This article is the answer: a practical guide, from easiest to hardest, to keep your communication channels standing as the siege tightens. Because the siege is tightening, and you should understand its pace before picking your tools.

The track record: none of this is new

Anyone surprised by the Discord case was not paying attention. The Brazilian judiciary has been blocking communication services for over a decade, always steamrolling millions of innocent users to reach half a dozen suspects:

• WhatsApp, 2015 and 2016: blocked three times by lower-court judges, always because the company would not hand over conversations that, by design, it cannot read.
• Telegram, 2022 and 2023: suspended for two days by order of Justice Alexandre de Moraes in March 2022, and again by a federal judge in 2023. Migalhas has the full timeline.
• X/Twitter, 2024: the landmark. Nationwide suspension from August 30 to October 8, 40 days, by a single justice’s order. And here is the detail that matters for this guide: the decision included a fine of R$ 50,000 (~US$ 10,000) per day for any individual who accessed X through a VPN, an order for app stores to remove VPN apps (walked back hours later), and the Federal Police and Anatel (the telecom regulator) producing reports on who bypassed the block to support the fines.

Notice what happened there: for the first time, using a neutral privacy tool became, by itself, punishable conduct in Brazil. Nobody was fined in the end, but the infrastructure to fine people was built, tested and documented. And in 2026 Congress voted and the president signed a sentence enhancement for crimes committed with a VPN. The X precedent stopped being an exception and became repertoire.

Keep this: in the X case, the Brazilian state already treated VPN users as offenders, already tried to pull VPNs from app stores, and already requested reports on who bypassed the block. All of it documented, in court orders and public reports.

The endgame: the Chinese model

I have little doubt that very well-positioned people in government look at China’s Great Firewall with envy, not horror. And it is worth understanding what it is, because it defines the limit of the game.

The Firewall goes far beyond blocking websites. It is deep packet inspection (DPI) at national scale, running on the country’s internet backbone: all traffic is classified in real time, known VPN protocols are identified by their handshake shape and dropped, Tor is blocked by default, and only state-approved VPNs (meaning, with a backdoor) operate legally. Ordinary citizens caught using unauthorized VPNs get fined. And even when the traffic cannot be read, the metadata gives the game away: who talks to whom, when, for how long.

That is why the honest answer to “can you bypass a Firewall like that without being noticed?” is: no, not for an ordinary citizen. Against a state-level firewall of that caliber, no consumer tool makes you invisible. At best it makes you too expensive to be worth persecuting at scale. Anyone selling you total invisibility is lying.

The good news is that Brazil is nowhere near that point. Censorship rarely arrives all at once: it comes in steps, and each step has a matching defense. The rest of this guide is that staircase, step by step. The logic behind everything that follows is a single one: censorship is a matter of cost. Our job is to make blocking expensive, technically and politically, until mass deployment becomes impractical.

Keep this: against a complete state firewall, no tool makes you invisible, only too expensive to persecute at scale. The game is climbing your staircase before the censor climbs his.

Phase 1: Commercial VPN, the minimum everyone should have

Start with the obvious. A VPN (virtual private network) creates an encrypted tunnel between your device and a provider’s server. Your ISP (internet service provider) now sees only a scrambled flow going to a single address; the sites you visit see the VPN’s IP, not yours. I explain it in depth, with the networking theory underneath, in Akitando 126 (in Portuguese).

What a VPN does: hides your traffic from your ISP, swaps your exit IP, gets you out of geo-blocks and of court-ordered DNS/IP blocks. What it does not do:

• It does not make you anonymous. The VPN provider sees all your traffic in place of your ISP. You did not eliminate the watcher, you just picked a different watcher.
• It does not hide your identity if you paid by credit card. A credit card subscription ties the VPN account to your tax ID. If authorities show up at the provider with a court order, your name is there.
• It does not protect content past the tunnel. From the VPN exit to the final website, the web’s normal encryption (HTTPS) applies. The VPN is one leg of the path, not the whole path.

That said, for the early phases of the siege it does the job. My recommendations, in order:

• ProtonVPN: Switzerland, outside easy jurisdiction, open source and audited, a no-logs policy tested in court, a decent free tier, and it accepts payment even in cash by mail.
• Mullvad: Sweden, the most paranoid on the market: it does not even ask for an email, your account is a random number. Flat €5/month, accepts cash in an envelope and cryptocurrency. It is the closest thing to an “identity-less VPN” that exists as a commercial product.
• NordVPN and the like work technically, but their money goes more to marketing than to privacy posture. Among the big ones, I stick with the two above.

The limit of this phase is well known: the exit IPs of famous VPNs are public and catalogued. An order from ANPD or Anatel to national ISPs to block those ranges is technically trivial, and the X case showed that pulling the app from the store is also on the menu. When (not if) that happens, the commercial VPN dies in a day. That is why Phase 2 exists.

Keep this: a commercial VPN is a seatbelt: use it always, but know it depends on three things outside your control. The app staying in the store, the IPs staying unblocked, and the provider staying honest.

Phase 2: Self-hosted VPN, your own tunnel

The move here changes shape: instead of subscribing to a service with millions of users and catalogued IPs, you rent a cheap little server outside Brazil and build your personal VPN. There is no public list with your IP for the censors to download. You are one user on an unknown IP, indistinguishable from any other traffic until someone looks closely.

Picking the provider (and why not AWS, Azure or Google Cloud). The big clouds have huge, public, well-mapped IP ranges (ASNs). Blocking them wholesale is one line in a routing table; the only brake is collateral damage (plenty of legitimate Brazilian businesses live there), and other countries have paid that price in crises. Smaller providers dilute that target. Options I would consider, from mid-sized to small:

A US$ 3 to 5 machine with 1 GB of RAM is plenty for a personal VPN. Important caveat: paying for a VPS (virtual private server) with a credit card leaves a trail just like the commercial VPN: your name is in the provider’s records, and the provider can be legally compelled. Some accept cryptocurrency, which reduces (does not eliminate) the trail. For most people, at this phase, the signup risk is acceptable: you are not hiding from a named investigation, you are getting out of the aim of a mass block.

Step by step: WireGuard with wg-easy

I will use wg-easy, which packages WireGuard (the modern, fast, auditable VPN protocol) into a Docker container with a web panel and QR codes to set up your phone in seconds.

1. Rent the VPS. Ubuntu 24.04, the smallest machine available, in a region outside Brazil (Amsterdam, Frankfurt and Helsinki are classic choices for jurisdiction and acceptable latency).

2. Log in and update:

ssh root@YOUR_IP
apt update && apt upgrade -y

3. Install Docker:

curl -fsSL https://get.docker.com | sh

4. Generate the panel password hash (wg-easy does not accept a plaintext password; write down the password you choose):

docker run --rm -it ghcr.io/wg-easy/wg-easy wgpw 'YourStrongPasswordHere'
# the output looks like: PASSWORD_HASH=$2b$12$abc...
# in the command below, double every dollar sign: $ becomes $$

5. Start the container:

docker run -d \
  --name=wg-easy \
  -e WG_HOST=YOUR_IP \
  -e PASSWORD_HASH='$$2b$$12$$abc...' \
  -v ~/.wg-easy:/etc/wireguard \
  -p 51820:51820/udp \
  -p 51821:51821/tcp \
  --cap-add=NET_ADMIN \
  --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
  --sysctl="net.ipv4.ip_forward=1" \
  --restart unless-stopped \
  ghcr.io/wg-easy/wg-easy

6. Open the firewall. Port 51820/UDP is the tunnel itself. Port 51821/TCP is the panel: do not leave the panel exposed to the internet. The right way is to open it only through an SSH tunnel (ssh -L 51821:localhost:51821 root@YOUR_IP and browse to localhost:51821), or to open 51821 just long enough to create your clients and close it right after.

7. Create the clients. In the panel, one click generates a client with a QR code. Point the official WireGuard app (Android/iOS) camera at it and you are done. On a laptop, download the config file and import it into the WireGuard client.

Done: all of your device’s traffic exits through your European server. Your Brazilian ISP sees only a scrambled flow to some random IP in Germany.

And on your machine, how do you use it?

The server is half the story. On your device, the ritual goes like this:

On your phone (Android/iOS): install the official WireGuard app from the store (or from F-Droid on Android). Tap the "+", choose “Scan from QR code” and point it at the code the wg-easy panel showed. A new “tunnel” appears in the list: one tap on the switch and you are in. On iOS, enable “On-Demand” in the tunnel settings so it reconnects by itself when you switch networks (Wi-Fi to 4G, for instance).

On your laptop (Windows/macOS): download the official WireGuard client for your system, click “Import tunnel(s) from file” and select the .conf you downloaded from the panel. One click on “Activate” and done. Important detail: the official client has a “Block untunneled traffic” option (the kill switch): turn it on. If the tunnel drops, your internet stops instead of leaking through your real IP.

On Linux: copy the .conf to /etc/wireguard/wg0.conf and bring it up with sudo wg-quick up wg0 (plus sudo systemctl enable wg-quick@wg0 to start it at boot). Or import the file straight into NetworkManager through the graphical interface, if you prefer clicking to typing.

A complete client .conf, for reference, looks like this:

[Interface]
PrivateKey = <THIS device's private key>
Address = 10.10.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server public key>
Endpoint = SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Two details worth their weight in gold here. PersistentKeepalive = 25 keeps the tunnel alive when you are behind NAT (home network, 4G), preventing the connection from silently dying. And AllowedIPs = 0.0.0.0/0 is what pushes all traffic into the tunnel; without it, only traffic to the VPN’s own IPs goes out encrypted. (The DNS = line works fine on Windows, macOS and phones; on Linux with systemd-resolved it can get in the way, as I explain in the common mistakes below.)

Checking that it worked: with the tunnel active, run curl ifconfig.me in a terminal (or open ipleak.net in the browser). It must show your VPS IP, not your home one. If your network has IPv6, check separately with curl -4 ifconfig.me and curl -6 ifconfig.me: both must show the server. And visit dnsleaktest.com: DNS must exit through the tunnel too. If your ISP’s DNS server shows up, there is a leak to fix.

Minimum maintenance: enable unattended-upgrades so the system patches itself, use SSH keys instead of passwords, and install nothing else on that machine. Small surface, small risk.

The 2026 way to do this: let the AI configure it

If you got stuck on some step, remember it is 2026: you no longer need to master every command in this guide. I went down that path myself. I rented the VPS, handed the SSH access to the AI agent and asked for the full setup; on the other side, on my own machine, it imported the .conf, brought up wg-quick, enabled it at boot and checked for leaks at the end. Today my server is a reproducible Ansible playbook (kill the VPS, spin up another, run one command) and my laptop’s config follows the same pattern. All in private repositories, private on purpose: VPN configuration is not the sort of thing I want strangers peeking at.

Mine, running on my own Gitea: private, versioned, and the whole server comes back up with one command.

And if you are going to ask an AI to configure it, skip the generic “install me a VPN” and hand over the real requirements. Something like this:

Turn this fresh Ubuntu 24.04 VPS into a robust WireGuard server,
preferably through an idempotent Ansible playbook (I want to be able to
destroy the VPS and recreate everything by running one command).
Requirements:

- WireGuard managed by wg-quick@wg0, server key generated on the server
  itself (mode 0600), no exposed web panel
- Dual-stack tunnel: IPv4 and IPv6 (fd00::/64 ULA subnet with NAT66), so
  no traffic leaks outside on networks with native IPv6
- ufw denying everything except SSH and the WireGuard UDP port
- key-only sshd (no passwords), fail2ban on sshd, unattended-upgrades
  with no automatic reboot
- Peers declared as data in a config file: adding a client = adding one
  entry and running the playbook again
- Generate client .conf files with PersistentKeepalive=25, full-tunnel
  AllowedIPs and QR codes via qrencode
- At the end, print the verification commands (curl -4/-6 ifconfig.me,
  wg show)

Finally, hand me a short operations README: how to add a client, how to
update, when to reboot.

The difference between a “working” server and a solid one lives entirely in those requirements: dual-stack, closed firewall, passwordless sshd, peers as data, reproducibility. The technical barrier of this entire article has, in practice, become a conversation.

Common mistakes (and how to avoid them)

I keep seeing the same stumbles whenever someone sets up their first self-hosted VPN. All avoidable:

• Exposing the wg-easy panel to the internet. The number one classic mistake. The panel is the key to the vault: open on port 51821, any botnet scan finds it within hours. SSH tunnel always, open port never.
• Weak or recycled passwords on the panel and SSH. An entire VPN protected by changeme123 is worse than no VPN. And disable SSH password login for good (PasswordAuthentication no in sshd_config) once your key is set up.
• Thinking you are anonymous because the IP is “yours”. The VPS is in your name, paid with your card. It protects you from mass blocking, not from an investigation with your name on it. The wrong level of paranoia creates a false sense of security, which is worse than none.
• A VPS in Brazil or from a Brazilian company. I have seen people build a “privacy VPN” on a national provider. If the court order arrives in the same country, you did not leave the reach, you just changed shelves. Server abroad, jurisdiction abroad.
• Handing out access to half the world. Each extra person is one more device, one more usage pattern, one more mouth. Close family, fine; a 40-contact group, no. The more people on the same IP, the faster it lands on some list.
• Using the same machine for other things. Personal blog, Telegram bot, seedbox: all of that grows the attack surface and ties together identities you wanted separate. The VPN VPS is for the VPN only.
• Trusting without testing for leaks. After setting up, test: ipleak.net or dnsleaktest.com with the VPN on. If your real IP or your ISP’s DNS shows up, something is wrong, and this is the only way you find out.
• Forgetting IPv6. This one got even me: an IPv4-only tunnel on a network with native IPv6, and all the v6 traffic goes around the VPN, in the clear, without you noticing. Either the tunnel is dual-stack, or half of your traffic leaks. Test with curl -6 ifconfig.me.
• The DNS = line breaking the Linux client. On systemd-resolved systems (Ubuntu, Fedora and the like), wg-quick calls openresolv to write the DNS, openresolv refuses to touch the /etc/resolv.conf owned by systemd-resolved (“signature mismatch” error) and the whole interface fails to come up. If your system DNS already works fine, just remove the line: queries ride the tunnel anyway.
• Losing the printer, the NAS and the local network. With AllowedIPs = 0.0.0.0/0, even traffic inside your own home tries to go through the tunnel. The fix is a policy routing rule evaluated before WireGuard’s own rules: PostUp = ip rule add to 192.168.0.0/16 lookup main priority 1000 (plus the matching PostDown to undo it on shutdown).
• Chaining wg-quick down && up. down returns an error when the interface is already down, and with && the up never runs. Run up on its own.
• Installing and abandoning. A server without updates for a year is a server with known vulnerabilities. And test the connection from time to time: what works today can be fingerprinted tomorrow.
• No backup of the configuration. The ~/.wg-easy directory holds everything (keys, clients). Keep an encrypted local copy. If the VPS dies or gets shut down by the provider, you bring another one up in ten minutes instead of starting from zero.

Keep this: a US$ 5 VPS outside Brazil running WireGuard gets you out of any mass block based on catalogued IPs. The price is your signup record at the provider: acceptable against blocking, insufficient against a named investigation.

The invisible enemy: DPI

So far I have assumed the censor blocks addresses. Their next level is blocking formats, and that is where deep packet inspection (DPI) lives.

Even encrypted, a VPN tunnel has a signature. The initial handshake of WireGuard and OpenVPN has characteristic packet sizes, sequences and timings. The content is unreadable, but the shape screams “I am a VPN”. China does exactly this at national scale: it does not need to read your traffic, it only needs to recognize the protocol and drop the connection.

Keep this: the censor does not need to read your traffic to block you. Recognizing the tunnel’s shape is enough. That is why obfuscation exists.

The technical answer is obfuscation: making the tunnel look like something else.

• AmneziaWG: a WireGuard fork that injects junk packets and scrambles headers until the signature vanishes. Same audited WireGuard base, free apps for every platform, and it points at the same kind of VPS from Phase 2. If you set up wg-easy, migrating to Amnezia is the natural step when DPI arrives.
• udp2raw: wraps WireGuard’s UDP traffic inside fake TCP packets that look like an ordinary connection.
• Shadowsocks: born in China precisely for this, an encrypted proxy designed to have no recognizable signature.

Notice we are still talking about free tools and a US$ 5 VPS. The cost rises for the censor much faster than for you.

Phase 3: when even your VPS is not enough

If the scenario degrades to national DPI with protocol blocking, the game becomes heavy camouflage and redundancy. The real options, in order of effort:

Protocols that disguise themselves as ordinary HTTPS. The current state of the art is VLESS with Reality (from the Xray-core project): your traffic presents itself as a legitimate TLS 1.3 connection to a real, innocent website, with certificate, handshake and packet pattern indistinguishable from a normal visit. To block you, the censor would have to block the innocent site too, and the collateral damage is the defense. Trojan-Go follows a similar philosophy. Outline, from Jigsaw (Google), packages Shadowsocks with a friendly manager if you want to hand out access to family and friends.

Tor with bridges. Plain Tor is blocked by default in censoring countries, but obfs4 bridges and Snowflake were tailor-made for that scenario: Snowflake disguises your entry into the Tor network as an ordinary WebRTC video call. It is slow, forget streaming, but it is the hardest network to extinguish in existence, maintained precisely for journalists and activists in hostile countries.

Redundancy and rotation. Two or three cheap VPSs at different providers, with automatic failover. If one lands on a blacklist, you switch in minutes: new instance, new IP. Your cost: another US$ 5. The censor’s cost: find and block it again, every time.

Alternative access. Starlink and other satellite links leave the national ground infrastructure entirely. As long as they are not regulated as well, they are the physical last resort. And for extreme cases, the usual sneakernet: thumb drive, external disk, physical copies.

Client-side hygiene, valid in every phase:

• Kill switch on: if the tunnel drops, the device cuts the internet instead of leaking through your real IP.
• DNS leak protection: your DNS queries must go through the tunnel, otherwise your ISP keeps seeing every site you visit.
• WebRTC disabled in the browser (or use an extension): it leaks your real IP even with the VPN on.
• VPN on when needed, not always: a 24/7 usage pattern becomes a behavioral signature of its own.

And the usual honest notes: running your own server for personal use is legal; using it to commit crimes is not. And since 2026, with the new sentence enhancement, “using a VPN” weighs on the sentence of any crime you would commit anyway. Keep the surface small, test your connectivity from inside Brazil regularly (what works today can be fingerprinted tomorrow), have a plan B (a second VPS, a Tor profile with bridges) and keep offline copies of everything critical.

Realistic assessment: no solution is permanent against a determined, well-funded censor. The goal here is different: make mass blocking expensive until it becomes a bad deal, technically and politically. A country that needs to take down half of the legitimate internet to silence half a dozen voices has a public relations problem, not a technology one. That cost is where we place our bet.

Keep this: the staircase is commercial VPN, then your own VPN, then obfuscated protocol, then Tor with bridges, then satellite. Each step raises your cost a little and the censor’s a lot. Start climbing before you need to.

Conclusion

The Brazilian pattern is what I called censorship by accumulation: no single step looks like the end of the world, and each comes with its little plaque of good intentions. But blocking infrastructure, once built, has no moral owner: it serves today’s government and tomorrow’s, against today’s target and against you.

Free communication infrastructure works exactly the same: also built by accumulation, also brick by brick. A commercial VPN configured today. Your own VPS tomorrow. An obfuscated protocol in the drawer for when it is needed. None of this is paranoia. It works like backups: you do not wait for the disk to fail before starting.

And if you want to follow this frontier closely, a personal recommendation: follow Ayub. He is the best source on internet infrastructure and state censorship in Brazil today. He was the one who sounded the alarm about the VPN criminalization in bill PL 3066/2025 months before it became law. And in recent days he has been covering two things the mainstream press barely touched: the handover of over R$ 100 billion in public networks, ducts and federal properties to the carriers and BTG Pactual, and the technical apparatus of the new Marco Civil regulation, which according to him gave Anatel remote access to ISPs’ edge routers. He posts in Portuguese, but your browser’s translator handles it. Required reading to understand where the next step of the staircase comes from.

The best time to build your tunnel was before you needed it. The second best time is now.

Ayub posted on X that this has all the usual signs of a national block ordered by Anatel against api.github.com. In that same context, the tweet he quoted showed api.github.com resolving to 4.228.31.149, but with no working route. The author said he tested through VIVO, Claro, and Oracle, and that it only worked through a Miami VPN. In other words: this does not look like “my Wi-Fi is down.” It looks like a block somewhere in the path.

According to Ayub, this kind of thing often happens in blocking waves, many times after Wednesday meetings with large carriers, inside the Brazilian mechanism for blocking addresses under the excuse of fighting piracy. The problem is the blast radius: instead of taking down only the target, it breaks legitimate infrastructure. Today it was the GitHub API. Tomorrow it can be anything your work depends on.

And yes, I confirmed it from here.

How to know if you were affected

First, test whether the main site opens:

curl -4 -I --connect-timeout 8 --max-time 12 https://github.com/

Here it worked. Then test the API:

curl -4 -I --connect-timeout 8 --max-time 12 https://api.github.com/

Here I got:

curl: (28) Connection timed out after 8002 milliseconds

Now check which IP your system resolves:

getent ahostsv4 api.github.com

In my case:

4.228.31.149    STREAM api.github.com
4.228.31.149    DGRAM
4.228.31.149    RAW

And gh depends on this API too. So commands like these may hang:

gh api rate_limit
gh pr list
gh issue list

If you are a developer and suddenly gh stopped, your release scripts stopped, your PR-listing bot stopped, or some CLI that queries issues started hanging, this may be it. It is not your bug. Your route to api.github.com is being thrown into a hole.

First try DNS 9.9.9.9

Some people mentioned that changing DNS to Quad9, 9.9.9.9, could work around it. It makes sense to test, because some blocks are done through DNS: the provider returns the wrong IP, NXDOMAIN, or sends you into a sinkhole. If the problem is only your provider’s DNS, changing DNS fixes it.

Test without changing anything in the system:

dig @9.9.9.9 +short api.github.com A

In my case, it did not help. Quad9 also returned:

4.228.31.149

And forcing that IP in curl still timed out:

curl -4 -I --connect-timeout 8 --max-time 12 \
  --resolve api.github.com:443:4.228.31.149 \
  https://api.github.com/

Result:

curl: (28) Connection timed out after 8002 milliseconds

So, on my link, 9.9.9.9 did not fix it. But test yours. If your provider is only poisoning DNS, it may work.

On Arch with NetworkManager, it would be something like this:

sudo pacman -S bind-tools curl

nmcli con show --active
sudo nmcli con mod "YOUR CONNECTION NAME" \
  ipv4.ignore-auto-dns yes \
  ipv4.dns "9.9.9.9 149.112.112.112"
sudo nmcli con down "YOUR CONNECTION NAME"
sudo nmcli con up "YOUR CONNECTION NAME"

On Ubuntu, same idea. Install the tools and adjust through NetworkManager:

sudo apt install dnsutils curl
nmcli con show --active

Or use the GNOME/KDE network settings screen and set manual DNS to 9.9.9.9 and 149.112.112.112 for the connection. Then disconnect and reconnect.

Test again:

dig +short api.github.com A
curl -4 -I --connect-timeout 8 --max-time 12 https://api.github.com/

If it works, good. You are done here.

If it keeps timing out, DNS was only the first layer. Then you need to route the connection through another path.

Why I do not like the fixed-IP hack

Another suggestion I saw was manually adding IPs to local DNS, like Pi-hole, Unbound, /etc/hosts, dnsmasq, that sort of thing. Example: “resolve api.github.com to this other IP that works.”

That can work for a few hours. I don’t like it.

GitHub is large infrastructure. IPs change. Routes change. Load balancing changes. Regions change. The IP that works for somebody in Miami may be bad for you in São Paulo. The IP that works today may fail tomorrow. And if the block is a blackhole route at the provider, changing DNS to another IP may only trade one hole for another.

Pi-hole is great for a home network. Unbound is great. /etc/hosts saves you in an emergency. But pinning the IP of a large service like GitHub is how you forget an invisible hack and lose two hours next month trying to understand why only your machine is broken.

Use alternate DNS as a test. Use fixed IP only as a temporary bandage and document where you changed it.

Fallback: SOCKS proxy only for GitHub tools

My solution was the least invasive thing I could make: a wrapper that starts a local SOCKS proxy through Tor and runs only the command I choose through it. It does not route the whole system. It does not touch the browser. It does not affect package managers, Steam, banking, nothing. Just gh, or whatever tool I explicitly call.

In my case, the wrapper lives at ~/.config/zsh/bin/github-proxy, and the alias in ~/.config/zsh/aliases does this:

alias gh='$HOME/.config/zsh/bin/github-proxy gh'

The wrapper is this:

#!/bin/bash
set -euo pipefail

proxy_host="127.0.0.1"
proxy_port="9050"
tor_dir="${XDG_RUNTIME_DIR:-/tmp}/github-proxy-tor"
tor_rc="$tor_dir/torrc"
tor_log="$tor_dir/tor.log"

if [[ $# -eq 0 ]]; then
  echo "usage: github-proxy <command> [args...]" >&2
  exit 2
fi

if ! ss -ltn "sport = :$proxy_port" | grep -q "$proxy_host:$proxy_port"; then
  mkdir -p "$tor_dir"
  : >"$tor_rc"
  tor -f "$tor_rc" --SocksPort "$proxy_host:$proxy_port" --DataDirectory "$tor_dir/data" >"$tor_log" 2>&1 &

  for _ in {1..60}; do
    if grep -q 'Bootstrapped 100%' "$tor_log"; then
      break
    fi
    if ! kill -0 "$!" 2>/dev/null; then
      echo "github-proxy: tor exited before bootstrap; see $tor_log" >&2
      exit 1
    fi
    sleep 1
  done

  if ! grep -q 'Bootstrapped 100%' "$tor_log"; then
    echo "github-proxy: timed out waiting for tor bootstrap; see $tor_log" >&2
    exit 1
  fi
fi

export HTTPS_PROXY="socks5h://$proxy_host:$proxy_port"
export HTTP_PROXY="socks5h://$proxy_host:$proxy_port"
export ALL_PROXY="socks5h://$proxy_host:$proxy_port"

exec "$@"

Notice socks5h. That h matters. It makes DNS resolution happen through the proxy, not through your local network. If you use plain socks5://, depending on the library, DNS may still happen locally before the proxy is used. With socks5h://, the idea is: “take the hostname to the other side and resolve it there.”

Installing on Arch

On Arch:

sudo pacman -S tor github-cli iproute2
mkdir -p ~/.local/bin

Create the script:

nano ~/.local/bin/github-proxy

Paste the wrapper above and make it executable:

chmod +x ~/.local/bin/github-proxy

Test it directly:

~/.local/bin/github-proxy gh api rate_limit --jq .resources.core.limit

An authenticated account usually returns:

5000

That is what happened here. Direct timed out. Through the wrapper, gh api rate_limit --jq .resources.core.limit returned 5000.

Now add an alias to your shell.

ZSH:

echo "alias gh='$HOME/.local/bin/github-proxy gh'" >> ~/.zshrc
source ~/.zshrc

Bash:

echo "alias gh='$HOME/.local/bin/github-proxy gh'" >> ~/.bashrc
source ~/.bashrc

Test:

gh api rate_limit --jq .resources.core.limit
gh pr list

Ubuntu

On Ubuntu, the Tor package is easy:

sudo apt update
sudo apt install tor iproute2 curl

For GitHub CLI, if the gh package is available in your version:

sudo apt install gh

If it is not, follow the official GitHub CLI installation for Ubuntu/Debian. The rest is the same: create ~/.local/bin/github-proxy, run chmod +x, and put the alias in .bashrc or .zshrc.

Better alternatives than Tor

Tor worked and it is convenient, but it is not the only option. Sometimes it is slow. Sometimes a service dislikes Tor exits. For gh api and listing PRs, fine. For heavier use, you may want something more predictable.

Reasonable options:

• Normal VPN: Proton, Mullvad, IVPN, your own WireGuard. Route everything or use split tunneling if you know how to configure it.
• Tailscale with an exit node outside Brazil: clean, if you have a trusted machine outside the country or a VPS.
• SSH SOCKS to a VPS: ssh -N -D 127.0.0.1:9050 user@your-vps. Then use the same HTTPS_PROXY=socks5h://127.0.0.1:9050.
• Corporate proxy: if your company has egress outside Brazil, configure only the tools that need it.

The care here is not changing everything at the same time. First prove that direct api.github.com fails. Then prove that another path works. Only then automate.

Adjusting your own tools: ghpending

This block also hit one of my utilities: ghpending. I already wrote about it in “I Built a CLI to Check My GitHub Pending Stuff: ghpending”. It lists open issues and pull requests across my repositories, so I know where somebody is waiting for an answer.

The problem is obvious: it uses the GitHub API. If api.github.com falls into a hole, it falls with it.

So I added a proxy fallback. ghpending now reads GITHUB_TOKEN like before, but also tries to use a SOCKS proxy in this order:

1. GHPENDING_GITHUB_PROXY, if you want to force a specific proxy.
2. HTTPS_PROXY, https_proxy, ALL_PROXY, or all_proxy, if they are socks5:// or socks5h://.
3. A local SOCKS proxy at 127.0.0.1:9050, if one is listening.
4. If none of that exists, it tries direct access.

In the README, it looks like this:

GITHUB_TOKEN=$(gh auth token) ghpending

And for proxy:

GHPENDING_GITHUB_PROXY=socks5h://127.0.0.1:9050 ghpending

Or just run it through the wrapper:

~/.local/bin/github-proxy ghpending

My wrapper starts Tor on 127.0.0.1:9050; ghpending detects that proxy and uses it for API calls. If you are not blocked, it keeps working directly. If you are blocked, it has an escape route.

This is the kind of fallback every Brazilian dev should now consider for tools that depend on foreign APIs. It is ugly, but the Brazilian internet is getting unpredictable.

The political problem

At the end of the thread, Ayub reminded everyone that, because of these secret collateral blocks and their side effects, there would already be around 250 million addresses blocked on the Brazilian internet. He also linked a presentation about the state of blocking in Brazil. In another tweet in the same thread, he says authorities defend secrecy as the only alternative left to fight crime.

I do not buy that excuse.

Secret blocking of critical infrastructure, with no transparency, no public adversarial process, no auditable list, no explanation of scope, is operational censorship. In my read, it is illegal precisely because it dodges the public, auditable process that should exist when the State orders internet access to be broken. Maybe it started with pirate TV boxes. Maybe the speech sounds noble. But the mechanism is there: somebody presses a button, carriers apply the block, legitimate users only find out when a work tool stops.

Today, the collateral damage hit honest developers trying to work with GitHub. Tomorrow it hits a Linux package, a container registry, a CDN, a payment API, an authentication service. Then everybody runs to VPNs, Tor, proxies, alternate DNS, /etc/hosts, Pi-hole. Congratulations: little by little, we are rebuilding the survival manual for a censored internet.

No need to overdo the metaphor. Brazil is not China yet. But the smell is the same: centralized opaque blocking, collateral damage, and ordinary users having to learn bypasses to work.

If you were affected, document it. Run the commands. Save outputs. Open an issue with your provider. Complain with data. Share workarounds, but do not normalize this. A bypass is a bandage. The real problem is a State giving itself the power to silently break pieces of the internet.

And if all you wanted was to run gh pr list to review a pull request: welcome to Brazilian infrastructure in 2026.

I have a nice Synology DS1821+ that also supports running Docker, but I prefer to keep the NAS doing only NAS duties and avoid risking my data by running other stuff on it. Having a single server that does everything isn’t a “problem” per se, but since I can, I prefer to separate things.

This Intel NUC runs a headless Ubuntu Server LTS (no desktop manager), which I access only via SSH (as I explained in the previous post about SSH). On it I run things like Portainer, Plex, Sonarr, Bazarr, qBitTorrent and much more.

The way it’s set up, I just added an entry to my desktop’s /etc/hosts like this:

192.168.0.100 synology.lan
192.168.0.200 plex.lan

From now on all my domains and IP addresses will be fake, obviously.

Anyway, this way I can open my browser and go to http://plex.lan:32400 to access my Plex, for example. But this has three disadvantages:

1. I can only use these hostnames on my desktop; from my laptop I’d need to edit the hosts file too. On top of that, I need to know the ports for each container.
2. I have no SSL for anything, so all authentication goes in plain text. It’s not a huge problem because the traffic is only internal on my local LAN. I haven’t been accessing it from outside the house.
3. If I ever want to access it from outside, none of this works.

There are dozens of ways to solve this problem, solutions involving WireGuard, or commercial solutions like TailScale and so on. But there’s a reasonably simple solution that solves all the problems at once: Cloudflare Tunnels.

The idea is to create secure tunnels via Cloudflare to access my services on my internal LAN WITHOUT having to expose ports outside my router or anything like that. My network stays isolated and unchanged.

1. Registering a Domain

The first recommendation is to register a real domain. Doing this lets you have real SSL certificates that Cloudflare itself manages and renews automatically.

I have a few domains registered and I’m not going to reveal which one I use for my Home Server. I’ll use this empty fabioakita.dev as an example just for this post.

Domains are cheap, around USD 12 per year, depending on the name you choose. Pick one that’s short and easy to type.

2. Installing Cloudflared

With the domain created, now we need to install the cloudflared service on the Home Server. It’s the one that connects to Cloudflare’s servers and opens the tunnel into my local server. Click the link for installation instructions, but on an Ubuntu Server 22.04 it goes like this:

# Add cloudflare gpg key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

# Add this repo to your apt repositories
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared jammy main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# install cloudflared
sudo apt-get update && sudo apt-get install cloudflared

Now we need to log in:

# login
sudo cloudflared tunnel login

# add the homelab tunnel
sudo cloudflared tunnel create homelab

# create the config directory
sudo mkdir -p /etc/cloudflared

Use the same credentials you use to log in to the Cloudflare website. If everything goes well, at the end it will create a file at /root/.cloudflared/xxxxx-yyyy-zzzz...json, which holds your credentials, just like an SSH private key, so don’t throw it on a USB stick or some cloud drive. Keep it very safe. Let’s move it:

sudo mv /root/.cloudflared/*.json /etc/cloudflared
sudo chmod 600 /etc/cloudflared/*.json

Finally, we need to create a configuration file /etc/cloudflared/config.yml with all the hostnames we want for each of the containers, pointing to the correct ports. Here’s a snippet of my config, modified with fake IPs and the fake domain:

# /etc/cloudflared/config.yml
tunnel: homelab
credentials-file: /etc/cloudflared/xxxx-yyyy-....json
ingress:
  ...
  - hostname: plex.fabioakita.dev
    service: http://192.168.0.254:32400
    originRequest:
      httpHostHeader: plex.fabioakita.dev
  - hostname: immich.fabioakita.dev
    service: http://192.168.0.200:2283
    originRequest:
      httpHostHeader: immich.fabioakita.dev
  - hostname: overseer.fabioakita.dev
    service: http://192.168.0.200:5055
    originRequest:
      httpHostHeader: overseer.fabioakita.dev
  - hostname: syncthing.fabioakita.dev
    service: http://192.168.0.200:8384
    originRequest:
      httpHostHeader: qbittorrent.fabioakita.dev
  - hostname: radarr.fabioakita.dev
    service: http://192.168.0.200:7878
    originRequest:
      httpHostHeader: radarr.fabioakita.dev
  - hostname: sonarr.fabioakita.dev
    service: http://192.168.0.200:8989
    originRequest:
      httpHostHeader: sonarr.fabioakita.dev
  - hostname: bazarr.fabioakita.dev
    service: http://192.168.0.200:6767
    originRequest:
      httpHostHeader: bazarr.fabioakita.dev
  - hostname: prowlarr.fabioakita.dev
    service: http://192.168.0.200:9696
    originRequest:
      httpHostHeader: prowlarr.fabioakita.dev
  - hostname: portainer.fabioakita.dev
    service: http://192.168.0.200:9000
    originRequest:
      httpHostHeader: portainer.fabioakita.dev
  - hostname: grafana.fabioakita.dev
    service: http://192.168.0.200:3001
    originRequest:
      httpHostHeader: grafana.fabioakita.dev
  - service: http_status:404 # this has to be the LAST ONE

As you can see, it’s an extremely simple file. I think anyone can understand what it does. Modify it for your own needs.

After saving the file and going back to the command line, you have to manually run this command for each hostname:

sudo cloudflared tunnel route dns homelab plex.fabioakita.dev

But that’s a lot of work with this many hostnames, so I found it easier to create a script /etc/cloudflared/add.sh like this:

# run only once
TUN=homelab
CONF=/etc/cloudflared/config.yml
grep -E '^[[:space:]]*-[[:space:]]*hostname:' "$CONF" \
| awk '{print $3}' | tr -d '"' | tr -d "'" \
| while read -r h; do
    echo "adding $h"
    sudo cloudflared tunnel route dns "$TUN" "$h"
  done

Now just run: sudo sh /etc/cloudflared/add.sh, only once! So make sure your config file is correct first!

Finally, we can configure the service to restart by itself on every boot:

sudo cloudflared --config /etc/cloudflared/config.yml service install

sudo systemctl enable --now cloudflared

3. Accessing your services via the tunnel

If nothing went wrong, you’re done! You can go straight to your browser and test it:

How cool is that. Notice in the URL bar I typed https://immich.fabioakita.dev and it just worked. By the way, if you didn’t know it, Immich works identically to Google Photos, except entirely under your control! It has a smartphone app and syncs nicely.

More importantly, notice it’s on HTTPS, which was provided by Cloudflare for my entire domain. When I log in, it will go through an encrypted tunnel. And more than that: even if I’m on 5G, away from home, on my phone, I’ll be able to access my photos using this address!

From my phone it opens a secure tunnel to Cloudflare, and that cloudflared service on my home server also has a secure tunnel open to Cloudflare, so Cloudflare bridges the two tunnels and done! I have remote access without exposing my server directly to the internet! The best of both worlds!

Don’t forget to configure all your services with strong passwords (I generate them via Bitwarden, but any service works, 1Password or whatever):

4. Bridge to vlans

I don’t remember exactly why, but my Plex container alone gave me more trouble. That’s because it uses a different VLAN than the others. Again, I don’t remember why I did this at the time, but it looks like this:

  plex:
    #image: plexinc/pms-docker:latest
    image: linuxserver/plex:latest
    restart: unless-stopped
    environment:
      - TZ=America/Sao_Paulo
      - PUID=1026
      - PGID=1026
      - VA_DRIVER=IHD
      - PLEX_HW_TRANS_MAX=16
      - PLEX_MEDIA_SERVER_OPTS=--network-host
    volumes:
      - /config:/config
      - /data:/data
      - /transcode:/transcode
      - /Videos:/media
    devices:
      - /dev/dri:/dev/dri
      - /dev/bus/usb:/dev/bus/usb
    healthcheck:
      test: curl --connect-timeout 15 --silent --show-error --fail http://localhost:32400/identity
      interval: 1m00s
      timeout: 15s
      retries: 3
      start_period: 1m00s
    mem_limit: 4g
    cpus: 5.0
    networks:
      plex_macvlan:
        ipv4_address: 192.168.0.254
        mac_address: "xx:xx:xx:xx:xx:xx"

networks:
  plex_macvlan:
    external: true
    name: plex_macvlan

Because of this, cloudflared can’t route to that container. The way to fix it is by creating a bridge from that vlan to my ethernet.

sudo ip link add macvlan0 link enp3s0 type macvlan mode bridge
sudo ip addr add 192.168.0.200/24 dev macvlan0   # free IP in your LAN
sudo ip link set macvlan0 up

Obviously, replace enp3s0 with the correct name of your ethernet interface. Check with ip addr or ip link, for example. Just by running the commands above, if I go to the browser and type https://plex.fabioakita.dev it should already work. To make this permanent, we need systemd:

# /etc/systemd/network/80-macvlan0.netdev
[NetDev]
Name=macvlan0
Kind=macvlan

[MACVLAN]
Mode=bridge

# /etc/systemd/network/80-macvlan0.network
[Match]
Name=macvlan0

[Network]
Address=192.168.0.200/24
Gateway=192.168.0.1
DNS=192.168.0.1

And now, just restart the services:

sudo systemctl restart systemd-networkd
ip addr show macvlan0

The “correct” thing would be to have my Plex configured with network_mode: host, but, again, I don’t remember why it wasn’t, and I wasn’t in the mood to unconfigure everything just to find out. In case anyone has similar setups, this is how you bypass it.

Speaking of Plex, I had heard that you have to be careful with streaming via cloudflared, I don’t know if there are limits or extra costs. I found this article that talks more about it but I didn’t stop to look into it deeply. The only extra thing I did, on the Cloudflare dashboard, was add a rule to not do CACHING on the plex subdomain, to avoid additional costs.

Conclusion

As you can see, it’s extremely easy to have a home server, isolate everything with Docker, and then expose your containers via a secure tunnel for remote access. None of this means instant security. Make sure your containers are always up to date using services like Watchtower, make sure each service has strong, random, unique passwords - don’t use the same password for everything. Make sure your firewall is well configured and active, even on a LAN.

Many modern Wi-Fi routers let you create a separate VLAN for guest Wi-Fi. That way guests can use your Wi-Fi but can’t see your computers, which will be logically isolated on another VLAN. Check your router’s documentation. I use a TP-Link BE1900 Tri-Band Wi-Fi 7, but for most people it’s too expensive and overkill. Do your research. And don’t bother asking me about other models: I haven’t tested all of them to know the differences.

If you saw names like Radarr, Sonarr and don’t know what they mean, read the Servarr Wiki, which consolidates all the documentation for these services in one place. It’s the infrastructure that lets you have your own “Personal Netflix”.

Also, don’t ask me why I use Plex and not Jellyfin. It’s a personal choice, pick what’s best for you. I like Plex, I’ve used Jellyfin, and I don’t plan to switch.

I hate the idea of paying subscriptions for everything and owning nothing. I think it’s money thrown away. I prefer to OWN my own things under MY CONTROL. It’s more expensive, it’s more work. Too much convenience means you have control over nothing and always depend on others.

I hate depending on others.

Everyone who follows me, particularly on Instagram, knows about my NAS saga. In particular my new Synology DS1821+ with more than 100TB (4x 12TB HDs and 4x 20TB HDs, and I already have 4 more 20TB HDs to upgrade in the future when I need to). I use it for a lot of stuff, particularly my Personal Netflix that I explained in that other post on how I set it up with Docker.

In the highlights and posts about it on Insta I already discussed details of this NAS, but to summarize:

• I prefer Synology because deep down it is a Linux box with the BTRFS filesystem (which I like), which is almost as flexible but easier to use than ZFS. And yes, I know unraid, TrueNAS and others exist. But I think Synology DSM is very competent (there is an open source version if you want), and it does everything I need.
• I prefer Plex over Emby or Jellyfin. I have tested them, but Plex’s support for TV and mobile apps is much better in my opinion, the player is more stable, and I also think its organization features are more robust.
• Why not just use Cloud? First because it is slow. My fiber is only 1Gbps and upload is half of that. Second because my internal network is ultra fast (10Gbps) and much better. Third because nothing in the “Cloud” has any guarantee, they can block you, they can get hacked, they can delete things by accident. Fourth, everything that is mine, I like it being really mine, within my reach, under my total control, with nobody to mess with my property. It costs more, it is a choice. I literally have more and better movies and series than Netflix with content you will not easily find in any streaming service anymore, for example.

In fact, I trust “cloud” so little that I use it but I keep a copy of everything on my local NAS using the Cloud Sync app from the Synology store:

“Yeah, but what if your NAS dies in some unrecoverable way and you lose EVERYTHING?!”

No backup is complete unless it follows the 3-2-1 Mantra, remember??

• 3 copies, 2 media types, 1 off-site

I have some things recorded on Millennial Discs (mdiscs, which are like Blu-Rays but made of inorganic material that never degrades). And I make copies of the most important things from my NAS to Amazon Glacier using the “Glacier Backup” app that is also in the Synology store.

Glacier is like S3 but much cheaper because it does not have easy access or fast transfer. It is built for backups, where you write once and almost never access again. ENCRYPTED, of course.

Notice how little I trust cloud, like dropbox, that I make a copy on my NAS and send it to another cloud. There are things with multiple copies indeed. I do not trust anyone’s service, some human will always commit a catastrophic mistake one day, it is just a matter of time.

Oh yes, and I do download a lot of things from torrent and I consider myself a Power User and I know what is malware/virus and what is not, and I know how they work. But I am also human, so all my Windows machines have at least Windows Defender active, Malwarebytes which I also like, and even so I still run yet another antivirus on the NAS as well, which is also in the Synology store. I do not trust anything without redundancy of everything, under my total control.

More importantly, and the reason I choose BTRFS both on the NAS and on my PC: snapshots. It takes snapshots of everything periodically. So, if at some point I run a botched rm -Rf, I lose nothing, I just go back to the previous snapshot and everything will be there, intact. Snapshots are smart, they take almost no space, because in BTRFS the same binary content of identical files points to the same physical location. It does not work like rsync that actually duplicates everything and doubles the space used.

On your Linux PC/notebook, with BTRFS, install the Timeshift program to do the same thing. The best part: if one day you update your system and it does not boot or something breaks after an update, it is easy: just reboot and choose the previous snapshot in GRUB and that is it, it will go back exactly as it was before the update. On Arch/Manjaro it is smart and already takes snapshots automatically every time before pacman runs:

Anyway, another use is for personal code projects on my Linux. On the mini-PC I use on the TV as a media center, I run Windows 11. Because I use it connected to another eGPU with an RTX 4060 and I use Steam for games. Yes, many Steam games run on Linux, there is Bazzite, etc. But there are things that only run on Windows and I preferred convenience. I only use it for games and media, so screw it, it works plug and play.

My other home server mini-PC is where my Docker stuff for media center, torrent, plex server and everything else runs. It is a headless Ubuntu LTS. Plus my handhelds like the Rog Ally X that runs Windows. All of them have access to my Synology NAS, where I expose shared folders with SMB and that is it. Plug and play.

I used to do the same on my Manjaro Linux: mount the folders with SMB. But this has a problem if I want to code something and want to use Git: in SMB there are no chmod attributes (like the +x flag for executable scripts) and every time I do git push, it messes up all the permissions of everything. It is a huge pain. Anyone who has used Git on Windows knows this.

I cannot keep scripts executable in this shared directory. So it makes my life hard on Linux. So I decided to fix this once and for all and do the right thing: stop using SMB and start using NFS, which is the native Linux way to access shared folders on the network from another Linux server (if the server were Windows, then it would have to be SMB, but nobody in their right mind sets up a NAS with Windows Server).

In SMB, the service ignores filesystem ownership and permissions. I create users and assign them to the service, not to the files. Just log in with that user and it will have access to the files. So there is no way to do chown and change ownership, nor chmod to change permissions individually on the files, it is all normalized.

In NFS, the service exposes exactly the ownership and permissions on the filesystem directly, without an ACL middleman to check permissions on the side. So I have the same level of access to those attributes that I have on the local files of my Linux, which is what I want.

But Synology does an annoying thing for some reason. On any Linux, the first user and first group created are usually UID: 1000 and GID: 1000. Try it, go to your terminal and run id [your user]:

❯ id akitaonrails
uid=1000(akitaonrails) gid=1000(akitaonrails) groups=1000(akitaonrails),998(wheel),996(audio),994(input),...

So it does not matter whether you do chown akitaonrails:akitaonrails foo.txt or chown 1000:1000 foo.txt. In practice, the identifier number is what matters, not the name.

With NFS, if on the Synology side there is a user with the same UID and GID number, I automatically have permission. But when you create users on Synology, for whatever reason, it starts creating them with IDs above 1020 instead of 1000. So I have an “akitaonrails” user on Synology with UID 1026 instead of 1000.

Even being able to mount the shared folder with NFS, if I try to use Git, for example, it detects that my local UID is 1000 and the files have ownership of UID 1026:

git st fatal: detected dubious ownership in repository at '/mnt/gigachad/Projects/dotfiles' To add an exception for this directory, call: 

	git config --global --add safe.directory /mnt/gigachad/Projects/dotfiles

I cannot keep using mixed UIDs, it becomes a mess as bad as SMB. There are mapping tricks and other hacks, but there are only two “cleaner” solutions:

• change my Linux UID/GID to also be 1026
• create a new user on Synology, change its ID to 1000 and chown all files to this new user.

I chose the second option. The first thing is to enable SSH access on the NAS (the ideal is to leave such things off, for security, but I am on a private local network so the risk is minimal):

At a minimum I always change the default SSH port, out of habit, but it does not really matter. You need to know how to use SSH, I will not teach it here, there is ChatGPT for that.

Now, create a new standard user:

Let’s also make sure the NFS service is on, since I am going to start using it (by default it comes off, with only SMB on because the majority of clients are Windows PCs):

Now SSH into the NAS and edit the UID and GID, first by editing /etc/passwd and finding a line like:

akitaonrails-nfs:x:10xx:10xx:...

And changing it to:

akitaonrails-nfs:x:1000:1000:...

Now editing /etc/group and the same thing, changing the newly created akitaonrails-nfs group to 1000 as well. Done, now I have a user with UID 1000 and GID 1000 created. The name is not the same as on my PC but that does not matter, only the numbers.

In the Synology DSM GUI, do not forget to add permissions for each shared folder, for NFS:

Still over SSH, you have to change the ownership and fix the permissions of ALL FILES and in my case, with terabytes, it took QUITE a while, just leave it running there:

sudo chown -R 1000:1000 /volume1/GIGACHAD
sudo chmod -R 0755 /volume1/GIGACHAD

If I want to disconnect from SSH and leave it running there (since it is going to take a long time), just run it detached from the SSH session with nohup:

nohup chown -R 1000:1000 /volume1/GIGACHAD > /tmp/chown.log 2>&1 &

One thing to be careful about is not doing something like chmod -R -x on everything. First: directories need to have the execute bit and if you remove it, you will no longer be able to navigate directories, so you have to separate fixing directories from files. Second: it is good to apply this fix on directories to make sure no files were left with the executable bit (which can create security problems, imagine random files inside Node modules directories). Third: directories like “#snapshot” are for filesystem control and are read-only, trying to mess with them will only eat A LOT of time, so it is better to filter them out and not touch them.

Or make a script with this and run it with nohup so you can leave SSH while waiting for it to run (in my case, with terabytes, it takes hours):

nohup /tmp/fix-terachad-perms.sh > /dev/null 2>&1 &

There are still some hidden little problems. Still on the Synology SSH you have to change the /etc/exports that NFS uses because it still maps by default to user UID 1026 and 100, you have to change both to 1000:

# old
sudo cat /etc/exports
Password:

/volume1/GIGACHAD       192.168.0.0/24(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100)
/volume1/TERACHAD       192.168.0.0/24(rw,async,no_wdelay,crossmnt,no_root_squash,insecure_locks,sec=sys,anonuid=1025,anongid=100

The problem with messing with system files like this is that you do not know if touching the NFS permissions GUI, or if updates come, will revert it to how it was before. If anyone knows of a more permanent solution, let me know.

And done, with all this, just unconfigure the CIFS/SMB configuration I had and replace it with NFS. I prefer to use AutoFS to do this. I had an auto.cifs before, which I can now delete. And create a new /etc/autofs/auto.nfs like this:

gigachad  -fstype=nfs4,rw,nosuid,noatime 192.168.0.xx:/volume1/GIGACHAD
terachad  -fstype=nfs4,rw,nosuid,noatime 192.168.0.xx:/volume1/TERACHAD

And replace the auto.cifs line in /etc/autofs/auto.master with this:

/mnt  /etc/autofs/auto.nfs --timeout=60 --ghost --browse

Now restart the service:

sudo systemctl daemon-reexec
sudo systemctl restart autofs

And done, everything mounted with NFS and now I have full support for native Linux ownership and permissions, without the overhead and incompatibilities of crappy SMB. It was a bit scary doing chown and chmod en masse, but it is a NAS with BTRFS. It has RAID to handle data corruption, it has snapshots if I need to revert something. That is the advantage of having safety systems: you can do things knowing that if something goes wrong, there is a way to revert. That peace of mind is priceless.

Bottom line is that attacks like this will probably happen again, more often. The more poorly managed online devices (IoT) we add to the network, the more open recursive DNS servers around, and the more blackhat hackers learn how easy it is to run attacks like this, the worse it will become.

Now, how does one mitigate this kind of problem?

What I will suggest now is not the be-all and end-all solution. As a disclaimer, I am neither a whitehat hacker nor a fully experienced systems administrator. If you are, please by all means let me know in the comments section below if what I am saying is totally busted or if it actually works the way I am describing.

I have a small company where up to 100 people work every day, either as software developers or performing administrative back-office work. We need access to a number of services such as GitHub, CodeClimate, Google Apps, Dropbox, and a number of internal services such as GitLab, Mattermost and so on.

When the DynDNS attack happened, we had some problems for a few hours. We didn’t go total dark, though.

Some of the internal services we use were not affected because the authoritative DNS was not DynDNS. So our internal chat app, Mattermost, for example, remained responsive and online. The same for GitLab. So we didn’t stop all our work duties. But some of our projects in GitHub and deployments over Heroku became compromised.

So this is the mitigation plan I am testing: installing my own DNS recursive/forwarder server. I want to forward all DNS queries to some public recursive DNS such as Google (8.8.8.8) or OpenDNS (208.69.38.170) and cache the results for more time than the TTL that returns from the query.

If you’re not aware, every time you perform a DNS lookup, it returns the IP address for a given name (for example, 50.19.85.154, 50.19.85.156, and 50.19.85.132 for heroku.com) and a Time To Live (for example, 28 seconds when I ran dig against heroku.com).

It means that for that window of 28 seconds any other DNS lookup can rely on the IP addresses provided without having to run the queries against the DNS servers again (caching).

After the TTL expires, I should query again to see if the IP addresses did change. TTLs are usually small so the administrators of the services can freely move and decommission servers at least after a certain small window (TTL) and be sure that almost everybody will see new IP addresses when the TTL expires. On the other hand, the smaller the TTL, the more DNS traffic we all need to keep re-checking addresses all the time.

In practice I believe most services are stable enough to not be changing servers all the time. They do, eventually, for maintenance or even scalability purposes, but I believe it’s “rare”.

Actually, I believe that if I had my own DNS server, caching DNS results and overriding the TTLs from 60 seconds/15 minutes to a larger extent (let’s say, 1 full day) before expiring and requiring a new query, we would have passed through that DDoS episode without noticing it.

In fact, I manually inserted GitHub’s web address in my local /etc/hosts file and I was able to browse through GitHub in the midst of the DDoS attacks.

For most people, that whole apocalyptic episode felt like “the internet fell”, but in reality only the authoritative DynDNS servers went down and every other recursive DNS, obeying the TTLs, also failed to get responses.

The cascading effect was that we were just unable to translate domain name queries such as spotify.com or heroku.com into their static IP addresses. But if we had those addresses in local caches, we wouldn’t feel it because Spotify’s, ZenDesk’s, Heroku’s servers were all online and fine.

It’s different from when AWS’s Sydney data center suffered an outage. That’s way more rare and I’ve seen it happen just once every couple of years.

Unbound

I was going to install BIND9 in an AWS EC2 t2.micro machine. But I’ve read that it’s probably overkill if I am not interested in setting up an authoritative server. What’s more, I can’t set a minimum TTL in BIND if I am not mistaken.

So the other simpler option is Unbound. It’s a simple apt-get install unbound away.

Configuration is super easy as well, I just added this:

server:
  interface: 0.0.0.0
  do-ip4: yes
  do-ip6: yes
  do-udp: yes
  do-tcp: yes
  do-daemonize: yes
  # access-control: 0.0.0.0/0 allow
  access-control: <your public IP>/8 allow
  access-control: <your public IP>/8 allow

  # Use all threads (roughly the same number of available cores)
  num-threads: 4

  # 2^{number_of_threads}
  msg-cache-slabs: 16
  rrset-cache-slabs: 16
  infra-cache-slabs: 16
  key-cache-slabs: 16

  # More cache memory (this is per thread, if I am not mistaken)
  rrset-cache-size: 150m
  msg-cache-size: 75m

  # More outgoing connections
  # Depends on number of threads
  outgoing-range: 206 # <(1024/threads)-50>
  num-queries-per-thread: 128 # <(1024/threads)/2>

  # Larger socket buffer
  so-rcvbuf: 4m
  so-sndbuf: 4m

  # Faster UDP with multithreading (only on Linux)
  so-reuseport: yes

  # cache for at least 1 day
  cache-min-ttl: 172800

  # cache for at most 1.5 day
  cache-max-ttl: 259200

  # security
  hide-identity: yes
  hide-version: yes
  harden-short-bufsize: yes
  harden-large-queries: yes
  harden-glue: yes
  harden-dnssec-stripped: yes
  harden-below-nxdomain: yes
  harden-referral-path: yes
  use-caps-for-id: yes

  use-syslog: yes

  python:
    remote-control:
            control-enable: no

  forward-zone:
    name: "."
    forward-addr: 8.8.8.8
    forward-addr: 8.8.4.4

Replace the <your public IP> with whatever IP you get when you Google for “what’s my IP”, it’s better to whitelist every IP you want to enable access to query this server.

Unbound comes pre-configured for DNSSEC and it seems to work out of the box (or at least this is what this test says).

In my “enterprise” ISP account I have a static IP address and I can set my Airport Extreme and add my new DNS server IP address and all clients connecting there receive the new DNS automatically.

In my inexpensive backup ISP account (your usual DSL or Cable internet service), it doesn’t have a static IP so I have to use the ISP’s DHCP and NAT and enable “Bridge Mode” on the router. In that case I can’t have a secondary DHCP turned on to set up the DNS automatically on the clients, so I have to add it manually in my notebook’s network configuration.

Anyway, one immediate advantage of setting up my own DNS server is that response times are much faster as I chose a data center very close to me, geographically. So instead of the usual 60ms from Google’s DNS I get less than 30ms on average now (not a dramatic improvement, but somewhat noticeable in web browsing).

The disadvantage is that a recursive DNS should obey the protocol and use the authoritative TTL, never overriding. But as I am using it only for whitelisted IPs within my own organization, I believe that with an occasional manual flush, I should be ok most of the time.

This is not a 100% guarantee that we will not suffer anything in case of another DDoS episode like we had, because not all domain names will be cached in this local DNS server. But the ones we use the most probably will be, particularly essential services such as access to GitHub or Heroku or ZenDesk.

With this new DNS “caching” system all my queries will return and be cached with a larger TTL, for example:

$ dig heroku.com

; <<>> DiG 9.8.3-P1 <<>> heroku.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34732
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;heroku.com.      IN  A

;; ANSWER SECTION:
heroku.com.   172800  IN  A 50.19.85.156
heroku.com.   172800  IN  A 50.19.85.132
heroku.com.   172800  IN  A 50.19.85.154

;; Query time: 357 msec
;; SERVER: xx.xx.xx.xx#53(xx.xx.xx.xx)
;; WHEN: Mon Oct 31 15:07:37 2016
;; MSG SIZE  rcvd: 76

I’m obfuscating my DNS IP, of course. The important bit is that you can see that my DNS is returning a TTL of 172800 seconds now. My local notebook cache should keep it that long now as well.

And now my organization should (possibly) be protected against another DNS DDoS attack like we had with Dyn DNS. Zerigo already went through that. SimpleDNS already went through that. Who knows which one will suffer next, maybe all of them again.

As I said before, I am not 100% sure this is a good mitigation. We will see if it works on the next Mirai attack. And a final BIG DISCLAIMER:

EVERY DNS recursive server MUST obey the authoritative TTL!! TTLs exist for many important reasons, so if you manage a publicly available DNS server, you MUST NOT override the TTL with a minimum cache time like I did. Make sure you know what you’re doing!

Are you an experienced whitehat hacker? Let me know if there’s something easier/more secure. The goal is not to fix the internet, just to protect the productivity of my tiny organization.

I’ll publish the full text and add a few comments. Plenty of people have opinions about this Marco Civil, and my guess is 99% never read the law before weighing in. So I recommend reading it. I took the text from this PDF; if it’s outdated, let me know.

Don’t forget to comment.

Translator’s note: the full legal text of the Marco Civil is preserved in the original Portuguese (it’s a Brazilian law, whose authoritative text is Portuguese). Only Akita’s commentaries are translated below, interleaved with a brief summary of each article so an English reader can follow along.

GLOBAL SUBSTITUTE SUB-AMENDMENT TO PLENARY AMENDMENTS TO BILL No. 2,126 OF 2011

Establishes principles, guarantees, rights, and duties for the use of the Internet in Brazil.

CHAPTER I. PRELIMINARY PROVISIONS

Art. 1. This Law establishes principles, guarantees, rights, and duties for the use of the Internet in Brazil.

Art. 2. The discipline of Internet use in Brazil is grounded on respect for freedom of expression, as well as: (I) recognition of the global scale of the network; (II) human rights, personal development, and exercise of citizenship in digital media; (III) plurality and diversity; (IV) openness and collaboration; (V) free initiative, free competition, and consumer protection; and (VI) the social purpose of the network.

There’s no way to guarantee “the social purpose of the network.” A purpose isn’t defined by decree; it’s whatever the users make of it. Guaranteeing a “social purpose” requires restrictive manipulation, and the Internet is what it is precisely because no purpose was imposed on it. Everyone does what they want, and the free market adjusts on its own.

The Internet is a data transport medium, everyone pays for it, and its use follows from that free access. Once you define an objective, however good the intentions, you create restrictions. Every restriction has to be regulated, and every regulation needs someone to audit it.

Art. 3. The discipline of Internet use in Brazil has the following principles: (I) guarantee of freedom of expression; (II) protection of privacy; (III) protection of personal data; (IV) preservation and guarantee of network neutrality; (V) preservation of stability, security, and functionality of the network; (VI) accountability of agents according to their activities; (VII) preservation of the participatory nature of the network; (VIII) freedom of business models on the Internet.

Principles II and III are redundant, and III actually restricts II: the first defines privacy, the second breaks it and hands the government a monopoly on the breach.

V should be irrelevant. Following any standard by decree doesn’t work, and it begs the question: who defines what “techniques compatible with international standards” or “use of good practices” are? In practice, some government body ends up holding a monopoly on that regulation.

VII can’t be defined either. Who decides what “participatory nature” means? These bits guarantee one more bureaucratic jobs rack, an Anatel or something like it, to “guarantee” these “rights.” Every non-fundamental “right” demands a regulator, and every regulator is harmful.

Art. 4. The discipline of Internet use in Brazil has the following objectives: (I) promote the right of access to the Internet to all; (II) promote access to information, knowledge and participation in cultural life; (III) promote innovation and broad dissemination of new technologies; (IV) promote adherence to open technology standards that allow communication, accessibility, and interoperability.

This whole article is bad. You can’t “guarantee” Internet access for everyone, the same way you can’t guarantee food or education to anyone. The moment you define one person’s right, you decree another’s servitude, because the government doesn’t have the means to guarantee it, we citizens do. And when you declare that someone has a right to something that’s ours, you infringe our rights too.

Sorry, the Internet isn’t free. Electricity, water, and basic sanitation aren’t free either, somebody pays. Put a government regulator in charge and we’ll get the same level of service as Sabesp and Eletropaulo: water shortages, blackouts, and the lights going out when it rains. Why do we put up with that? Government regulation.

Fostering “innovation” isn’t and shouldn’t be the government’s job. Innovation is a natural consequence of free competition and a free market. Making it a state task hands out permission to burn our tax money. And, again, who defines what “innovation” is? Another regulator, another rack of bureaucrats.

So far, the only thing these articles guarantee is the creation of regulatory bodies.

Art. 5. Definitions: Internet, terminal, autonomous system administrator, IP address, Internet connection, connection record, Internet applications, and records of access to Internet applications.

At least it shows some politicians aren’t total illiterates. These are just technical definitions, pretty raw, but they do the job for this document. Note the “IP address,” as if it guaranteed identifying someone. What’s missing is a line saying an IP address can’t be used as the basis to identify anyone.

Art. 6. In the interpretation of this Law, the nature of the Internet, its particular uses and customs, and its importance for the promotion of human, economic, social, and cultural development shall be taken into account.

CHAPTER II. RIGHTS AND GUARANTEES OF USERS

Art. 7. Access to the Internet is essential to the exercise of citizenship, and the following rights are guaranteed to users: inviolability of intimacy and private life; inviolability and secrecy of communications; non-suspension of Internet connection except for debts; maintenance of the contracted quality; clear information in contracts; non-provision of personal data to third parties except with consent; clear information about data collection and use; express consent; deletion of personal data upon request; publicity of usage policies; accessibility; application of consumer protection norms.

Translating “inviolability”: the access provider shouldn’t violate it unless the Judiciary forces them to.

The maintenance of the contracted quality should be the domain of Consumer Rights.

The paragraphs of this article are all redundant. In short: the provider has to declare how it uses the data it collects, and when that isn’t clear, the government holds a monopoly on getting at it, since every paragraph ends with “except by judicial order, in the form of the law.” Everyone already does this. We have the “Terms of Service” nobody reads and everybody accepts, but that technically are there.

It’s not a totally bad article: it ratifies behaviors that are already standard in any decent service. But we all know that, by judicial order, anyone can get anything in this country, because there’s no privacy limit on the government. And if the government can access everything, so can anyone else. There’s no guarantee of privacy anywhere in this document.

Art. 8. The guarantee of the right to privacy and freedom of expression in communications is a condition for the full exercise of the right of access to the Internet.

CHAPTER III. PROVISION OF CONNECTION AND INTERNET APPLICATIONS

Section I. Network Neutrality

Art. 9. The person responsible for transmission, switching, or routing has the duty to treat any data packets in an isonomic way, without distinction by content, origin, destination, service, terminal, or application. Traffic discrimination or degradation is only allowed for: (I) indispensable technical requirements, and (II) priority for emergency services.

In short, this is the article that should stop a provider from creating a “Facebook” plan, where traffic to Facebook gets high priority and access to everything else is slower or nonexistent. It also blocks silent “traffic shaping,” where the provider watches your traffic and makes access to certain places, like the Pirate Bay, slower.

The principle is valid enough. Nobody in their right mind would be against “neutrality” or isonomy.

Except it raises a question. We’ve had commercial Internet in Brazil for nearly 20 years, and before this document none of that was illegal. So why don’t you see a Claro or a Net selling “YouTube” plans?

Ask yourself that. The answer isn’t simple, and you’ll start wondering what the real purpose of this article is.

Section II. Protection of Records, Personal Data, and Private Communications

Arts. 10–12. Guardianship and disclosure of connection and application access records, personal data, and content of private communications; sanctions (warning, fines up to 10% of revenue, suspension, prohibition).

This article makes it explicit that all data sit at the Judiciary’s disposal. Privacy is broken by law, and the government holds a monopoly on the breach. That opens the door to every kind of corruption. If only the government can open someone’s information, corporate espionage gets easier: grease a judge’s palm, issue a warrant, and whoever can pay gets access to anything.

Yet another mechanism that guarantees the creation of a regulator, and here it’s spelled out, “in the form of the regulation.” Who’s going to “verify compliance with Brazilian law on data collection, storage, and retention”? This was always unnecessary and still is, but now we’ll pay some deadbeat auditor to do nothing and bully smaller services on top of it, choking off free competition. Want to mess with someone’s business? Call this “police” and say company X isn’t complying with this paragraph.

Subsection I. Storage of Connection Records

Art. 13. In providing Internet connection, the relevant autonomous system administrator has the duty to maintain connection records, under secrecy, in a controlled and secure environment, for one year.

I take this article to cover only Internet access providers. It’s just an excuse to raise costs and, again, break privacy.

Subsection II. Storage of Access Records to Internet Applications in Connection Provision

Art. 14. In providing connection, paid or free, it is forbidden to store records of access to Internet applications.

Subsection III. Storage of Access Records in Application Provision

Art. 15. The provider of Internet applications constituted as a legal entity, which carries out this activity in an organized, professional, and economic manner, must maintain the respective records of access to Internet applications, under secrecy, for six months.

This one is even more Orwellian. It lets the government force a provider to track more information, for an indefinite period and indiscriminately. The government could already pull this off before, through Anatel’s pull and other lobbies, but now it’s secured by law.

Arts. 16–17. Prohibition of storing records of access to other applications without prior consent; opting not to store records doesn’t imply responsibility for damages.

Section III. Responsibility for Damages from Third-Party Content

Arts. 18–21. Connection providers are not civilly liable for damages from third-party content. Application providers can only be civilly liable for damages from third-party content after a specific judicial order. Special treatment for cases involving nudity/private sexual content.

This doesn’t seem totally bad, it already happens today, but it got more confusing. In practice, if a user of your site posts an offensive comment and the offended party gets a judicial order, the site isn’t criminally liable for the content as long as it takes the comment down when ordered.

The people who lean on this the most are the imbecile candidates for public office, who fire off judicial orders all the time against any site with political content. The problem is that offending a politician is against the law. Our Constitution itself has become a problem these days.

Section IV. Judicial Request for Records

Arts. 22–23. The interested party may request that the judge order the person responsible for the storage to provide connection records. Secrecy and privacy must be preserved.

This article extends what the previous ones already set up: unrestricted, indiscriminate access to data that’s supposed to have “privacy” guaranteed.

“It’s up to the judge,” meaning, forget your privacy. Judges can be, and are, bought. It’s a market.

CHAPTER IV. ACTION OF THE PUBLIC POWER

Art. 24. Guidelines for the action of the Union, States, Federal District, and Municipalities in the development of the Internet in Brazil: multi-stakeholder governance, promotion of management rationalization, interoperability, open standards, data publicity, infrastructure optimization, capacity building, promotion of culture and citizenship, provision of integrated public services.

This article sanctions the Orwellian part: the creation of regulatory bodies, the “Thought Police”. That body would be responsible for “guaranteeing” what’s in the paragraphs: setting up governance mechanisms, rationalizing management, promoting interoperability, and on it goes. You’ve sanctioned by law a machine for corruption, market reserve, breach of free competition, and the rotting of the Internet market.

Understand: there’s no way to define “multi-stakeholder governance,” “collaborative,” or “rationalization.” Who decides what counts as collaborative, interoperable, or efficient? Someone has to interpret it, and anything left open to interpretation only benefits whoever has the power to impose their reading. By definition, it’s a bad text.

Arts. 25–28. Internet applications of public entities should seek compatibility with multiple terminals, accessibility, compatibility with both human reading and automated processing, usability, and strengthening of social participation.

This shouldn’t be here. They’re technical clauses for software procurement bids, which already exist, and I don’t see the use of them. In some cases the items are dispensable and add one more unnecessary restriction.

This isn’t the state’s duty.

Again, it’s not the state’s duty. This whole chapter is restrictive and shouldn’t exist, because it frees up unrestricted use of our money on government programs. As a taxpayer, I’m against any program that spends my money that way. It’s one person’s right breaking another’s, and by definition that can’t be a guaranteed right.

CHAPTER V. FINAL PROVISIONS

Arts. 29–32. The user has the option of free choice in using software for parental control; the defense of interests and rights established in this Law may be exercised in court; until the entry into force of the specific law, liability for copyright infringement remains governed by current legislation; the Law enters into force sixty days after publication.

Representative ALESSANDRO MOLON. Rapporteur

Honestly, I don’t see the upside of this text. The relevant part, neutrality, should be regulated by Consumer Rights. Everything else sanctions the legality of breaking privacy and hands the government a monopoly on that breach. And it creates “rights” that will demand more public spending and more state apparatus, at our expense and with no apparent benefit. At bottom it’s a propaganda document to make the government look good, at my expense and at yours. Congratulations.

Forewords

The real Cold War in the 60s wasn’t being fought in the field, with soldiers and planes, but in research laboratories, funded by the government, and universities were already equipped with the best computing resources available. It was thought that the ability to create and maintain technological advantages over the adversary would determine the winner of the conflict.

The idea of connecting these centers, aiming at the exchange of information, began to be developed. However, a determining factor was attributed to the choice of network technology that would enable the connection of the strategic centers: the information should continue to flow even under the worst conditions, such as a nuclear attack.

ARPA (Advanced Research Projects Agency) and DoD (Department of Defense) were delegated the responsibility of developing the best alternative for integrating information centers.

A few years later, ARPA would change its name to DARPA (Defense Advanced Research Projects Agency), starting a plan called the Internetting Project to investigate the possible forms of connection between packet-switched networks. As a result of this project and the studies of the INWG (InterNetwork Working Group), the two basic protocols of the Internet were developed and presented. In 1974, Vinton Cerf and Robert Kahn presented IP (Internet Protocol) and TCP (Transmission Control Protocol). These two protocols specified how messages (files or commands) would be transferred between computers on the Internet.

Numbers

To understand the importance of the Internet in every sense — social, political, and financial — it’s necessary to see who surfs the Internet. We’ll base ourselves on the research of John Quarterman, an access provider, consultant, and publisher from Austin, Texas, who researches the composition of the Internet population in his Internet Demographic Survey.

One of the things Quarterman has been doing is defining several Internets according to the types of applications running on the servers and the activities of the users. The “core of the Internet” is made up of computers that offer interactive services like FTP, Telnet, or WWW applications. The “consumer Internet” includes people who use the interactive services offered by the core — for example, users browsing the World Wide Web. The total cyberspace, which he labels as the “matrix,” includes all users who exchange email with other users. These categories fit into one another: the matrix includes the consumer Internet, which includes the Core Internet.

One of the problems Quarterman has to face involves virtual hosts. An Internet access provider has to register domain names for users, but the addresses actually reside on the provider’s machines. This can lead to misunderstandings, making it seem that people have machines connected to the Internet. This group belongs to the consumer Internet category, and all the mail Quarterman sends to postmasters at various addresses is ultimately handled by one host.

“The problem of virtual hosts has grown enormously in the last year (1995),” said Quarterman. “You can access a Web site, there really is information there, and it really corresponds to the organization. It’s actually on a computer on the Internet, but it may be the same computer as other domains.”

The most recent survey, for 1995, was published in January 1996. Out of the universe of 45,091 domains, 2.9% (1,293) responded. In the world of statistics, more than 1,000 responses is a large number of data, and these responses represent entire organizations, not just users. In this survey, Quarterman estimates that there were 16.9 million users of the core Internet (more than double the previous year) and 26.4 million users of the consumer Internet (again double); 39 million users (a 50% increase) already had email. Quarterman attributes the increase to Internet users on consumer networks (America Online, CompuServe, Prodigy, and others).

In the 1995 survey, Quarterman counted 45,000 machines connected to the Internet. The actual number of registered domains exceeded this number because not all registered domains are used, and some are domains on other networks, such as UUCP, where you can send mail, but you can’t use interactive Internet services.

The Web is hot, but FTP still beats browsing. Quarterman also notes that the use of the Windows operating system is declining, and that Macintoshes (despite using the Internet Protocol and not MacOS) and Unix machines are increasing their share of domain control.

The results are announced and posted on the MIDS Web site (which publishes the monthly magazines Matrix News and Matrix Maps Quarterly, both on paper and online, and sells maps and other information about Internet hosts, users, and other demographic data) at http://www.mids.org. “What we made available to survey respondents, and to the Internet as a whole almost a month ago, is a result of the responses for each question. We also manage to draw detail levels between individual responses (which are never revealed) and the summaries. That’s how we get some income.”

Speaking of Brazil, the Secretary of Informatics and Automation Policy of the Ministry of Science and Technology, Ivan Moura Campos, says that Brazil boasts one of the most astonishing growth rates toward cyberspace — we are growing 50% per month. With that, we reached a population of 260 thousand cybernauts at the beginning of May this year. To give an idea, if the adoption rate continued at this speed, by the end of the year the number of Brazilian cybernauts would be 16 million. But the Secretary’s predictions, more realistic, estimate one million users at the turn of the year.

Advertising

After the microcomputer revolution in the 80s and the spread of computing with “a micro on every desk and in every home,” we had one of the greatest evolutions ever seen in history, where humanity evolved in 10 years what it hadn’t managed to evolve since the Middle Ages, entering the Information Age.

With microcomputers and the Internet, physical borders have been erased, in a place where “countries” and “oceans” no longer have meaning and where physical distances no longer make sense. Virtualization has evolved to such a point that a person living in a country like Brazil can already get to know and make friends with people from anywhere in the world, such as Australia, for example. Tools like Netscape Inc.’s CoolTalk (http://www.netscape.com), which replaces the telephone, or TimedVideo Grabber (http://www.avernus.com/~allan), which enables the transmission of real-time images using a camera, makes it possible for people to meet without ever actually having to meet in the “flesh and bone.”

And speaking of evolution, after 500 years of absolute reign of print media as a disseminator of information, it’s being rapidly replaced by digital publications on the World Wide Web, the part of the Internet that most catches attention today.

With pioneering works like Encyclopedia Britannica (http://www.eb.com), which was absolutely shaken after printed encyclopedias fell into total disuse after the emergence of digital encyclopedias like Microsoft’s Encarta (http://www.microsoft.com), and also of “yellow pages”-type search services like those offered by sites like Yahoo! (http://www.yahoo.com) or Lycos (http://www.lycos.com), they made the Internet also the largest data repository ever built, the best place for research you can find.

World-famous magazines like PC Magazine (http://www.pcmag.com) from Ziff Davis Publishing (http://www.ziff.com) or Playboy (http://www.playboy.com) already have their publications displayed and updated periodically on the WWW.

The World Wide Web or WWW was conceived to give a “face” to the Internet, enabling the editing of graphical sites as opposed to the hitherto text-based interface (something similar to the transition from DOS to Windows, for example). A new scripting language was created, HTML (Hyper Text Markup Language), and a specific protocol, HTTP (Hyper Text Transfer Protocol). And for navigation through these pages, browsers were created, programs made to interpret HTML. Right from the start, two stood out: Netscape with its Netscape Navigator and SpyGlass with its Mosaic. Netscape became more widespread, and SpyGlass sold the Mosaic rights to Microsoft, which today distributes Netscape’s biggest competitor, Internet Explorer, in one of the largest software distribution campaigns ever seen.

The possibility of editing virtually everything that exists in print media quickly caught the world’s attention to the Internet. New concepts began to emerge such as online publishing. One of the most recent examples is about the Atlanta Olympics, where the computing work was in charge of IBM (http://www.ibm.com), which set up a grandiose scheme of machines and networks and information distribution via the Internet that can be checked on the Olympics homepage (http://www.atlanta.olympic.org), where the data are updated as soon as they are obtained. Thus, at the end of each game, the homepage can be updated and the whole world has access to it, not having to wait until the next day to read it in the newspapers.

Speaking of newspapers, they are not far behind, putting on the WWW much of their daily publications such as The Gate (http://sfgate.com), an Internet-based product of two newspapers from the West Coast of the United States, the San Francisco Chronicle and the San Francisco Examiner with a right to conference areas with discussion forums such as Community, Media, Sports, Movies, etc.

Agência Estado, which publishes famous newspapers like Estado de São Paulo, also already distributes its newspaper via internet (http://www.agestado.com.br) with the main headlines of the day and various information, including its classifieds and, in an Olympics period, with special areas for the sports in Atlanta.

Another concept that became famous with the Internet is online services such as the giants CompuServe and America Online, which serve people around the world and have allies like Netscape and Microsoft. This type of organization is based on “services” that include discussion forums; libraries with updated information; magazines, newspapers, and other periodicals; virtual stores that sell everything from CDs to clothes; leisure and business tips; and also services common to the Internet like email and the WWW.

In Brazil, such types of service have also started to spread, with emphasis on Folha de São Paulo and Grupo Abril, which launched, respectively, Universo Online and Brasil Online. Such Brazilian services are still experimental and free, with no projections regarding costs. For illustration, The New York Times charges USD 30.00 per month and America Online charges USD 9.95 for 5 hours or USD 19.95 for 20 hours.

Such services have very high billing mainly because of the current excitement of the world around the virtualization of services and the rental of digital space for companies interested in placing “virtual billboards” or even adding other services like digital stores on the main pages, since the number of people who travel through the digital lines every day is very large. To see this, just go to the Brasil Online page, for example, and come across advertising calls from companies like Sun or Credicard. These calls are links that lead to the homepages of the respective companies.

And speaking of advertising, someone must be making such pages and ads. These companies are specializing in designing specific and creative pages for a type of media that goes beyond the limitations of paper and enables things like Hypertext (words within a text that lead to other pages), Marquees (phrases that move on the line), music (through WAVE files or the new Real Audio technology), animations (via animated GIF images or using features of the Java language), or even totally three-dimensional environments (using VRML - Virtual Reality Markup Language technology) and much more. In this marketing niche are companies like Vivid Studio (http://www.vivid.com), which has clients like the giants Silicon Graphics and Microsoft, or Razorfish (http://www.razorfish.com), which designs for Time-Warner and Pepsi.

Commerce

The main point of friction when talking about digital commerce is security. The TCP/IP protocol is the starting point for the Internet, conceived as a universal protocol but that falls short on the security aspect, where, unlike its siblings IPX/SPX or NetBIOS, for example, it doesn’t have encrypted data transmission. Since it’s the standard data transmission protocol, it would have been convenient to stipulate a standard data security protocol as well. Since this doesn’t exist, the impasse is around companies fighting to develop the standard that would cause the initial surge toward the end of printed money and the development of digital credit.

One of the oldest is CyberCash (http://www.cybercash.com), about a year old. For now, the company only works with credit card services, but soon promises to offer monetary payment services. Currently, with a browser connected to the network, you can shop safely in virtual shopping malls. Through the SIPS (Secure Internet Payment Service) protocol, according to the company, it’s as easy as point and click. In this type of transaction, you buy as many cybercashes as desired and it’s debited from the credit card.

The CyberCash standard supports all types of credit cards. It uses the 768-bit RSA and 56-bit DES encryption standards. All transactions are authenticated with MDS and 768-bit RSA signatures. The first step for those interested is to download the free program the company offers. The CyberCash server is connected to the private networks of several banks. The company’s initial services include credit and debit cards and an electronic payment system. For the services, users pay a modest amount, comparable to the value of a stamp. For suppliers, the system represents savings on fees charged for credit card transactions, due to the risk that still exists in transactions by telephone and email.

In this type of development, there are also companies like DigiCash (http://www.digicash.com), with services centered on the First Digital Bank site (http://bank.digicash.com), using an e-cash system (real money converted into virtual money in virtual accounts). Visa (http://www.visa.com) (which is also a partner of Sony — http://www.sony.com — in developing a multifaceted environment of entertainment, information, and commercial transactions) and Microsoft own STT (Secure Transaction Technology), the standard that these two powerhouses want to become an electronic version of the credit card. Mastercard (http://www.mastercard.com) is partnered with IBM, Netscape, GTE, and CyberCash, with the SEPP (Secure Electronic Payment Protocol) standard. It’s an open protocol for secure online transactions.

Netscape develops the open security protocol SSL (Secure Sockets Layer) and contributes to the development of the SSL interface of the W3C (World Wide Web Consortium), a European consortium dedicated to creating a standard for the European Common Market — http://www.w3.org). About 50 companies from around the world are part of this consortium. The company will license the SSL technology to its partners for commercial use. The list of partners includes MCI (http://www.mci.com), Bank of America (http://www.bankamerica.com), Mastercard, First Data Corporation, Novell (http://www.novell.com), Digital (http://www.dec.com), and Silicon Graphics.

Practically all companies in the financial sector have been investing heavily in developing a platform that is secure and reliable enough for financial transactions of all levels of importance. Hackers aside, business via the Internet doesn’t differ much from those conducted outside it. That is, the best way to be free from problems is to trust the credibility of serious companies. It’s unlikely that anyone will want to compromise their good name by failing to deliver the merchandise on time or “negotiating” the credit card number.

In Brazil, Mappin (http://www.mappin.com.br) was the first large company to enter the computer-sales business. It’s also possible to choose sweets and pies at Confeitaria Brunella (http://www.ams.com/brunella) in São Paulo or make reservations at Marcellu’s Bar (http://www.marcellus-bar.com.br) in Rio de Janeiro. The consumer chooses the sweet or pie they want to buy through the photos and descriptions on Brunella’s homepage, then the shop calls to confirm the order and sends the merchandise. In the case of Marcellu’s Bar, the reservation is made by email.

If anyone is moving to the United States or simply needs to compare prices, they can consult For Sail By Owner Connection. It’s a site specialized in house sales, with photos and specifications. If you actually need to sell your house, you can also advertise on this page: http://www.cracker.com/byowner.

Thinking about travel, Cruisin (http://www.cracker.com/cruisin) is the first tourism agency specialized in cruises that serves exclusively via the Internet. But there are already many hotels and agencies on the network. Really, there are alternatives for all bank limits: from Ceará cashews for less than R$ 3.00 up to a house in Florida for USD 329,000. Today it’s virtually possible to buy anything on the Internet.

Afterwords

Created for military purposes, then expanded to academic circles, and finally reaching the general public, the Internet is walking in accelerated evolution, covering practically all sectors of society, where the foundations of what can be considered a virtual world are being built.

When the Internet evolves enough, new technologies will build the expected Information Super Highway, where, then, a truly worldwide network will be constituted, using not only computers in the way we know them but also any electronic equipment, such as set-top boxes (the replacements for VCRs and video-lasers).

In this next generation, “walking” will be wearing a virtual reality suit and visiting virtual locations with friends from other continents in a digital meeting. And this isn’t science fiction delusions: we are so close to it that such technologies are real and already exist — all that’s left is time to make them accessible and operational at the level of mass distribution.

The text below is exactly as I left it in a Word file, on August 3, 1996, at 9:52 in the morning, named “CAP12.DOC”. See how I saw the Internet 17 years ago.

Sales on the Internet

Forewords

The real Cold War, in the 60s, wasn’t being fought in the field, with soldiers and planes, but in research laboratories funded by the government, and universities were already equipped with the best computing resources available. It was thought that the ability to create and maintain technological advantages over the adversary would determine the winner of the conflict.

The idea of connecting these centers, aiming at the exchange of information, began to be developed. However, a determining factor was assigned to the choice of the network technology that would make the connection of the strategic centers viable: the information had to keep flowing, even under the worst conditions, such as a nuclear attack.

ARPA ( Advanced Research Projects Agency ) and the DoD ( Department of Defense ) were delegated the responsibility of developing the best alternative for integrating the information centers.

A few years later, ARPA would change its name to DARPA ( Defense Advanced Research Projects Agency ), starting a plan called the Internetting Project to investigate the possible forms of connection between packet-switched networks. As a result of this project and the studies of the INWG ( InterNetwork Working Group ), the two basic protocols of the Internet were developed and presented. In 1974, Vinton Cerf and Robert Kahn presented IP ( Internet Protocol ) and TCP ( Transmission Control Protocol ). These two protocols specified the way in which messages ( files or commands ) would be transferred between computers on the Internet.

Numbers

To understand the importance of the Internet in every sense: social, political, and financial, one needs to see who navigates the Internet. We’ll base ourselves on the research of John Quarterman, an access provider, consultant, and publisher from Austin, Texas, who researches the composition of the Internet population in his Internet Demographic Survey.

One of the things Quarterman has done is define several Internets according to the types of applications running on the servers and the activities of the users. The “core of the Internet” is made up of computers that offer interactive services like FTP, Telnet, or WWW applications. The “consumer Internet” includes people who use the interactive services offered by the core - for example, users who navigate the World Wide Web. The whole of cyberspace, which he labels the “matrix,” is all the users who exchange email with other users. These categories nest inside one another: the matrix includes the consumer Internet, which includes the Core Internet.

One of the problems Quarterman has to face involves virtual hosts. An Internet access provider has to register the domain names for the users, but the addresses actually reside on the provider’s machines. This can lead to misunderstandings, making it seem that people have machines connected to the Internet. This group belongs to the consumer Internet category, and all the mail Quarterman sends to the postmasters at various addresses is in the end grouped under a single host.

“The problem of virtual hosts grew enormously last year ( 1995 ),” said Quarterman. “You can reach a Web site, there really is information there, and it really corresponds to the organization. It is in fact on a computer on the Internet, but it may be the same computer as other domains.”

The most recent survey, for 1995, was published in January 1996. Out of the universe of 45,091 domains, 2.9% ( 1,293 ) responded. In the world of statistics, more than 1,000 responses is a large amount of data, and these responses represent entire organizations, not just users. In this survey, Quarterman estimates that there were 16.9 million users of the core Internet ( more than double the previous year ) and 26.4 million users of the consumer Internet ( again double ); 39 million users ( an increase of 50% ) already had email. Quarterman attributes the increase to the Internet users on the consumer networks ( America Online, Compuserve, Prodigy, and others ).

In the 1995 survey, Quarterman counted 45 thousand machines connected to the Internet. The real number of registered domains exceeded this figure because not all registered domains are used, and some are domains on other networks, such as UUCP, where you can send mail but cannot use interactive Internet services.

The Web is hot, but FTP still outweighs browsing. Quarterman also notices that the use of the Windows operating system is falling, and that Macintoshes ( despite using the Internet Protocol and not the MacOS ) and Unix machines are increasing their share of domain control.

The results are announced and published on the Web site of MIDS ( which publishes the monthly magazines Matrix News and Matrix Maps Quarterly, both in print and online, and sells maps and other information about Internet hosts, users, and other demographic data ). “What we made available to those who answered the questionnaires, and to the Internet as a whole about a month ago, is a result of the answers to each question. We also managed to trace levels of detail between the individual responses ( which are never revealed ) and the summaries. That is how we get some income.”

Speaking of Brazil, the Secretary of Informatics and Automation Policy of the Ministry of Science and Technology, Ivan Moura Campos, says Brazil boasts one of the most astonishing growth rates toward cyberspace - we are growing 50% per month. With that we reached a population of 260 thousand cybernauts at the beginning of May this year. To give an idea, if the adoption rate kept up at that speed, by the end of the year the number of Brazilian cybernauts would be 16 million. But the Secretary’s more realistic predictions estimate one million users by the turn of the year.

Advertising

After the microcomputer revolution in the 80s and the spread of computing with “a micro on every desk and in every home,” we had one of the greatest evolutions ever seen in history, where humanity evolved in 10 years what it had not managed to evolve since the Middle Ages, entering the Information Age.

With microcomputers and the Internet, physical borders have been erased, in a place where “countries” and “oceans” no longer have meaning and where physical distances no longer make sense. Virtualization has evolved to such a point that a person living in a country like Brazil can already meet and make friends with people from anywhere in the world, like Australia, for example. Tools like Netscape Inc.’s CoolTalk, which replaces the telephone, or the TimedVideo Grabber, which enables real-time image transmission using a camera, make it possible for people to get to know each other without ever really having to meet in “flesh and blood.”

And speaking of evolution, after 500 years of the absolute reign of print media as a spreader of information, it is being rapidly replaced by digital publications on the World Wide Web, the part of the Internet that most catches attention today.

With pioneering works like the Encyclopedia Britannica, which was thoroughly shaken after print encyclopedias fell into total disuse following the appearance of digital encyclopedias like Microsoft’s Encarta, and also “yellow pages”-style search services like those offered by sites such as Yahoo! or Lycos, the Internet also became the largest data repository ever built, the best place for research one can find.

World-famous magazines like PC Magazine from Ziff Davis Publishing or Playboy already have their publications displayed and updated periodically on the WWW.

The World Wide Web, or WWW, was conceived to give a “face” to the Internet, enabling the editing of graphical sites, unlike the until-then text-based interface ( something similar to the transition from DOS to Windows, for example ). A new scripting language was created, HTML ( Hyper Text Mark-Up Language ), and a specific protocol, HTTP ( Hyper Text Transfer Protocol ). And for navigating these pages, browsers were created, programs made to interpret HTML. Right at the start, two stood out: Netscape with its Netscape Navigator and SpyGlass with its Mosaic. Netscape became more widespread, and SpyGlass sold the Mosaic rights to Microsoft, which today distributes Netscape’s biggest competitor, Internet Explorer, in one of the biggest software distribution campaigns ever seen.

The possibility of editing practically everything that exists in print media quickly drew the world’s attention to the Internet. New concepts began to emerge, such as online publishing. One of the most recent examples is the Atlanta Olympics, where the computing work was handled by IBM, which set up a grand scheme of machines and networks and information distribution over the Internet that can be checked on the Olympics homepage, where the data is updated as soon as it is obtained, so that at the end of each match the homepage can be updated and the whole world has access to it, without having to wait until the next day to read it in the newspapers.

Speaking of newspapers, they are not far behind either, putting much of their daily publications on the WWW, like The Gate, an Internet-based product of two newspapers from the West Coast of the United States, the San Francisco Chronicle and the San Francisco Examiner, complete with conference areas with discussion forums like Community, Media, Sports, Movies, etc.

The Agência Estado, which publishes famous newspapers like Estado de São Paulo, also already distributes its newspaper over the internet with the main headlines of the day and various information, including its classifieds and, during an Olympic period, with special areas for the sports in Atlanta.

Another concept that became famous with the Internet is that of online services like the giants Compuserve and America On-line, which serve people all over the world and have allies like Netscape and Microsoft. This type of organization is based on “services” that include discussion forums; libraries with up-to-date information; magazines, newspapers, and other periodicals; virtual stores that sell everything from CDs to clothes; leisure and business tips; and also services common to the Internet like email and WWW.

In Brazil, such types of service also began to spread, most notably the Folha de São Paulo and the Grupo Abril, which launched, respectively, Universo Online and Brasil Online. Such Brazilian services are still experimental and free, with no projections on costs. As an illustration, The New York Times charges US$ 30.00 per month, and America Online charges US$ 9.95 for 5 hours or US$ 19.95 for 20 hours.

Such services have very high revenues, mainly because of the world’s current excitement around the virtualization of services and the rental of digital space to companies interested in placing “virtual billboards” or even adding other services like digital stores on the main pages, given that the number of people traveling through the digital lines every day is very large. To see this, just go to the Brasil Online page, for example, and come across advertising calls from companies like Sun or Credicard. These calls are links that lead to the homepages of the respective companies.

And speaking of advertising, someone must be crafting these pages and ads. These companies are specializing in designing specific and creative pages for a kind of media that steps out of the limitations of paper and enables things like Hypertext ( words inside a text that lead to other pages ), Marquees ( phrases that move along the line ), music ( through WAVE files or the new Real Audio technology ), animations ( via animated GIF images or else using resources of the Java language ), or even fully three-dimensional environments ( using the VRML - Virtual Reality Markup Language technology ) and much more. In this market niche are companies like Vivid Studio, which has as clients the giants Silicon Graphics and Microsoft, or Razorfish, which designs for Time-Warner and Pepsi.

Commerce

The main point of friction when talking about digital commerce is security. The TCP/IP protocol is the starting point for the Internet, conceived as a universal protocol but one that falls short on the security aspect, where, unlike its siblings IPX/SPX or NetBIOS for example, it does not have encrypted data transmission. Since it is the standard protocol for data transmission, it would have been convenient to establish a standard protocol for data security as well. Since this does not exist, the impasse revolves around companies fighting to develop the standard that would cause the initial surge toward the end of printed money and the development of digital credit.

One of the oldest is cybercash, about a year old. For now, the company only works with credit card services, but it soon promises to offer monetary payment services. Currently, with a browser connected to the network, one can shop securely in virtual malls. Through the SIPS ( Secure Internet Payment Service ) protocol, according to the company, it is as easy as point and click. In this type of transaction, you buy as many cybercashes as you wish and it is charged to the credit card.

The Cybercash standard supports all types of credit card. It uses the 768-bit RSA and 56-bit DES encryption standards. All transactions are authenticated with MDS and 768-bit RSA signatures. The first step for anyone interested is to download the free program the company offers. The Cybercash server is connected to the private networks of several banks. The company’s initial services include credit and debit cards and an electronic payment system. For the services, users pay a modest amount, comparable to the value of a stamp. For the suppliers, the system represents savings on the fees charged for credit card transactions, due to the risk still present in transactions by telephone and email.

In this type of development one still finds companies like Digicash, with services centered on the First Digital Bank site, using an e-cash system ( real money converted into virtual money in virtual accounts ). Visa ( which is also already a partner of Sony - in developing a multifaceted environment of entertainment, information, and commercial transactions ) and Microsoft have STT ( Secure Transaction Technology ), the standard of these two powerhouses that wants to become an electronic version of the credit card. Mastercard is in partnership with IBM, Netscape, GTE, and Cybercash, with the SEPP ( Secure Eletronic Payment Protocol ) standard. It is an open protocol for secure online transactions.

Netscape develops the open security protocol SSL ( Secure Sockets Layer ) and contributes to the development of the SSL interface of the W3C ( World Wide Web Consortium ), a European consortium dedicated to creating a standard for the European Common Market. About 50 companies from all over the world are part of this consortium. The company will license the SSL technology to its partners for commercial use. The list of partners includes MCI, Bank of America, Mastercard, First Data Corporation, Novell, Digital, and Silicon Graphics.

Practically all the companies in the financial sector have been investing heavily in developing a platform secure and reliable enough for financial transactions of every level of importance. Hackers aside, business over the Internet does not differ much from that done outside it. That is, the best way to stay free of problems is to trust in the credibility of serious companies. It is unlikely that anyone will want to compromise their good name by failing to deliver the goods on time or by “trading” the credit card number.

In Brazil, Mappin was the first large company to enter the business of computer sales. It is also possible to choose sweets and pies at Confeitaria Brunella in São Paulo, or make reservations at Marcellu’s Bar in Rio de Janeiro. The consumer chooses the sweet or pie they want to buy through the photos and descriptions on Brunella’s homepage, then the store telephones to confirm the order and sends the goods. In the case of Marcellu’s Bar, the reservation is made by email.

If someone is moving to the United States, or simply needs to compare prices, they can consult the For Sail By Owner Connection. It is a site specialized in home sales, with photos and specifications. If you actually need to sell your house, you can also advertise on this page.

Thinking about travel, Cruisin is the first tourism agency specialized in cruises that serves exclusively over the Internet. But there are already many hotels and agencies on the network. There really are alternatives for every bank limit: from Ceará cashews for less than R$ 3.00 to a house in Florida for US$ 329 thousand. These days it is virtually possible to buy anything on the Internet.

Afterwords

Created for military purposes, then expanded to academic circles, and finally reaching the general public, the Internet marches on in accelerated evolution, covering practically all sectors of society, where the foundations of what can be considered a virtual world are being built.

When the Internet evolves enough, the new technologies will build the awaited Information Super Highway where, then yes, a truly worldwide network will take shape, using not only computers in the way we know them but also any electronic equipment, like set-top boxes ( the replacements for VCRs and video-lasers ).

In this next generation, “strolling around” will be putting on a virtual reality suit and visiting virtual places with friends from other continents in a digital meeting. And this is not science fiction delusions: we are so close to it that such technologies are real and already exist, all that remains is the time to make them accessible and operational at the level of mass distribution.