• Quick note - the problem with Youtube videos not embedding on the forum appears to have been fixed, thanks to ZiprHead. If you do still see problems let me know.

Set up a proxy for Iran citizens!

ravdin

Illuminator
ravdin
Joined
Oct 16, 2005
Messages
4,985
If you have geek skills, an extra machine, and an interest in undermining fascist censorship, please help! Here's how you can set up an anonymous proxy server to help Iranians bypass the Internet barriers:

Windows
Linux
Mac OS X
 
ravdin said:
If you have geek skills, an extra machine, and an interest in undermining fascist censorship, please help! Here's how you can set up an anonymous proxy server to help Iranians bypass the Internet barriers:

Windows
Linux
Mac OS X
Click to expand...

Thanks, I'll pass it along. I know someone who can probably use this :)
 
Ok some security concerns here, now that I have read this...

I see where they set trusted IPs incoming as what is presumably Iranian IPs, however I don't see where this proxy is anonymizing. IE: This doesn't seem to be distributed, you're providing direct 1:1 proxy for someone, and don't have much control over what they do.

This concerns me greatly. The point of Tor is that no one can be tracked back through the proxy, and the list of nodes is massive. This seems to me, on quick review, a process by which anyone tracking activity would see my IP and only if they followed up would notice a squid proxy running. This has legal implications for those in the US. Be forewarned of that. While I support the circumventing of oppressive censorship, I'm not sure I want to assume a legal liability to running an open proxy on this basis.

Why, exactly, has Tor not been suggested? This is already in place, already gets the Chinese folks around the great firewall of China, and is very effective. On top of that, I don't have to assume liability for use of tor nodes, since I don't know where the traffic comes from when I run it.
 
Ducky said:
Ok some security concerns here, now that I have read this...

I see where they set trusted IPs incoming as what is presumably Iranian IPs, however I don't see where this proxy is anonymizing. IE: This doesn't seem to be distributed, you're providing direct 1:1 proxy for someone, and don't have much control over what they do.

This concerns me greatly. The point of Tor is that no one can be tracked back through the proxy, and the list of nodes is massive. This seems to me, on quick review, a process by which anyone tracking activity would see my IP and only if they followed up would notice a squid proxy running. This has legal implications for those in the US. Be forewarned of that. While I support the circumventing of oppressive censorship, I'm not sure I want to assume a legal liability to running an open proxy on this basis.

Why, exactly, has Tor not been suggested? This is already in place, already gets the Chinese folks around the great firewall of China, and is very effective. On top of that, I don't have to assume liability for use of tor nodes, since I don't know where the traffic comes from when I run it.
Click to expand...

Agreed, there are some security concerns. These people are risking their lives, so I'm prepared to risk a little legal liability. If you would rather not, then don't.
 
ravdin said:
Agreed, there are some security concerns. These people are risking their lives, so I'm prepared to risk a little legal liability. If you would rather not, then don't.
Click to expand...

You obviously miss my point. If you want to trust that an entire country now getting full internet access won't find CP somewhere on the net and it be tracked to your proxy, fine. Tor is an answer to do exactly what they want to do, it's in place, it works, and it protects those that run tor nodes by having the ability to deny knowledge as to where traffic comes from and what it is (the proxy can't tell much.)

As I said, I am all for helping circumvent oppressive censorship, but there is a smarter way to do this.

ETA: If I were an iranian government official and I wanted this to stop, all I would have to do is use the system to go get illegal content for those running the proxy and cause legal problems for these proxy owners. Tor stops that by only making the end point (which can be any point in the network) the only part that can be compromised, leaving thousands of other endpoints to use.

Ps: the cheap attempt at a guilt trip is obnoxious.
 
Last edited:
Is there a link to the organizers of this, so we can make suggestions that will help them accomplish what they want to without running risks as they are? Or is it just the guy's blog who you linked to?
 
Ducky said:
You obviously miss my point. If you want to trust that an entire country now getting full internet access won't find CP somewhere on the net and it be tracked to your proxy, fine. Tor is an answer to do exactly what they want to do, it's in place, it works, and it protects those that run tor nodes by having the ability to deny knowledge as to where traffic comes from and what it is (the proxy can't tell much.)

As I said, I am all for helping circumvent oppressive censorship, but there is a smarter way to do this.

ETA: If I were an iranian government official and I wanted this to stop, all I would have to do is use the system to go get illegal content for those running the proxy and cause legal problems for these proxy owners. Tor stops that by only making the end point (which can be any point in the network) the only part that can be compromised, leaving thousands of other endpoints to use.

Ps: the cheap attempt at a guilt trip is obnoxious.
Click to expand...

The message came across wrong: no guilt trip was intended. You're right that someone could cause problems for me if my public server address were to fall into the wrong hands. I'm willing to take a risk with the anonymity. The proxy doesn't need to be up long, and I'm trying to make it easy on non-experts trying to get the word out under less than ideal circumstances.
 
Ducky said:
Is there a link to the organizers of this, so we can make suggestions that will help them accomplish what they want to without running risks as they are? Or is it just the guy's blog who you linked to?
Click to expand...

The blog has a comment section, if you want to contribute. You can also tweet the organizer (@austinheap).
 
ravdin said:
The message came across wrong: no guilt trip was intended.
Click to expand...

Fair enough, I'll try not to be thin skinned ;)

To the rest: It has implications for the success of this, though. What I'm worried about isn't just your legal problems, it's the success of the movement in a sustainable way. Eventually this needs to move to a system (like tor) that can survive attacks on end points or it will fail.
 
Why not tor?

Because it's dog slow, the idea is to let the Iranians get their stories out in a timely manner and tor can't really handle that, could you imagine uploading a 40+ MB vid to Youtube at 5-15 kb/s max?

Tor is great for getting information in an anonymous fashion(good or bad) but sucks at providing information to the rest of the interwebs.
 
drainbread said:
Why not tor?

Because it's dog slow, the idea is to let the Iranians get their stories out in a timely manner and tor can't really handle that, could you imagine uploading a 40+ MB vid to Youtube at 5-15 kb/s max?

Tor is great for getting information in an anonymous fashion(good or bad) but sucks at providing information to the rest of the interwebs.
Click to expand...

Ok the OP didn't mention what this is for. It said to help circumvent the firewalls, not that there is a timely immediate need for this.

You're right, Tor is slow. If you weren't trying to push large things out fast it would be the better answer. I was under the impression this was a generic need (like China's) and not a time-sensitive large-volume need.

That said, the risk is still there.
 
Ducky said:
Fair enough, I'll try not to be thin skinned ;)

To the rest: It has implications for the success of this, though. What I'm worried about isn't just your legal problems, it's the success of the movement in a sustainable way. Eventually this needs to move to a system (like tor) that can survive attacks on end points or it will fail.
Click to expand...

That was my real concern- not that the mullahs will download CP, but that my proxy would be hit with DOS attacks. I see this as a temporary measure in any case- there's a short but critical window of opportunity for the uprising to work. I don't plan on keeping the proxy running for very long.
 
ravdin: I'm apparently not getting the full picture here (as evidenced by drainbred's post) can you detail what the specific need is here? My responses were under the assumption this was like helping the Chinese people get around the great wall, which is a general and sustained need. This appears more immediate, can you detail what the goals/technical needs are for me?

(ETA: Also what is going on. I have been face deep in a bash shell on a deadline for the past week or so and am totally out of touch.)


ETA2: Ok so apparently there's something between a riot and a revolution going on and some contention about a fixed election (color me unsurprised.) I assume then, that this is in place as a temporary measure to move large files (video, audio, pictures etc.) to blogs to document what's going on, not a suggestion to help subvert government oppression in a sustained and permanent way (like my example of China.)

In that case the security needs are still valid, however the time sensitive nature of what is going on may outweigh the issues and Tor may well indeed be completely ineffective for large volume traffic. I would, however, caution that a DDoS response either from sheer traffic pointed at your proxy, or in a way to cause you legal problems, is probably a real issue and should be mitigated. I'd love to suggest to the organizers a way to more quickly use a central registry to bring up more nodes and down ones attacked in the list. Who do I email these scripting ideas to (and they wouldn't take long to script with squid.)
 
Last edited:
Ducky said:
ravdin: I'm apparently not getting the full picture here (as evidenced by drainbred's post) can you detail what the specific need is here? My responses were under the assumption this was like helping the Chinese people get around the great wall, which is a general and sustained need. This appears more immediate, can you detail what the goals/technical needs are for me?

(ETA: Also what is going on. I have been face deep in a bash shell on a deadline for the past week or so and am totally out of touch.)
Click to expand...

Ah! I forget this is not the Politics section.

Long story short: The Iranians recently held a fake "election" over the weekend. Even though the poll was a sham, there was an 85% turnout (compared to a 63% turnout with our last election in the USA). The current President, Mahmoud Ahmadinijad, was reportedly reelected in a landslide. The supposed results are highly dubious. A lot of angry protesters took to the streets today, even though the government imposed a ban. The police have been using live ammunition and beating protesters. There will certainly be more happening tomorrow.

Most significantly, the protesters have been using Twitter, Facebook, and Youtube to get the story out to the world. The regime is trying to block these sites, but they are failing miserably. Hence the call for proxy servers.

A bit more background:

http://news.bbc.co.uk/2/hi/middle_east/8102224.stm
http://andrewsullivan.theatlantic.com/the_daily_dish/ (live blogging the revolution).

ETA: Going to bed now, so I may not respond to your next post for a while.
 
Last edited:
hahaha we cross posted.

Is there a central contact for this proxy movement?
 
Ducky said:
ravdin: I'm apparently not getting the full picture here (as evidenced by drainbred's post) can you detail what the specific need is here? My responses were under the assumption this was like helping the Chinese people get around the great wall, which is a general and sustained need. This appears more immediate, can you detail what the goals/technical needs are for me?

(ETA: Also what is going on. I have been face deep in a bash shell on a deadline for the past week or so and am totally out of touch.)


ETA2: Ok so apparently there's something between a riot and a revolution going on and some contention about a fixed election (color me unsurprised.) I assume then, that this is in place as a temporary measure to move large files (video, audio, pictures etc.) to blogs to document what's going on, not a suggestion to help subvert government oppression in a sustained and permanent way (like my example of China.)

In that case the security needs are still valid, however the time sensitive nature of what is going on may outweigh the issues and Tor may well indeed be completely ineffective for large volume traffic. I would, however, caution that a DDoS response either from sheer traffic pointed at your proxy, or in a way to cause you legal problems, is probably a real issue and should be mitigated. I'd love to suggest to the organizers a way to more quickly use a central registry to bring up more nodes and down ones attacked in the list. Who do I email these scripting ideas to (and they wouldn't take long to script with squid.)
Click to expand...

It's is like a mirror image of the China situation where as people in China can't get information the people in Iran can't release information.
 
Sent the following:

Hi,

I'm a unix admin and have some questions before I throw up a proxy service for this cause.

I'm confused as to why these proxies are being set up in the manner they are, since Tor exists and is much less of a security risk for those running the node. I'll explain: If the Iranian government wises up slightly, in the set up I'm reading about that you have created, all they would need to do is point massive traffic at nodes to down them or more deviously use them to hit child porn and cause legal issues for the proxy owners. Tor exists to not only protect the end user, but all those running nodes on their network by not only encrypting the data but not allowing (within reason) node admins to see where the traffic comes from. This means an attack on an endpoint is not detrimental to the network as a whole. In the model you've created it would seem anyone running this is vulnerable to a myraid of legal and technical problems.

Also, I am curious how the central registry for this list of nodes is handled (which is automatic on Tor) and whether there is fast ability to manipulate network traffic to and from specific nodes in case of attack. Since your system doesn't seem to have much redundancy this could be an issue, but again, I'm not privy to how you're handling the central registry.

The install for tor is pretty easy, by the way. You can find info at:

http://www.torproject.org/

Install instructions for linux, mac and windows.

The drawback is this: Tor is pretty damned slow compared to a straight proxy. If you're trying to move things at lightning speed (which may or may not be a reasonable goal in this situation) Tor isn't the answer.

So I guess the questions is: Why not tor, and if not tor how can I help build some bulletproofing and security into the system you have in place so that we also are not subject to legal and technical problems? I'm happy to script some configs that would involve ssl connections and central registry, etc if I can...
Click to expand...
 
You must log in or register to reply here.

Back
Top Bottom