May 27 (edited) • General Discussion
Security Review: Psiphon Conduit vs. conduit-ir-patch (Iran-only fork)
## TL;DR
The **official Conduit** code is clean. New paid tier requires Google/Apple login — worth
knowing if you care about anonymity.
The **ir-patch** source code and patch are legitimate. Don't run the prebuilt binaries
— they're unsigned, from an unknown author, and you're told to bypass OS security
warnings. Build from source if you want to use it.
**Easier alternative:** use OS firewall rules with Iranian IP ranges — same effect, no
code changes, no untrusted binaries.
Psiphon don't officially support region filtering and haven't said why.
Iran-only filtering **will block Iranian users who are already behind a foreign VPN**,
but that's rare in practice since Psiphon is itself the VPN most of them need.
# And now for the long version - Here is a summary of a chat I had with Claude AI:
## Context
relay tool by Psiphon Inc. Volunteers run it on their home machines so that people in
censored countries can route encrypted traffic through them. Iran is Psiphon's largest
user base — during a January 2026 blackout, over 40,000 Iranians were connected through
Conduit volunteers simultaneously.
A repository called `conduit-ir-patch` (GitHub: `adpunt/conduit-ir-patch`, author
"Adelaide Punt") claims to add a 4-line change that makes a Conduit relay accept
connections **only from Iranian users**, so volunteers who specifically want to help Iran
aren't spending bandwidth on other countries.
---
## Official Conduit — findings
The core relay code is clean. No backdoors or tampering found.
One notable addition in this version: a **"Hosted Conduit" paid tier** that requires
shift — users of Hosted mode are now identifiable to Psiphon through their OAuth account.
The traditional self-hosted anonymous relay mode is unchanged and still works without any
account.
---
## conduit-ir-patch — findings
### The source code is clean
- **`ir-only.patch`** — exactly the 8 lines claimed: adds `if clientRegion != "IR" {
return false, errors.TraceNew("client region not allowed") }` in
`psiphon/common/inproxy/proxy.go`. Nothing else.
- **`extract-config.go`** — reads an official Psiphon binary, finds the embedded JSON
config, writes it to a file. No network calls, no side effects.
- **`install.sh`** — clones from Psiphon's official repo and applies the patch.
Structurally clean.
### The distribution model is a problem
1. **README and NOTICE.md directly contradict each other.** NOTICE.md says the repo
contains no prebuilt binaries and you build from source. The README's primary install
path (Step 1) tells most users to download prebuilt binaries from the `adpunt` GitHub
Releases page. Those binaries are from an unknown person, are unsigned, and have no
checksums or reproducibility guarantees.
2. **Users are instructed to bypass OS security warnings.** The README tells Mac users
to right-click → Open to bypass Gatekeeper, and Windows users to click "More info →
Run anyway" past SmartScreen. Legitimate projects either code-sign their releases or
direct users to build from source — they don't train users to ignore these warnings.
3. **`install.sh` fetches the patch from GitHub at runtime** (`curl … | git apply`),
meaning the applied patch could differ from the one in the repo without you noticing.
**Bottom line:** The patch logic is legitimate. The prebuilt binaries should not be
trusted. Anyone who wants to use this should build from source using the manual
instructions.
---
## Is there a way to do Iran-only filtering without code changes?
**Yes — OS firewall rules.** Multiple community projects
filtering by blocking non-Iranian IP ranges at the OS level (Windows Firewall / iptables)
while keeping Psiphon's broker infrastructure reachable so the node stays active. No code
changes, no building, no untrusted binaries required.
Does Psiphon officially support region filtering? No. [Issue #159 on the official
and was closed with no visible team response. A related PR (#166) adding geographic
*statistics* was redirected to the broker level (shipped in CLI v2.0.0) — but that's
about seeing which regions connect, not filtering them. Psiphon has not published a
stated reason for not supporting filtering.
0
0 comments
Security Review: Psiphon Conduit vs. conduit-ir-patch (Iran-only fork)
skool.com/libertypolitics
Talk politics with others who care, in live calls and community posts. Share your views, ask questions, or just listen in.
Leaderboard (30-day)
1
+669
2
+560
3
+278
4
+270
5
+198
Powered by