bodyType

customContents

entityId

printArticlePageQuery

filter

article

body

urlAlias

articleSectionsContent

articleSeoArticle

articleSourceHeaderArticle

contentSchemaRenderContent

contentSubHeadlineContent

contentHeadlineContent

mainImagePrintArticleArticle

authorBlockPrintArticleArticle

contentSponsorTagContent

articlePianoPaywallContent

scmpYoutubeContent

hooksTrackPageViewArticle

query printArticlePageQuery(
  $entityId: String!
  $customContents: [CustomContentInput]
  $bodyType: BodyFormatTypeEnum
) {
  article(filter: {entityId: $entityId}) {
    entityId
    body(customContents: $customContents, type: $bodyType) {
      json
    }
    urlAlias
    ...articleSectionsContent
    ...articleSeoArticle_3o8td4
    ...articleSourceHeaderArticle
    ...contentSchemaRenderContent
    ...contentSubHeadlineContent
    ...contentHeadlineContent
    ...mainImagePrintArticleArticle
    ...authorBlockPrintArticleArticle
    ...contentSponsorTagContent
    ...articlePianoPaywallContent
    ...scmpYoutubeContent
    ...hooksTrackPageViewArticle
    id
  }
}

fragment articlePianoPaywallContent on Content {
  __isContent: __typename
  ...hooksPaywallPromiseContent
}

fragment articleSectionsContent on Content {
  __isContent: __typename
  sections {
    value {
      ...helpersCheckIfNewsSectionInFirstIndexSection
      ...entityLink
      name
      id
    }
  }
}

fragment articleSeoArticle_3o8td4 on Article {
  ...hooksArticleSeoArticle
  ...helpersCheckIsPostiesArticle
  ...helpersGetArticleTypeArticle
  entityId
  publishedDate
  updatedDate
  summary {
    text
  }
  subHeadline {
    text
  }
  body(customContents: $customContents, type: $bodyType) {
    text
  }
  keywords
  sections {
    value {
      name
      id
    }
  }
  topics {
    name
    entityId
    id
  }
  urlAlias
  authors {
    name
    id
  }
  images {
    style(filter: {style: "768x768"}) {
      url
    }
  }
  readingTime
}

fragment articleSourceHeaderArticle on Article {
  urlAlias
  ...entityLink
}

fragment authorBlockPrintArticleArticle on Article {
  ...defaultArticleDateContent
  ...authorNamesArticle
}

fragment authorNameAuthor on Author {
  ...entityLink
  name
  entityUuid
}

fragment authorNamesArticle on Article {
  authorLocations
  authors {
    entityId
    location
    ...authorNameAuthor
    id
  }
}

fragment blockquoteQuoteContent on Content {
  __isContent: __typename
  ...contentShareWidgetContent
}

fragment checkersCheckContentContainsStarlingImageContent on Content {
  __isContent: __typename
  topics {
    entityId
    id
  }
}

fragment contentHeadlineContent on Content {
  __isContent: __typename
  headline
  socialHeadline
  ...contentHeadlineTagContent
  ...helpersUseContentSponsorContent
}

fragment contentHeadlineTagContent on Content {
  __isContent: __typename
  ...hooksContentHeadlineTagContent
}

fragment contentNewsletterWidgetContent on Content {
  __isContent: __typename
  topics {
    relatedNewsletters {
      ...helpersMassageToNewsletterItemNewsletter
      id
    }
    id
  }
  sections {
    value {
      relatedNewsletters {
        ...helpersMassageToNewsletterItemNewsletter
        id
      }
      id
    }
  }
  ... on Article {
    relatedNewsletters {
      ...helpersMassageToNewsletterItemNewsletter
      id
    }
  }
}

fragment contentSchemaRenderContent on Content {
  __isContent: __typename
  ...blockquoteQuoteContent
  ...imageContent
  ...inlineWidgetContent
  ...photoGalleryWidgetContent
  ...scmpYoutubeContent
}

fragment contentShareWidgetContent on Content {
  __isContent: __typename
  entityId
  urlAlias
  shortUrl
  socialHeadline
  headline
}

fragment contentSponsorTagContent on Content {
  __isContent: __typename
  ...helpersUseContentSponsorContent
}

fragment contentSubHeadlineContent on Content {
  __isContent: __typename
  subHeadline {
    json
  }
  summary {
    json
  }
  ...contentSchemaRenderContent
}

fragment defaultArticleDateContent on Content {
  __isContent: __typename
  ...hooksArticleDateUtilsContent
}

fragment entityLink on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  __typename
  entityId
  entityUuid
  urlAlias
  urlRedirect {
    toUrl
    id
  }
  application {
    entityId
    id
  }
  ... on Section {
    fullSectionPath {
      entityId
      id
    }
    parentSection
  }
  ...helpersAppBarVariantBase
  ...helpersApplicationBase
  ...helpersCheckIsPlusArticle
  ...helpersStyleSectionContent
}

fragment helpersAppBarVariantBase on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  ...helpersCheckIsLiveArticle
  ...helpersCheckIsPlusPage
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostiesPage
  ...helpersCheckIsPostMagazineArticle
  ...helpersCheckIsStyleArticle
  ...helpersSectionContent
  ...helpersStyleSectionContent
}

fragment helpersApplicationBase on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostiesPage
  ...helpersCheckIsPlusPage
}

fragment helpersCheckIfNewsSectionInFirstIndexSection on Section {
  name
}

fragment helpersCheckIsAmpEnabledArticle on Article {
  entityId
  types {
    value {
      entityId
      id
    }
  }
  sections {
    value {
      entityId
      id
    }
  }
  disableOffPlatformContent
  sponsorType
  published
  ...helpersCheckIsPlusArticle
  ...helpersCheckIsPostiesArticle
}

fragment helpersCheckIsLiveArticle on Article {
  flattenTypeIds
  liveArticle {
    status
    id
  }
}

fragment helpersCheckIsMainTopicContent on Content {
  __isContent: __typename
  topics {
    entityId
    id
  }
}

fragment helpersCheckIsPlusArticle on Content {
  __isContent: __typename
  ... on Article {
    paywallTypes {
      entityUuid
      id
    }
  }
}

fragment helpersCheckIsPlusPage on Page {
  urlAlias
}

fragment helpersCheckIsPostMagazineArticle on Article {
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersCheckIsPostiesArticle on Article {
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersCheckIsPostiesPage on Page {
  urlAlias
}

fragment helpersCheckIsStyleArticle on Content {
  __isContent: __typename
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersGetArticleTypeArticle on Content {
  __isContent: __typename
  ... on Article {
    types {
      value {
        entityId
        id
      }
    }
  }
}

fragment helpersMassageToNewsletterItemNewsletter on Newsletter {
  entityId
  name
  alternativeName
  description {
    text
  }
  summary {
    text
  }
  homepageDescription {
    text
  }
}

fragment helpersSanitizeArticleTypeEntityIdsArticle on Article {
  types {
    value {
      entityId
      id
    }
  }
}

fragment helpersSanitizeAuthorTypesArticle on Article {
  authors {
    types
    id
  }
}

fragment helpersSanitizedAuthorEntityIdsArticle on Article {
  authors {
    entityId
    id
  }
}

fragment helpersSectionContent on Section {
  fullSectionPath {
    entityId
    id
  }
}

fragment helpersStyleSectionContent on Section {
  fullSectionPath {
    entityId
    id
  }
}

fragment helpersUseContentSponsorContent on Content {
  __isContent: __typename
  topics {
    entityId
    sponsor {
      ...sponsorTagSponsor
      name
      type
      id
    }
    id
  }
  ... on Article {
    sponsorType
  }
  ...helpersCheckIsMainTopicContent
}

fragment hooksArticleDateUtilsContent on Content {
  __isContent: __typename
  createdDate
  publishedDate
  updatedDate
}

fragment hooksArticleSeoArticle on Article {
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostMagazineArticle
  ...helpersCheckIsStyleArticle
  ...hooksContentHeadlineTagContent
  ...helpersCheckIsAmpEnabledArticle
  entityId
  headline
  socialHeadline
  types {
    value {
      entityId
      id
    }
  }
  authors {
    entityId
    id
  }
  images {
    generic_og: style(filter: {style: "og_image_scmp_generic"}) {
      url
    }
    styles(filter: {styles: ["og_image_posties_article", "og_postmag", "og_image_style", "og_image_scmp_analysis", "og_image_scmp_explainer", "og_image_scmp_editorial", "og_image_scmp_fact_check", "og_image_scmp_debate", "og_image_scmp_live", "og_image_scmp_obituary", "og_image_scmp_opinion", "og_image_scmp_review", "og_image_scmp_series", "og_image_scmp_generic"]}) {
      url
      style
    }
    type
  }
  urlAlias
}

fragment hooksContentHeadlineTagContent on Content {
  __isContent: __typename
  __typename
  ... on Article {
    types {
      value {
        name
        entityId
        description {
          text
        }
        id
      }
    }
    ...helpersCheckIsStyleArticle
  }
  flag
  sections {
    value {
      name
      id
    }
  }
  ...hooksContentHelperContent
}

fragment hooksContentHelperContent on Content {
  __isContent: __typename
  ...helpersSanitizeArticleTypeEntityIdsArticle
  ...helpersSanitizeAuthorTypesArticle
  ...helpersSanitizedAuthorEntityIdsArticle
  flag
}

fragment hooksPaywallPromiseContent on Content {
  __isContent: __typename
  entityId
  ...helpersCheckIsPostiesArticle
}

fragment hooksTrackPageViewArticle on Article {
  entityId
  publishedDate
  headline
  sections {
    value {
      name
      id
    }
  }
  urlAlias
  authors {
    name
    id
  }
  entityUuid
}

fragment imageContent on Content {
  __isContent: __typename
  headline
  ...checkersCheckContentContainsStarlingImageContent
}

fragment inlineWidgetContent on Content {
  __isContent: __typename
  ...contentNewsletterWidgetContent
}

fragment mainImagePrintArticleArticle on Article {
  images {
    title
    url
    isSlideshow
    size_652x446: style(filter: {style: "652x446"}) {
      url
    }
  }
}

fragment photoGalleryDialogContent on Content {
  __isContent: __typename
  __typename
  ...contentShareWidgetContent
}

fragment photoGalleryWidgetContent on Content {
  __isContent: __typename
  ...photoGalleryDialogContent
}

fragment scmpYoutubeContent on Content {
  __isContent: __typename
  entityId
  urlAlias
  publishedDate
}

fragment sponsorTagSponsor on Sponsor {
  name
  type
  images {
    url
  }
}


sections

types

disableOffPlatformContent

sponsorType

published

headline

socialHeadline

authors

images

publishedDate

updatedDate

summary

subHeadline

keywords

topics

readingTime

authorLocations

entityUuid

Matt Haldane

China's ability to control what its population sees online is well known. Facebook, Twitter and YouTube -- among others -- aren't accessible in the country.
Yet amidst a harsh crackdown on circumvention tools that help people in China get access to the global internet, one piece of technology -- developed in China -- has proven remarkably effective. It’s also gaining traction elsewhere in the world.
Shadowsocks is a proxy tool that was specifically designed to allow internet users to scale the Great Firewall. It was first developed in 2012 by a Github user named clowwindy.
Like other types of proxies, Shadowsocks forwards web traffic through a foreign IP address, allowing users to circumvent censorship or appear like they’re browsing from another location. And though the idea of Shadowsocks was initially developed in China, the individual components that make up a Shadowsocks proxy aren’t anything new.
Shadowsocks is effectively a SOCKS5 proxy wrapped in encryption of the user’s choice. The innovation was combining open source technologies into something unique that meets the needs of Chinese users.
The result is a highly customizable, encrypted proxy. The customizability of Shadowsocks is perhaps its greatest strength. It can use many different types of encryption, come from servers from any provider anywhere in the world, and the traffic can be obfuscated to look like normal web traffic.
In 2015, though, creator clowwindy said he got a visit from the police and announced that he would no longer work on the project, subsequently deleting the code. But that’s hardly the end of Shadowsocks’ story.

Four years after that fateful police visit, the open source proxy technology is still thriving thanks to other developers. Moreover, it’s been increasingly adopted by overseas VPN companies seeking to help people improve security and circumvent geographical restrictions.
One of these companies is Jigsaw. The Alphabet subsidiary formerly known as Google Ideas created a project called Outline that deploys Shadowsocks on a private server for users.
Jigsaw describes the goal of Outline as making it “easy for news organizations to set up a corporate virtual private network (VPN) on their own server.” In fact, though, it’s a Shadowsocks proxy server, a sometimes subtle but important difference.
Unlike a VPN connection, when you have a proxy set up on a computer, not all internet traffic runs through that proxy by default, potentially revealing unencrypted data or your true IP address. For those who might be government targets, like Chinese dissidents, that can be dangerous.

Jigsaw has worked to make Outline appear similar to a VPN, like implementing fixes that prevent potentially-dangerous domain name server leaks. But it still operates by setting up a proxy on your computer.
Jigsaw representatives wouldn’t comment on why the organization chose Shadowsocks over other VPN protocols, but company product manager Justin Henck said they sought to use the “strongest technology available.”
“Shadowsocks seemed like a great fit as an actively developed, cross-platform open source protocol designed to help protect your internet traffic,” he told Abacus in an email. “We built on what the Shadowsocks team created, and chose state-of-the-art encryption and other secure defaults, and tried to make it accessible not just to technical users, but also to anyone who can use a computer.”
The technology’s increasing popularity outside of China may be owed to its ease of use. Auto-installation scripts like Outline are easy to find on GitHub, the largest repository for open source code. These allow people to buy a virtual private server (VPS) from companies like Digital Ocean or Vultr for as little as US$5 per month and quickly deploy their own proxy.
After installation to the server, users simply have to copy and paste a custom URI link or scan a QR code containing all the necessary proxy settings in a Shadowsocks program or mobile app.
This simplicity doesn’t just benefit users. It also makes it easy for an entrepreneur to run a one-man shop, providing proxies to those who can’t be bothered to set up a server themselves. That’s what Daniel Szmulewicz did by starting Caonima.io, a proxy company with a provocative name taken from a vulgar Chinese phrase.
“Caonima grew out of my needs as a frequent China traveler,” Szmulewicz said. “We are small and do not worry about growth too much… Call it a boutique shop, if you will.”

As it gets easier to find and use Shadowsocks proxies, it might be a more appealing option than a VPN for users in China even though it might not be as secure. Many users are more interested in simply getting access to the internet outside China than they are securing all their communication.
In recent years, China has gotten increasingly better at blocking VPNs, especially through the use of artificial intelligence. But it’s still not an easy task. Two major means of cracking down on circumvention are identifying VPN connections by recognizing patterns from specific protocols like OpenVPN or just completely blocking IP addresses used by popular VPN services.
This has resulted in a cat-and-mouse game as VPN providers get more creative -- like using TLS encryption used for web traffic to disguise VPN connections -- and dumping IP addresses for new ones whenever they’re attacked. But anyone running their own Shadowsocks proxy can easily jump over to a new server or completely change VPS providers at the cost of mere pennies.
Another benefit of Shadowsocks is that it was designed first-and-foremost to circumvent censorship, according to Szmulewicz. But since it’s a proxy, it’s not as secure as a VPN by design.
“Shadowsocks looked at the problem of censorship in isolation, without preconceptions, and came up with a proxy solution,” Szmulewicz said. “To fool the censorship system, it was crucial to make the traffic look like normal HTTPS traffic. VPNs are ill-suited for that.”
Szmulewicz offers his service free to journalists based in China, but he explicitly says on the website FAQ that the service is not meant to keep journalists safe. In spite of that, he says he was inspired to start Caonima.io while working at a newspaper in Jerusalem, where he gained greater respect for journalists covering dangerous stories.
Shadowsocks does use high-end encryption, though. It offers a variety of choices, some of which you’ll find in VPNs, such as AES-256. This is why Jigsaw touts “strong privacy and security.”
And no VPN matches the simplicity of getting up-and-running on Shadowsocks. VPN protocols like OpenVPN may require sharing public key certificates.
Since Shadowsocks was designed to get around China’s Great Firewall, it was natural for developers to devise something that could be shared simply by scanning a QR code on a friend’s phone. All of a sudden, within seconds, that person is connected to the World Wide Web in all its unbowdlerized splendor.
The plethora of options in setting up Shadowsocks also makes connections hard to detect. The proxies vary in type of encryption, ports used, obfuscation techniques and server providers.
Even amid a fierce crackdown on commercial VPN services in the leadup to the 30th anniversary of the June 4th Tiananmen crackdown, Shadowsocks remained a reliable circumvention tool as Chinese censors played whack-a-mole in blocking IP addresses. Even though some VPS providers saw many of their IP addresses blocked in June, simply copying the proxy settings to a new server from the same provider could be enough to regain access with another IP address.
Detection methods are getting more sophisticated, though. The Great Firewall can recognize and cut off certain types of connections by patterns in data packets or port numbers. With artificial intelligence becoming more sophisticated, some people are also bleak about Shadowsocks’ chances at staying ahead of the censors.
That was the conclusion of a detailed report from Comparitech on the methods used by the Great Firewall to block or detect and shut down VPN connections. The sophistication of China’s detection methods led the author to state, “It’s only a matter of time until Shadowsocks is on the chopping block.” The author did note, though, that obfuscation methods like those using TLS encryption offer some hope.
Another person who seems bleak about the long term chances of Shadowsocks is a Chinese developer known as Teddysun. He developed one of the more popular auto-installation scripts for Shadowsocks on Github, but he announced in May that he would no longer be developing it. He noted that other tools now met that need and referenced the “bad things” that have happened to past developers, like clowwindy.
“Numerous maintainers have abandoned the maintenance of the project,” Teddsun told Abacus. “It won't last long, and it's a matter of time.”

For now, though, foreign companies seem happy to adopt this piece of free, open source tech that gives their users yet another means of avoiding censorship. VPN services like ibVPN and Surfshark offer Shadowsocks connections within their custom apps. A company called WannFlix offers Shadowsocks proxies to people looking to get around Netflix’s geographic restrictions for certain content.
It might seem ironic that one of the most rapidly adopted pieces of anti-censorship tech today came from China. But there’s no other place in the world with more of an incentive to create such an effective tool.
In the long run, Shadowsocks will live or die based on interest and necessity. But today, it’s very much alive, even if developers from its home country feel compelled to abandon it.


Google is using a tool Chinese users developed to bypass the Great Firewall

(Picture: Thomas White/Reuters)

Clowwindy’s neglected Github projects following that fateful police visit. (Picture: Github)

Jigsaw touts strong privacy and security for news organizations with its Outline “VPN.” (Picture: Jigsaw)

Daniel Szmulewicz says he offers his service free to journalists based in China. (Picture: Caonima)

WannaFlix joined the many companies offering to unblock Netflix content in different regions by using its own Shadowsocks proxies. (Picture: WannaFlix)

Abacus

Tech

Shadowsocks was developed in China to jump the Great Firewall, and now companies like Google are adopting it even as some debate its security and longevity
