More or less, built on top of it with added udp/icmp.

When writing server and client a lot of time is consumed by additional features, not on implementing the spec itself. For instance, in order to be truly stealthy we have to make sure that it looks *exactly* like Chromium on the outside, and then maintain this similarity as Chromium changes TLS implementation from version to version. Or here’s another example: on the server-side we need to have an anti-probing protection to make it harder to detect what the server does.

Hi, thank you very much for supporting AG!

We are very cautious with Apple as we suffered from them before [1]. So we're trying to stick to the APIs they provide. I hope the new URL filtering API [2] will improve the situation with the system-wide filtering, but our request for API access is still being reviewed by Apple.

Regarding jailbroken iOS devices, unlike Android the numbers are really marginal so it won't be feasible to support them.

[1]: https://adguard.com/en/blog/adguard-pro-discontinued.html

[2]: https://adguard.com/en/blog/apple-url-filter-system-wide-fil...

We do, and from what we know a bigger problem in China is detecting traffic patterns. SNI filtering is not that big of a deal, in order to block your domain it needs to first learn which one you’re using. What for the traffic patterns, people in China prefer to selectively route traffic to the tunnel. For instance, the client apps allow you to route *.cn domains (or any other domains) directly. It makes it harder to detect that you’re using a VPN.

>GFW has been able to filter SNI to block https traffic for a few years now.

SNI isn't really the threat here, because any commercial VPN is going to be blocked by IP, no need for SNI. The bigger threat is tell-tale patterns of VPN use because of TLS-in-TLS, TLS-in-SSH, or even TLS-in-any-high-entropy-stream (eg. shadowsocks).

Performance reasons aside, TrustTunnel is developed by the team whose main language is C++ (and the client library is actually written in C++) so Rust was a more natural choice for them.

Likewise interested in the authoritative answer, but: if I needed to write a decent chunk of code that had to run as close to wire/CPU limits as possible and run across popular mobile and desktop platforms I would 100% reach for Rust.

Go has a lot of strengths, but embedding performance-critical code as a shared library in a mobile app isn't among them.

Embedding Go code into other binaries sucks ass. Debugging is worse, it installs some signal handlers.

https://github.com/XTLS/Xray-core

It won't help you get around the endpoint compliance software, I use this for my byod phone (Streisand is a nice ios client). VLESS is the proxy protocol, kinda like SOCKS I guess. It uses xhttp over TLS as the transport.

Just use Amnezia VPN - it can masquerade as https.

I'm an American. I knew about the VPN service, but mostly associate your brand with the DNS services and lists you provide (thank you!).

And AdGuard Home is a wonderful alternative to Pi-hole :)

Thanks for the suggestion! I'll definitely try the uninstall-reboot-reinstall flow. I was about to switch browsers on all the elderly devices.