Gnosis VPN: What does it take to build a true web3 product?

All right, thanks for having me here. And yeah, so first of all, sorry for the ones who are coming for a talk. I'm not here for a talk, this is DAPCON. I want to show how we bring the D back into DAPS. I'm Sebastian, I'm VP Technology and Ethnosis, and I am the founder of Hopper.

And what these two things have to do with one another is something that I'm looking forward to talk to you about. So yeah, this is about Nusselt VPN, and if we're talking about how we bring the D back into DAPS, we realize that the D, first of all, stands for decentralization. But there's also this narrative that I really appreciate quite a lot at Vitalikorg recently of defensive accelerationism. In short, we have these wonders of the technologies that we all work on, but we want to roll that out to the planet in a safe fashion, being mindful that the greatness of the technologies that we all work on is also used by bad people and might have consequences. So one important thing for me is privacy or anonymity if we talk about data being sent around.

The most fundamental of those in all these peer-to-peer systems where data typically goes across the wire, right, all peers have to talk to other peers, and I talked last year here at DAPCON on what could go wrong in that, is, yeah, data transport. So I talk about Nusselt VPN, and I'm here today to show a new version of Nusselt VPN which is still a proof of concept, it's still pretty early, and yeah, this one is as of now available in what we call unrestricted proof of concept, so yeah, I'll dive right into that. Now yeah, vpn.nusselt.es, what is this all about?

Let's first look at what's happening behind the scenes. How do we claim to bring the insensible open internet in the most anonymous fashion? So Nusselt VPN is building on the Hopper Mixnet. What does that mean? On the right, we see an artistic representation of a mixnet which comprises of many nodes which send packets to one another, and as you have trouble kind of figuring out how these packets are being routed, that is exactly what we want to achieve, not just for you, but for powerful corporations and state-level actors that are trying to spy on us.

They're trying to undermine our digital interactions that we have on every single day, at every single second with every service that we interact with, and yeah, so what is happening is that we build a network which allows you to route packets that are being relayed by other peers in the network, and they're not just rerouting your packets, they're mixing it up in other traffic that looks indistinguishable from your packets, and on top of that, mixnet infrastructure which you can use for any sort of packet-routing application, we are now building a VPN that ultimately aims to be an application on your laptop or on your mobile that you can use just like a normal VPN, but it is the most anonymous fashion that you could access web 3 infrastructure. Now what do I mean with web 3 infrastructure exactly? And it seems to me that there's some clarification that's necessary, so first of all, it means to no user tracking of any kind. I thought, what a stupid thing to put on here, that's obvious, right? It seems to me that it's not always obvious, right?

We have to be respecting the privacy of the individual, and that starts there, and it continues with the technology we utilize, right? It means committing to not using a centralized RPC provider. Now that is tough. How many people here are running it up now, just quick check? Nice, wonderful.

Thank you for doing that. Thank you for supporting decentralized networks, right? We are mindful of the fact that this is hard, and we'll later on briefly talk about how we want to roll it out at larger scale for the ones who maybe still have friends who don't run a DAPNode at home. It also means for the folks who actually build DAPs here, not relying on centralized indexers because I think that is a disgrace. Relying on centralized infrastructure that you blindly trust is not what we set out to build here.

It also means beyond indexers, not any other APIs that you leak user metadata because there's always some provider which can capture data from your users that can be used against your Now, I heard from DAPN developers, I don't care. Well, the user does care. The user does care, and there's laws and regulations increasingly in place to try to protect the users in case the developer doesn't care. Now, let's take a step back here, and as developers, try to improve that. Now, that all sounds painful.

I know, right? I know that we want to build fast, we want to ship products, and we want to get there ASAP. And, I argue that it is possible. It is possible to build these applications, and what I'm showing here, although it's a proof of concept, tries to give the first glimpse of how they can actually be rolled out. So, briefly, what we'll be looking at is shown here on the right-hand side of this screen.

We have OnYourUserDevice, and those are VPN clients. Currently, that's a command line application, but again, this is DAPN, so I hope you're fine counting that as a DAPN. And currently, this comes with an entry node to this hopper mixnet. That's what I showed before, this packet mixing infrastructure that you gain access to that routes and reroutes your data packets towards the NoSysVPN exit node that gives you the actual access to the internet, fetches information from a web server, and sends it back through this mixnet to your NoSysVPN client that is locally running on your machine. So, yeah.

So, how does this look like, and how does this work? Well, I would say, let's see. This is an actual live demo, and I hope that it works, despite the hardships of trying to build a Web3 product. All right. So, currently, there's an onboarding on GitHub, and the first thing that I'll skip over, just because of shortness of time, is you need access to a hopper node.

I have access to my hopper node here. That's one of these nodes you saw in the animation that is kind of relaying packets to all sorts of people. That's the web interface that it exposes to me, and, yeah, we don't need to understand what it does. It has a bunch of hopper tokens, it has a safe, because every hopper node is a safe. By the way, great infrastructure to build with.

And this is the entry node that I will connect to to route my traffic to the internet. All right. So, I have that one. That's good. Now, let's see what we need to do.

What we need to do is, you can do this, all of this is publicly available, so for the ones who want to play along, vpn.gnosis.eth.limo is the starting point. So, what I'm going to do here now is, yeah, I will just run this installer.

So, I'm downloading a binary, which is installing gnosis-vpn binaries. And this one is basically asking me for a connection to my hopper node. So, remember, in the animation I showed you before, this needs to get access to the packet mixing infrastructure, so I'm going to give it to it. It requires a port for me to connect to, and, yeah, it will now download the binaries that are required to run this. So, we have two binaries here.

One is the VPN, and the other one is some controller interface. Controller for the ones here that are using VPNs allows you to say which server do you want to use. Do you want to be in Germany? Do you want to be in Spain? Do you want to be in the US or wherever you want to be?

Who here is using a VPN, by the way? Any casual VPN users in the room? Cool. All right. I hope to convert you all towards gnosis-vpn later on this year once this maybe becomes less painful, or for the ones who have higher pain thresholds, you can try it out right now.

All right. So, let's see what's going on here. This one created a folder for me called gnosis-vpn. So, I'll go there, and first of all, I'll start the VPN app. It's basically what it's telling me up here, right?

So, I'm just going to start the gnosis-vpn app, and I'll pass it a config file. So, that config file currently tells it which exit nodes are around, and yeah, it starts doing that. It doesn't do much yet. The second thing that we will now start is we have this config app, right? So, we have this gnosis-vpn control app, and that's what's used to configure my VPN so we can ask it for status.

So, my gnosis-vpn app, it currently tells me, okay, the connection is down. I'm not connected to anything, but I know of a few exit peers. And the first thing you see already is these are not DNS names, these are not IP addresses, these are Hopper peer IDs, yeah? So, these are kind of nodes in this Hopper peer-to-peer network that I can't connect to through my Hopper nodes, and therefore, I'm not connected to any kind of centralized infrastructure like DNS, you know, or any other services. It's all trying to be reliant on information that I have available locally.

All right, so, let's initiate a connection. So, let's tell it to, you see the commands that this dev here has available, gnosis-vpn connect, and I will connect to Germany. So, I copy this peer ID. If you find this command line interface a little bit cringe, yes, there will be a UI. We had a team last weekend at the Web 3.

0 Hackathon already working on some, but I'll stick to command line because I know how that works by now. All right, so, I'm connecting to a peer. Let's see what our actual VPN app is doing. It's, yeah, it's setting up a VPN connection from my entry node via some intermediate mix nodes. So, currently, I've selected only one mix node towards this exit node that I've chosen here.

What you might have seen is that up here there was a VPN icon popping up, and it's because this client application established a wire guard connection, and I have the VPN running. Currently, I'm not using it yet, so if I check out my IP address here, I see, you know, this IP address. Interestingly, kind of funny, like this venue here is its own IFP, so I see what I'm connected to. Now, let's go ahead and let's set up a proxy to use the actual VPN. So, I'm using this in Firefox.

I'm configuring the proxy, and let's see if it works. I'm trying to get my IP address again, okay, so something went down here. Currently, it's trying to re-establish a new session, probably is going to take a few seconds before it re-establishes. Second, it seems that works, so I took a few seconds longer, and indeed, we see I'm currently connected to Frankfurt. So, I established a VPN connection through this underlying mixnet, exposed it as a proxy into my browser, and I'm connected to the VPN.

I'm just going to open them side by side, so if something breaks or some of the notes in between goes down, I can see what's going on. Okay, now, this is a VPN, and, you know, there's maybe some performance issues, but let's see what we can actually do. Like, can we use this early POC version already for something? So, I'm going to try to open, you know, something like Twitter, and, yeah, we'll see if this one can actually be used to route traffic. Well, and the answer is, right now, we can't really.

So, what I'm going to do is I'm going to connect to another server, so I'm going to connect to Spain. Okay, let's see how that one is going, Spain, that's an entry node. So, you'll see that my VPN connection dropped off here, and my VPN client tries to establish a new connection, and, yeah, it seems the session got opened. I have a WireGuard connection open here, and, yeah, awesome, okay, it seems that we were loading part of the video of this live stream here, let me reload that, yeah, okay, awesome, it seems we have a live stream running here, there's a bit of a lag, but, yeah, so, that's the unrestricted POC of NoseVPN. Thank you.

Yeah, I'm kind of happy that this worked, it's a bit meta, connected now to Hopper via NoseVPN. Okay, what did I want to talk about? Let's get back to this one here. By the way, this page now, again, very meta, is being loaded through NoseVPN, see if that works, yeah, cool. All right, where was I?

I showed you the demo, now, what is going on here? How does this compare to your existing VPN and other VPNs? So, we have something that's rooted to this mixnet and this multi-hop architecture, which makes it surveillance-resistant, so if there's anyone who tries to spy on you, yeah, they're going to have a way harder time. I'm not saying it's impossible, but I'm saying it's way harder, and how does it compare to a VPN? So, quick recap for the ones who just use a VPN without wondering what it actually does, you run your traffic from your node via somebody else's server to the wider internet.

Okay, that's not great, you just trust somebody else's server. With Tor, you basically do the same thing, but there's kind of three servers in between, and you trust that the first and the last are not colluding. In case of NoseVPN utilizing Hopper, we trust that just one mixnode along the path is honest. Now, something that we're excited about coming soon is kind of unblockable exits that you cannot find and cannot get in touch with, as well as residential IPs. So, currently, this is operated by Nose's exit nodes.

We want to enable all of you to run exits if you choose so, and if you want to earn tokens for doing so, of course, to judge if you want to expose your home IP address for other people to use and earn money with that, if you want to do that, it will be available soon. And, yeah, so some of the things that I'm excited about going soon, and just to spend a few minutes on what's coming next and why this is not really a fully-fledged application that at least most of your friends can use, is, well, you need a separate Hopper node, right? This interface that I showed you, that's not exactly useful if you want to install an app and have to set up a safe, bridge money over to Nose's chain and grab Hopper token to WX Hopper token and so on. There's a bunch of work there. But what we're working towards is have what we call edge nodes, which are running inside your device, which are not used for packet mixing of other people's traffic, but which are used to integrate the direct access to the Hopper network in one application that you can install.

That leads over to the second point of kind of streamlined UX for the whole thing. And finally, for the people who are interested in more of the cryptography behind it, I invite you to look at this. We have some RFC on that, on this anonymous return path, which is actually super cool. You can connect to an exit server and say, hey, give me this website, like x.com.

And the server responds something, but they don't know who you are. This sounds kind of weird, right? You're getting something back, but they don't know where they sent it to. So you can imagine it like you give somebody an envelope and it has a return envelope in it where they pack a payload in, send it back, they have no idea where it's actually going until it comes to you, and with the next request you do the same thing. So something that will be available very soon.

And just to give some glimpse of why we're not there yet, but that will be available soon. And, yeah, lastly, GnosisVPN is, as mentioned, running on top of the Hopper Mixnet. The Hopper Mixnet is relying on settlement infrastructure called GnosisChain. Why GnosisChain, actually? We started this, we looked at a whole bunch of chains, and what properties do we want?

We want something that's actually very resilient. So like, you know, base and all of the other kind of centralized L2s are obviously out of the picture because VPN and anonymity infrastructure is something that many people don't like. And when you go, when you can go to, you know, Coinbase and say, hey guys, you're not allowed to do that anymore, otherwise we ban you from our next military parade, that's not great. That's not great for actual resilience infrastructure that makes the Web3 for me. So GnosisChain is a very decentralized chain that is also, you know, at least currently not heavily used.

That makes it kind of convenient for us. So we have predicted gas prices and so on. That's great. I did mention already every Hopper node is a safe, or more specifically, it's connected to a safe to separate your operational concerns, you know, like the DevOps fiddling from the finance. You know, finance is like, okay, I want to manage money and I want to manage the risk and access to money.

And safe is basically that what we use to separate these two areas of concerns. And finally, the underlying transport that we leverage is LibP2P and infrastructure is used in the space by most Ethereum nodes and those chain nodes as well as IPFS. And yeah, this work has been supported by GnosisDAO, GIP98 and 122 that enable that. You will see another GIP coming soon. And we're setting up a new entity that is offering this product.

And this new company will belong 100% to GnosisDAO in a commitment to build this in the open. Obviously, all of that is free in open source software and under ownership of GnosisDAO. Yes. So with that, I would like to close here. I invite you to check it out.

Again, vpn.gnosis.is. If you still need a centralized resolver, that's .limo.

And yeah, with that, I will close here and I'm open for some questions. Thank you very much for the talk. My question is, you said no user tracking of any kind. And my question is how we balance this idea, which of course I think everyone that's in this room today agrees with full decentralization, with the need of security, for example. I think that as much as we agree with decentralization, we still want to have our kids protected of sexual abuse or of a terrorist attack that is being coordinated through a fully decentralized and untrackable VPN.

Yeah. At Hopper and at Gnosis, we believe that bad things happen in the world and we do not want to support it. Right. And it is indeed challenging to balance these two. So we will for the Gnosis VPN, which you can run on your dapp node, and that's what's happening right now.

If you try to access some bad stuff on the internet, it will not be available. So the exits are, you know, censoring bad things and that's already implemented right now to protect people and also to protect node runners. Because frankly, what's happening here is you're exposing your home IP address to anybody out there. There are obvious issues with that. So we give you the tools to censor whatever is legal in your place.

Beyond that, I mean, I see actually, I mean, again, I think that it's an issue and we give people the tools to protect themselves and protect the network. I am more concerned about the marketing side of the story because marketing and growth people typically want to know what's the user profile, right? And yeah, I mean, I think we have to just not cut corners and, you know, engage with our user audience to try to understand it instead of tracking all. Like tracking all is a sledgehammer that always works and you can use it for everything. Tracking is fantastic.

I say user tracking is a low effort way of getting what you actually want to get because you don't care about all the tracking. What you care typically about is understanding user behavior and I claim that is doable in other ways than just full-on tracking. Any other questions? What do you think the throughput for the HopperNet might be? How many users can be connected with reasonable speed?

Yeah, great question. So first of all, it is going to be slower than what you have today, right? So, okay, I am going to push it a bit, but I will try it anyway. So, let's see. So, this is actually going through like three Hopper nodes and it seems that I can get to around one megabit per second.

Okay, we are getting a bit more. Like that's enough for HD video streaming. Maybe it's not yet enough for 4K, but you can get speed. Again, this is a POC. I think this can be improved over time.

Now, that is on one user to answer your question, right? So, that's what I get. And the second part of the question is kind of what does the network provide? So, first some property that is very cool. We talk a lot about scalability, right?

And Jordi just had like a very wonderful contribution to Ethereum scalability, which is very tricky. These networks like Hopper network scales really nicely, which is perfectly horizontal. If you want more network bandwidth, you just need more nodes. And currently, we have in the network, let's see, around 300 to 400 nodes, which, yeah, I mean, currently this is actually more limited. Like in the nodes, you are limited more by the user device because your user device is what creates the packets.

So, you see here, we have around 300, 400 nodes online right now. This one, since you're bounded more by the compute load on your entry node, which does path selection, packet creation, and return packet creation, actually, it should scale well also with the number of exits. I can't give you exact numbers, but I am pretty sure that the first couple of thousand users, we are fine with a relatively small network of a few hundred mixed nodes. But again, I also think that this is, Web3 is actually kind of cool for that because as you have more usage of that, the return of currently like you earn around 10% APR for running a node and relaying traffic, that will go up, right? It's not just, this is not an investment sort of thing, right?

You don't put in money to earn more money. This is your relaying traffic and for that you earn. And if you relay more because there's more organic users that pay for this, you'll earn more and that's why I'm kind of hopeful that this will kind of always find its own balance. Can we all please have it on?