevant apps and documents for Russian people. Why would they care that US citizens can still access them?
maccard 5y ago
So is this app using some other protocols that aren't DNS/http(s) that would make it immune to a dns level block? Because a native app that makes http calls is just as easy to block as a pwa
- patrakov 5y ago
  The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least several times per day.
  - maccard 5y ago
    The client still needs to receive those domains somehow though, and that's the tricky bit. Unless the domains are unique per user, the blocker can just install the app and block the domains as they change.
    - vadfa 5y ago
      You can embed the domains in the app, obfuscated. It's not foolproof but as long as they can't crack it in the few days that are left until the election...
  - aasasd 5y ago
    Is there a name for this technique, or a thorough description of it somewhere? So that I could put it in my bookmarks & notes.
    - patrakov 5y ago
      Domain Generating Algorithm. https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ https://blog.malwarebytes.com/security-world/2016/12/explain... Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.
      - 5y ago
vbezhenar 5y ago
What about onion website? Can Russia already block Tor?
- jsn 5y ago
  Not as of yet. Actually, if you use tor (with out-of-Russia exit nodes, which I think is the default when using it from Russia?), you can already freely access all the sites blocked in Russia, non-onion ones. But, obviously, tor and VPNs are good solutions only for people willing to go an extra mile to get to the prohibited content.
- neonbones 5y ago
  I'm not sure about Tor, but I know from my friends in Russian, who have direct access to this information, that the Russian government inherits all the practices and technologies from China, with DPI and all the things. Now even VPN + shadowsocks won't be a permanent solution. It's obvious cooperation of governments that can help each other, one with tech to control, and the other with cheap resources for manufacturing. (you can google how Russian almost sold part of territories to China, there are even cities where all the administration are Chinese).

by jsn 5y ago

leppr 5y ago

I see, that makes sense. The advantage of a web app is that it can be distributed in any number of ways though. It's trivial to take it and re-host it on different servers, as an onion service, or go the full decentralized route with IPFS or similar.

beebeepka 5y ago
Do you really think going through all that would be trivial to the masses?
- leppr 5y ago
  Not now, but people adapt when there's an incentive. Already if you go in a country with restrictive internet, you'll find the average working-age person knows how to use a VPN. Regular drug users in western countries know how to use Tor. Hong-Kong protestors were using a bluetooth mesh network app.
jsn 5y ago
Yes, you can re-host, but propagating the new URL to your users will take days, and the authorities reaction time is, for high profile cases, measured in hours. Another interesting question is how will you propagate the new URL? To do that, you need some way to reach your users when your website is down. And if you have such a way, do you really need a website?
- vbezhenar 5y ago
  Just e-mail people an update from random address with GPG signature. That should be the more resilient and hard to block way to communicate information. It's fun when the old proven tech proves superior to new shiny tech.
  - gatronicus 5y ago
    Just as the gov required google to remove the app they can also require the big email providers to block all emails with links to it. 99% of the people are on the big email providers. Also, you will quickly find out that sending many emails from random addresses (ie: spamming) doesn't work these days, they will be blocked by existing anti-spamming techniques, as evidenced by multiple posts on HN of people trying to do that from their own mail server. You need to go through a whitelisted mail service (MailChimp, ...) which is another block point.
    - vbezhenar 5y ago
      > Just as the gov required google to remove the app they can also require the big email providers to block all emails with links to it. You don't need to mail links, you just need to mail required information. Asking Google to filter out some specific e-mail (which could be somewhat randomized for every recipient) probably will not work. > You need to go through a whitelisted mail service (MailChimp, ...) which is another block point. Russia can't ask US service to deny making business with US citizen (for example). It's completely outside of their territory.
      - gatronicus 5y ago
        > Russia can't ask US service to deny making business with US citizen (for example). It's completely outside of their territory. Not sure what US citizens have got to do with this. Russia obviously was able to order Google to block relevant apps and documents for Russian people. Why would they care that US citizens can still access them?

maccard 5y ago

So is this app using some other protocols that aren't DNS/http(s) that would make it immune to a dns level block? Because a native app that makes http calls is just as easy to block as a pwa

patrakov 5y ago
The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least several times per day.
- maccard 5y ago
  The client still needs to receive those domains somehow though, and that's the tricky bit. Unless the domains are unique per user, the blocker can just install the app and block the domains as they change.
  - vadfa 5y ago
    You can embed the domains in the app, obfuscated. It's not foolproof but as long as they can't crack it in the few days that are left until the election...
- aasasd 5y ago
  Is there a name for this technique, or a thorough description of it somewhere? So that I could put it in my bookmarks & notes.
  - patrakov 5y ago
    Domain Generating Algorithm. https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ https://blog.malwarebytes.com/security-world/2016/12/explain... Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.
    - 5y ago

vbezhenar 5y ago

What about onion website? Can Russia already block Tor?

jsn 5y ago
Not as of yet. Actually, if you use tor (with out-of-Russia exit nodes, which I think is the default when using it from Russia?), you can already freely access all the sites blocked in Russia, non-onion ones. But, obviously, tor and VPNs are good solutions only for people willing to go an extra mile to get to the prohibited content.
neonbones 5y ago
I'm not sure about Tor, but I know from my friends in Russian, who have direct access to this information, that the Russian government inherits all the practices and technologies from China, with DPI and all the things. Now even VPN + shadowsocks won't be a permanent solution. It's obvious cooperation of governments that can help each other, one with tech to control, and the other with cheap resources for manufacturing. (you can google how Russian almost sold part of territories to China, there are even cities where all the administration are Chinese).