Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
VPN ban is strangling communication in Myanmar (irrawaddy.com)
126 points by PaulHoule on July 5, 2024 | hide | past | favorite | 74 comments


I wish VPN also considers DPI when they design their protocol. It just sucks that every self-claimed decentralized app can easily be blocked. They can block faster than you can host another new instance & migrate users.


Every VPN advertised in China takes DPI in account and there is a very huge community around how to circumvent GFW. The previously popular protocol was Shadowsocks (until GFW blocked fully random traffic) and now I use Hysteria2 (which masquerades itself as QUIC) and it has not been blocked yet.

In case your favorite VPN provider does not provide these protocols you can buy a VPS and deploy one of these protocols by yourself.


Is there any sort of criminal risk to playing cat and mouse with GFW censorship? Or are you generally free to just do your best to subvert the limitations put in place?


A quote from someone I know working in a related agency for “cybercrime” in China:

> If you just set it up and use it yourself, at most you will just be given a verbal warning and urged to rectify and confiscate the tools. If you set it up and give it to your friends to use, there may be risks, but in reality, law enforcement agencies usually don't have extra time to manage these small things. If you set it up for your friends to use, the traffic of three or five people is very small, just normal access to the external network, and there is no other illegal behavior such as money laundering, telecommunications fraud, etc. No one cares. If you are the airport owner, that is, the VPN commercial service provider, then your legal risk will be very high, you will be involved in illegal operation of telecommunications services, because this requires you to apply for a license, and VPN commercial service providers usually earn large illegal income, may be sentenced and confiscated for several years. Note that the sentence is due to its illegal operation. Once he has the qualifications, then he will be a legal communication service.

> Because such behavior can be subject to administrative penalties at most in the law, which is what I just said, warnings or orders to make corrections and confiscate tools, and at most fines, but generally not. The fine will be determined based on your attitude of admitting your mistakes. If your attitude is good, there will basically be no fine. In addition, if there is illegal income to be confiscated, such as illegal income obtained by browsing the Internet and conducting cross-border money laundering or cross-border telecommunications fraud or computer network crimes with international illegal organizations, it will be confiscated.

Funnily enough, he says almost everyone used VPN-like technologies, even within the regulatory agencies.


Shameless plug, you can use wstunnel which disguise your traffic as websocket to tunnel any traffic you want. I had most success with it, as it uses TCP, than with QUIC/HTTP3 as usually UDP is more heavily restricted. It works behind GFW and let you use your wireguard for example... I had also good feedback from people in Turkey and Iran

wstunnel: https://github.com/erebe/wstunnel


Isn't UDP over TCP a generally bad idea?


As far as I know, TCP over TCP is less than ideal. I don’t see why UDP over TCP (or the other way around) would be bad.


Packet size is dependent on the MTU, so practically speaking you're trying to put something 1460 bytes into a 1460 byte container and the only way for that to fit is the split the packet or tell the packet generator to make smaller packets. both of which are reasonable options but they're not the most efficient, leading to slower connections when tunneling one inside the other. It's less of a deal theses days, but that's the why of it.


Well, sure, but then any kind of encapsulation is less than ideal. However, here the context is VPNs and this means there’s always going to be some sort of encapsulation. And if the choices are between encapsulating something in TCP and encapsulating something in UDP, the latter should always be chosen.


I use the word tunnel but it would be more correct to use "proxy"

There is no wrappring of udp packet into another layer of TCP. Wstunnel unpack the data at the client forward it using tcp/websocket, and after re-take this data to put it back into its original form (i.e: udp)

so there is no encapsulation of many protocol.

The only place where there is encapsulation, is for tls. if your client use tls to connect to wstunnel server. And that your data is already encrypted with tls (i.e: https) there will be 2 tls encryption


What's DPI in this context?


Deep packet inspection. it's supposedly how the great firewall of China (GFW) detects VPN connections.


Deep Packet Inspection


Not a VPN but I think Telegram takes that into account? My understanding is they use some of the millions of AWS registered IPs to goad ISPs into blocking them - censoring blocks of AWS IPs isn't usually a fun time.


This is called cloud fronting, and cloud services are slowly starting to block this tactic. If it still works, it won't keep working for long.


Every annonymized communication strategy that touches state owned isp as endpoint is bound to fail. which is why starlink is such a game changer.


I doubt Starlink is going to go against governments. You might think, "Oh, how can they stop it? It's between dishes and satellites!" You'd be wrong, governments have ways...


> Every annonymized communication strategy that touches state owned isp as endpoint is bound to fail.

What major ISP isn't state 'owned'?

> which is why starlink is such a game changer.

That has got to be one of the most naive comments I've read. Yes, the company that works on defense projects is a 'real game changer'. If there ever was a state 'owned' company, it's starlink. If there ever was a state 'owned' person, it's elon musk.


The US government can definitely influence Starlink but the idea here is that it allows individuals to view a different portion of a balkanized internet that isn't subject to their own government's monitoring/censorship. In the future we will likely have multiple constellations run by different countries so if you are worried about US censorship you can hop into the Chinese or Russian internet if you desire.


I'm in Berlin. We just watched Germany lose to Spain. We walked past a restaurant and saw a bunch of people starting at a screen, and it looked like a good picture to me. I was about to take it, and my friend said "You cannot take pictures without permission from those people." I had no intention of posting on social media because I don't use that.

Then we had a fascinating discussion about how photos without consent are outlawed. And, how video cameras are outlawed in public places. You cannot put up a camera outside your house to watch for Amazon packages.

I was really struck by the "news" I get about Europe. I hear incessant discussions about GDPR, which is a very abstract thing about collecting data. I'm for it, I think, but it is abstract. If I ever heard a reporter saying "You know, in Europe they are having a very different conversation about people taking pictures of your kids without your consent" well, damn, I would be very excited and interested in that article.

The fact that I don't read those articles makes me think my "news" is very controlled by social media companies, or should I say, anyone who has business in making sure data collection is unimpeded, which means Google, Facebook, probably Amazon.

Is my friend wrong? Is this more complicated? Or am I right that the discussion of what happens in Europe is framed in a way that keeps me uninformed about what is really possible?


Wikipedia has a table that claims your friend is wrong: https://commons.wikimedia.org/wiki/Commons:Country_specific_...

I'm not sure I'd trust random wikipedia page to be up to date on this, but it's good evidence at least that there isn't a EU-wide prohibition on taking pictures of people (without publishing them) without consent. Also that there are some EU countries where it is likely illegal.


>> We walked past a restaurant and saw a bunch of people starting at a screen ...

> Wikipedia has a table that claims your friend is wrong

"Consent required for action related to a picture of a person in a public place"

a restaurant is not a public space.


It is not public vs private place that matters in this situation. Here's a summary of German photography laws [1]. It's mostly based on privacy rights, and your privacy rights do not go away just because you happen to not be in a public space.

[1] https://allaboutberlin.com/guides/photography-laws-germany


I think that legally, a crowded space is a public space in some EU countries


what _you_ "think" doesn't matter. if it's on the premises of company then it's private.


I'm not a lawyer, nor am I familiar with how my neighbour countries define public spaces. My response was based on the fact that for tobacco legislation, for instance, public spaces are defined as follows by the EU commission: "places accessible to the general public or places for collective use, regardless of ownership or right of access" - Directive 2014/40/EU

This implies restaurants. Another paper by the EU commssion regarding terrorist soft targets describes crowded spaces as public spaces as well.

Given all this, I assumed that some countries in the EU share this definition, and some don't. Because in the end it's up for each country to decide, and it's always a mess like that.


I don't know about "public place" in Germany, but that certainly isn't universal. In my jurisdiction (Canada), "public place" effectively means any location that is open/accessible to the general public.


Great. Can you provide any resources to back this up?

In this case, the person is outside and not on the property; if the restaurant wishes to be private they can take measures (curtains or blinds) but they’ve chosen not to.

This is where jurisdictions differ and is not cut-and-dry.


They weren’t saying what they think, they were saying what they think the law is.



> Is my friend wrong? Is this more complicated? Or am I right that the discussion of what happens in Europe is framed in a way that keeps me uninformed about what is really possible?

European (Polish) here.

Saying that all of Europe is privacy conscious is like saying that the entire US is extremely republican and never gets below 40 degrees Fahrenheit; there are a few states that fit this definition, but that's not the entire country.

You have countries like Germany on one hand, where taking photos in public places is heavily restricted, you can get a ticket if the police find a dash cam in your car, quite a few organizations are passionate about avoiding Microsoft and hosting their own solutions, and a significant percentage of the population has Signal installed on their devices. On the other, you have countries like Poland, where everybody uses Facebook Messenger, nobody uses Signal, door and dash cams are perfectly legal, privacy isn't really that much of a concern, and photo laws are quite a bit less restrictive.

We're both in the EU, we're neighbors actually, we both have to follow the GDPR, but the mentality and approach is very different.

Over here, GDPR is mostly seen as "another stupid law that Brussels came up with and that makes things more difficult than they ought to be", not so much in Germany.

A completely separate concern, unrelated to privacy, is how photo copyright is handled. In the US and some European countries (like Poland), taking photos of public buildings is legal, and you generally own the rights to those photos. In other countries, the owner / architect of a building, who owns the copyright on the design of that building, may disallow taking pictures of that design.

In some places, the restrictions on photos stem from that different stance on copyright, not from any privacy concerns.


A professional photographer in California before the age of the Internet, explained with great emphasis that is was not legal at that time to take photos of people for commercial purposes without a signed consent form. Following that talk, I was handed real consent forms to carry with me. At that time, privacy and commercial rights for resale were taken seriously. It is a social contract between strangers, and yes people can get very agitated.

Fast forward to the age of the smart phone. The expansion happened so fast, for so many.. and with the marketing commercials and endless hype on using the phone to take "fun vacation photos" or whatever, and the explosion of Facebook uploads with "friends at a party" .. that social contract changed rapidly. New adoptors are often under 25 years old, and may not have heard of this formal signed consent form.

Now, mass facial recognition at public events is "no big thing" ? Everyone has heard in California from someone that "privacy is dead - get over it" ? Then, covid-19 and masks. Now lots of people wear masks on the street or on public transport, with questionable effectiveness over disease prevention, but is that the only reason? Young thugs dudes certainly wear masks with hoodies every day here..

This situation is not settled and still evolving.


Are you claiming that people wear medical face masks for the sake of privacy? I have literally never heard a single person say a single thing about that. However, I’m finding I’m out of touch with “the kids” these days so maybe this is a thing. I’d love to hear more about it.

EDIT: Changed my comment because I decided I’m probably out of touch and I thought the tone of what originally wrote came across a touch more aggressive than I intended.


People who commit crimes are often wearing medical masks these days.

Before covid, there was the stereotype of criminals wearing ski masks. It would make sense if you were doing a serious crime and expected to be caught on camera. It did require you to commit to looking like a criminal. Now, you can just wear a medical mask, walk down the street, you can’t be identified, you aren’t blatantly criminal-looking, but you can opportunistically do a smash and grab or whatever without worrying about your face being seen.


Oh! I understand you now. I thought at first that you meant something along the lines of college students at parties choosing to wear masks as a new trend to avoid being recognized on social media. Thanks!


https://allaboutberlin.com/guides/photography-laws-germany

Your friend was not quite right, but in general it's very poor form to photograph strangers in Germany, when it's not simply illegal. People will walk up to you and scold you.

If you host an event, you usually ask for permission before sharing pictures. At the very least, if someone asks you not to share pictures with them in it, you're expected to oblige them.

A while ago I needed a picture of a Späti to explain what they are to my readers. The owner walked out and asked me what I was doing. I didn't need his permission, but it was a surprisingly tense encounter until I explained my motives, showed how the picture would be used, and how he was not in it.

I wholeheartedly support this culture of privacy.


If it's true, it's not GDPR. GDPR explicitly does not apply to personal use. There can be other laws that apply here. I am not a lawyer.


> You cannot put up a camera outside your house to watch for Amazon packages.

Yeah, no. Amazon wouldn't drop your package in a public area. That only happens in North America and very weird.

Europe is not an entity. Every country has a different legislation and it's complicated. Some countries allow dashcams some don't because the lack of consent. Germany is one of the countries doesn't allow this, do police would ask you to turn it off if they see one.

What's infuriating is North Americans talking about "what's happening in Europe". It's equivalent to thinking abortion is banned and heavily persecuted in whole North America. Is what's happening North America really true?


>> You cannot put up a camera outside your house to watch for Amazon packages.

>Yeah, no. Amazon wouldn't drop your package in a public area. That only happens in North America

In London, Amazon drivers will happily dump your parcels on your door step on full view of the road. Some slightly more considerate drivers will attempt to hide them behind a bin or flower pot. Some will put them in the garbage bin, sometimes on collection day.


And yet in Germany you have to put your name and address on your website.


Yeah your friend is flat out wrong.

Its actually silly how many people (in Europe at least) think they can forbid you from recording them “because copyright”.


According to a lawsuit in 2020 [1] his friend is right.

From the lawsuit: "Ein gezieltes Fotografieren von fremden Personen ist auch dann unzulässig, wenn die Verwendung ausschließlich privaten Zwecken dienen soll."

Translation via DeepL: "Targeted photography of other people is not permitted even if the use is exclusively for private purposes."

[1] https://www.landesrecht-hamburg.de/bsha/document/NJRE0014656...


How to tell what's targeted at you specifically and what's street photography art?


I find it difficult to understand the boundaries of private rights in public spaces with rulings like that one.

It's not like Hamburg residents have the freedom to opt out of surveillance cameras. Even Street View is back.

I would hope that such cases would use rules around harassment instead of privacy laws for people in public spaces.


But if people generally believe the folk version of the law, does it really help to be technically in the clear? You can still easily find yourself in an really unpleasant and pointless confrontation.


If you avoid the slightest possibility of unpleasant and pointless confrontations, then you’re going to lead a very dull life. I sometimes photograph random people. Never has anyone had an issue with that. Sometimes they approach me and we have a chat. That’s all that happens. I’ve had more chances of being hit by a car than anyone having an issue with me taking pictures of them. Boils down not being a dick about it.


When we were travelling in the Andes, we were warned multiple times to not take photographs of local peoples without their permission as they could take offense. Seems like a reasonable position but should the wishes of people in the Andes be respected while those of people in Europe ignored? If so, why?


Is it standard for people in the Andes to take offence at people taking pictures of them? I don’t know, maybe it is, haven’t been there. It is not in Europe.


Err.. what?

If you walk up to a random European on the street and start taking photos of specifically them, they’ll get agitated real quick.


Thanks for taking the most uncharitable interpretation of what I wrote possible. It’s so productive.


"I'm not an animal in the zoo." how about that?

You are being a dick by taking my picture without permission. That's what it boils down to.


I would think you're a dick if I saw you taking pictures of me without asking. Also, a creep.


Who said anything about copyright?


The article was originally published by The Irrawaddy - an amazing, high quality online-paper.

The Irrawaddy does detailed and ethical journalism about Burma/Myanmar, a part of the world ruled by an authoritarian regime.

There's no Irrawaddy for Venezuela, Afghanistan, or North Korea. We only see them by the shadows they leave on other countries.

But because of the hard work of The Irrawaddy, Burma/Myanmar is much more visible to English-speaking audiences - a touchy demographic in the country being covered.

The least you could do is link to the original publisher, especially when they are such an amazing group.


You said all that (which I agree with), but you didn't provide a link:

https://www.irrawaddy.com/in-person/interview/war-on-citizen...


Ok, we've changed the URL above to that from https://globalvoices.org/2024/06/28/war-on-citizens-how-the-.... Thanks!


Hahaha, I’m so sorry. You are right. Thank you.


It's also been heavily criticized for using rhetoric that supports the ethnic cleansing of the Rohingya minority in Myanmar[0] and being a mouthpiece for the Burmese government. The editor-in-chief has denied these allegations but has run a number of problematic pieces. Like a cartoon depicting a dark-skinned Rohingya cutting in line in front of other ethnic minorities, and another one which suggested Bangladeshis were waiting at the western edge of Myanmar ready to invade. Or running a fake news piece stating that the US ambassador alleged the Rohingya “would demand a Rohingya State or Muslim State” if their ethnic name were officially recognized

It's also funded by the US (specifically, the U.S. National Endowment for Democracy has given it $150-200k every year since 2005)[1]

[0] https://www.bustle.com/p/is-the-us-funding-anti-rohingya-new...

[1] https://www.thedailybeast.com/why-is-the-us-government-fundi...


> There's no Irrawaddy for ... North Korea.

Rimjin-Gang [1] publishes news from North Korea in Japanese, English, and Korean. Their articles are based on reports from people inside North Korea using smuggled cellphones and focus on daily life.

A list of other sources is at [2]. Note in particular 38North [3].

[1] https://www.asiapress.org/rimjin-gang/

[2] https://guides.library.cornell.edu/c.php?g=225914&p=1790887

[3] https://www.38north.org/


> There's no Irrawaddy for Venezuela, Afghanistan, or North Korea

There are several for Afghanistan (Tolo, Rukhsana, Bano, Khaama, Pajhwok, etc) and Venezuela (Pitazo, Efecto Cocuyo, Runrun). You just choose not to read them, or don't want to put the legwork to find and read Spanish, Pukhto, Dari, Uzbek, or regional English publications.

And Irrawaddy has issues as well - they lack the ability to report on what's happening on the ground in Arakan, Sagaing, and Chinland and just repeat what spokespersons of those region's warlords say.

Myanmar has become a Southeast Asian Syria or Libya with every regional power in the region (China, Thailand, India, Bangladesh, Vietnam) funding, aiding, and abetting warlords both within the Tatmadaw as well as within the various liberation coalitions.

It feels weird how certain internet users (especially because most people on HN only started hearing about Irrawaddy after using junk subreddits like CredibleDefense or WorldNews) are following this horrible conflict with a sense of glee or at least entertainment. It's horrid.


>It feels weird how certain internet users (especially because most people on HN only started hearing about Irrawaddy after using junk subreddits like CredibleDefense or WorldNews) are following this horrible conflict with a sense of glee or at least entertainment. It's horrid.

Noticed the same as well and it's happening over all social networks! I've seen this happening since Russia invaded Ukraine, so I assume it's cause of social media campgains and propoganda that started at the time - conflicts were dyed black and white removing all nuance, and people got off on "supporting" the side they picked


Venezuela has Caracas Chronicles, which is great.

https://www.caracaschronicles.com/


If that is the original article, you can send an email to hn using the contact link and they can update it.


> The Irrawaddy does detailed and ethical journalism about Burma/Myanmar, a part of the world ruled by an authoritarian regime.

Why does it feel like every time someone promotes 'ethical journalism' here, it's always state backed propaganda? Not only that, people use propaganda terms like 'authoritarian regime'.

> There's no Irrawaddy for Venezuela, Afghanistan, or North Korea.

No. There are many british, american, etc funded propaganda outlets ( fringe and major ) targeting these countries.

> But because of the hard work of The Irrawaddy, Burma/Myanmar is much more visible to English-speaking audiences

Could it be because britain, the former colonial master of myanmar, is trying to overthrow the regime?

> especially when they are such an amazing group.

Are they 'amazing' though?


Why does it feel like every time someone promotes 'ethical journalism' here, it's always state backed propaganda?

A quick keyword search on the phrase easily refutes the supposition you're making here.

Not only that, people use propaganda terms like 'authoritarian regime'.

Probably because it would seem to be a reasonable enough description of the system of government in that country since 1962.

Meanwhile the weirdly exaggerated language you're using here seems to be in itself quite propagandistic.


> A quick keyword search on the phrase easily refutes the supposition you're making here.

You don't have to do a quick keyword search. The 'ethical journalism' the guy referred to in this comment thread is a US government funded propaganda outlet.

> Probably because it would seem to be a reasonable enough description of the system of government in that country since 1962.

But not the colonial british government before 1962? Can you show me on reuters article calling the colonial british government 'authoritarian'?

Funny how the democractic russian government and indian governments are called authoritarian, but not the saudi government? Strange.

Lets hope myanmar stays authoritarian long enough to maintains its independence. So many people with political agendas.


But you didn't reference just that one comment.

You specifically took the trouble to make it look like this was something that keeps happening all the time, via the carefully chosen phrasing:

every time someone promotes 'ethical journalism' here,

That's where things started to get weird in this thread.

The democractic russian government ...

Before they got weirder still.


You really are deluded if you think the Russian government is "democratic".

>But not the colonial british government before 1962? Can you show me on reuters article calling the colonial british government 'authoritarian'?

And even if the British government before that was authoritarian, does that remove the details around the current government being extremely repressive? How about addressing that before going directly to whatabout ism with what might have been the case over 50 years ago?

Finally and generally, just because a given website receives financial support from some U.S. organization doesn't automatically make it propaganda or free of ethical journalists. The details of what they report and how do matter, so does it's factual accuracy, regardless of funding.


My comment included a lot of stock phrases and low-thought words. “Authoritarian regime,” etc.

Sorry. That was poor style on my part.

I also made some sweeping statements about media coverage in other countries.

Sorry. Low thought on my part.

I was trying to give credit to some folks who deserve it, but instead I made what looks like a State Department press release.

Sorry.

I’ve been trying to spend less time writing these comments out. You can spend a day on a couple paragraphs. Not a good use of time.

I’ll be more careful in the future.


What a bizarre response. But not unexpected.


“The least you could do is…”.

Being a fan of some journalists doesn’t justify being this aggressive. There are nicer ways to say this.


If the article is indeed based off another article, I think that is really the very least it could do without risking being called out for plagiarism.


That really wasn't aggressive. How would you have phrased it?


>>“The least you could do is…”. > There are nicer ways to say this.

Could they be as effective, though?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: