What is mirage?

Mirage is a small encrypted tunnel written from scratch in Go, built by one person as an alternative to existing tools like Xray, V2Ray, or Shadowsocks rather than a wrapper around them. A single small binary, about 2.5 megabytes, acts as both the server, which you run on a rented server abroad, and the client, which runs on your Mac. Apps on your Mac connect to a local proxy, and everything sent from there to the server is encrypted so it looks like random bytes to anyone watching the network. The README explains its design goals for resisting network censorship: after the initial connection, the traffic has no recognizable pattern for filtering systems to detect, since there are no plaintext headers or fixed-size handshakes. If someone tries to probe the server to check whether it is a proxy, the server does not respond like one. Instead it either silently ignores the connection or forwards it to a real, unrelated website so the prober just sees ordinary web traffic. Each session uses a fresh random value and a timestamp to prevent replay attacks, and the encryption itself relies on standard, well reviewed building blocks: AES-256-GCM and HKDF-SHA256, both part of Go's standard library, with no custom-built ciphers. Setting it up involves cloning the repository onto a remote server and running an install script that sets up the service, generates a secret key, and prints a link you paste into a Mac client, either a SwiftUI app or a command line script. The client then exposes a local proxy that other apps can point to, either individually or by switching the whole Mac's network settings. The author is explicit about the project's limits: it has no forward secrecy, so a leaked key could expose past traffic, it does not disguise itself as a real TLS connection the way some competing tools do, it only tunnels TCP traffic and not UDP, and it has not been independently security audited. The README closes by asking that it be used lawfully.