Hi, Manuel from ondevice here.

Here's a rough explanation:

- ondevice makes use of `ssh`'s `-oProxyCommand`, which makes ssh send its protocol data to a command's stdin and expect the responses on its stdout (you can use that for example to get around certain proxy servers using `nc`)

- `ondevice ssh` basically executes `ssh -oProxyCommand=ondevice pipe %h $@` (there's a bit more to it, but that's the gist) - internally `ondevice pipe` creates a websocket connection to the ondevice API servers, who in turn tell the device (where `ondevice daemon` is running) that there's a connection incoming.

pretty much the same goes for `ondevice rsync` (and the - not yet released... - `scp` and `sftp` subcommands)

I recently thought about using websockets for tunneling, too, but found out that "security appliances" which do MitM and virus scanning seem to block websockets by default and even need the newest version to support them at all.

So for some scenarios, using websockets seems to be not enough

I think it's actually ssh, but the connection is tunelled through public proxy server.

Cool, but I don't really understand the need for a replacement script. You can tunnel your ssh connexions using .ssh/config "proxy command" option[1], so they could use this functionality to achieve the same goal, and make any command using ssh (e.g. git) usable in a transparent way.

[1] for ex, see here https://www.cyberciti.biz/faq/linux-unix-ssh-proxycommand-pa...