| ▲ | rVPN – stealth VPN with end-to-end encryption(rvpn.org) |
| 46 points by michaelsbradley 2 hours ago | 34 comments |
| |
|
| ▲ | tptacek 2 hours ago | parent | next [-] |
| Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it. WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport. We did this at Fly.io when we discovered that, for one reason or another, 5% of our users simply couldn't reliably use UDP. It was a one-day project to run it under WebSockets instead, and that was before coding agents. |
| |
| ▲ | drum55 2 hours ago | parent | next [-] | | Wireguard is both really useful and pretty frustrating as a user. As a developer it's amazing that you can do things like relay packets through a bouncer with authentication to get around NAT without ever having to think about the protocol level safety, as a user it's near impossible to configure without the confused "why are no packets working", and as you had here it just doesn't make it through a lot of restrictive networking conditions. I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them. The parent is obviously just Claude making a fancy website and some sort of unreviewed networking protocol that's dressed up to look as if it's a real project. Github really needs to start showing commit cadence and repo birthdates. | | |
| ▲ | joecool1029 an hour ago | parent | next [-] | | > I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them. netbird's a thing to check out if you want an alternative to tailscale you can self-host. | | |
| ▲ | drum55 an hour ago | parent | next [-] | | Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code. | |
| ▲ | tamimio 30 minutes ago | parent | prev [-] | | Netbird doesn’t have proper network isolation, due to its shared policy space compared to one gateway interface per customer/organization. Which is not an issue if you are the only user, but if you are building a service for customers to use, and there’s a potential scale up, it will be an issue, either having multi account mode which will results in many resources you need to deploy or containers per customer, or, having them all shared policy that could potentially allow customer to customer access if misconfiguration happens, alternatively, building a gateway in the middle to broker it all but traffic must pass through which is operational cost plus extra latency, and even privacy concerns. |
| |
| ▲ | tamimio 39 minutes ago | parent | prev [-] | | Which is why I am building my stuff around iroh instead. |
| |
| ▲ | aborsy 33 minutes ago | parent | prev | next [-] | | If you wrap wireguard or build a layer on top of it, it's no longer wireguard that first listens to packets on public interface, it's your wrapper. The security properties of wireguard don't hold (potential for RCE before packets reach wireguard). That's a problem with projects like wstunnel or udp2raw. You want wireguard to be the software that takes the packets first. | | |
| ▲ | tptacek a minute ago | parent [-] | | This isn't true. You don't lose the security properties of WireGuard just because you wrap it in some other transport. There is no particular virtue to it "taking the packets first". |
| |
| ▲ | nyeki 36 minutes ago | parent | prev | next [-] | | Yeah, I just forwarded my wireguard connection through websockets with this and even though it's way slower it works just fine. Not even 1000 loc i think. https://github.com/nekidev/tow | | |
| ▲ | tptacek 34 minutes ago | parent [-] | | And even if you don't tunnel an existing WireGuard implementation (ideally, you would, to inherit the security track record of that implementation) you at least get the design right. Doing a brand new encrypted transport design for no good reason is a weird red flag for me. |
| |
| ▲ | WhyNotHugo an hour ago | parent | prev [-] | | > Not sure why you'd vibe-code a new VPN protocol, double ratchet or otherwise, when you can just take WireGuard and make a new transport for it. Why TFA explains it, it's also in the title: "stealth". WireGuard is trivial to detect and block, and has no aspirations at being stealth. | | |
| ▲ | ronsor an hour ago | parent | next [-] | | He literally acknowledged that: > WireGuard by itself is not a stealth VPN, but the things that make a VPN "stealthy" are all things you'd layer on top of a WireGuard design, not thread through the middle of it. A datagram-based protocol can run under any obscured transport. | |
| ▲ | UqWBcuFx6NV4r 43 minutes ago | parent | prev [-] | | Please read the full comment before replying. |
|
|
|
| ▲ | Sha1rholder an hour ago | parent | prev | next [-] |
| > Memory-safe in Rust
> The core is written in Rust, so entire classes of vulnerability cannot occur. Hmm... It just ain't true. --- For those who need a "stealth VPN", use <https://github.com/XTLS/Xray-core/> or its GUI version <https://github.com/2dust/v2rayN/> |
|
| ▲ | munro 37 minutes ago | parent | prev | next [-] |
| I discovered recently Three UK is slowing down port 443, and if I started using 2000-3000 port range it increased my speeds 10x |
|
| ▲ | rock_artist 37 minutes ago | parent | prev | next [-] |
| > The mobile apps are paid. Development is fully funded by PDG Global Limited; revenue from app sales, together with donations, contributes towards development costs. The core remains open source under AGPLv3. |
| |
| ▲ | lifeisloving 31 minutes ago | parent [-] | | I cant find anything on this company, but I got to say im sussed out by any VPN who's three language options are English, Russian and Chinese. It screams spook activity. | | |
| ▲ | petu 24 minutes ago | parent [-] | | Throw in Iran/Farsi and you've probably covered >80% of the stealth VPN market/users. Normal protocols get blocked in those countries, so. |
|
|
|
| ▲ | f311a 37 minutes ago | parent | prev | next [-] |
| It’s not enough to put everything in https if you really want to circumvent modern censorship technology. |
|
| ▲ | eric15342335 an hour ago | parent | prev | next [-] |
| Why not Xray-core VLESS families?
It sounds like your code is written by an LLM that is trained on Xray-core source code. |
|
| ▲ | dieseltech 2 hours ago | parent | prev | next [-] |
| > We believe privacy should be proven, not promised Then instantly gives you a shell script that it pipes to `sudo bash`. The irony isn't lost here. |
| |
|
| ▲ | lxgr an hour ago | parent | prev | next [-] |
| > curl https://[...] | sudo bash > [...] verifies checksum [...] Phew, good thing it verifies that, otherwise piping unverified output to a sudo shell could be dangerous! |
|
| ▲ | PUSH_AX 2 hours ago | parent | prev | next [-] |
| There's only 4 mentions of Rust on the landing page. Are we sure this is memory safe enough? |
| |
| ▲ | cowlevel an hour ago | parent [-] | | To be extra sure I saved a copy on a spinning platter of iron oxide. |
|
|
| ▲ | jmclnx an hour ago | parent | prev | next [-] |
| >stealth VPN with end-to-end encryption Not sure what this means. AFAIK all VPNs have end-to-end encryption. Stealth ? will need to read to see what that means. |
| |
| ▲ | tonymet an hour ago | parent [-] | | a vpn that bypasses deep-packet-inspection firewalls by simulating common HTTPS traffic |
|
|
| ▲ | therein an hour ago | parent | prev | next [-] |
| I am all for exciting new VPN technologies but even the home page is vibecoded. > Many flows. One connection shape Shape, shape... shape. I feel up until AI, nobody with their right mind would refer to the shape of a connection. |
| |
| ▲ | cowlevel an hour ago | parent [-] | | That's how you know there's nothing exciting here. Just some ordinary technology rehyped by AI phrasing. | | |
|
|
| ▲ | amir734jj 37 minutes ago | parent | prev | next [-] |
| Do you have a Docker image available? I want to run this on my Coolify server. I have a V2Ray for my family in Iran setup currently and I am wondering how this hold up. |
|
| ▲ | tonymet an hour ago | parent | prev [-] |
| i was needing this very thing while trying to do work from the infusion clinic with a very aggressive outbound firewall. Does anyone have a guide on getting wireguard + stunnel set up to evade DPS firewalls? |
