📦 Censorship-resistant config distribution — steganography, bot, QR codes

[sepehrsadri]

Problem

If our Telegram channels or subscription URLs get blocked/discovered, users have no way to receive VPN configs. We need censorship-resistant distribution.

Ideas

A. Steganography Tool

Encode subscription URLs inside innocent-looking images shared on Instagram/Telegram/WhatsApp.

• User receives image → opens in companion app → extracts config
• Undetectable by content filters

B. Telegram Bot with Dead-Drop Architecture

• Bot DMs configs directly to authenticated users
• If bot gets banned, spin up new bot automatically
• Bot token rotation + user auth via shared secret

C. Domain Fronting / CDN Relay

• Host configs on legitimate-looking websites
• Use CDN to proxy requests (already partially doing this)

D. QR Code Distribution

• Print QR codes physically (stickers, flyers)
• QR code → subscription URL → Hiddify imports configs
• Works offline, immune to digital censorship

E. DNS-Based Config Distribution

• Encode config URLs in DNS TXT records
• User queries a specific domain → gets config
• DNS is hard to fully block

Action Items

• Build steganography encoder/decoder (Python script: URL → image → URL)
• Set up Telegram bot for config distribution
• Design QR code generation pipeline
• Test DNS TXT record config delivery
• Document distribution fallback playbook for users