Over the past 48 hours, the focus has been on connection and device security. The main topic was how filtering systems can recognize VPN traffic even when encrypted. Authors explain what DPI sees: IP addresses, ports, packet sizes, timings, and flow behavior. Encryption protects content but does not hide connection characteristics. It is also explained that VLESS, XHTTP, and REALITY are not three protocols but different layers of one architecture: VLESS is protocol logic, XHTTP is transport, REALITY is transport security. This is important to avoid false assumptions about invulnerability.
Another important topic is the Ministry of Digital certificates. Many Russian sites are switching to them, causing problems for users. Installing the Ministry's root certificates creates a risk of man-in-the-middle attacks, as the regulator can issue certificates for any domain. The author suggests restricting the certificate to national domains (.ru, .su, .рф) using nameConstraints to reduce risks.
Smart home security was also discussed: recommendations for segmenting IoT devices, changing passwords, disabling unnecessary features (WPS, UPnP), and regular updates. There was also a mention of a WireGuard issue where AllowedIPs for a peer can be overwritten when adding a new peer with the same prefix, leading to traffic loss.
Additionally, there were news about Microsoft outages (GitHub, Copilot, Teams) and telecom operator reports. Overall, the period was rich in materials on network security and service availability.