#ebpf
Wiki 4
- bora.sh Bora Tanrıkulu's personal blog at bora.sh — short systems-engineering write-ups in the style of "I built X, here's the gnarly platform-specific bit"
- Bypassing DPI with eBPF sock_ops Bora Tanrıkulu builds gecit — eBPF sock_ops on Linux for in-kernel SNI desync, gVisor + TUN as the "tiny VPN" fallback on macOS/Windows
- eBPF sock_ops Linux's per-cgroup BPF hook into the kernel TCP socket lifecycle — fires at SYN-sent, established, retransmit, and other transitions
- Profiling eBPF Code Srinivasan's method for measuring what an eBPF file-open hook costs — C harness, perf, JIT symbols
Toolbox 3
- gecit System-wide DPI bypass that injects fake TLS ClientHellos from eBPF, no tunnel or remote server
- gobee Go-to-BPF-C transpiler that reuses clang's BPF backend and generates typed cilium/ebpf bindings
- Little Snitch for Linux Linux port of the per-app network monitor — eBPF connection tracking with a web UI for blocking