16:00:45 <shelikhoo> #startmeeting tor anti-censorship meeting 16:00:45 <shelikhoo> here is our meeting pad: https://pad.riseup.net/p/r.9574e996bb9c0266213d38b91b56c469 16:00:45 <shelikhoo> editable link available on request 16:00:45 <MeetBot> Meeting started Thu Nov 21 16:00:45 2024 UTC. The chair is shelikhoo. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:00:45 <MeetBot> Useful Commands: #action #agreed #help #info #idea #link #topic. 16:00:48 <shelikhoo> hi~hi~ 16:01:00 <meskio> hello \o 16:01:23 <cohosh> hi 16:02:13 <onyinyang> hihi 16:02:15 <shelikhoo> please add discussion topic to the pad if any 16:03:06 <shelikhoo> I didn't see any new topic... 16:03:08 <meskio> I don't think I have anything for today 16:03:18 <meskio> and there might not be updates on the old topics, isn't it? 16:03:24 <shelikhoo> let's start with interesting links.. 16:03:35 <shelikhoo> https://github.com/doxx/darkflare 16:03:35 <shelikhoo> TCP over CDN. using cloudflare to tunnel traffic, the client does HTTP requests. 16:03:49 <meskio> DrWhax shared it in our channel 16:03:50 <shelikhoo> I got a look into its code, it works in meek way 16:03:55 <shelikhoo> yes.. 16:04:04 <shelikhoo> and next link is 16:04:12 <meskio> good that you actually look into it, I only scheem into the readme 16:04:13 <shelikhoo> https://www.youtube.com/watch?v=rZYfrj2iqYE&list=PLbRoZ5Rrl5ldQ2K_dpmPKHEyRgyf5JSxd&index=148 16:04:13 <shelikhoo> Snowflake conference presentation from Usenix Security 2024 16:04:52 <meskio> nice, the video si finally public 16:05:04 <shelikhoo> the link for snowflake conference presentation is now live, and it is highly recommended to watch it 16:05:10 <shelikhoo> it was awesome!!! 16:05:15 <meskio> I'll love to see dcf1 there :) 16:05:29 <shelikhoo> okay, anything we wish to discuss about these links? 16:06:24 <shelikhoo> okay, let move back to the discussion points 16:06:38 <shelikhoo> do we have any updates about snowflake censorship in russia, cohosh? 16:06:55 <shelikhoo> https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40407#note_3132285 16:07:28 <cohosh> yeah, i wrote a patch to directly test specific proxies by using manual copy-paste as a signaling channel 16:07:48 <cohosh> we used to have this for testing, i just added it back in 16:08:02 <cohosh> https://gitlab.torproject.org/cohosh/snowflake/-/commit/a4a574a4584332fc2825ff4ebe142c9702032fad 16:08:18 <cohosh> i'll probably post instructions on how to use it somewhere later today 16:08:59 <cohosh> i tried it out from the vantage point, and a few proxies i spun up showed the same blocking behaviour 16:09:08 <cohosh> which seems to suggest it's being blocked by protocol 16:09:29 <cohosh> i also tried the padding patch that dcf1 shared last week and it was still blocked 16:09:53 <shelikhoo> too bad... 16:10:01 <cohosh> i think i'll try and see if it's a data channel block next 16:10:08 <dcf1> I was wondering it it's something else conspicuous right after the initial handshake, like a Hello Retry Request maybe? 16:11:02 <cohosh> i didn't notice any difference in handshake messages between proxies that were blocked and ones that seemingly werent, from our pcaps 16:11:22 <cohosh> including hello retry requests 16:12:08 <cohosh> i'll check again 16:12:10 <dcf1> It's not possible there's something different about Application records, do you think? 16:12:43 <cohosh> that's also possible, i didn't look closely at application records 16:12:58 <cohosh> i only checked how many bytes were sent before the connection went stale 16:13:44 <dcf1> I guess theodorsm is not here. I wonder if it's possible to quickly implement a client with covertDTLS https://github.com/theodorsm/covert-dtls? 16:14:06 <dcf1> I saw that pion webrtc v4 was merged, which I believe was a prerequisite to doing that. 16:14:13 <cohosh> yeah if it's quick it's definitely worth trying 16:15:56 <shelikhoo> yes... it still need some additional efforts to find out root cause... thanks cohosh and dcf1's work! 16:16:09 <dcf1> theodorsm's notes say "Test Snowflake fork with covert-dtls", but I don't see a snowflake fork at https://github.com/theodorsm?tab=repositories. 16:16:55 <meskio> maybe this one? https://gitlab.torproject.org/theodorsm/snowflake 16:17:02 <shelikhoo> an update about snowflake broker transition is that, next monday there will be an dns switch to make new broker primary 16:17:08 <meskio> there is a covert-tls-test branch... 16:17:30 <cohosh> nice! 16:17:41 <shelikhoo> yes! 16:17:45 <shelikhoo> expired cdn77 alerts 16:17:45 <shelikhoo> https://lists.torproject.org/mailman3/hyperkitty/list/anti-censorship-alerts@lists.torprojec 16:17:50 <meskio> shelikhoo: nice, shout if you need any help there 16:18:00 <meskio> I added that one 16:18:12 <shelikhoo> https://lists.torproject.org/mailman3/hyperkitty/list/anti-censorship-alerts@lists.torproject.org/thread/6BAEW3ENYOPJI3XZWTR67TLSJWND3XFT/ 16:18:18 <meskio> I see there is being alerts the last couple of days about the cert in cdn77 being about to expire 16:18:35 <meskio> cohosh: do you know anything about it? does it require any manual intervention? 16:18:47 <cohosh> oh, i didn't know about these alerts 16:19:10 <cohosh> cert expirty was an issue for fastly domains because of their domain fronting policy 16:19:26 <cohosh> i'm not aware of any trouble with cdn77, unless the domain does not renew it's cert at all 16:19:38 <meskio> I'm not sure where is this alert comming from 16:19:52 <meskio> but if is not a problem we should probably find a way to silence it 16:20:00 <cohosh> oh these are our domains, lol 16:20:17 <cohosh> i might need to look into this 16:20:25 <meskio> blackbox is one of the prometheus exporters that tests if a service is reachable, like a website 16:20:55 <meskio> https://gitlab.torproject.org/tpo/tpa/prometheus-alerts/-/blob/main/targets.d/blackbox_anticensorship.yaml?ref_type=heads 16:21:15 <meskio> It looks like it was me who added there 16:21:30 <cohosh> hehe 16:22:00 <cohosh> i'll look into it, i think everything is just a let's encrypt cert 16:22:09 <meskio> thanks 16:22:24 <shelikhoo> yes 16:22:35 <shelikhoo> anything more we would like to discuss in this meeting? 16:23:15 <meskio> nothing from me 16:23:18 <dcf1> I'll send an email to theodorsm and Cc anti-censorship-team@ to ask about the state of the covert-dtls-test branch 16:23:28 <cohosh> thanks dcf1 16:23:34 <shelikhoo> yes, thanks dcf1 16:23:36 <cohosh> nothing more from me 16:23:40 <onyinyang> me neither 16:23:46 <shelikhoo> #endmeeting