Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

Wait, how did simple access to google DNS circumvent their twitter ban?

They had blocked twitter... merely by removing it from some DNS servers that they thought were the only ones used by people in Turkey? Or something?

That seems like a particularly ineffectual way to try and block twitter. And I don't understand, if they have the ability to _actually_ block Google DNS... why don't they just do the same thing to actually block twitter?

This makes no sense, I must be missing something. Anyone have the scoop?

View on HN

Removing routes from ISP DNS servers nationwide is often the first step in blocking content. It's easily bypassed if you know what you're doing, but most people don't and are stuck. China did this circa 2004, and AFAIK a lot of blocks in Vietnam are still done like this. I doubt Turkey has the infrastructure that more advanced censorship regimes like China and Iran use, so it's something of a poor man's solution (especially in a world of apps on mobile where the end user has no control over how data is fetched over the network).

Google DNS being just two IP addresses makes it a lot easier to shut down without collateral damage.

Probably because blocking Google DNS is 2 just IPs? If you can "force" most people to use your own DNS, it's far easier to implement blocking via DNS. Otherwise, you're left playing whackamole if a company adds new frontend machines.

Except there are an indefinite number of other DNS servers, free and with a contract, that Turkish users could use too, from an indefinite number of different vendors. It's a heck of a lot harder to block "any DNS server that isn't under Turkish government control" than it is to block twitter.

We can all speculate, but really I was hoping that someone had some additional information, perhaps because they are in Turkey, on what's going on exactly.

(Is it too much to expect discussion of technical details on HN, instead of political bickering? On anything involving Turkey, anywhere on the internet, yeah, it probably is. The reason why I'm curious about technical details is, of course, because I have an interest in knowing how to circumvent and help people circumvent whatever censors are up to these days).

I imagine that if you wanted to block all DNS queries not going to government DNS, you put a block on packets routing to port 53. This is going to hit a lot of businesses that use their own DNS systems though. It would be harder to do a wide-ranging-but-not-total block, methinks, but I am not a net admin; I don't know the feasibility of mass port blocking.

Mass port blocking is easy. Not so hard and less disruptive is DPI of all port 53 traffic, blocking only requests for Twitter. In addition, you block the IP address range of Twitter to foil the smart-asses who use hosts file.

Reply on news.ycombinator.com