Hacker News Reader

Comment by kitteh | Hacker News Reader

Turkey is an interesting country to deal with. For example let's say you are a hosting company in the US and one of your customers is rebroadcasting Turkey television. A turkey govt agency would reach out to you and ask that you terminate that customer. If you refused, they go to the domestic incumbent Telecom (Turk Telecom) and null route your entire company ip addr space. Basically all of turkey won't be able to hit any of your customers. Know a few small hosting shops this happened to and saw the emails.

View on HN

That's not the case anymore. They built an application level filter. For example, Wikipedia block was due to http header reading. https wasn't also a solution because of hand-shaking part. Even TOR can be blocked this way but it's reachable through obfs4proxy.

Besides that, DNS queries to all servers are blocked if you try to get a blocked site's IP. No hijacking attempt here, as far as I can see.

I routed only Wikipedia through TOR with a browser extension. With this setup not all DNS queries goes through proxy. So I had to take advantage of CoreDNS' dns-over-tls support.

Because people who knows basic networking and also read English are less than a thousandth of the country, their method works very well enough.

“DNS queries to all servers are blocked if you try to get a blocked site's IP”

Wait, so if I was in Turkey, a request for wikipedia.org to my ISP DNS server would not only have failed, but caused all my other queries to fail as well? For how long?

I think I couldn't explain well. When we use ISP's DNS, we get a local IP address and a web-page at that address, explaining who blocked the site and why. But if I use Google's or Cloudflare's public DNS, the query won't get an answer, falls to timeout.

Gotcha. Thanks for explaining!

A funny method to circumvent the block was to visit wikimedia. As long as your connection was kept alive, you could keep surfing wikipedia like it wasn't blocked at all!

This worked well in domestic telecommunications providers. Universities implemented the block themselves, and you were unable to use the workaround stated in those universities.

If you don't mind sharing, what browser extension was that?

https://chrome.google.com/webstore/detail/proxy-switchyomega...

I brought a Spanish SIM card in and had no problems accessing Wikipedia (or presumably any other site that would have been blocked).

Roaming tunnels your connection back to your home provider. https://en.wikipedia.org/wiki/Mobile_IP

To be honest, that sounds like the reasonable and fair thing to do when a foreign company is violating your laws on the internet. First tell them to stop, then block them. Not every country has this "safe harbor" concept that the US does, so you may have to take responsibility for the content you host if you want access to those markets.

It'd be better if they were transparent about it and you could see these actions clearly instead of having to glean it from a looking glass or from in country probes.

Getting direct contact about the issue directly seems very transparent to me?

If you just suddenly disappeared without a note, that's one thing. "Please stop action X occurring on your network" sounds very clear and direct.

I meant why doesn't the government publish a list of IPs blocked, when it started and the reason why.

Edit: I see I'm getting downvoted here but I want to explain why I am passionate about this topic. As someone who supports network infrastructure and it's operation I'm on the hook to find out why x can't talk to y. It's a challenge when dealing with ISP/country level blocks or packet manipulation. Proving that this is something deliberate versus a legitimate broken thing is a process to go through. Not being able to tell a customer why is not a great story. Different countries have different techniques for this and over time you learn them. Seeing your packets in a traceroute going to a hop that has a DNS PTR record that says "DPI" in the name is a nice heads up to an operator to give you that sort of indication of what you're dealing with. I am aware that basically no country publishes such blocks today and ISPs that are forced to implement such blocks are usually instructed to not tell you anything about it (sometimes off the record, if you're lucky).

I'm really disappointed when I see this sort of response. Somebody in a foreign country is hosting content on their own servers that offends you, or violates one of your local laws, so your best possible response is to null route an entire block of their IP space? Please tell us which ASNs you do network engineering for...

> hosting content on their own servers that offends you

It's not about offense in the parent comment, it's about theft.

I see this as a reasonable response, given no additional context.

Yes but there is all of the collateral damage of other hosted sites who did nothing.

Which presumably impacts the hosting company's bottom line, encouraging them to remove the offending content.

When you steal something it means the owner doesn't have it anymore. How is this theft?

Pushers of the paradigm of imaginary property like to misuse the word "theft" to make the plebs identify with their position.

Twitter and Youtube occasionally blocked in Turkey for years. They have found their solution in region-locking the contents after court orders. This may not be feasible to small hosting companies though. For youtube and twitter, implementing that control system was the only option to access the Turkey's market.

How does "region locking" work with Twitter content? Don't have you to control the content to lock it to a certain region via GeoIP or similar?

Reply on news.ycombinator.com