BetterLAN Release Notes: Security Refactoring and Architecture Upgrade

Removed v0.0.1 due to security vulnerabilities.

Cryptography & Security

Implemented True End-to-End Encryption (E2EE): Introduced Elliptic-Curve Diffie-Hellman (ECDH) dynamic key exchange. Session keys are negotiated independently by both endpoints, providing Perfect Forward Secrecy (PFS) and stripping the relay node of any traffic decryption capabilities.

Fixed Stream Cipher Vulnerability: Refactored the underlying encryptor to deprecate fixed Initialization Vectors (IV). A cryptographically strong 16-byte random IV is now generated per connection during the initial handshake, thoroughly mitigating key-stream reuse attacks.

Strengthened Key Derivation Function: Replaced single-pass hashing with the industry-standard PBKDF2 algorithm (65,536 iterations with a static salt) to derive local encryption keys, significantly raising the threshold against brute-force and dictionary attacks.

Decoupled Authentication and Encryption Credentials: The authentication token sent to the server is now a secondary SHA-256 hash of the AES key, eliminating the possibility of the server reverse-engineering the encryption key from the auth credentials.

Network & Connection Logic

Introduced Zero-Trust Host Approval: Removed automated connection mechanics. All external join requests are halted at the network protocol layer. The host must manually click "Accept" or "Reject" via the in-game chat to establish a physical data channel, fundamentally preventing unauthorized access and offline identity spoofing.

Developed Protocol Sniffer: Added a protocol sniffer to the client's network layer to accurately distinguish between Minecraft protocol "Status Requests (Ping)" and "Join Game (Login)". Unauthorized players can successfully ping the server list, but actual join attempts are intercepted pending host approval.

Implemented Bilateral Latency Tracking: Displaying each player's ping to the relay node alongside the calculated peer-to-peer latency between the host and the joining player.

User Experience & UI (UX & UI)

Fixed Server List Flickering: Optimized the underlying heartbeat mechanism. Memory states are no longer forcefully cleared upon short TCP closures, resolving the issue where the online player list and latency data would frequently flicker or reset to zero.

Fixed Erroneous Disconnect Prompts: Optimized the read-blocking logic of the host listening channel, fixing the bug where the chat box would frequently display "Connection to relay node lost" warnings after opening to LAN.

Relay Server Optimization (Go Backend)

Memory Leak Prevention: Introduced a background daemon goroutine to periodically clean up zombie sessions left unprocessed by the host for over 60 seconds, preventing Out-Of-Memory (OOM) crashes.

Anti-DoS Protection: Implemented LimitReader to restrict the maximum byte length of single-line reads. Combined with handshake timeout disconnects and TCP KeepAlive mechanisms, this prevents malicious oversized packets or dead connections from exhausting server resources.