b0569c92d8
Before 0.1.8, a BNS name with an on-chain `ip` record made the daemon return the origin's public IP directly. Browsers then hit the origin's own HTTPS server -- and if that origin's cert was not browser-trusted (which is the whole point of the on-chain `tls` fingerprint pin next to the `ip` record), every browser except Theseus rejected the site with ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. game.x and hephaestus.x both hit this. Theseus was fine because its in-process resolver validates against the on-chain pin. 0.1.8 answers DNS with 127.0.0.1 whenever the name has BOTH `ip` and `tls`, terminates the browser's TLS locally with our trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin. Same algorithm Theseus uses (main.js:pinnedHttpsGet, cert.fingerprint256 lower-cased, colons stripped) so a site's `tls` record means the same thing in-Theseus and system-wide. Names with just `ip` (no pin) keep direct routing -- unchanged. Only opts in when the owner has published a fingerprint pin, so nothing regresses for sites that deliberately wanted direct IP routing. Two subtle bugs found + fixed while landing this: 1. `agent: false` on the outbound https.request. With Node's default global agent (keepAlive on), the second request onwards reuses the TLS socket and `res.socket.getPeerCertificate(false)` comes back stripped of fingerprint256 -- pin validation then reads "empty" and rejects with 526. Fresh socket per request costs a handshake but is cheap next to the pin-verify miss. 2. Removed `content-encoding` from the hop-by-hop strip list. Origin sends gzip'd bytes; my proxy streams them unchanged. If we strip content-encoding while forwarding compressed bytes, the browser treats the gzip magic as text and renders garbage. content-encoding is end-to-end per RFC 7230 -- keep it. Verified on this box: game.x, hephaestus.x, theseus.x, sirius.x, coinspectrum.x, hello.bch all load HTTPS 200 in strict IWR and Chromium; DNS answers 127.0.0.1 for game.x + hephaestus.x (was their origin IP before), still their origin IP for names without a tls pin. Deployed - dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe - s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.8.exe - silentmode.st manifest advertises 0.1.8 - sha256 47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb
109 lines
9 KiB
HTML
109 lines
9 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<meta property="og:type" content="website">
|
||
<meta property="og:site_name" content="Silent Mode">
|
||
<meta property="og:title" content="Silent Mode — releases &amp; checksums">
|
||
<meta property="og:url" content="https://silentmode.st/releases">
|
||
<meta property="og:image" content="https://silentmode.st/brand/og.png">
|
||
<meta property="og:image:width" content="1200">
|
||
<meta property="og:image:height" content="630">
|
||
<meta name="twitter:card" content="summary_large_image">
|
||
<title>Silent Mode — releases & checksums</title>
|
||
<style>
|
||
:root{--bg:#0b0e14;--panel:#141a24;--line:rgba(255,255,255,.09);--ink:#e7eaf1;--mut:#8b98a9;--dim:#5e6678;--acid:#d6ff3d}
|
||
*{box-sizing:border-box}
|
||
body{margin:0;background:radial-gradient(1100px 560px at 50% -12%,#16202e,var(--bg));
|
||
color:var(--ink);font:16px/1.65 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
|
||
.wrap{max-width:820px;margin:0 auto;padding:3.5rem 1.2rem 4rem}
|
||
a{color:var(--acid)}
|
||
h1{font-size:1.8rem;margin:0 0 .3rem}
|
||
h1 .g{color:var(--acid)}
|
||
.lede{color:var(--mut);margin:.2rem 0 2rem}
|
||
.rel{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:20px 22px;margin-bottom:16px}
|
||
.rel h2{font-size:1.15rem;margin:0 0 .2rem}
|
||
.rel .meta{color:var(--dim);font-size:12.5px;margin-bottom:1rem}
|
||
.file{border-top:1px solid var(--line);padding-top:12px;margin-top:12px}
|
||
.file .n{font-size:14px;color:var(--ink)}
|
||
.file .n a{text-decoration:none}
|
||
.file code{display:block;font-family:ui-monospace,monospace;font-size:11.5px;color:#c9d4e3;
|
||
word-break:break-all;margin-top:4px}
|
||
.note{background:var(--panel);border:1px solid var(--line);border-left:3px solid var(--acid);
|
||
border-radius:10px;padding:14px 18px;color:var(--mut);font-size:13.5px;margin-top:1.6rem}
|
||
.note b{color:var(--ink)}
|
||
footer{color:var(--dim);font-size:12.5px;margin-top:2.5rem;text-align:center}
|
||
</style>
|
||
<link rel="stylesheet" href="shared.css?v=20260910">
|
||
<link rel="icon" type="image/svg+xml" href="favicon.svg">
|
||
</head>
|
||
<body>
|
||
|
||
<nav class="topnav">
|
||
<a class="brand" href="./"><svg class="logo" viewBox="0 0 32 20" aria-hidden="true"><rect class="l1" x="1.5" y="3.5" width="17" height="13" rx="6.5" ry="6.5" fill="none" stroke-width="2.6"/><rect class="l2" x="13.5" y="3.5" width="17" height="13" rx="6.5" ry="6.5" fill="none" stroke-width="2.6"/></svg>Silent <span class="g">Mode</span></a>
|
||
<a href="theseus">Theseus</a>
|
||
<a href="prometheus">Prometheus</a>
|
||
<a href="sirius">Sirius</a>
|
||
<a href="hephaestus">Hephaestus</a>
|
||
<a href="helios">Helios</a>
|
||
<a href="hermes">Hermes</a>
|
||
<a href="tools">Tools</a>
|
||
</nav>
|
||
|
||
<div class="wrap">
|
||
<h1>Silent <span class="g">Mode</span> — releases</h1>
|
||
<p class="lede">Canonical SHA-256 checksums for every published build. This page lives at the on-chain
|
||
name <code>releases.silentmode.bch</code>; the name pins where it is served from, so a tampered
|
||
mirror cannot change what you check against here.</p>
|
||
|
||
<div class="rel">
|
||
<h2>Theseus Navigator <span style="color:var(--acid)">0.3.59</span></h2>
|
||
<div class="meta">Windows 64-bit · unsigned · 2026-09-28 · <b>0.3.59 — DNS over HTTPS, Global Privacy Control, Settings pages with addresses</b> — Privacy, regrouped: Settings › Privacy now opens with a status card and gathers tracking protection (Shield and Cookie Pop-ups with their per-site exceptions), device access, anti-fingerprinting, network and browsing data in one place. New there: DNS over HTTPS (on by default with Quad9; Cloudflare, Mullvad, AdGuard or your own resolver; an increased-protection mode that never falls back to plain DNS) and Global Privacy Control, which tells every site not to sell or share your data (the Sec-GPC header plus navigator.globalPrivacyControl). Every Settings page has an address you can copy and open, theseus://settings/privacy for example, with sub-pages for the longer lists. Search-engine icons ship inside Theseus and a custom engine's icon is cached once, so the toolbar, the picker and Settings look the same offline and opening the picker no longer asks a favicon service which engines you use; the default-engine control in Settings shows the icons too. A video's fullscreen now hides the toolbar and leaving it, switching tabs or closing the tab puts the window back (before, the window could stay fullscreen with no title-bar buttons); F11 toggles fullscreen. A name owner's subdomain rules (a blocked or redirected subdomain) now apply in Theseus for names it reaches directly by IP as well, not only through the gateway.</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.59.exe">TheseusNavigator-Setup-0.3.59.exe</a> — installer</div>
|
||
<code>82506429906f7dca5db4e1cb37f26b806f0217e8db35426a0345c339a8b4ced5</code>
|
||
</div>
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-0.3.59-portable.exe">TheseusNavigator-0.3.59-portable.exe</a> — portable</div>
|
||
<code>3fd83638c205b2ec42176031b5c775cb519c8ca24bf8acda63bf514a781b6f69</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="rel">
|
||
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.8</span></h2>
|
||
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.8 — pinned-origin proxy for `ip`+`tls` names</b> — BNS names that publish an <code style="display:inline">ip</code> record with an on-chain <code style="display:inline">tls</code> fingerprint pin (game.x, hephaestus.x, and any other site that pins its origin cert) now load cleanly in every browser. Before 0.1.8 the daemon returned the raw <code style="display:inline">ip</code> and browsers hit the origin directly; if that origin's cert was not browser-trusted (which is the whole point of publishing an on-chain pin) users got <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_UNKNOWN_ISSUER</code>. 0.1.8 answers DNS with <code style="display:inline">127.0.0.1</code> whenever <code style="display:inline">ip</code>+<code style="display:inline">tls</code> are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin — same algorithm Theseus uses in <code style="display:inline">pinnedHttpsGet</code>. Names with just <code style="display:inline">ip</code> (no pin) keep direct routing unchanged, so nothing regresses. Includes 0.1.7 (runtime-switchable collision policy) and 0.1.6 (self-syncing routing + CA). Upgrades in place.</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe">AriadneResolver-Setup-0.1.8.exe</a> — ~24 MB</div>
|
||
<code>47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="rel">
|
||
<h2>Ariadne for Android <span style="color:var(--acid)">0.20</span></h2>
|
||
<div class="meta">Android 5.0+ (API 21) · self-signed release key · 2026-09-28 · <b>0.20 — every live TLD, fresh snapshot</b> — Every live BNS TLD is claimed by the on-device resolver. The app took its TLD list from the registry's legacy advertised set (nine TLDs), so a name under a newer TLD was only intercepted once it had turned up in the local index; the app now reads the registry's routable list (every TLD on the public listing, 24 today), and ships a bootstrap list matching it for cold start. The cold-start snapshot it pulls from the CDN is now refreshed every ten minutes from the gateway's index instead of by hand, so a fresh install sees names registered minutes ago rather than weeks. Same signing key; installs over 0.19.</div>
|
||
|
||
<div class="file">
|
||
<div class="n"><a href="https://dl.silentmode.st/ariadne-v0.20.apk">ariadne-v0.20.apk</a> — 150 KB</div>
|
||
<code>e7362e356de14f010646f3c60908ccd4bbd8030914f7e6a5dc2722d9dcf5e51e</code>
|
||
</div>
|
||
<div class="file">
|
||
<div class="n">Signing certificate — SHA-256 (the same key signs every future release)</div>
|
||
<code>46ebbbe5dc73148d66410fd0337b1e6683472128c983e8e2578200b9e3ca548c</code>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="note"><b>How to verify.</b> After downloading, compute the file's SHA-256 and compare it to
|
||
the value above — on Windows: <code style="display:inline">certutil -hashfile <file> SHA256</code>;
|
||
on Android, hash the downloaded <code style="display:inline">.apk</code> on a computer before you move
|
||
it to the phone, or use any file-hashing app. Nothing here is signed by an authority your device
|
||
already trusts — <b>by design</b> — so it will warn about an unrecognized app; the checksum is the
|
||
real check. The machine-readable manifest is at
|
||
<a href="https://dl.silentmode.st/releases-manifest.json">releases-manifest.json</a>.</div>
|
||
|
||
<footer>Silent Mode — a Deviant project. Alpha software on a test network.</footer>
|
||
</div>
|
||
</body>
|
||
</html>
|