I’ve noticed a pattern where crypto people don’t seem to understand the edge cases of tcp congestion control, so I agree that this workaround is suspicious. Of

I’ve noticed a pattern where crypto people don’t seem to understand the edge cases of tcp congestion control, so I agree that this workaround is suspicious. Of course, it’s better than no VPN if your UDP is blocked. I like sshuttle’s way better (but I’m biased). However, it’s not broken in the exact way you’re thinking. TCP_NOTSENT_LOWAT is diffent from TCP_LOWAT. The latter would imply a hardcoded bandwidth-delay product. The one they’re using is a margin on top of the bandwidth-delay product, which mostly just depends on a fast enough CPU. They’re using a surprisingly high value for it though.