{"action":"created","issue":{"url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/21","repository_url":"https://api.github.com/repos/Jigsaw-Code/outline-server","labels_url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/21/comments","events_url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/21/events","html_url":"https://github.com/Jigsaw-Code/outline-server/issues/21","id":307408336,"number":21,"title":"ShadowSocks security issue","user":{"login":"sailosha","id":1269208,"avatar_url":"https://avatars3.githubusercontent.com/u/1269208?v=4","gravatar_id":"","url":"https://api.github.com/users/sailosha","html_url":"https://github.com/sailosha","followers_url":"https://api.github.com/users/sailosha/followers","following_url":"https://api.github.com/users/sailosha/following{/other_user}","gists_url":"https://api.github.com/users/sailosha/gists{/gist_id}","starred_url":"https://api.github.com/users/sailosha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sailosha/subscriptions","organizations_url":"https://api.github.com/users/sailosha/orgs","repos_url":"https://api.github.com/users/sailosha/repos","events_url":"https://api.github.com/users/sailosha/events{/privacy}","received_events_url":"https://api.github.com/users/sailosha/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-03-21T20:35:57Z","updated_at":"2018-03-27T08:32:49Z","closed_at":"2018-03-21T22:32:51Z","author_association":"NONE","body":"It seems like China has already developed sniff & tracking machine learning to track ss data transfer. [Link for the research. ](http://ieeexplore.ieee.org/document/8048116/?reload=true#full-text-section)\r\nThey DID give the warning for the people who own ss VPN servers. \r\n\r\nIf we didn't change ss protocol, it wouldn't work so well in the long term.  \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/comments/376441645","html_url":"https://github.com/Jigsaw-Code/outline-server/issues/21#issuecomment-376441645","issue_url":"https://api.github.com/repos/Jigsaw-Code/outline-server/issues/21","id":376441645,"user":{"login":"paperbag","id":19257585,"avatar_url":"https://avatars3.githubusercontent.com/u/19257585?v=4","gravatar_id":"","url":"https://api.github.com/users/paperbag","html_url":"https://github.com/paperbag","followers_url":"https://api.github.com/users/paperbag/followers","following_url":"https://api.github.com/users/paperbag/following{/other_user}","gists_url":"https://api.github.com/users/paperbag/gists{/gist_id}","starred_url":"https://api.github.com/users/paperbag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paperbag/subscriptions","organizations_url":"https://api.github.com/users/paperbag/orgs","repos_url":"https://api.github.com/users/paperbag/repos","events_url":"https://api.github.com/users/paperbag/events{/privacy}","received_events_url":"https://api.github.com/users/paperbag/received_events","type":"User","site_admin":false},"created_at":"2018-03-27T08:32:49Z","updated_at":"2018-03-27T08:32:49Z","author_association":"NONE","body":">It seems like China has already developed sniff & tracking machine learning to track ss data transfer. Link for the research. \r\n\r\nThat's all we known. But this paper is absolutely wrong.\r\n\r\nI would like refer fortuna's comment posted last year.\r\n\r\n>The paper says:\r\n>\r\n>>Like most principles of proxy software, Shadowsocks firstly establish a SSH [8] based encrypted channel with servers which are outside the firewall\r\n>\r\n>That's simply wrong: Shadowsocks does not use SSH. Did they test the right thing? SSH is a lot easier to identify.\r\n\r\nhttps://github.com/shadowsocks/shadowsocks/issues/988#issuecomment-336508578\r\n\r\n>Without any evidence, but we believe this ShadowsocksR would be more secure in China.\r\n\r\nIn theoretically, there is no traffic can't be analysis. ShadowsocksR also can be  entropy attack, according to [Seeing through network-protocol obfuscation](http://pages.cs.wisc.edu/~liangw/pub/ccsfp653-wangA.pdf)."}}
{"actor":{"display_login":"paperbag"}}