<story><title>17-year-old student exposes Germany&apos;s &apos;secret&apos; pirate site blocklist</title><url>https://torrentfreak.com/17-year-old-student-exposes-germanys-secret-pirate-site-blocklist-240822/</url></story><parent_chain><item><author>codedokode</author><text>Both openvpn and wireguard protocols are trivially blocked by DPI. Why do people make custom protocols today? Everybody should use something standard and indistinguishable, like QUIC, DTLS or TLS1.3, for their transport layer.</text></item><item><author>mrinfinitiesx</author><text>Openvpn &amp;#x2F; Wireguard service is preferable, but for free: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;DNSCrypt&amp;#x2F;dnscrypt-proxy&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;DNSCrypt&amp;#x2F;dnscrypt-proxy&lt;/a&gt;&lt;p&gt;sudo apt install dnscrypt-proxy&lt;p&gt;sudo systemctl enable dnscrypt-proxy (or system service dnscrypt-proxy start|enable)&lt;p&gt;sudo mv &amp;#x2F;etc&amp;#x2F;resolv.conf ~&amp;#x2F;resolv.conf.bak&lt;p&gt;sudo rm &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;sudo nano &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;nameserver 127.0.0.1&lt;p&gt;#back up to dns over plaintext not recomennded if your dnscrypt-proxy service stops for whatever reason (enable in systemd, too lazy to write here)&lt;p&gt;#nameserver 1.1.1.1&lt;p&gt;sudo chattr +i &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;Always use DoH &amp;#x2F; DoT (DNS over HTTPS &amp;#x2F; TLS)&lt;p&gt;in firefox, settings -&amp;gt; DNS in search select Max protection choose NexDNS, make a NexDNS account for further privacy&amp;#x2F;setting up your local DNS restrictions like ad&amp;#x2F;tracker blocks&lt;p&gt;or use cloudflare.&lt;p&gt;Cheap VPS proxy:&lt;p&gt;on a VPS, do said dnscrypt-proxy&lt;p&gt;ssh -D 8080 -i ~&amp;#x2F;.ssh&amp;#x2F;sshkey username@vps.server (always use SSH key auth, no passwords)&lt;p&gt;in firefox, set up proxy 127.0.0.1 8080 select &amp;#x27;Use DNS through proxy&amp;#x27; - can set proxy settings at OS level to use DNS.&lt;p&gt;There&amp;#x27;s some options for you. Tailscale works, haven&amp;#x27;t tried it though.</text></item></parent_chain><comment><author>ignoramous</author><text>&amp;gt; &lt;i&gt;wireguard protocols are trivially blocked by DPI&lt;/i&gt;&lt;p&gt;There&amp;#x27;s at least 2 or more different efforts to make WireGuard DPI resistant. Ex: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;database64128&amp;#x2F;swgp-go&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;database64128&amp;#x2F;swgp-go&lt;/a&gt;&lt;p&gt;Interestingly, Cloudflare (and Apple?) have begun switching to MASQUE: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;zero-trust-warp-with-a-masque&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;zero-trust-warp-with-a-masque&lt;/a&gt;&lt;p&gt;&amp;gt; &lt;i&gt;Everybody should use something standard ... like QUIC, DTLS or TLS1.3, for their transport layer.&lt;/i&gt;&lt;p&gt;Very common for anti-censorship tools (V2Ray, XRay, Clash, Hysteria, Trojan, uTLS, Snowflake, SingBox, Outline etc) to use these.</text></comment>
<story><title>17-year-old student exposes Germany&apos;s &apos;secret&apos; pirate site blocklist</title><url>https://torrentfreak.com/17-year-old-student-exposes-germanys-secret-pirate-site-blocklist-240822/</url></story><parent_chain><item><author>codedokode</author><text>Both openvpn and wireguard protocols are trivially blocked by DPI. Why do people make custom protocols today? Everybody should use something standard and indistinguishable, like QUIC, DTLS or TLS1.3, for their transport layer.</text></item><item><author>mrinfinitiesx</author><text>Openvpn &amp;#x2F; Wireguard service is preferable, but for free: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;DNSCrypt&amp;#x2F;dnscrypt-proxy&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;DNSCrypt&amp;#x2F;dnscrypt-proxy&lt;/a&gt;&lt;p&gt;sudo apt install dnscrypt-proxy&lt;p&gt;sudo systemctl enable dnscrypt-proxy (or system service dnscrypt-proxy start|enable)&lt;p&gt;sudo mv &amp;#x2F;etc&amp;#x2F;resolv.conf ~&amp;#x2F;resolv.conf.bak&lt;p&gt;sudo rm &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;sudo nano &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;nameserver 127.0.0.1&lt;p&gt;#back up to dns over plaintext not recomennded if your dnscrypt-proxy service stops for whatever reason (enable in systemd, too lazy to write here)&lt;p&gt;#nameserver 1.1.1.1&lt;p&gt;sudo chattr +i &amp;#x2F;etc&amp;#x2F;resolv.conf&lt;p&gt;Always use DoH &amp;#x2F; DoT (DNS over HTTPS &amp;#x2F; TLS)&lt;p&gt;in firefox, settings -&amp;gt; DNS in search select Max protection choose NexDNS, make a NexDNS account for further privacy&amp;#x2F;setting up your local DNS restrictions like ad&amp;#x2F;tracker blocks&lt;p&gt;or use cloudflare.&lt;p&gt;Cheap VPS proxy:&lt;p&gt;on a VPS, do said dnscrypt-proxy&lt;p&gt;ssh -D 8080 -i ~&amp;#x2F;.ssh&amp;#x2F;sshkey username@vps.server (always use SSH key auth, no passwords)&lt;p&gt;in firefox, set up proxy 127.0.0.1 8080 select &amp;#x27;Use DNS through proxy&amp;#x27; - can set proxy settings at OS level to use DNS.&lt;p&gt;There&amp;#x27;s some options for you. Tailscale works, haven&amp;#x27;t tried it though.</text></item></parent_chain><comment><author>red-iron-pine</author><text>makes me think of the Harvard kid that called in a bomb threat via Tor -- and was the only one on campus using Tor.&lt;p&gt;so even though that stream was itself encrypted, it was trivially easy to track down that one guy and tie it to him.</text></comment>