iasds

Coordinated Deployment and Reachability Asymmetry of Chinese I2P Routers

Fri, 03 Jul 2026 00:00:00 +0000

We are releasing a preprint that characterizes a cluster of Chinese I2P routers discovered via passive DHT scanning.

Key Findings

Across five i2pd 2.60.0 floodfill instances, we scanned the I2P network over multiple collection rounds (June 29 – July 1, 2026) and discovered 20,701 unique routers.

The matched CN cluster (58 routers) exhibits:

2–3× elevated floodfill declaration rate (27–36% vs. 14–20% global baseline) in their RouterCaps — yet zero were observed participating as active floodfills.
Version lock on 0.9.66 (79.3% of CN routers vs. 1.8% globally) — a 43× enrichment.
82.8% share a high-bandwidth XfR/XRG RouterCaps template; 32.8% explicitly carry the floodfill flag (f) via XfR.
Concentrated on Alibaba Cloud (AS37963, 46.2%), with no knownRouters or family declarations, and ongoing IP rotation.
Four China-vantage-only routers — observed only from inside China’s GFW, unreachable from Singapore and Tor exit paths — with TCP RST/timeout behavior consistent with selective reachability filtering along the path.

Our Approach

We distinguish three separate concepts throughout the paper:

Build Security Doesn't Need Full Determinism — A Practical Multi-Sig + Transparency Log Approach

Thu, 11 Jun 2026 00:00:00 +0000

Qubes’ current release signing flow relies on a single point of trust — one person holds the release key. It’s worked for over a decade, but “hasn’t been compromised yet” isn’t the same as “can’t be compromised.”

Everyone agrees deterministic builds + multi-signature is the right direction. Issue #816 has been open for years, which shows the community knows its value. But full determinism is a heavy lift — getting thousands of packages across dozens of upstream projects to produce bit-identical output is a massive undertaking.

Clash Gateway — Transparent Proxy Guide

Fri, 15 May 2026 00:00:00 +0000

Intro

This guide explains how to set up a transparent proxy gateway on Qubes OS using qubes-clash-gateway, powered by mihomo (formerly Clash Meta).

Unlike per-AppVM proxy configurations, this approach turns a single NetVM into a proxy gateway. All downstream AppVMs get proxied automatically with zero configuration — just set the NetVM and go.

What it does:

Transparent proxy for all TCP/UDP traffic
DNS fake-ip to prevent DNS pollution
GeoIP rule-based routing (CN direct, foreign proxy)
Subscription parser supporting Clash YAML, vmess/vless/ss/ssr/trojan/hy2/tuic/wireguard
Terminal controller clashctl + Web UI for management

How it works:

I2pd netvm based on debian guide

Wed, 15 Jan 2025 00:00:00 +0000

This guide demonstrates how to set up i2pd as a netvm, allowing you to easily proxy traffic through the i2p network to access the clearnet or i2p services. This significantly enhances security and privacy.

This method is an improved implementation compared to the I2pd netvm guide, utilizing debian-12 and avoiding the outdated i2pd-qt and archlinux community template.

Installation

First, you need a debian-12-xfce template VM.
Clone this template and name it debian-12-xfce-i2pd.

Consulting

Mon, 01 Jan 0001 00:00:00 +0000

I provide paid technical consulting for privacy, anonymity, censorship resistance, and security engineering.

Rate: $120/hour. For small, well-defined tasks, I can quote a fixed cap before work starts.

What I Can Help With

Privacy and anti-doxxing: personal exposure assessment, public data footprint review, cleanup planning, account and identity compartmentalization, and social-engineering risk reduction.
Censorship circumvention: proxy and relay infrastructure design, deployment review, operational hardening, and troubleshooting.
I2P infrastructure: private testnets, hidden services, router deployment, measurement tooling, and custom application integration.
Qubes OS: installation planning, template and qube layout, network isolation, hardening, troubleshooting, and security review.
Security engineering: protocol and architecture review, dependency audit, cryptographic design review, threat modeling, and implementation guidance.

Typical Deliverables

Depending on the scope, the result may be: