boratanrikulu

Thanks for sharing! I'm the author, happy to answer any questions about the implementation.

Thanks! Yes, the DPI systems I've tested against only look at the first ClientHello in a connection. They don't do full TCP reassembly. The fake packet arrives first (eBPF fires synchronously before the app sends data), DPI records that SNI, and the real ClientHello passes through unchecked.

More sophisticated DPI (like China's GFW) does reassembly and would likely catch this. But for simpler stateless DPI, it works.

Good analogy with domain fronting. The key difference is exactly what you said: the server sees the real SNI, so no server-side cooperation needed.

Do you have any sandbox-like restrictions in place to ensure that commands are limited to only touching the project folder not any other places in the system?

> it won't do that. Claude is trained to be careful about this stuff and we've further prompted it to be careful.

Could you please explain a bit how you are sure about it?

I don't see any sandbox usage in the demo video.

Allowing LLMs to execute unrestricted commands without human review is risky and insecure.

Thank you! Yes, AFAIK There's no way to code the eBPF part in Go, so I used C without loops. Go part handles loading the eBPF and utilizing the maps. Btw, Rust hcan be used as eBPF code language since It was added to the Kernel.

I meant Transport Layer packages.

> https://github.com/CN-TU/machine-learning-in-ebpf

Thank you! I'll take a look.

It's written with Golang. You can check the source code at here: https://github.com/boratanrikulu/lirik.app

Lirik.app shows lyrics for currently playing song in your Spotify account. It's super simple to use, just login to see Lyrics. It's built by me, let me know about your thoughts.