alt Hacker NewsrVPN – stealth VPN with end-to-end encryption
Comments
> Memory-safe in Rust > The core is written in Rust, so entire classes of vulnerability cannot occur.
Hmm... It just ain't true.
---
For those who need a "stealth VPN", use <https://github.com/XTLS/Xray-core/> or its GUI version <https://github.com/2dust/v2rayN/>
Proxyguard already fills this niche using Wireguard over HTTPS and is not a vibe-coded project. https://codeberg.org/eduVPN/proxyguard
I discovered recently Three UK is slowing down port 443, and if I started using 2000-3000 port range it increased my speeds 10x
> The mobile apps are paid. Development is fully funded by PDG Global Limited; revenue from app sales, together with donations, contributes towards development costs. The core remains open source under AGPLv3.
Why not Xray-core VLESS families? It sounds like your code is written by an LLM that is trained on Xray-core source code.
It’s not enough to put everything in https if you really want to circumvent modern censorship technology.
>stealth VPN with end-to-end encryption
Not sure what this means. AFAIK all VPNs have end-to-end encryption. Stealth ? will need to read to see what that means.
> We believe privacy should be proven, not promised
Then instantly gives you a shell script that it pipes to `sudo bash`. The irony isn't lost here.
It is possible to write a TLS-on-443 VPN that is hard to distinguish from HTTPS.
However, if someone claims (or as good as) that "encrypted over TLS on 443" intrinsically pos5esses this property, they demonstrate that they
• do not understand the state-of-the-art in L7 firewalls as of 2010, let alone today
• don't understand common enterprise and state-level controls like HTTPS decrypt (which instantly break this)
• haven't read any of the last decade of papers on detecting protocols like obfsproxy
• haven't even bothered to look at existing takes on this (like tor) and the compromises that they make
---
From the whitepaper:
> Desktop, CLI, and Android clients use BoringSSL to mimic a Chrome TLS 1.3 ClientHello fingerprint, helping evade deep-packet inspection.
Do you set an SNI / eSNI? No? Trivially detectable. I believe Palo Alto AppID would flag this instantly as non-HTTPS masqueraded traffic.
Go fire this up behind China's golden shield, and see how many minutes your tunnel stays performant before they tarpit you; then come write a whitepaper.
> curl https://[...] | sudo bash
> [...] verifies checksum [...]
Phew, good thing it verifies that, otherwise piping unverified output to a sudo shell could be dangerous!
There's only 4 mentions of Rust on the landing page. Are we sure this is memory safe enough?
I am all for exciting new VPN technologies but even the home page is vibecoded.
> Many flows. One connection shape
Shape, shape... shape.
I feel up until AI, nobody with their right mind would refer to the shape of a connection.
Do you have a Docker image available? I want to run this on my Coolify server. I have a V2Ray for my family in Iran setup currently and I am wondering how this hold up.
i was needing this very thing while trying to do work from the infusion clinic with a very aggressive outbound firewall.
Does anyone have a guide on getting wireguard + stunnel set up to evade DPS firewalls?
[dead]
Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it.
WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport.
We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents.