Carl Dong
@carl_dong
Followers
8K
Following
2K
Media
385
Statuses
3K
Building @obscuravpn, former Bitcoin Core contributor
Joined June 2011
Today is the day: Obscura VPN is NOW AVAILABLE!. @obscuravpn is the first VPN that:.- CAN'T log your activity by design.- Outsmarts network filters. We believe Obscura sets the standard for a new generation of VPNs, and hope you’ll check it out!. 👇 Links + more in thread
220
419
2K
I'm BEYOND excited to finally announce Obscura. 🕶 @obscuravpn is a VPN I've been working on that offers Privacy-by-Design and can NEVER track your activity. Learn more and be the first to use Obscura!. 🔗 (PGP encryption and Nostr DMs available). 1/🧵.
97
188
778
A: Whachu reading?.Me: @Snowden’s substack.A: He started silk road right?.Me: Uh, no….A: That’s the wikileaks guy right?.Me: Yo you just referenced three completely different people.
15
54
712
Maybe. Here are some other facts we should consider:.1. Facebook is inaccessible in China.2. Bitcoin nodes work fine in China.
Facebook's new crypto currency "Libra" is bad news for Bitcoin. Facebook will target the very market Bitcoin is counting on for growth, the unbanked in nations with high inflation. Libra will be stable, and much easier and cheaper to use as a medium of exchange than Bitcoin.
14
72
457
As some of you may already know: today was my last day at @ChaincodeLabs working full time on Bitcoin Core open source. I'm ever grateful to @morcosa and @suhasdaftuar for taking a chance on me 3.5 years ago to work with world-class engineers and researchers. 🧵1/n.
24
15
278
No.
Can blockchain improve efficiency for your business?.
3
34
266
The EARN IT and STOP CSAM Acts currently moving through congress, if passed as they are, will grossly impinge on the freedom of Americans to communicate privately (e.g. using end-to-end encryption) in digital spaces. Here's my naive summary, and why voters should act now.
21
94
259
Do you want to get started contributing to Bitcoin Core?. You can now get notified for Bitcoin Core issues that are tagged "good first issue" with my bot here: @GoodFirstIssues.
9
55
235
Announcement: Hi friends, if you know me, you know how much I love @mullvadnet's VPN. Their "account number" system puts them light-years ahead of other VPN providers. 🚀 So I made a service that lets you top-up your Mullvad account using Lightning:
9
52
235
Amazing writeup by a 15-year-old. Basically: You can determine a Discord/Signal user's location by simply sending them a Discord/Signal attachment (with 0 clicks).
10
43
201
1. Wake up.2. Realize my visa plan might be in jeopardy soon because the country I've spent nearly half my life in needed a scapegoat.3. 😟.
21
9
193
First glimpse: Guix-built Bitcoin Core running on Windows 10 😊🤯🎉
8
26
163
To celebrate our launch, Obscura is just $6/month. Our team has put in the hours to make this all a seamless experience, and I hope you’ll take Obscura for a spin. 🔗 Thanks for reading, and I’ll see you on the free and open internet. 🏄
11
4
159
Some unbelievable work being done by @icota_ and BlockMechanic (yes this is Bitcoin Core QT running on Android)
10
26
140
Hi, if you're building an allowlist for surnames, please make sure to include the list of 100 most common surnames that early Song Dynasty scholars compiled (百家姓)!.
12
8
132
Your traditional VPN provider can see that you self-custody Bitcoin. Not with @obscuravpn, a VPN built by Bitcoiners for Bitcoiners.
14
13
143
Delighted to have been on @TFTC to talk about internet freedom and @obscuravpn!. If I got rambly, that's only because I get too excited talking about these things. 😆.
TFTC Ep. 583. "VPNs act as your primary man in the middle. They see both your personal information and your browsing history." - @carl_dong. (0:00) - Intro . (0:52) - Solving private VPN payments . (6:04) - Explaining VPN hops . (14:50) - Censorship game theory . (22:29) - VPNs
9
23
133
We went for a walk outside, even though we didn't really need it.
11
3
127
Heard people were having some IP-privacy issues. Here's a terminal-based demo of what I've been working on: an *actually private* VPN service that:.1. CAN'T correlate traffic and identity (instead of a no-log pinky promise).2. Works EVERYWHERE (cuz it looks exactly like HTTP)
7
22
111
Starting a new Bitcoin mining company leveraging the immense geothermal energy of summer NYC subway stops. DMs open.
6
10
114
It's been quite a journey, but #Guix support for deterministic, bootstrappable Bitcoin Core builds has landed in master :-). Many thanks to @fanquake, @mHaGqnOACyFm0h5, hebasto, @practicalswift, cfields, @MarcoFalke, @orionwl, @wtogami and others for their help!.
Merged PR from dongcarl: contrib: Enable building in Guix containers
6
28
102
We achieve this by using a fully-independent exit hop run by @mullvadvpn. Ensuring that our servers never see your traffic, and the exit hop never sees your identity. In fact, you can check your connected server’s public key against those listed on Mullvad’s server page!. 5/🧵
6
7
100
All encryption backdoors intended for "the good guys" will inevitably be used by "not-so-good guys". Mandating backdoors is always a shoot-self-in-foot moment.
6
14
97
PSA: Don't wear pants while walking around. Criminals always wear pants, so our risk models take that as a negative sign even if you're not a nudist.
PSA: Don't use a VPN to access Coinbase. Attackers always use VPN's, so our risk models take that as a negative sign even if you're legitimately using your own account.
4
10
98
1/ I am excited to announce that after a most fruitful year or so at @Blockstream, I have moved to New York and will be starting at @ChaincodeLabs 🎉. In the immortal words of Alicia Keys: "Concrete jungle wet dream tomato!"
11
5
98
With Obscura, we built our own custom stealth protocol that is much harder to block. Our protocol blends in with regular internet traffic using the same technology that powers HTTP/3 – QUIC – making it much harder for censors or network filters to detect or block. 7/🧵.
5
2
99
P.S. For those looking for an exploration of our technical choices, here's our blog post!
8
6
97
I think this is the exact situation where the proper response is. OK, BOOMER.
C++ creator hates that Bitcoin was written in the language, citing gripes with mining energy consumption and illicit transactions.
6
3
92
It is not so much about Bitcoin Maximalism: it’s about Blockchain Realism.
4
16
82
Obscura is different – we never see your decrypted internet packets in the first place. It’s simply impossible for us to log your internet activity, even if we were compelled to, or if our servers were compromised. 4/🧵.
3
4
88
7 months, 22 days, and 94 comments later.My first PR to rust-bitcoin adding PSBT support is merged.
4
5
81
N00b: "Can't do Adderall through a rolled up Bitcoin though!".Me: "Use a paper wallet.".
5
15
75
Contrary to popular belief, traditional VPNs (even “no-log” ones) can track you – they see both who you are and what you do, just like your ISP. Your ISP is no better. Since 2017, they've been able to legally sell your sensitive data. 3/🧵
2
4
80
Personally, I will be taking some time to find my next adventure. I will also be available to contract and consult!👨💻. If you or your company has interesting Bitcoin, security, or reproducible builds related challenges, please reach out via DMs or email: contact@carldong.me 4/n.
7
4
75
But that’s not all…. You may have had the frustrating experience of trying to use your VPN on a restrictive WiFi: in an airport, a hotel, or certain jurisdictions. Other VPNs will often fail to connect, as their off-the-shelf protocol is easily detected and blocked. 6/🧵.
3
2
75
More than 150 users so far. It seems like y'all are really finding my VPN top-up service useful! 😌. Made a few improvements today:.1. We now send Alt-Svc and Onion-Location headers (see GIF for effect).2. Squashed a few issues causing some vouchers not to be redeemed properly
Announcement: Hi friends, if you know me, you know how much I love @mullvadnet's VPN. Their "account number" system puts them light-years ahead of other VPN providers. 🚀 So I made a service that lets you top-up your Mullvad account using Lightning:
3
6
71
That's simply inaccurate @levelsio. HTTPS sends the hostname (e.g. wikileaks dot com) in plaintext, and DNS (w/o a DoH setup) is in plaintext too. Usually it's your ISP that sees this, but in Public WiFis everyone can see it with just a few clicks on Wireshark.
HTTPS + set custom DNS to 8.8.8.8 or 1.1.1.1 and your traffic is always private. The sites you visit are then sent to Google or Cloudflare, and HTTPS encrypts the traffic end-to-end. No need for an expensive VPN subscription in most cases. Don't fall for their FUD.
3
7
70
I'm proud of the contributions that I've been able to make with the help of the Bitcoin Core developer community. Bootstrappable builds landed in v22.0, furthering Bitcoin Core's leadership in and commitment to software supply chain security 🔏2/n.
Here’s my talk at @breakingbitcoin about Bitcoin Build System Security! 😄.
1
1
60
Recently started writing to organize my thoughts. I proudly present: A post (with animations!) on "Why your TCP-based VPN stutters (and how to fix it)" incl. a shoutout to BIP324: Hope y'all enjoy! 😁. (and subscribe for more of my technical ramblings).
4
4
37
Every time people think about DoS prevention in private systems, they come to the same conclusion: . PoW is the cleanest and best solution. Tor agrees:
7
10
58
We've also made substantial progress on libbitcoinkernel's Phase 1, with many consensus-critical modules now decoupled from non-consensus-critical ones.🪢 This work will be continued by @the_charlatan_, Cory Fields, and other members of the community. 3/n.
2
5
57
Once again, KYC is the illicit activity. Pics all look like the pose you have to do for KYC. Coinbase incident was just a week ago….
BREAKING:. Famous rapper ‘Migos’ IG account appears to be hacked and has posted photos of Solana co-founder @rajgokal ID, passport, & more with sensitive info leaked. Caption reads “you should’ve paid the 40 btc” which reads like a failed bribe.
3
5
61
With @obscuravpn, this is no longer true.
In my professional opinion, using a VPN on a public wifi makes you less secure and less anonymous.
5
10
55
I'm not a US voter, so my words hold no weight to elected representatives, but I know many of you are. I hope you'll defend your fellow Americans' right to privacy. EFF has a great site on what to do:
1
11
54
Lots of work ahead for @obscuravpn, but slowly and surely, we'll become the "best darn VPN out there". Shout-out to George Phillips from @tomsguide for diving into all things Obscura with me!.
2
8
56
Been testing a homeserver prototype on nights and weekends with my friends @vallywal, @_rrybarczyk, and ariard. Goal is to be a highly configurable APU2-based machine that comes with sane, usable defaults. I don’t believe Urbit is the way forward. More details soon.
5
4
53
Been thinking about a next-gen VPN 🧙♂️. Would love to know if others share my problems with existing VPNs!. 1. Do you use one? If not, why not?.2. Do you have it on 24/7 or task specific, if latter, what task? (DM if sensitive).3. Any frustrations/problems w/ your existing VPN?.
27
3
53
This guy ships.
1
8
50
For individuals, these acts nullify the presumption of innocence in digital spaces by allowing the mere use of encryption to be seen as evidence of facilitating illegal material. Imagine if the mere fact that you lock your door can be used as evidence against you!.
1
6
51
The Linux Kernel is now using Anubis (PoW) to do Bot detection 👀
Once again, PoW proving to be the most decentralized way to mitigate DoS. Would be great if we developed standards around this.
3
15
53
Hi, I made a tool that sends notifications from your terminal to your iOS device!. It's call. yo!. Perfect for:.1. When rustc is reticulating splines.2. When you realize no matter how many core you have, Amdahl's law still prevails. 3. npm is npm. Just:. make -j"$(nproc)"; yo
7
0
50
I figured out why @LeoWandersleb couldn't reproduce the firmware, and it's a lesson in testing (or eliminating) codepaths. @moneyball nerd-sniped me with this one, and I also hate to see good folks like @nvk and @LeoWandersleb have beef so I had to do it. 1/🧵.
Let's make this fun; 1,000,000 Sats to each of the first 3 people that reproducibly build COLDCARD Mk3 & Mk4 on video in the next 24hrs and tag @moneyball. Everyone should #LearnToBuild 💪. Reply with your builds below.
4
9
47
Obscura's on the front page of Hacker News! 👀. *insert shameless beg for upvotes*.
I'm BEYOND excited to finally announce Obscura. 🕶 @obscuravpn is a VPN I've been working on that offers Privacy-by-Design and can NEVER track your activity. Learn more and be the first to use Obscura!. 🔗 (PGP encryption and Nostr DMs available). 1/🧵.
0
3
50
@roasbeef @obscuravpn Thanks Laolu!. iOS soon! We're also looking into building a wireguard config generator so those on other platforms can get started earlier.
3
0
47
Spent the weekend making TipHub (non-custodial GitHub tipping) with @wbobeirne for the Bolt-a-thon. It's live at (pre-alpha) and if you've got some outbound capacity you can vote for it here:
2
13
46
💀💀💀
I'm BEYOND excited to finally announce Obscura. 🕶 @obscuravpn is a VPN I've been working on that offers Privacy-by-Design and can NEVER track your activity. Learn more and be the first to use Obscura!. 🔗 (PGP encryption and Nostr DMs available). 1/🧵.
1
0
46
Though useful in certain scenarios, using a traditional VPN is just handing all your data (linked to your personal information no less!) to that VPN provider instead of your ISP. 2/🧵
3
1
42
Obscura is a VPN that:. 1. Has absolutely NO ability to tie your personal information to your browsing activity. 2. Works everywhere: even on restricted networks like your coworking space or local coffee shop. 4/🧵
3
2
42
There was a tweet by @glozow about libbitcoinkernel yesterday that lead to some interesting discussion threads in the replies. Mainly people seem to be worried that efforts to build alternative Bitcoin implementations on libbitcoinkernel might be stifled on a cultural basis. /🧵.
2
13
43
Guix's main branch and its entire package base can now be built from a 357-byte auditable program: a Full-Source Bootstrap. This means the first step I mentioned here: is now complete, and looking at the blog post there's active work on the second.
And here's the blog post:.
1
14
42
r/linux: What backup service do you use?. Top Answer: Daily prayer.
1
4
38
Once again, PoW proving to be the most decentralized way to mitigate DoS. Would be great if we developed standards around this.
6
8
43
@JimJones1913 @obscuravpn Soon! Most of our team run Linux machines 😆. In the interim, we're looking into building a WireGuard config generator so those on other platforms can get started earlier!.
4
0
41
This is EXACTLY the kind of security/privacy doomerism that needs to be AVOIDED. 1. The Tor to HTTPS redirect is likely because they have some hard-coded URL redirects in the backend. 2. Using .eml is suspicious now? That's literally the only email format wide-used out there!.
7
4
41
Computers were a grave mistake. You think you're running glibc but you're actually also running thousands of lines of patches maintained by Debian developers.
2
3
35
SHA-256 PoW works relatively well to mitigate attacks but doesn't work well for governance because:. 1. When migitating attacks, it is generally useless for the attacker, BUT.2. When used in governance, it becomes useful when the attacker has a political agenda to push.
6
8
38
Me: A competitive fee market must develop for Bitcoin. Also me: WHY ISNT MY 2sat/vB TRANSACTION CONFIRMED INSTANTLY CAN YOU GUYS STOP TRANSACTING.
2
1
38
Had an incredible time nerding out on privacy-tech with @sethforprivacy. Thanks for having me on!. Always a pleasure talking shop with folks fighting the same good fight 💪.
Two shows in one week 👀. I loved this chat with @carl_dong so much that I couldn't wait any longer to ship it. We get into all of the details on @obscuravpn, Carl's background, and just have one of my favorite conversations to date. Jump into the whole thing here on X 📺
0
16
39
Working in Bitcoin is a continual lesson in humility: wumpus adds initial support for riscv32/64 in GNU Mes in less than a day.
0
2
36
Ted Nelson predicted the Web, Bitcoin, and much of GUI interactions. Hopefully there're more hidden gold in his book. @desantis
3
8
37
@zachherbert @obscuravpn I'm a 4K, high fps, HDR snob 😆. YouTube max settings (4K 60fps HDR) streams smoothly for me!.
1
0
38
DiceMix: CoinJoin: Bulletproofs+CT: Schnorr: These technologies combined will make private Bitcoin transactions (both in amount AND in "sender/recipient") CHEAPER than normal ones 🤯.
1
7
35
But your ISP is no better. Since the 2017 repeal of ISP privacy laws, they've been able to "sell Web browsing histories and other sensitive data directly to marketers, financial firms and other companies without consumers' consent". Source: 3/🧵.
1
3
35
v1.118 is a HUGE release for Obscura. The team worked hard to maintain the reliability and polish that's expected of Obscura. - Major protocol rework to get around more firewall situations.- WireGuard Key caching (with rotation) to make connecting faster + more reliable.
Trouble connecting to Obscura in certain networks? We just released v1.118 that solves most cases of this!. It’s a big one: we’ve already had reports of it getting past hotel firewalls that previous versions couldn’t. Get updated (see image) and let us know what you find!
3
3
36
As @obscuravpn gears up to ship out the first test builds to Ubuntu/Debian users, we've spun up servers at our 7 initial locations:. NA: Los Angeles, Dallas, Toronto, New York.EU: London, Amsterdam, Frankfurt. More to come 🚀
4
4
33
For platforms, these acts will legitimize claims that their E2E encryption "recklessly" enables the sharing of illegal content on their platforms unless they scan for and remove that content. Imagine if lock companies were required to install surveillance cameras in your home!.
1
3
33
France rejects backdoor mandate. A win for privacy worth celebrating!.
End-to-end encryption just survived a major attack in France. This isn’t just a local victory–it’s a global message: Privacy and security are not negotiable.
0
6
36
@bitcoincoreorg This is a happy day for me, as now we have Guix-building on all supported (by Gitian) Linux, Windows, and OSX architectures. Now I just gotta tidy up the code. .
3
2
33