Architect of China's Great Firewall Embarrassed After Needing To Use VPN (shanghaiist.com) 106
An anonymous reader writes: Fan Binxing, architect of the China's infamous Great Firewall, was put in the embarrassing position of having to use a VPN in front of a live audience when trying to access a blocked web page. Fang Binxing was giving a speech on internet safety at his alma mater, the Harbin Institute Technology. During the speech, he presented a defense for internet sovereignty and used North Korea's own version of the system as a talking point. Things got awkward really fast, however, when he attempted to access blocked web pages hosted in South Korea to demonstrate his point. From there his speech went from being a defense of the Firewall to a demonstration of its stupidity. Unable to access the websites he needed to continue his speech, Fang somewhat unexpectedly resorted to the same illicit tool which all expats in China are all familiar with: the beloved VPN. This raises one question: Is China's Great Firewall that easy to circumvent, or are members of the government treated differently than normal citizens?
Raises one question.... (Score:1)
I believe that's two questions....however, there is only one answer.
Re: (Score:3)
When you have a government VPN catering to about 1/2 of the world's population. You cannot sufficiently lock it down to an ideal settings, as even if you have 1% of the population deserving and exception that is 30 million people who you need to modify. Because of this, it is very easy to find a flaw, as there is a lot of holes to take advantage of.
Also the problem with communism is the idea in order for it to function the entire population will need to be onboard with the communal living. That just can
Re:Raises one question.... (Score:5, Interesting)
It really is the same psychological trick that the Communist regimes have been using since the beginning. They've never been able to censor information completely, even in the pre-Internet age it was an impossible technical problem to fully solve. So you play a psychological warfare game instead. So long as the citizens think you have the ability, and that if they read a forbidden book or a forbidden website, that somewhere the vast colossus of state security, a light will flash and a klaxon will go off, and very serious men will appear at your doorstep and you won't be seen again. You reinforce that by making the odd citizen disappear here and there, to build up society's paranoia. The whole point is to make people police themselves.
That's why the Great Firewall, and the versions that other countries, even some so-called "liberal" democracies are creating, are as much a form of security theater as an actual control on reading forbidden content. These firewalls are like a polygraph test, they are effective because people believe they are effective, so they don't need to actually get anywhere near 100% success rate in blocking content and recording attempts. Heck, I doubt they even have to approach 50%.
Re: (Score:3)
somewhere the vast colossus of state security, a light will flash and a klaxon will go off, and very serious men will appear at your doorstep and you won't be seen again
What first hand stories do you have to support this?
As someone grew up in China in the 80's, we listened to Voice of America for 10 years and not a single serious man or woman ever appeared at our doorstep. What you said would be true in the Cultural Revolution period in the 70's, and I have first hand story too: when I, as a 5 year old, tried to fold a piece newspaper into a boat, my sister who was 5 years older stopped me because there was a picture of Chairman Mao.
Today, I also have friend there doing VP
Re: (Score:1)
"'Communism doesn't work because people like to own stuff." - Frank Zappa
"Under Capitalism, man exploits man. Under Communism, it's just the opposite. - J. K. Galbraith
Re:Raises one question.... (Score:5, Interesting)
Blocking 99% is good enough. China is not trying to totally block outside information. They are just trying to keep a lid on organized dissent. Western news publications are commonly available at newsstands, although an occasional story on Tibet, or Xinjiang, or Xi Jinping's offshore bank accounts, will be torn out. Most urban Chinese are better informed about what is going on in the world than typical Americans. China is actually more worried about social networks, where people can organize outside of party control. So Facebook is blocked, and instead they have WeChat and QQ, which are monitored and controlled.
Also, the Chinese Firewall is not "stupid". It may be evil, but it is not stupid. It is very effective at accomplishing its goals.
China has never even tried to implement a classless society. In fact, they did the opposite, by strengthening feudalism and binding the poor to the land. Everyone in China is issued a Hukou [wikipedia.org] identification card at birth, that has their hereditary class printed on it. If you have the "wrong" class, as 80% of the population does, then you can be deprived of public education, housing, and even food. 99% of the 30 million people that starved to death during the Great Leap Forward had low class (rural) hukous. Today, about half the children in big cities like Beijing and Shanghai, have no right to attend public school, or go to a public hospital.
One reason that the Chinese and outsiders see the Tiananmen Square incident very differently, is that the protesters never called for reform of the Hukou system. Outsiders see the protesters as heroes standing against oppression. Many Chinese see them as spoiled offspring of the urban elite trying to preserve their privileges.
Re: (Score:3)
thanks. Learnt something today. I never realized this was the basis of effectively a new class system
The main reason you haven't heard more about it, is because 99% of Chinese that are able to obtain visas and travel to the West belong to the privileged class, and have no reason to criticize a system that benefits themselves and their families.
Re: (Score:1)
The reason why China had set up a hukou system was to make sure that the social services that were provided in the cities wouldn't be overtaxed.
Nonsense. For every extra person given education or medical care in a city, is one less given those services in a rural village. So the cost is not higher to relocate the services. Migration to the cities started more than 30 years ago. That was plenty of time to adjust.
It's also no different than people who argue against illegal immigration.
More nonsense. Illegal immigrants are not citizens of the country denying them basic services. Also, their status is not hereditary. The child of an illegal immigrant is not considered an illegal.
It's not like children from rural areas DON'T get any education or health care. That's not true. They just have to go to school in THEIR area.
You are completely missing the point.
Re: (Score:1)
Their class has nothing to do with where they were born. It is inherited paternally. So their class is whatever is printed on their father's hukou (identity card). If they are illegitimate, and their father is not identified, then they are screwed, and have no rights to education or healthcare, regardless of their mother's social status.
Stop spreading misinformation. The hukou class of a child can follow either the mother's or the father's.
Re: (Score:2)
The hukou class of a child can follow either the mother's or the father's.
Here is a citation [chinadaily.com.cn] that says you are wrong. A quick Google search turns up many more. Illegitimate children in China (heihaizi or "black children") are denied many basic rights of citizenship.
Re: (Score:1)
Today, about half the children in big cities like Beijing and Shanghai, have no right to attend public school, or go to a public hospital.
There are many problems with the hukou system and most people in China do not like it at all. But you are spreading LIES. It may be difficult for a rural hukou child to get public education in a big city, but certainly not impossible. A rural hukou person can get services at any public hospital without any problem. He just doesn't have health insurance to cover his expenses.
Everyone in China is issued a Hukou [wikipedia.org] identification card at birth, that has their hereditary class printed on it.
Saying that hukou is hereditary is misleading. Except for the two megacities (Beijing and Shanghai), it's trivial to get a city hukou
Re: (Score:2)
it's trivial to get a city hukou if you have a college degree.
Riiiight, because the son of a rice farmer, banned from public schools, should have no problem getting a college degree. And if the peasants don't have bread, let them eat cake!
Re: (Score:1)
it's trivial to get a city hukou if you have a college degree.
Riiiight, because the son of a rice farmer, banned from public schools, should have no problem getting a college degree. And if the peasants don't have bread, let them eat cake!
"banned from public schools"? What a joke! You're sickening. Any one who has been to China should know that you're just telling lies.
Re: (Score:2)
One reason that the Chinese and outsiders see the Tiananmen Square incident very differently, is that the protesters never called for reform of the Hukou system. Outsiders see the protesters as heroes standing against oppression. Many Chinese see them as spoiled offspring of the urban elite trying to preserve their privileges.
The other reason is that Chinese school children are taught it never happened. I've actually had conversation with college aged kids from China who still don't believe it really ever happened.
Re: (Score:2)
Yep the answers is both. The ruling party gets special treatment and China's great firewall is mostly that easy to bypass. China does keep blocking various vpns which makes it a moving goal.
Re:Raises one question.... (Score:5, Informative)
When I was there, it was definitely not easy to circumvent. I tried multiple VPNs, dns tricks, all kinds of things, but my internet coverage was spotty at best. If I tried to go to any western news site for any reason, I'd find my phone either throttled to nothing or completely offline for hours or days.
They seemed to be cracking down on VPN usage via deep packet inspection and/or whack-a-mole with overseas endpoints.
I was there in November of 2014, so I can't imagine things have gotten much better.
Re: (Score:3, Informative)
Re: (Score:3)
Re: (Score:1)
I was in shanghai, oct 2015 and feb 2016.. I used a VPN all the time. The problem is that you get about 1-2 days of it working, and then it completely stops. We had to VPN over strange ports to an ip in chicago, then to germany, and keep moving them around. We got through, but it burned the hell out of our phone batteries pretty quick.
I'm sure (Score:4, Funny)
Re: (Score:3)
are members of the government treated differently than normal citizens
Name me country where this is not so?
Or, asked a different way, do you REALLY think Hillary is going to prison? Even if convicted?
He just happened to have one handy? (Score:5, Insightful)
So he just happened to have a VPN and an account all ready and set to go or is this a normal thing? I'm guessing it's the latter. I'm not sure why you'd be embarrassed about it. It's not like he just happened to notice while being shown live. He had one already there, installed, and an account configured.
By the way, I've been to China and, as near as I can tell, everyone that I met had a VPN - usually one of the 'free' ones that you load up in your browser as an extension. And no, they didn't seem embarrassed about it. Then again, they weren't live and the person who configured the firewall.
Re: (Score:2)
Nobody is truly embarrassed by the porn like until they have to watch it in front of an audience.
It is one thing to do something privately and something entirely different to do the same publicly. Especially when there is a reasonable chance of a prison sentence for doing so.
Re: (Score:2)
I'm not sure it's really private - as in, I witnessed people using them as I walked through outdoor areas and could see browser extensions. I've also discussed them, specifically, because I found the concept weird. (I'll touch on that in a moment.)
So, I don't really think it's all that private. An AC mentioned an interesting point below - that he'd surely visited the pages in preparation for his talk. He should have already known. Then again, maybe he'd told someone to have it unblocked for him by the time
Re: (Score:2)
I think that blocking by the GFoC is inconsistent. I don't know the factors, but I suspect that source IP address may affect what sites are blocked.
The GFoC changes all the time, but when I was there a small number of years ago, OpenVPN was being blocked. It appeared at the time that the system had some heuristics to detect encrypted streams. I read shortly after that playing with the MTU values would allow the OpenVPN-based VPN to connect. I found that SSH was not being blocked, so I just used that.
In this
Re:He just happened to have one handy? (Score:5, Interesting)
Or his personal computers where he works are outside the GFW, so he didn't realize the pages were blocked.
Re: (Score:2)
That's a good point, by the way. I hadn't thought of that. The poster below adds to it as well... It's not like the usage was hidden so I'm not sure why anyone would be embarrassed. Ah well. Their culture's quite different as is their politics.
Re:He just happened to have one handy? (Score:4, Interesting)
The real point of the firewall is probably like the driving code in the U.S. With regular law, what you do is legal unless explicitly stated to be illegal. But by loading up the books with thousands of little laws that everyone occasionally violates in the course of their everyday lives, you invert that situation. The government can just ignore enforcement of the law for 99.9% of people, but if you raise their ire they can arrest you and cite you for violating all those little laws that everyone else breaks every day. You are guilty as a byproduct of living, the government just picks and chooses which of the guilty need to be punished.
Re: (Score:2)
So he just happened to have a VPN and an account all ready and set to go
If you were the boss of such a firewall system wouldn't you have that all set up?
The real question here all Chinese people should be asking is, what VPN service does this guy use and how does on sign up?
Re: (Score:1)
Freegate [dit-inc.us]. It used to work pretty well, at least until 2012, and you didn't have to install it. I used to carry it around on a usb stick. So yes, people just happen to have one handy. It probably still works the same, but I'm not in China to tell.
Re: (Score:1)
Secondarily, in order to defeat the technological measures that he himself had created in order to protect China's 'innocence', hes fired up an extremely standard tool to bypass the blocking mea
Re: (Score:1)
Ain't cognitive dissonance grand?
Re: (Score:2)
Yup. I'd think he'd be as matter-of-fact about it as the rest of 'em.
Though, now that you mention it... The chances (two of them) that I had to interact with people who were fairly high-level government officials do bring that phrase to mind. I'd called it "role playing" to my traveling companion on multiple occasions but cognitive dissonance might be more accurate.
The answer is in the question (Score:2)
I would go one step further, the Chinese are supplying 'approved' VPN IP's for their government people, IP's that are probably green listed in the firewall.
Answer... (Score:5, Informative)
Yes and Yes.
Yes it's that easy to circumvent, and yes they are treated differently.
Re: (Score:2)
I'd have to say "Yes" and "Maybe".
The second question doesn't make sense as it is written. ...", or should it be "... differentlier than ..."?
Should it be "... different from
I'd say Yes to the first of those, but No to the second, as I believe the Chinese government is too big to have individual rules for all the apparatchiks.
If Only There Was a Website to Answer That! (Score:5, Insightful)
This raises one question: Is China's Great Firewall that easy to circumvent, or are members of the government treated differently than normal citizens?
If only we had a website the covered this sort of stuff ... oh right, we do [slashdot.org]! New VPN IP addresses probably take a while for them to identify the traffic on and block. But there are plenty of services like HMA that constantly roll out new ip addresses. So as long as you're a mouse willing to play whackamole with your cat overlords ... Annoying, yes, but that's the definition of the internet in China.
In response to the second part, that is always true regardless of the answer to the first part. Not only are members of the government are treated differently but also their families. The "party" class enjoys many many perks. Unmonitored VPN connections would be laughable compared to their insider trading, disregard for the law and instant attack dogs they routinely utilize.
While you're accepting suggestions, why isn't my aforementioned article linked in the "You may like to read:" section of this page? Those stories seem to have nothing to do with China's firewall yet a simple google search shows a whole slew of those stories on Slashdot. I think you could get timothy's family to help you track that stuff if you would return his body to them. They only want closure, it doesn't matter if it has to be a closed casket funeral!
Demonstration of whose stupidity? (Score:2)
Was it a demonstration of the "stupidity" of a firewall doing it's job (why he had to access those sites is not clear from TFS to me, nor what he tried to achieve with it), or the human stupidity of someone not properly preparing a presentation?
Study about the use (Score:2)
Here's perhaps a useful study about circumvention tools and usage, and what are the most common reasons to use them: https://www.openitp.org/pdfs/C... [openitp.org] It's from 2013 though. Anyway, from all the bit over 1000 respondents only 2 had never used any tool.
It is that easy (Score:2, Interesting)
American with a Chinese wife here, I was in China last year. I set up vpn service before I left, installed the android app, and it worked in china just fine. You won't have as much luck with TOR, it will be slow or unavailable a lot of the time (tried that too just for giggles when I was there). A large number of foreign born Chinese that are there for tourism or business use VPNs, usually with exit nodes in hong kong, korea, or japan. Several people there including at least one Chinese born one happily
Ethics (Score:2)
Seriously as engineers we need to have enough balls to say no and stand up to requests from employers to design/implement anything who's ultimate use is to do something immoral, such as suppressing individual freedom.
http://www.globaltimes.cn/cont... [globaltimes.cn]
Giiven the indisputable evidence that he actually did circumvent the Chinese firewall, I would love it if the Chinese arrested this joker. If I was Chinese I would have already filed a complaint against him.
Re: (Score:1)
[quote]Seriously as engineers we need to have enough balls to say no and stand up to requests from employers to design/implement anything who's ultimate use is to do something immoral, such as suppressing individual freedom.[/quote]
I'm sure some of the engineers in China do have enough balls to do that. Or they did, before the government made them disappear...
As long as they allow SSH, they're screwed (Score:2)
as long as you have shell access (doesn't even need to be root level) to an outside unix box running ssh, the great firewall is doomed. Its so easy to use putty to tunnel HTTP traffic, that almost anyone can do it.
http://www.techrepublic.com/bl... [techrepublic.com]
Didn't need VPN... (Score:2)
All citizens are equal... (Score:5, Funny)
Anyone can (Score:5, Interesting)
In graduate school, I asked a Chinese student about this. He said that anyone can get past the filters in China. He did it all the time. He also said, no one cared. The Chinese government didn't care if you did, but they cared if you talked about it. If you start posting things, blocked links or discussing politics in public forums in China, you can expect a knock on your door, fines, jail or worse. But as long as you don't talk about it, you can view whatever the fuck you want.
Re: (Score:2)
But as long as you don't talk about it, you can view whatever the fuck you want.
I wouldn't go quite that far. While I'm sure that there are subjects they will let you look at without talking to you, I wouldn't interpret to mean that there's not anything you can view on your own without having to, ahem, talk to the local authorities about. The CCP is still off the charts opposed to Falun Gong and nobody but the upper levels of the party itself seems to know exactly why this is. I've read several completely different explanations for this and they can't really be reconciled. My ex-gi
Huh? (Score:2)
How is this "evidence of its stupidity"? How does that even follow? If anything, it is evidence of its effectiveness. The website was deemed harmful to the citizens by the government, and it was blocked. Even the creator couldn't access it. I'd say, job well done.
Are members of the government treated differently from normal citizens? How is this even a question? Of course Communist governments think that intelligent people like Party members should be treated differently from the Great Unwashed and th
Re: (Score:2)
How is this "evidence of its stupidity"? How does that even follow? If anything, it is evidence of its effectiveness. The website was deemed harmful to the citizens by the government, and it was blocked. Even the creator couldn't access it. I'd say, job well done.
Except for the part where he then proceeded to trivially circumvent the filter and access the website anyway, using a technique any Chinese citizen could use to do the same, and which many do use to do the same.
Yes (Score:1)
There is only one answer, and offshore trust funds for China's Ruling Elites are the method to arrive at that answer.
Incorrect summary (Score:2)
Fang somewhat unexpectedly resorted to the same illicit tool which all expats in China are all familiar with: the beloved VPN.
No he didn't. He just used a VPN. VPNs are not illegal, they are not banned, people don't get in trouble for using them, and every multinational corporation doing business in China inadvertently bypasses the great firewall anyway. What is illegal is to view certain types of content but this does not include things that the wall blanket bans. Likewise China's VPN administrators attempt to counteract circumvention by blocking known VPN providers that exist for the purpose of bypassing the great wall, yet no o
Re: (Score:2)
Re: (Score:2)
The Chinese government is not one for blanket regulation of businesses. They are very careful of who and how they approach businesses. This is purely conjecture but I would put some money on the fact that wanting to monitor your VPN has nothing to do with keeping citizens uninformed about the outside world, and more to do with the fact that you're a foreign company and there's a potential to gain access to some information you have.
Industrial espionage is so much easier when you're welcomed in the front doo
Re: (Score:2)
The power of the state (Score:2)
Why either/or? (Score:2)
"This raises one question: Is China's Great Firewall that easy to circumvent, or are members of the government treated differently than normal citizens?"
Why is this an either/or thing?
Car analogy (Score:2)
Golf clap, China.
Re: (Score:2)
Not quite -- it's more like Chevrolet giving a public demonstration about how easy it is to get out of their cars in an accident, and then the person doing the demonstration gets stuck in the seat belt. Then, to finish the demonstration, they have to perform it again while not wearing a seatbelt.
It really is just that easy (Score:2)
For example, you can freely SSH from inside China to anywhere outside, except maybe some completely blocked IP address ranges. Certainly things work fine if you SSH to any of the AWS locations.
So, fire up a nano instance before you go to China, and run a proxy server on it. I think I used squid last time, but there are a billion choices. Then simply port forward localhost port whatever to your proxy, and tell the browser to find the proxy at localhost on that port. My advice is to set your proxy up to liste
VPN must for technical research in China (Score:2)
A VPN is a must living in China for technical research. Even Baidu's Chinese language result list is bad. I know they have the same information as google,( I see the bot searching my sites), but the order is terrible. Most of the world advance research in computers is in English. but Baidu English sorting algorithm is very much like the funny Chinglish signs [transparent.com]. For an engineer and other professionals to have access to the full internet will be required for China to advance and integrate into today's worl
Obligatory Orwell quote (Score:2)
"...or are members of the government treated differently than normal citizens?"
All animals are equal but some animals are more equal than others
Not fun making the Internet work there (Score:2)
Easy to circumvent (Score:2)
I spent four weeks teaching at two Chinese universities in 2014. All of the students were using VPN to circumvent the Great Firewall, and they all were using Facebook and Twitter. They were doing this openly in class. Circumvention is easy, well-known and seems to be fairly well-tolerated. I think it is tolerated with the students because they are using services like Facebook and Twitter for social activities. I expect there are Chinese government monitors watching what they say,and if they said the wrong t