# We Promised Decentralization, but Forgot to Build the Infrastructure | Shayan Eskandari - Channel: [Ethereum Cypherpunk Congress](https://streameth.org/ethereum-cypherpunk-congress) - Date: 2026-08-09 - Duration: 17:26 - Topics: web3, privacy, now, crypto, cryptography, blockchain, data, security, human right, rights, tech, technology, internet, open source, free, freedom, ethereum, hackers, ethics, cypherpunk, dev, developer, dapp, decentralization, bitcoin, computer, surveillance, cyber, peer2peer, p2p, love, solidity, zk, zero knowledge, education, academy, w3pn - Watch: https://streameth.org/watch/yt-bt9mLR6wOQs - YouTube: https://www.youtube.com/watch?v=bt9mLR6wOQs ## Description We Promised Decentralization, but Forgot to Build the Infrastructure Shayan Eskandari is a security researcher, hacker, educator, and internet freedom activist working at the intersection of blockchain technology, security, and digital rights. His PhD dissertation, Uncovering Blockchain Challenges: Technical Nuances and Their Unforeseen Consequences, maps the gap between blockchain's ambitious promises and its real-world implications; from cryptojacking and front-running attacks that exploit the protocol's foundational properties, to oracle trust failures and the regulatory blind spots that leave auditors unable to accurately understand cryptoassets. The central argument: the same properties that make blockchains powerful — permissionlessness, transparency, decentralization — are also the source of their most dangerous attack surfaces. He currently serves as a postdoctoral fellow at NOVA SBE's Data, Operations & Technology Knowledge Center, contributing to BLOCKCHAIN.PT, a Portuguese national initiative co-funded by PRR and NextGenerationEU. His career spans the full arc of Web3: blockchain engineer at Bitaccess during Bitcoin's early ATM era, security engineer at ConsenSys Diligence specializing in smart contract auditing, and CTO at Ether Capital, where he led one of the first publicly traded Ethereum staking operations (36,000 ETH). He co-founded IranUnchained, a Moloch v3-based NGO addressing the gap between crypto's borderless ideals and geopolitical exclusion. He is also co-founder of Shiryakhat and CoinIran Academy, educating Farsi-speaking communities on blockchain technology since 2015. His current obsession is MoaV — Mother of All VPNs (moav.sh). The ideology: internet freedom cannot depend on any single tool, protocol, or organization. It must be distributed infrastructure, built before the crisis, resilient enough that no state can shut it all down without breaking their own internet. One command turns a $10 VPS into a node running 16+ simultaneous circumvention protocols: DNS tunnels, obfuscated proxies, Psiphon relays and Tor bridges. Deployed by activists and diaspora communities keeping people connected when their governments decide they shouldn't be. Outside the terminal: analogue photography, film, multi exposures, and a camera collection that has clearly gotten out of hand. Shayan Eskandari: https://x.com/sbetamc Follow Web3Privacy Now: 🌐 https://new.web3privacy.info 𝕏 https://x.com/web3privacy 🦋 https://bsky.app/profile/web3privacy.info 📸 https://www.instagram.com/web3privacy_now/ 🎤 Neocypherpunk Summit: https://s26ber.web3privacy.info/ Subscribe for more talks on privacy, cryptography, digital rights, decentralized infrastructure, and the future of the open web. ## Transcript So, hello everyone. This talk is originally for 30 minutes, so I'm going to try to fit it in 15. Um, it's more about this mad scientist that I really like. Um, just a bit about myself. I'm a security researcher. I'm a hacker. human- centered technologist. Um, I did my PhD on blockchains, unforeseen consequences, everything about frontunning, Oracle failure, the dark side of permissionless. Uh, I did some security work on smart contracts, some infrastructure for staking. Uh but what matters here is I've been teaching Farsc speakers crypto tech and like cryptography since 2015 through coin Iron Academy and Shia podcast and also co-ounded Iran on chain a few years ago that we try to use crypto to um basically pass the geopolitical exclusion and my current obsession is just internet freedom and moth. So um I just want to say like the internet blackout is not a one-time thing. So Iran has been going on um going through the dark internet moments for like over two decades. Uh every time it gets longer, it gets harder. There are more people getting arrested and killed. Um and this is just a sample of like the big events that happened in the last two decades. And every time the governments learn how to do this better. Um this year um it's weird to say that Iran has been mostly offline in 2026 and um it started with some uh street protest uh around January 8th and 9th that um it was weird cuz this time everything was killed like even SMS phones like even the internet that the government used it was like all down and um the numbers are weird around 30 to 70,000 people were killed in the street um and there was an internet came back a bit but then 88 days of just inter internet went dark and um yeah it came back two weeks ago and interestingly it's routing through Azerbaijan uh which we're still figuring out how and why um but getting to the point is so before you say this is like a Iran's problem no it's not it's becoming a global uh trend um and now you see Nepal this is like a VPN uh demand on specific events uh Nepal Uganda, United Kingdom, um in Russia, they're not even banning VPN. They're starting to like dusting VPN um uh VPN infrastructure. And basically, if you look back, every one of these spikes is a population trying to uh flee to a free internet. It's almost like immigration in some sense. Um and it's just different flags, different countries, but same playbook. they just want to control the network to control the people and see what they know and what they can talk about online. Um I have this part of the talk that is about talks about why internet infrastructure and web 3 is inch enchitifying but I feel like this crowd already knows about that. So I'm not going to spend that much time on this but just to say that um with web 3 a lot of these started with cippher punk saying that we are defending our privacy with cryptography. They wanted to be able to have secure communications through borders without anyone knowing uh what they're talking about through emailer signatures and other things. And they were talking about um privacy, communication privacy. And what we have right now and we talk about now maybe is more about financial privacy in web three world. And one of the issues is uh basically the gist of this slide is financial privacy has a business business model. People can uh have tokens and make money out of it. But uh communication privacy for let's say someone in Tehran doesn't have a business model and that's one of the issues that we're seeing in the web three space and um around that and the part that I actually changed the title of this talk and I like the previous one more but now this is a topic that in web3 world we a lot of other um spaces we started focusing on the app layer the protocol layer and also the transport like ENS and others uh but we kind of forgot about the ISPs, the physical layer, the fiber. Um, it's not necessarily a technical problem, um, a technical failure. It's more a failure of imagination of who the adversary could be and what they're capable of. Um, and we're seeing here that if access or physical access is cut, then the whole thing is irre irrelevant. Um, and this is more about this personal story that I went through building Moab. And I want to tell you like why I built this. So, I'm Iranian diaspora. I've been teaching rep three tech stack for over a decade and when the blackout came it just was all worthless like I couldn't even message my family like they was not even blocked it was not even delivered and it took me a few like a week to be able to like get get back to myself and instead of like sitting in a corner and crying I was like I need to do something so I started rage coding and um it was not necessarily something I had hopes for I was just for my own sanity I was like, I need to do something. And I started grad coding this and I had almost no hope that it would work. I was like, there's this Chinese proxy that might work. There is this other Russian VPN that might work. So, let's just put them all together and see how that works. So, in January or February, um, basically shipped MOAB and people started using it and get through and it was working and I was so happy. And then around late February, there was a full internet shutdown. So, nothing got through anymore. There was silence in all the charts and I broke. I was like I failed again and I went for a walk for a few days and I came back and I looked at the charts and I was realized people from Myanmar, Russia, China, a lot of other people are even UK is still using these these servers. So I started like fixing bugs, adding protocols. Um and then later in May when internet in Iran started coming back I saw Iran's coming back to the charts and I was like those were they were power users I was building this for. So it made me a bit motivated again. And just before before I say like what this does and how this works. So I wanted to basically turn anyone into an arsenal of VPN protocols. And it wasn't necessarily an elegant solution. I just want the most redundant solution. And it wasn't necessarily about picking up the best protocol. I picked up all protocols, everything that is out there. Sorry. And uh basically the idea is more security the other way around is in the sense that like the sensor has to block all of them but we just need one to get through. Um and basically using like one command you can run all possible protocols that I know of. There are some on GitHub that I'm like integrating more. Uh about 16 protocols are getting there. And initially as a joke I named it mother of all VPNs but it became the thesis of it. Um and basically anyone any stranger with the expert VPS can become um the infrastructure and one of the issues that I had hard time explaining to people outside Iran was so when internet shutdown happened it's not like it's actually physically unplugged there there are people inside Iran started scanning internet it's similar to like you scan the universe for life people started scanning internet for getting some pings and sometimes times there were like some regions for some reason either mistake or infrastructure for the government like Azure North Africa was open so we can we had two problems one how how can we as outsiders get an IP address in that range which is a technical problem and is solvable uh but then you need to set up as many VPNs as you can and give people access so I wanted to spend no time setting up the VPN there's one command runs everything even starts donating bandwidth to um tour to snow to uh siphon um and I want to config to be handy and be able to like pass it to people. So you had only a few days for that server and IP addresses to work. So you just didn't want to waste any time. So this is one of the problems I built Moa for um and you have to be ready for that. And just to say this is not really um like slideware. Um so basically this blue box is MOAB like all those protocols there and the way it works is almost any VPN protocol any VPN apps that are out there MOAB has some config for config configuration for them. So there are some apps I wrote as a sample also siphon users and tour through snowflake they all can route through MOAB. So MOAB when you run the server you become part of the infrastructure for all these anti- censorship protocols and also it gives you this config file that is so easy to use. Um and by that what I mean is so that one command runs this. You have a TUI which enables you to do anything on the server. You get like admin dashboard. You can add um users, remove users and u donate configs and also a graphometric to see who's using your server if it's working or not. And thanks to AI coding my goal was to make it best UX ever, user experience ever for the operator and also user. So my goal was like you don't need to be technical to become this VPN provider and it was one command it just runs and it gives you this for users gives you this HTML file right now in Farscian English that explains every step and it's so easy to use that I hope even your grandma can use on your phone on her phone to get online um when she goes to Iran or Russia or some other places and um something I also I want to talk about the frontier and like the arms race that Iran and a lot of other countries are starting to block like obvious VPN traffic like um OpenVPN, WireGuard and then they learn and they block other proxies that look like proxies. So it's an arm race and it's it's interesting. They get really creative people there is that so when they start like um blocking servers they didn't want smart TVs to be outdated because they got hacked before to a smart TV. So they enabled update. Samsung come to be able to like pass through. So you could fake your traffic that is going through there but goes through Mo app and goes through the actual internet. Um there was some some of the Google infrastructure was open for a while and people started using the script of Google to like run Apple script to be used as a exit. Uh, one of my super favorite ones is ballet is one of the Iran's approved messaging app that's full of back doors but people started using it as using the web RTC video calls to route traffic and later on I found there is like a protozoa which is a academic paper that Russia and China also used this um a few years ago um and of course DNS tunnels uh we saw in Iranian developers that there's like a massive amount of new DNS tunnels out there and I was able to include four big ones that DNS TT a slipstream famous ones and also some new exotic ones all through MOAB. Um so basically one of the goals like like governments still need some infrastructure to run and we can hide our traffic there. So they build the pipelines and we just use that. Um so from here is the more what the state of everything uh the frontier and also what we can do. Uh I really want to be honest here because if you oversell any of these tech, people actually get hurt inside uh these uh black blackouts. Um there are a few really exotic approaches. People start using a GitHub um continuous integration to like commit um like do a git commit with a URL in the message and then the CI would download that file and reserve it in that git git repo. Um TCP or WhatsApp is it wasn't that useful in Iran and WhatsApp was also filtered. Um the feed I want to shout out to them because there was telegram over DNS. It's really slow but it worked. Um Neto is something I'm going to talk about next slide. So these are also something that was built by the people inside the blackouts and that's what researchers also call grassroot infrastructuring or survival work. Um we saw a lot of applications that people start sharing neighborhood uh sharing Starlink through their neighborhood of people that um they really need an internet. uh but it got really risky because you were using still the government infrastructure to share that traffic and a lot of people got arrested because of doing that. Uh I've seen some people trying to do power using power lines to do uh networking inside the building. I know it's not possible to go pass through transformers but can we try? Um and yeah so I'm going to like get to the next one is more um so this is another one. So that period of dark internet, there was the only way for people to communicate was to call from landline from inside Iran to a number outside and I was still building Moab and I wanted like them to try some of these VPNs. Um but I couldn't really read a JSON file over the phone to my um like wife's parents. Um so I rage coded another another software. It's basically uses the um voice to send data. It should be possible. It's really slow. It's around 20 bits bit by per second bit bits per second um on a noisy phone call, but still it gets to um it's using the same tech that NASA uses at Voyager from Interstellar to communicate. So it's the same tech um and it works. The only problem is like the cold start how to get that app inside Iran. But if they are able to do it even through npm, it just works fully offline. Um, and I would love to hear anyone using it and see how that works. But it works. It's really slow. It works. And it's also creates this weird noise. Um, this is kind of a state for the web 3. I want to take a stab at the web 3 and saying that like well, um, we still need crypto inside like especially that's really more useful inside Iran because they need to like in the blackouts to be able to buy things. And um it's really embarrassing right now that we don't really have a way to do offline transactions in most of the blockchains. Like Bitcoin has something um like um partially signed Bitcoin transaction. But let's say for EVM wallets, Ethereum wallets, you can't even build an offline transaction because you need the gas, you need the nuns, and let's say even you get through that, you can't even export a sign transaction out to be able to like pass it through um carrier pigeon or neog to um broadcast it. One of my askers is basically can we use any escrow or any way to do low off low value offline transactions? They're low risk and they save people today. Um I don't have that much time but like we have like pop-up cities. Why why don't we do pop-up mesh? Like if we have pop-up cities let's or this conference we should be able to run our own mesh do our own uh traffic and communication here and then after this conference they're all gone. Like we don't need to keep that those information. why don't we do this like we should and it enables people to like make this technology better get more familiar with it and be ready for something that happens to them if something happens to them um and know we don't have to like win we just have to make it more expensive for the governments to censor like at first they sensor through DNS we created DNS tunnels and DNS over HTTP they created the blocked IPs we route through that through proxies um I want to get this ask cuz this is like really important for me. So this one um basically you need to build first of all if you build a software that breaks in the crisis it was built for it's worse than no tool cuz people trusted it and we wanted to use it. So build for the people who gets cut cut off like first of all deploy mo tonight if you have a Raspberry Pi or VPS deploy it it by default it starts conduit snowflake so before you sleep someone behind this wall is going to breathe through your bandwidth uh build for the hard problems not just a DeFi thing offline payments mesh exa exotic routing like we need more of these and I'm glad that this crowd is like really doing that and find fund the gap also like there are so many projects that can use these funding also for the next hackathon put a prize up for something really crazy and a mesh and see if people would build it and they would um and yeah so it's kind of like a rent that we're paying on the free internet we have um and I think I'm out of time but like yeah become the infrastructure run it and be um what you want to see in this inter on this internet and those are my that's my website and Twitter please reach out I would be happy to talk more about this Yeah.