https://github.com/ooni/blocking-fingerprints
Consolidate all the blocking fingerprints in one place
https://github.com/ooni/blocking-fingerprints
Last synced: over 1 year ago
JSON representation
Consolidate all the blocking fingerprints in one place
- Host: GitHub
- URL: https://github.com/ooni/blocking-fingerprints
- Owner: ooni
- Created: 2022-08-01T15:37:36.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2023-09-12T11:26:29.000Z (almost 3 years ago)
- Last Synced: 2024-04-14T09:04:43.337Z (over 2 years ago)
- Language: Python
- Size: 944 KB
- Stars: 6
- Watchers: 7
- Forks: 3
- Open Issues: 4
-
Metadata Files:
- Readme: Readme.md
Awesome Lists containing this project
README
# Blocking Fingerprints
The goal of this repo is to document all the known blocking fingerprints for
use in network measurement projects aimed at measuring internet censorship.
The sources of these fingerprints are:
* [ooni/pipeline](https://github.com/ooni/pipeline/blob/master/af/fastpath/fastpath/utils.py)
* [censoredplanet/censoredplanet-analysis](https://github.com/censoredplanet/censoredplanet-analysis/tree/master/pipeline/metadata/data)
* [citizenlab/filtering-annotations](https://github.com/citizenlab/filtering-annotations)
In here you will find two CSV files for HTTP and DNS fingerprints respectively.
## Schema
* `name` is an identifier of this particular fingerprint. They are generally in the form of `org.fingerprint_id` (ex. `ooni_br_1`)
* `location_found` indicates where the fingerprint can be found. If we are searching for it in the HTTP response body we will use the key `body`, while if we are looking for it inside of a header it will take the form `header.{header_name}` where `{header_name}` is the header field name in lowercase (ex. `header.x-app-url`). In the case of DNS fingerprints, this will have the value `dns`.
* `pattern_type` indicates what sort of pattern matching should be used, it can be one of `full`, if it's a full strict match (i.e. `==`), `prefix` if we are matching against the prefix of the target value (i.e. `startswith`), `contains` if we are searching for the pattern substring inside of the target (i.e. `is in`), `regexp` if the pattern should be interpreted as a regular expression.
* `pattern` is the value of the pattern used to match. See `pattern_type` for the possible types of patterns.
* `scope`, we currently follow the same definition of scopes used by the citizenlab, which is, `nat` national level blockpage, `isp` ISP level blockpage, `prod` text pattern related to a middlebox product, `inst` text pattern related to a voluntary instition blockpage (school, office), `vbw` vague blocking word, `fp` fingerprint for false positives.
* `confidence_no_fp`, taken also from citizenalb: how likely (by self-assessment) the signature is to cause a false positive. Shorter or more vague text patterns which may be likely to match against are given lower numbers.
* `expected_countries`, a list of countries where we expect to see the blockpage fingerprints comma separated (ex. `IT, IR`).
* `source`, this indicates where this fingerprint came from
* `exp_url`, a link to an OONI Explorer measurement documenting this fingerprint
* `notes`, additional freeform notes on the fingerprint
* `other_names`, a list of other names identifying the fingerprint when it's present in multiple repositories