For those wondering: it's DNS blocks, so only affecting those using ISP DNS.

▲ drnick1 25 minutes ago | parent | next [-]

If this is the case, someone running their own recursive DNS server (like Bind9 or Unbound) can trivially bypass these restrictions. Doing this is a sensible step towards more privacy, regardless of censorship.

	▲	layer8 21 minutes ago \| parent [-]
		They don’t need to run their own DNS server, just configure a DNS server other than the ISP-provided one, like Quad9 or Google.

▲ Reason077 2 hours ago | parent | prev | next [-]

Interesting. UK ISPs have had a similar block/filter list for many years (mostly covering copyright-infringing torrent websites and the like). But it’s more robust than a simple DNS block. A VPN can bypass the block, but changing DNS providers will not.

▲

hsbauauvhabzb an hour ago | parent [-]

What / how do they do it then? SNI inspection?

▲

lategloriousgnu 20 minutes ago | parent [-]

The ISP's blackhole the IP for some blocked domains. So changing your DNS to 8.8.8.8 will resolve the domain, but the IP won't work. A VPN avoids this, since the traffic goes via the VPN IP.

	▲	hsbauauvhabzb 8 minutes ago \| parent [-]
		How would that work with cloudflare and similar though?

▲ JohnLocke4 10 minutes ago | parent | prev | next [-]

As a reward for freeing yourself from the de facto government DNS, you will now be gifted free movies for eternity

▲ wrboyce 3 hours ago | parent | prev | next [-]

Worth mentioning NextDNS and ControlD under this! I migrated from the former to the latter about six months ago, but both are a solid choice.

▲

mctt an hour ago | parent [-]

Free trial then $20USD per year for ControlD. Is that what you use? If so, why do you use this over another service?

	▲	silisili an hour ago \| parent \| next [-]
		Not OP but I also use ControlD. I admittedly like NextDNS interface better, but honestly, I rarely need to login anyways. So why ControlD? Because I don't want to run my own piHole, basically. They maintain ad block lists that you can edit as you see fit to add things or relax things that may cause issues(which you can't do easily with public ad blocking dns servers). Why ControlD then and not NextDNS? First, because their support was awesome when I had an issue. AFAICT it was the founder actually emailing me back and forth, and it ended up being my ISP's fault, but I only knew that based on research provided to me by support. Secondly, I got a good deal on a 5-year subscription at one point. Happy to answer any questions, not affiliated but a fan of the service.
	▲	cyberpunk an hour ago \| parent \| prev [-]
		Not GP, but I just run my own dns inside the network (unbound on a little openbsd sbc) with a cronjob that pipes oisd.nl into it every night, works great..

▲ maxloh 3 hours ago | parent | prev | next [-]

I am curious why SNI-based block isn't used.

▲ trinix912 3 hours ago | parent [-]

Shhh, don’t give them ideas

▲ ronsor 2 hours ago | parent [-]

It won't be relevant in a couple years when 90% of sites will be using ECH, meaning the SNI will be encrypted as well.

▲ hypeatei 2 hours ago | parent [-]

Just enabling ECH doesn't stop this, firewalls can see it and mangle the data to force a downgrade because most servers need to support older protocols. It's more accurate to say that once sites only support ECH, then they'll be forced to stop downgrading or deal with angry users.

▲ ronsor an hour ago | parent | next [-]

TLS 1.3, including the ECH extension, does not permit downgrading, unless your implementation is broken.

Trying to downgrade or strip extensions from any TLS 1.3 connection will simply break the connection.

▲ hypeatei an hour ago | parent [-]

In the wild, that's not true at all[0][1]. The corporate firewall at my employer actually wasn't able to block ECH until they updated it then it was able to block sites as usual.

0: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Ho...

1: https://docs.broadcom.com/doc/symantec-ech-whitepaper (see page 8)

	▲	dilyevsky 35 minutes ago \| parent \| next [-]
		I ready the FortiGate link and this is the gist: `The DNS filter setting on the FortiGate analyzes the DoH traffic and strips out the ECH parameters sent by the DNS server in the DoH response. If the client does not receive those parameters, it cannot encrypt the inner SNI, so it will send it in clear text.` So basically they mess with DoH ECH config and trigger fallback behavior in the clients. I don't think any browsers do this yet but I think this loophole is not gonna last.
	▲	dilyevsky an hour ago \| parent \| prev [-]
		This is literally impossible. What your corp fw likely does is mitm outer SNI because your IT department installed your company CA in every client's trust store. So unless you do that at national level your only other option is to block ECH entirely. Edit: actually totally possible but you need build quantum computer with sufficient cubits first =)

▲ hsbauauvhabzb an hour ago | parent | prev [-]

Is there even a push for ECH? I don’t imagine big tech and other powerful players particularly want it.

▲ peter_d_sherman 2 hours ago | parent | prev [-]

An excellent point!

Yes, any given domain name (or as non-technical people would think about it, "website" -- any website) could be "blocked" (re-routed to a non-functioning IP, claimed to not exist, other DNS error or malfunction, ?, ???) at any level of DNS (ISP, Local, Regional, Country, ?, ???)

A question your statement so excellently potentially suggests, is:

What's the true extent of the block?

Is it merely a DNS failure -- or are inbound/outbound packets to an IP address actively suppressed and/or modified to prevent TCP/IP connections? (i.e., The Great Firewall Of China, etc.)

You have "Bad Faith Actors" (let's not call them "governments", "countries", "nation states" or even "deep states" -- those terms are so 2024-ish, and as I write this, it's almost 2026! :-) )

Observation: Let's suppose a "Bad Faith Actor" (local or nationwide, foreign or domestic) attempts to block a website. They can accomplish this in one of 3 ways:

1) DNS Block

2) TCP/IP Block, i.e., block TCP/IP4/6 address(es), address ranges, etc.

3) Combination of 1 and 2.

#3 is what would be used if a "Bad Faith Actor" absolutely had to block the "offending" website, no ifs ands or buts!

But... unfortunately for them (and fortunately for us "wee folk"! :-) ), each of these types of blocks comes with problems, problems for them, which I shall heretofore enumerate!

From the perspective of a "Bad Faith Actor":

1) DNS Block -- a mere DNS block of a single domain name is great for granularity that is, it targets that domain name and that domain name alone, and something like this works great when a given company's products and services are directly tied to their website as their brand name (i.e., google.com being blocked in China), but it doesn't work well for fly-by-night websites -- that's because a new domain name pointing to the old IP address can simply be registered...

2) TCP/IP Address / Address Range Block -- The problem with this approach is that while it is more thorough than a simple DNS block, it may also (illegally and unlawfully, I might add!) block legitimate other users, websites and services and businesses which share the same IP or IP address range!

Think about it like this... A long time ago, all of the mail traffic for AOL (America Online), about 600,000 users or so, was coming from a single IP address. Block that IP address, and yes, you've stopped spam from the single user who is annoying you, but you've also (equal-and-oppositely!) blocked 599,999 legitimate users!

So "Bad Faith Actors" -- are "damned if they use the first method, and really damned if they use the second or third methods"... the first method is easily circumventable for non-brand name dependent websites and web services, while the second and third methods risk causing harm to legitimate users, sometimes huge amounts of them... which should be illegal and unlawful by any country's legal standards...

In other words, Countries should read their own sets of laws(!) before contemplating Internet blocks on their Citizens... :-) And not just one country either, all of them!!! :-)

Anyway, an excellent point!

Very thought stimulating -- as you can see by my ramblings! :-)