Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal
A comprehensive tutorial demonstrates how to deploy a personal Hysteria 2 proxy entirely from the terminal on a KVM VPS. The author focuses on core Linux administration tasks including handling executable binaries, managing open ports, configuring SSH keys, and applying basic security hardening.
The guide targets Debian and Ubuntu systems; users of AlmaLinux or similar distributions are instructed to substitute apt commands with dnf equivalents. After connecting via the hoster-provided password, the first recommended step is to generate an ed25519 key pair locally with ssh-keygen and copy the public key to the server’s authorized_keys file.
Password authentication is then disabled in /etc/ssh/sshd_config, the SSH service is restarted, and future logins require the private key. The server is updated, ufw is installed, and rules are set to deny all incoming traffic except TCP 22 and UDP 443.
Hysteria 2 is downloaded from the official GitHub releases, moved to /usr/local/bin, and marked executable. A self-signed certificate is generated with openssl and placed in /etc/hysteria. The server configuration in TOML format enables the salamander obfuscation method together with a password-based authenticator.
A minimal systemd unit is created to manage the service, after which it is enabled and started. On the client side, the same binary is used with a configuration that pins the SHA256 hash of the server certificate and specifies a local SOCKS5 listener.
The author notes that QUIC requires a kernel no older than 5.4 for proper Brutal BBR operation and that the resulting setup provides a single-user, self-hosted proxy rather than a multi-tenant VPN service.
Related articles
Rostec Scales PCAT Platform Nationwide as Russia's First Industrial Marketplace
Rostec has expanded its PCAT platform to every organization within the state corporation that manufactures civilian products. Operating since 2025 and upgraded in September 2026, the platform now unites more than 180 enterprises and research organizations. Its catalog contains over 1,250 finished products along with 370 technological and manufacturing competencies. Visitors can locate not only equipment and components but also partners able to design, test, or produce required solutions. The portal receives more than 23,000 weekly visits, 60 percent of them from corporations and large enterprises. Rostec is extending the network into the regions through supply-chain agreements already signed with Krasnodar Krai and the oblasts of Tver, Tula, and Ryazan. In parallel the corporation launched the Robot Management System in November 2025 for centralized control of robots, sensors, and related IT services.
Kate Mobile Loses VK API Access After New Request Limits Exhaust Quota in 1.5 Days
Popular third-party Android client Kate Mobile has been cut off from VK services following the introduction of strict monthly API request caps. VK implemented the new limits on September 7, offering verified partners up to 100 million requests per month while requiring payment for additional access by third-party services. Kate Mobile developers had requested pricing details in advance but received no response from VK. Calculations showed that the app's real user base would consume the entire 100-million-request allowance in roughly 36 hours, with the messages.send method alone generating twice the allowed volume. Caching optimizations cannot mitigate the issue because message sending cannot be cached. Developers view the change as an effort to eliminate alternative clients rather than a genuine monetization strategy. Users expressed disappointment, praising the app's long-term support and criticizing the official VK client for excessive features and advertising.
Russian AI Research Ranks High in Global Science but Struggles with Commercialization
Russia has secured third place among BRICS nations and twentieth worldwide in the number of scientific papers presented at ten leading international conferences on machine learning and artificial intelligence. According to a study by the Scientometric Center of HSE University, Russian organizations contributed 560 papers between 2020 and 2025 that received over 12,300 citations. The average international citation rate reached 3.59, surpassing India despite fewer total publications. Russian strengths are most evident in the mathematics of machine learning, optimization, and formal concept analysis, with notable results also in computer vision and speech technologies. More than 40 percent of domestic publications involve business participation, led by Yandex among companies, HSE University and Skoltech among universities, and AIRI among non-profit organizations. Significant barriers remain, including shortages of computing power, limited access to high-quality data, and weak transfer of research into commercial products, particularly in natural language processing, AI agents, and infrastructure technologies. The Ministry of Digital Development has announced plans to stimulate demand for domestic AI solutions, expand computing infrastructure, improve regulation, and accelerate the implementation of scientific developments.
redb.Identity Deploys Three-Layer Defense to Neutralize Stolen Access Tokens in OpenID Connect
redb.Identity, a custom OAuth 2.1 and OpenID Connect provider built on .NET, addresses the inherent risks of bearer access tokens by implementing three distinct protection layers. The first layer uses a Backend-for-Frontend pattern with Blazor Server and HttpOnly cookies to ensure no tokens ever reach the browser. The second layer applies DPoP proof-of-possession binding so that a stolen token remains useless without the corresponding private key. The third layer provides rapid revocation through RFC 7009 endpoints, refresh token rotation, idle timeouts, and a hybrid push-pull backchannel logout mechanism that guarantees no revocation is lost across replicas. The architecture also mitigates XSS vectors from direct application code, compromised npm dependencies, browser extensions, and localStorage. Additional routine controls include constant-time secret comparison, TOTP replay protection, rate limiting at multiple scopes, and sanitized proxy headers. The design explicitly acknowledges that BFF shifts rather than eliminates risk, requiring complementary CSRF protection via SameSite cookies and antiforgery tokens.