Direct Internet Method v1.5.4 — Stable (.NET 10 LTS)

Direct Internet Method v1.5.4 — Stable (.NET 10 LTS)

Maintenance release for Windows x64 and Linux x86_64. Windows WPF GUI and native privileged service are rebuilt self-contained on .NET 10 LTS before .NET 8 reaches end of support (November 10, 2026). Linux ships as a separate versioned archive, with protected-backend compatibility and data-preserving in-place upgrade controls.

Downloads and integrity

Download only from the files attached to this release, and compare their SHA-256 against the attached SHA256SUMS.txt.

Platform	Official file	SHA-256
Windows x64	DirectInternetMethod_1.5.4_Windows_Setup.exe	FFB9A2AE19C2E89338EE12EE8DA133F5A16DBF4DCF961678C33D77D0C3843133
Linux x86_64	DirectInternetMethod_1.5.4_Linux_x86_64.zip	4784FCD44ED3D1B40103BCA140B2C0066784F794D07C3AE1F525334766A553C7

The checksum file SHA-256 is 68E70329E8B9DAC6B738CE9B90D99A0010030980CD9C17CDE45A5199A60692D8. Matching corresponding Cygwin and WinDivert source archives are also attached.

Installation and updates

Windows: Launch the single Windows Setup and approve the ordinary UAC prompt when asked. The same Inno AppId and installation directory are retained for in-place updates, rather than stacking separate versions. Safely switch off an active Direct Method connection through its own controls before installing; don't kill active DNS/DPI, Tailscale or RustDesk processes on a remotely connected computer. Keep previous settings and a verified older installer for rollback. No automatic reboot is performed by our installer.

Linux: Extract the ZIP, enter DirectInternetMethod_1.5.4_Linux_x86_64 and execute ./install.sh. The official installer refuses to modify a live Direct Method session; use the application's managed Stop/Recovery path, and preserve an alternate network route before an update. Protected root-owned backend files can remain at a compatible previous version when byte-identical with the required version; root changes use the platform's normal PolicyKit authorization.

Native acceptance — exact published asset bytes

Four independent, disposable hosted-machine lifecycle tests, together with negative and SHA provenance gates, were accepted before publication:

• Windows 2025 R488: public v1.5.1 → exact GitHub v1.5.4 Setup → rollback to original v1.5.1, user files, Router Gateway custom provider, one uninstaller, staged updater finalization, Windows service and DNS/routes all verified.
• Windows 2025 R490: public v1.5.3 → exact v1.5.4 Setup → original v1.5.3 rollback, data and network unchanged.
• Ubuntu 24.04 R489: public v1.5.3 protected backend and user app → exact v1.5.4 ZIP upgrade, staged transaction rollback, compatible protected backend, owner-only safe uninstall and preserved custom data.
• Ubuntu 24.04 R491: fresh root+user install from exact v1.5.4 ZIP and safe complete removal with data preservation.

The attached ACCEPTANCE_V154.json includes exact source SHA, per-run SHA-256 receipts, and the independent verifier's source-tree exceptions. Native-tested product Commit: daf1a939c97f38d4ecec1f8144dd754a2d392c99. Published source/tag Commit: 51009372e3c2d069d7016b97773f35ee5e1e0631. The Git blob audit confirms that only the CI workflow and exact-release verifier differ between these commits; no shipped product file changed.

Signing and network limitations

The publisher distributes Windows Setup unsigned, and a code-signing certificate is not a publication prerequisite. A system that enforces Smart App Control or stricter unsigned-app policies may reject installation. Do not disable Windows security policies or TLS verification to install this program.

Direct Internet Method provides targeted direct DNS/DPI techniques; it is not a VPN, proxy or default-route tunnel and cannot guarantee unrestricted access on every ISP, website or account. HTTP 401/403, authentication, geographic restrictions and upstream TLS/DNS interference can remain. The known owner-host Tailscale/system-preserved DNS issue is not claimed fixed by this .NET 10 maintenance release.

The old public v1.5.3 release is preserved for versioned rollback and historical provenance. Microsoft's .NET 8/10 support reference: https://devblogs.microsoft.com/dotnet/dotnet-8-9-end-of-support/ .

Direct Internet Method v1.5.3 — Stable

Direct Internet Method v1.5.3 — Stable

One maintained Windows/Linux product, one active installation per system, and verified in-place updates. This release incorporates the Windows legacy staged-updater finalization fix and preserves settings, custom Router Gateway provider data and user-managed files across the tested upgrades. The public v1.5.2 artifacts remain unchanged.

Download and integrity

Download the appropriate installer from this GitHub Release. The SHA256SUMS.txt attached here is authoritative.

Platform	Official file	SHA-256
Windows x64	DirectInternetMethod_1.5.3_Windows_Setup.exe	B517EA79C8949E960897CE814591F7C1518FDEA45E4419A891B64469E879B6FF
Linux x86_64	DirectInternetMethod_1.5.3_Linux_x86_64.zip	680343F86ABEC2D7B69CE807F4EC5B344789B2D6335C51C068BC49F4650DFC05

The checksums file itself is SHA-256 98B9AB15EA2894396CC8336BC0871C40388799E8EB211C6BA92437E28DB29331.

Windows: Run the single Setup executable. Installation or privileged upgrades use the normal Windows UAC prompt; normal application operation does not require permanently elevated privileges. It uses the existing Inno Setup AppId and installation directory rather than accumulating parallel versions. Do not force-stop a currently active DNS/DPI service or Tailscale connection; use a safe OFF state before upgrading.

Linux: Extract the ZIP, enter the extracted DirectInternetMethod_1.5.3_Linux_x86_64 directory and run ./install.sh. The installer preserves existing user data and can retain an exact compatible protected v1.5.2 backend without needlessly modifying root-owned files. A fresh protected-backend installation may request ordinary PolicyKit authorization.

Acceptance evidence

All of the following ran on disposable native hosted machines using the exact files attached to this release, with corresponding raw SHA-verified reports linked from the ACCEPTANCE_V153.json asset:

• Windows 2025 VM: run 38389324841. Official public v1.5.2 installed; this exact GitHub v1.5.3 Windows installer SHA verified and installed in place; five seeded user files including custom Router Gateway data, a single uninstaller, updater staging cleanup, Windows service ownership, DNS/routes and rollback to exact v1.5.2 binaries all passed.
• Ubuntu 24.04 fresh installation: run 38388513538. Genuine root-owned protected backend, PolicyKit/systemd checks, user installation and safe removal completed with preserved user configuration and zero leftover managed backend.
• Ubuntu 24.04 genuine upgrade: run 38390031680. Downloaded public v1.5.2 Linux ZIP and exact v1.5.3 GitHub draft ZIP; real protected v1.5.2 + user v1.5.2 installation, tested staged v1.5.3 transaction rollback, in-place upgrade to user v1.5.3 with byte-identical root backend retained, then safe removal. User settings and network routes/DNS were preserved.
• The release source tag includes only CI and provenance-verifier changes relative to the native-tested product source; exact Git blob SHA and file-mode equality has been checked for all shipped product files.

Security and limitations

The publisher distributes this Windows installer unsigned and does not require a signing certificate for publication. Windows systems enforcing Smart App Control or other unsigned-app policies may reject it; do not disable operating-system security protections to install it.

This application provides direct DNS/DPI methods; it is not a VPN, proxy or default-route tunnel. Network-specific filtering, HTTP 403 access restrictions, account authentication and site/geolocation policy cannot be guaranteed away. Hosted installation tests do not imply every user network is accepted. Take a configuration backup and preserve network recovery options before upgrades on active machines.

Corresponding upstream Cygwin and WinDivert source archives are attached, along with the SHA-attested release acceptance record.

Source lineage: Native-tested product commit eb6a7bf9a7c6a04cef5a85100e805d0575ef9c9a. Published tag target commit 581a063836a20ca3c0adb941bfc77146e33d693a (CI/provenance changes only; product blobs unchanged).

Direct Internet Method v1.5.2 - Stable

Direct Internet Method v1.5.2 — Stable

One official Windows/Linux product. One active installation per system. In-place updates retain settings and user data.

Source commit: 14a3eec378eb75856f6691b7b3edc970507ee61f
GitHub PR: Integrated v1.5.2 candidate #44

Download and install

Windows (x64): DirectInternetMethod_1.5.2_Windows_Setup.exe. Upgrade the existing v1.5.1 installation in place: keep the same Inno AppId and installation path, without a duplicate application or uninstaller. Settings, custom Router Gateway providers and user-owned files are retained. To update from the app itself, stop Direct Method first, then choose Check Update / Update; its installed Windows service downloads and SHA-verifies the latest official Stable release and installs it without a second independent product.

Linux (x86_64): DirectInternetMethod_1.5.2_Linux_x86_64.zip. Extract it, then run ./install.sh inside the extracted application directory. The installer maintains one managed user application and a protected system backend, preserving existing configuration. Native OS authorization may be needed for initial installation or changes to protected system files. Ordinary Start/Stop/Recovery does not require repeated administrative authentication.

Neither platform changes the default route to a tunnel or installs a system-wide proxy. The default targeted direct-DNS/DPI mode is designed to coexist with Tailscale and RustDesk.

Exact release assets (SHA-256)

File	SHA-256
DirectInternetMethod_1.5.2_Windows_Setup.exe	F94A81CC819E465D6B1000FFDB0B20A7212E39B6F6282ED8A720774148DFC78D
DirectInternetMethod_1.5.2_Linux_x86_64.zip	53C9FCADDBE96CEC9F63505AB20992479C422F3AB9A9E2379898F5A80BF76692
SHA256SUMS.txt	F5AD1390F3D62E35F4D9695A2B8602A18280EC6CC4B802688774EDA37F18B529
ACCEPTANCE_V152.json	AB778E6C995760DDBB31F9A1FFE14D64A4E0A23B3CD9DAB6E7B397F55EE0D880
cygwin-3.4.10-1-src.tar.xz	AC70AF0D4E644732F74946F55F7BAFE010BAB9B9DA39A9327C3F0367F1FA43A2
WinDivert-v2.2.2-corresponding-source.zip	65EC79C9E6AFA99F648A3F4D1F6DB794640B40D0B65BD438770EA503EE14ECB7

Real installation and rollback validation

• GitHub Actions Windows R450: PASS. Installed the exact Windows Setup downloaded from the GitHub Release draft: real v1.5.1 install → v1.5.2 in-place upgrade → remove → restore native v1.5.1. Verified preservation of five user-owned test files including custom Router Gateway providers, one uninstaller, exact original binary hashes, DNS/routes, recovery watchdog and zero unresolved errors. Raw REPORT_R435.json SHA-256 8448D818AA9F11C5F3BA48B8BB9ED15CCB5AB63818DE0B8903794DA090EEFF9B.
• GitHub Actions Linux R451: PASS. Installed the exact Linux ZIP downloaded from GitHub on an ephemeral Ubuntu VM, verified root-owned services and PolicyKit registration, user install/uninstall, preserved personal settings and exact route/DNS state. Raw REPORT_R436.log SHA-256 34D3930FF19FF09663A8AC6A74982628304A46F4D0E88787AF1CEEFDDB654A86.
• GitHub Actions R452/R453: PASS for strict public-release receipt schema. The two normalized reports reference the same real hosted Windows lifecycle, not two independent VM runs; source report SHA and both individual report SHA values are in ACCEPTANCE_V152.json.
• Linux Emad and Linux Mohammad: installed native v1.5.2 with one application. GUI and protected backend verified. Emad Linux reproduced YouTube HTTP 204 twice in Compatibility mode while preserving Tailscale, RustDesk, DNS, routes and user settings.

Known service and network limitations

Direct DNS/DPI cannot change your public Internet egress location or override remote website authorization. ChatGPT may return HTTP 403 on restricted network paths; this release does not claim authenticated ChatGPT access where it remains blocked. On one tested Linux/Mohammad network, YouTube DNS interception and TCP/TLS resets remained observable despite safe operation of several DPI profiles. Connectivity varies by ISP, network and remote website; universal access is not guaranteed.

Third-party software and corresponding source

The Windows package includes notices for Cygwin, WinDivert, ctrld and zapret. Exact versioned corresponding-source archives for Cygwin 3.4.10-1 and WinDivert 2.2.2 are separately attached to this release, with SHA-256 values above. See docs/THIRD_PARTY_WINDOWS_LICENSES.md for license terms and provenance. Source-code rights to Direct Internet Method itself are not granted merely by public repository visibility; retain its rights-holder terms when reusing source.

Installation and update acceptance are version- and environment-specific. A successful hosted test does not prove every OS policy, network condition or user machine. Existing user data should be backed up before administrative system changes.

Direct Internet Method 1.5.2 - Public Unsigned Preview 4

Direct Internet Method 1.5.2 — Public Unsigned Preview 4

Public PRE-RELEASE, not yet Stable. One public product with no code-signing certificate requirement. Like v1.5.1, the Windows installer is unsigned. Do not disable Smart App Control, Defender or other Windows protections; machines which reject unsigned executables may not install it.

Exact source: PR #35 commit 37b2e9a.
Windows + Linux source CI: https://github.com/GOD13emad/DirectInternetMethod/actions/runs/38171352614 — PASS.

Windows Setup: 157,112,111 bytes. SHA-256: 752B967B44D7B549508F25E442F4B464A01A4C0B573E1BA09AB28CEF20B3C706. NotSigned.
Linux x86_64 ZIP: 8,234,805 bytes. SHA-256: 0218BEBD0DC8F88670374FF0E12A61D45229A03092C606678C5C00FD81DC2C9E.
The SHA256SUMS.txt asset must match both release digest values and independently downloaded files.

Previous Preview3 hosted Windows install and rollback tests PASS, but used a different source Commit and Installer SHA, so they do not validate this new candidate. The new build's Windows installation/upgrade/rollback acceptance is still OPEN.

The Cygwin 3.4.10-1 corresponding source archive is supplied as an additional public asset. See CYGWIN_SOURCE_PROVENANCE_R398.md. The original project's source-license selection and other third-party redistribution obligations remain under review.

Known site limitations remain: usable authenticated ChatGPT and YouTube websites have not been validated across every network; regional 403 restrictions and carrier DNS/TLS interference are outside an unconditional local-DPI guarantee.

Stable v1.5.1 remains public and unchanged. Neither a public Preview nor a successful Build establishes product FINAL.

Direct Internet Method 1.5.2 - Public Unsigned Preview 3

Direct Internet Method 1.5.2 — Public Unsigned Preview 3

Public prerelease, unsigned. This is an optional test build, not yet the stable v1.5.2 release.

Release policy: All Direct Internet Method releases, including the existing public/stable v1.5.1, may be distributed without a code-signing certificate. The publisher does not require a separate internal/external or signed/unsigned product channel. This build is available for anyone who chooses to install it; installation may be blocked by their Windows security policy. No security protection should be disabled or bypassed.

Exact source: PR #30, commit 3ead24911ca583932ed8fbcb5820b8a25b20303f. Windows + Linux CI: source jobs PASS.

Files and SHA-256:

• DirectInternetMethod_1.5.2_Windows_Setup.exe, 157,124,929 bytes, SHA-256 2F054752E3B1B4715D68958CA49639AEA6FE43E0E4CBC6611DDEEBABAE2C7EB5 — NotSigned.
• DirectInternetMethod_1.5.2_Linux_x86_64.zip, 8,234,805 bytes, SHA-256 0218BEBD0DC8F88670374FF0E12A61D45229A03092C606678C5C00FD81DC2C9E.

Verified: Byte-identical native Windows GUI/service build on two Windows computers; Linux ZIP reproducible on one Windows and two Linux computers; GUI launches on both Windows computers; native Inno compiler PASS; Linux protected Targeted Start/Stop/Recovery accepted on both Linux systems.

Not yet fully accepted: Fresh Windows installation/uninstall/rollback of this exact Installer, upgrade from active v1.5.1, all GUI actions, and authenticated ChatGPT/YouTube access across all networks. If you already have an active Direct Internet Method network engine, stop and recover it before upgrading. Do not assume a successful download means a successful install.

Rights and notices: Redistributed third-party license texts are documented in the repository. Corresponding-source obligations and a clear license grant for original project code remain under review and are not claimed completed.

No certificate purchase is required to distribute this unsigned build, and no code signing has been applied. Existing stable public v1.5.1 is unchanged.

Direct Internet Method 1.5.2 - UNSIGNED PREVIEW 1

Direct Internet Method v1.5.2 ظ�¤ UNSIGNED PUBLIC PREVIEW 1

Published under the GitHub account GOD13emad. This account name is not a verified Windows code-signing identity.

Status: Public pre-release for voluntary testing. NOT the stable v1.5.2 release, not a security-certified build, and not claimed to work on all PCs. Stable public release remains v1.5.1.

Source: exact commit e3ef363a1c84d8c6cb36d0beef3685aa66c1e894. The Windows payload was built from this source in an isolated build worktree; its generated package manifest SHA-256 is AA73EAB98419A9062BC6E84461FE7C1C09272CCEF5406596262B6F0DFC467E74. The Linux archive was rebuilt deterministically from the same source.

Assets and integrity

• Windows x64: DirectInternetMethod_1.5.2_Windows_Setup.exe ظ�¤ 157,120,785 bytes; SHA-256 8609070B6F86368422F14FFDBD311A616802229224AF35E9E6A999D70D1B2CA5.
• Linux x86_64: DirectInternetMethod_1.5.2_Linux_x86_64.zip ظ�¤ 8,234,805 bytes; SHA-256 0218BEBD0DC8F88670374FF0E12A61D45229A03092C606678C5C00FD81DC2C9E.
• Also provided: SHA256SUMS_UNSIGNED_PREVIEW.txt and BUILD_PROVENANCE_UNSIGNED_PREVIEW.json. Compare your downloaded file's SHA-256 with the checksum list on this GitHub release before attempting an install.

On Windows, use Get-FileHash .\DirectInternetMethod_1.5.2_Windows_Setup.exe -Algorithm SHA256. On Linux, use sha256sum DirectInternetMethod_1.5.2_Linux_x86_64.zip.

Unsigned Windows limitation ظ�¤ read first

The Windows installer and project executables are NOT Authenticode-signed. Windows may display Unknown Publisher or SmartScreen warnings; devices with Smart App Control enforcement or similar policies may block installation or execution entirely. There is no verified publisher certificate, no guarantee of compatibility, and no recommendation to disable or bypass OS security protections. Installation needs Windows administrator approval where permitted. Antivirus/App Control failures are known unresolved acceptance gates.

Operational cautions

• Do not install this preview as your only remote-access or critical network connection. Back up settings first and maintain a separate way to recover.
• Tailscale and RustDesk coexistence passed bounded source and environment tests, not full independent end-to-end acceptance on every device. No default route or DNS modifications were made to the development systems when preparing this release.
• Real authenticated ChatGPT/YouTube/Gemini availability and previously observed HTTP 403 are not universally resolved; no promise of global access.
• Linux setup may require operating-system authorization for protected components; inspect included install.sh and README before running. GUI/reboot input acceptance on Linux MMZ remains open.
• Automatic upgrade/rollback from this preview is not independently accepted. The embedded pre-release RELEASE.json belongs to the prior signed-release candidate and its installer hash is not the authority for this public preview; the attached checksum list is.

Attribution, distribution and licenses

Distributed at the instruction of the project owner via GOD13emad on GitHub. The owner permits downloading and installing this preview where lawful and permitted by device policy, without any warranty. Bundled third-party software retains its respective license and notice terms; see the licenses, LICENSE.* and other bundled notices. A project-wide open-source license has not been selected; do not infer an open-source grant or independent redistribution/sublicensing rights for original project code.

┘�╪د╪▒╪│█î

╪د█î┘� ┘�╪│╪«┘ç ┘╛█î╪┤ظ�î┘�┘à╪د█î╪┤ ╪╣┘à┘ê┘à█î ╪ذ╪»┘ê┘� ╪د┘à╪╢╪د ╪د╪│╪ز ┘ê ╪ذ╪د ╪ص╪│╪د╪ذ ┌»█î╪زظ�î┘ç╪د╪ذ GOD13emad ┘à┘�╪ز╪┤╪▒ ┘à█îظ�î╪┤┘ê╪». ╪د┘à╪╢╪د█î ┘à╪╣╪ز╪ذ╪▒ ╪»█î╪ش█î╪ز╪د┘� ┘�╪»╪د╪▒╪» ┘ê ┘à┘à┌ر┘� ╪د╪│╪ز Smart App Control ┘ê█î┘�╪»┘ê╪▓ ╪د╪ش╪د╪▓┘ç┘¤ ┘�╪╡╪ذ █î╪د ╪د╪ش╪▒╪د ┘�╪»┘ç╪». ╪ذ╪▒╪د█î ┘�╪╡╪ذ╪î ╪ص┘�╪د╪╕╪ز ╪د┘à┘�█î╪ز█î ╪│█î╪│╪ز┘à ╪▒╪د ╪║█î╪▒┘�╪╣╪د┘� ┘�┌ر┘�█î╪». ┘é╪ذ┘� ╪د╪▓ ┘�╪╡╪ذ╪î ┘ç╪┤ SHA-256 ┘�╪د█î┘� ╪»╪د┘�┘�┘ê╪»╪┤╪»┘ç ╪▒╪د ┌ر┘�╪ز╪▒┘� ┌ر┘�█î╪» ┘ê ╪د╪▓ ┘à╪│█î╪▒ ╪ش╪د█î┌»╪▓█î┘� ╪ذ╪▒╪د█î ╪»╪│╪ز╪▒╪│█î ╪ذ┘ç ╪│█î╪│╪ز┘à ┘à╪╖┘à╪خ┘� ╪ذ╪د╪┤█î╪». ╪د█î┘� ┘�╪│╪«┘ç ╪ذ┘çظ�î╪╣┘�┘ê╪د┘� ┬س┘�┘ç╪د█î█î ┘ê ╪ز╪╢┘à█î┘�ظ�î╪┤╪»┘ç ╪ذ╪▒╪د█î ┘ç┘à┘ç┘¤ ╪│█î╪│╪ز┘àظ�î┘ç╪د┬╗ ┘à╪╣╪▒┘�█î ┘�┘à█îظ�î╪┤┘ê╪».

R306 confirmed Smart App Control rejection (October 10, 2026)

The exact published Windows Setup (157,120,785 bytes, SHA256 8609070B6F86368422F14FFDBD311A616802229224AF35E9E6A999D70D1B2CA5) was tested in a fresh offline Windows Sandbox with Windows Smart App Control ENFORCE. The unsigned Setup was blocked before installation: An Application Control policy has blocked this file. Code Integrity events 3077 and 3033, and policy {0283AC0F-FFF1-49AE-ADA1-8A933130CAD6}, confirm the enforcement. This is NOT an installable/released Windows build for computers enforcing Smart App Control. Do not disable Windows security protections to install it. Other Windows environments still require their own independent acceptance tests.
The Linux ZIP is independently downloadable and SHA-valid; install/GUI/reboot on every Linux host remains unverified. This is still only an UNSIGNED PREVIEW; the stable latest release is v1.5.1. Technical evidence: Issue #25 and Draft PR #26.

فارسی: اجرای نسخهٔ بدون امضای Windows در محیط آزمایشی با Smart App Control فعال واقعاً مسدود شد. این نسخه برای سیستم‌هایی با این حفاظت، نصبِ تأییدشده ندارد. برای نصب، حفاظت ویندوز را خاموش نکنید. فایل Linux از نظر دانلود و هش بررسی شده، ولی همهٔ آزمون‌های نصب آن تکمیل نشده‌اند.

Direct Internet Method v1.5.1

Direct Internet Method v1.5.1

Final Windows + Linux release for the direct-only DNS/DPI architecture.

Accepted

• Windows exact-installed lifecycle: PASS; balanced/targeted restored ACTIVE.
• Linux exact canonical archive installed; balanced/targeted restored ACTIVE.
• Opt-in broad Adult coverage with maintained catalog and offline fallback.
• Representative Adult checks: Pornhub, XVideos, XNXX and XHamster usable in normal client operation.
• Linux XHamster stability: 5/5 restart cycles returned HTTP 200; when an unusable Cloudflare edge was first in DNS order, the normal client failed over to the healthy edge.
• Reddit, YouTube, GitHub, Wikipedia and OpenAI endpoint reachability validated.
• Start/Stop/Recovery rollback gates validated.
• Windows payload self-integrity pins and Linux protected payload identity validated.
• Protected source/contract CI on the exact release tree: PASS.

Known boundaries

• Gemini reaches Google but returns HTTP 403 on the current public egress, including real Chrome. This is not counted as PASS; direct-only DNS/DPI cannot change service-side geographic/egress policy.
• A forced XHamster Cloudflare edge (104.16.3.81) is not usable on the validated Linux network; normal DNS/client operation demonstrated failover to 104.16.4.81 and 5/5 successful restart cycles.
• Windows Authenticode remains unsigned because a publicly trusted publisher certificate is external/missing; SHA-256 release digests remain authoritative.

SHA-256

• DirectInternetMethod_1.5.1_Windows_Setup.exe
  4E1974B5A40F96B49B7B4196FFE963DCDF65B05E4F2B89DE4EC06E794B77EE9B
• DirectInternetMethod_1.5.1_Linux_x86_64.zip
  21FE512444957008DA4D79F540ABCEAD5CC9CB18481F1FF8B620A4B90A9374B8
• SHA256SUMS.txt
  BE9249CD5E326C2B47BC6DAC79EF62EFC9A2B4ACC9491E223A3DBE0064583DC0

Direct Internet Method v1.5.0

Direct Internet Method v1.5.0

Site coverage and live diagnostics

• Keeps the accepted v1.4.0 bounded direct engine: leak-closed direct-IP DoH, HTTP/80 host split, TLS/SNI TCP/443 desync and QUIC UDP/443 desync.
• Adds built-in host-scoped coverage for Gemini, the requested adult-site/CDN target, OpenAI/ChatGPT and GitHub.
• Adds Gemini to the in-app live checks.
• Adds an Adult site live check with a per-user on/off switch. It defaults OFF and the adult brand/domain is not displayed in the application UI.
• Live checks now distinguish PASS (2xx/3xx), REACHABLE (HTTP transport succeeded but the server returned a non-success application status such as 403), and FAIL (transport failure).
• Gemini/adult diagnostics are non-gating: they never roll back a successful core Direct Method Start. Core lifecycle acceptance still uses owned-resource health plus the established YouTube/OpenAI/GitHub checks.
• Linux updater integrity now requires exact-one expected assets and three-way SHA-256 agreement: GitHub API digest == SHA256SUMS.txt == downloaded ZIP.
• Adds Custom Sites (normalized domain/URL input, max 256), Balanced / Compatibility / Strong strategy profiles, and opt-in All Sites (experimental) scope; Targeted remains the default.
• Router Gateway endpoint tests no longer imply protocol authentication: PPTP reports TCP/1723 control reachability with GRE/authentication unverified; L2TP/IPsec generic fallback explicitly states UDP 500/4500/authentication are not verified.
• Adds third-party binary admission policy and CI blocked-hash regression. The evaluated zapret2 v1.0.5.2 Windows/archive remains rejected after a Severe/Concrete Defender detection; no Defender exclusion or restore is used.

Evidence-first scope

The v1.4.0 host list contained only YouTube-related domains. Linux baseline testing therefore showed Gemini was already network-reachable but returned HTTP 403, while the requested adult site timed out before a useful HTTP response. Explicit hostlist targeting remains the minimum-sufficient default because zapret applies desync only to listed hosts. v1.5.0 adds user-managed Custom Sites and an opt-in All Sites mode for unknown blocked domains. Automatic hostlist learning remains disabled because it requires broader inbound/outbound interception and additional false-positive controls.

The Direct Method does not change public egress IP. It can mitigate DNS/DPI interference, but it cannot guarantee access when a remote service itself rejects an IP range, account, age/region policy, or product availability.

Preserved invariants

• No VPN or default-route tunnel.
• No HTTP/SOCKS/WinHTTP application proxy.
• No physical-adapter DNS mutation.
• No broad /1 route creation.
• Hostlist-scoped DPI handling by default; All Sites is explicit opt-in only.
• Stop/Recovery retain owned-resource and rollback checks.

Validation boundaries

An authenticated Router Gateway tunnel remains router-model/firmware-dependent. HTTP/3 application-level E2E remains separately unproven where the installed curl lacks HTTP/3. The Windows installer is not Authenticode-signed.

Direct Internet Method v1.4.0 — Direct Multi-Protocol Engine

Direct Internet Method v1.4.0

Direct multi-protocol engine

• Hardens the existing direct-IP DoH path by disabling ctrld's desktop OS-resolver fallback on upstream failure.
• Adds bounded HTTP/80 host split/desync.
• Keeps and formalizes TLS/SNI-oriented TCP/443 desync.
• Replaces Linux's previous UDP/443 reject/fallback with bounded QUIC UDP/443 desync.
• Uses zapret multi-strategy profiles so each traffic family has its own filter and method.
• Remains scoped to the existing host list.

Non-goals / safety invariants

• No VPN or default-route tunnel.
• No HTTP/SOCKS/WinHTTP proxy.
• No physical adapter DNS mutation.
• No broad /1 route creation.
• No global all-domain packet manipulation.
• Stop/Recovery retain owned-resource and rollback checks.

Method selection rationale

Official zapret documentation supports separate HTTP/TLS/QUIC strategies, hostlist scoping and multi-profile --new configuration, and recommends intercepting the minimum traffic required. The same documentation warns that IP fragmentation is unreliable on modern networks and that server-window tricks can slow sites, so those methods are not enabled by default. ctrld officially supports DoH, DoH3, DoQ and DoT, but live isolated tests on the current Linux network passed only the established direct-IP DoH path; DoH3, DoQ and DoT did not resolve successfully. They are therefore not activated merely for feature count. v1.4.0 does explicitly disable ctrld's desktop OS-resolver fallback so encrypted-DNS failure does not silently leak back to the physical resolver.

Validation boundary

An authenticated Router Gateway tunnel remains router-model/firmware-dependent. QUIC configuration and runtime ownership are validated, but curl on the current Windows/Linux hosts does not expose HTTP/3, so a curl-based HTTP/3 end-to-end claim is not made.

Direct Internet Method v1.3.2 — Router Gateway visibility fix

Direct Internet Method v1.3.2

Router Gateway table-visibility hotfix on top of the accepted v1.3.1 startup-layout release.

Windows Router Gateway

• Fixed the DataGrid theme defect that made unselected profiles render white text on the default white row background.
• Explicit dark row, alternating-row, cell and column-header styles keep all loaded profiles readable.
• Selected row remains high-contrast blue.
• Runtime UI automation verifies 9 rows, 7 columns and 9 data items with the current provider catalog.

Preserved from v1.3.1

• 1289 × 632 preferred Windows startup size.
• Responsive wrapping footer with no overlap at reduced width.
• Provider catalog revision 2: 9 ready profiles from VPN Gate, VPNBook and Pilovali.
• Direct DNS/DPI privileged networking logic is unchanged.
• Linux protected backend compatibility remains 1.2.1; Linux user-space package advances only for release parity.

Validation boundary

Physical-router authenticated tunnel success remains model/firmware-dependent. Windows installer remains unsigned by Authenticode.