From 448b58ebd6c4e2d388a19d77c59635b27738a240 Mon Sep 17 00:00:00 2001 From: blessdyb Date: Sun, 27 Sep 2026 00:54:40 -0700 Subject: [PATCH 1/2] Roadmap: 0.9 is about being trustworthy on its own terms Five entries, and what they have in common is that each one turns a claim Flowlight makes into something it can show. Coverage per app rather than "every connection". A threat model that says what it does not defend against, and product language that says monitoring rather than prevention beside every mention of blocking. Limits you set on the recorded bodies, which are the most sensitive thing it holds. A rule you can watch before it refuses anything. And the export disclosing itself the way Flowlight makes everything else disclose. Most of it comes from a security review of 0.8.1, the rest from what the 0.8.2 fixes exposed: the redaction that protects recorded bodies is a guess at which headers carry credentials, and a guess is not a budget. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 30 ++++++++++++++++++++++++++++++ docs/index.html | 5 +++++ docs/llms-full.txt | 10 ++++++++++ docs/sitemap.xml | 2 +- site/pages/index.html | 5 +++++ 5 files changed, 51 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fe02d24..f5f7586 100644 --- a/README.md +++ b/README.md @@ -418,6 +418,36 @@ Shipped: Planned, in order: +- **0.9.0 — Coverage, stated rather than assumed.** Flowlight says it sees every connection, and then the honest + paragraphs elsewhere explain the exceptions: traffic from before the filter started, system services exempt + from content filters, a Mac where another content filter owns the slot, apps that pin their certificates, QUIC + the proxy never sees, and an agent's local MCP server talking over a pipe. Today you have to know all of that + to read the screens correctly. A coverage view would say it per app: watched by the extension, decrypted by + the proxy, named only by DNS or SNI, or not covered at all — and *why*, with the fix where there is one. It is + the difference between a tool that claims completeness and one that can be trusted about its own limits. +- **0.9.1 — A threat model, written down.** What Flowlight defends against, and what it does not, on one page: + software on this Mac behaving badly in the open; not software with root, which can switch the filter off. + A signed update from someone who is not us — which 0.8.2 closed. A VPN or security agent holding the content + filter slot. Certificate pinning, QUIC, and anything routed around the proxy. The product language should say + **monitoring, not prevention** beside every mention of blocking, because "block" invites a guarantee the + design cannot make. Alongside it, a security contact address and key for people who can't or won't use + GitHub's private reporting, and the web fonts served from this domain rather than Google's — a local-first + tool shouldn't make a third-party request to render its own privacy page. +- **0.9.2 — A budget for inspection.** HTTPS inspection records request and response bodies for three days, and + that is the most sensitive thing Flowlight ever holds. The redaction that protects it is a guess at which + headers carry credentials — improved in 0.8.2, still a guess. This turns it into something with limits you + set: a header allowlist rather than a denylist, patterns of your own, an option to keep no headers at all, + per-app byte ceilings, bodies deleted on a schedule you choose, and an inspection session that expires by + itself instead of running until someone remembers. +- **0.9.3 — Show me what this rule would have done.** A rule that refuses connections is easy to write and + frightening to switch on, because the first thing you learn about it is what it breaks. Simulation replays the + last day of recorded traffic against a rule and lists what it would have refused, before it refuses anything. + The data is already there; it has only ever been used to explain the past. +- **0.9.4 — What leaves the Mac, before it leaves.** The OpenTelemetry export sends recorded traffic to a + collector someone typed in. Before the first row goes, it should show the destination, whether the connection + is encrypted, exactly which fields travel and whether any of them are headers — the same disclosure Flowlight + demands of everything else it watches, applied to itself. + Later, no version yet: - **Linux (Ubuntu).** A daemon plus a local web UI, sharing the Swift core (storage, protocol classification, agent diff --git a/docs/index.html b/docs/index.html index 2f4e02f..bf4574d 100644 --- a/docs/index.html +++ b/docs/index.html @@ -402,6 +402,11 @@

What's coming

Flowlight watches, explains and refuses today. This is the order the rest is being built in.

+
Coverage, stated rather than assumed 0.9.0

Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits.

+
A threat model, written down 0.9.1

What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google.

+
A budget for inspection 0.9.2

Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.

+
Show me what this rule would have done 0.9.3

Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.

+
What leaves the Mac, before it leaves 0.9.4

Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.

Linux, then Windows

The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.

diff --git a/docs/llms-full.txt b/docs/llms-full.txt index f854274..a41d659 100644 --- a/docs/llms-full.txt +++ b/docs/llms-full.txt @@ -1034,6 +1034,16 @@ e.g. Wireshark Flowlight watches, explains and refuses today. This is the order the rest is being built in. + Coverage, stated rather than assumed 0.9.0Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits. + + A threat model, written down 0.9.1What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google. + + A budget for inspection 0.9.2Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself. + + Show me what this rule would have done 0.9.3Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past. + + What leaves the Mac, before it leaves 0.9.4Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself. + Linux, then WindowsThe analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs. Privacy diff --git a/docs/sitemap.xml b/docs/sitemap.xml index 3d7afdb..357be42 100644 --- a/docs/sitemap.xml +++ b/docs/sitemap.xml @@ -2,7 +2,7 @@ https://flowlight.xinbetween.com/about/2026-09-25 https://flowlight.xinbetween.com/docs/2026-09-26 - https://flowlight.xinbetween.com/2026-09-26 + https://flowlight.xinbetween.com/2026-09-27 https://flowlight.xinbetween.com/privacy/2026-09-25 https://flowlight.xinbetween.com/releases/2026-09-27 https://flowlight.xinbetween.com/de/about/2026-09-26 diff --git a/site/pages/index.html b/site/pages/index.html index a21c5e0..f6c801c 100644 --- a/site/pages/index.html +++ b/site/pages/index.html @@ -348,6 +348,11 @@

What's coming

Flowlight watches, explains and refuses today. This is the order the rest is being built in.

+
Coverage, stated rather than assumed 0.9.0

Per app: watched by the extension, decrypted by the proxy, named only by DNS or SNI, or not covered at all — and why, with the fix where there is one. A tool that claims completeness is worth less than one you can trust about its own limits.

+
A threat model, written down 0.9.1

What Flowlight defends against and what it doesn't, on one page: software misbehaving in the open, not software with root. Monitoring, not prevention, said beside every mention of blocking. Plus a security contact, and fonts served from here rather than from Google.

+
A budget for inspection 0.9.2

Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.

+
Show me what this rule would have done 0.9.3

Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.

+
What leaves the Mac, before it leaves 0.9.4

Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.

Linux, then Windows

The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.

From 640e4c47f6e8693f73cb151585db97a2fb7804b1 Mon Sep 17 00:00:00 2001 From: blessdyb Date: Sun, 27 Sep 2026 00:59:22 -0700 Subject: [PATCH 2/2] Roadmap: 1.0 is the other half of the exfiltration story MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flowlight can say an agent uploaded 40 MB somewhere unfamiliar. It cannot say it read ~/.ssh/id_rsa first, and a file leaving is a read followed by a send — so today it watches half the event and names it in full. Deliberately not a resource monitor. CPU, memory and energy per process are Activity Monitor's job, already on every Mac and done well; adding tabs for them would make this a worse Activity Monitor with one good tab. The one number of that shape worth having belongs beside the away-activity alert, not in a tab. The two gates are in the entry rather than waiting to be discovered: EndpointSecurity needs an entitlement Apple grants on review, and the data it yields is sensitive enough that 0.9.2's inspection budget becomes a prerequisite rather than a nicety. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 17 +++++++++++++++++ docs/index.html | 1 + docs/llms-full.txt | 2 ++ site/pages/index.html | 1 + 4 files changed, 21 insertions(+) diff --git a/README.md b/README.md index f5f7586..3528717 100644 --- a/README.md +++ b/README.md @@ -448,6 +448,23 @@ Planned, in order: is encrypted, exactly which fields travel and whether any of them are headers — the same disclosure Flowlight demands of everything else it watches, applied to itself. +- **1.0 — What an agent did besides the network.** Flowlight can say that Claude Code uploaded 40 MB to an + unfamiliar host. It cannot say that it read `~/.ssh/id_rsa` first, and that second half is the exfiltration + story: a file leaving is a read followed by a send, and only the send is visible today. This would record + what an agent's tools opened, wrote and spawned, and line it up against the connections that followed — + *read the private key, then talked to paste.example* as one finding rather than two screens. + + It is not a resource monitor. CPU, memory and energy per process are Activity Monitor's job, done well and + built into the Mac already; the only number of that kind worth having here is "this agent was busy while you + were away", which belongs beside the away-activity alert rather than in a tab of its own. + + **Two things gate it, both stated here rather than discovered later.** Per-process file attribution on macOS + needs the EndpointSecurity framework, whose entitlement Apple grants on request and review — not a + checkbox — and which only works from a system extension. And it would put far more sensitive material in + Flowlight's hands than network metadata ever did, so the inspection budget in 0.9.2 stops being a nicety and + becomes the thing that has to exist first. A tool that asks you not to monitor it has to deserve that twice + over when it can see every file you open. + Later, no version yet: - **Linux (Ubuntu).** A daemon plus a local web UI, sharing the Swift core (storage, protocol classification, agent diff --git a/docs/index.html b/docs/index.html index bf4574d..83f0483 100644 --- a/docs/index.html +++ b/docs/index.html @@ -407,6 +407,7 @@

What's coming

A budget for inspection 0.9.2

Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.

Show me what this rule would have done 0.9.3

Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.

What leaves the Mac, before it leaves 0.9.4

Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.

+
What an agent did besides the network 1.0

A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make read the private key, then talked to paste.example one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.

Linux, then Windows

The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.

diff --git a/docs/llms-full.txt b/docs/llms-full.txt index a41d659..521af15 100644 --- a/docs/llms-full.txt +++ b/docs/llms-full.txt @@ -1044,6 +1044,8 @@ e.g. Wireshark What leaves the Mac, before it leaves 0.9.4Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself. + What an agent did besides the network 1.0A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make read the private key, then talked to paste.example one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first. + Linux, then WindowsThe analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs. Privacy diff --git a/site/pages/index.html b/site/pages/index.html index f6c801c..3506b3b 100644 --- a/site/pages/index.html +++ b/site/pages/index.html @@ -353,6 +353,7 @@

What's coming

A budget for inspection 0.9.2

Recorded bodies are the most sensitive thing Flowlight holds. A header allowlist instead of a denylist, patterns of your own, an option to keep no headers at all, per-app ceilings, and a session that expires by itself.

Show me what this rule would have done 0.9.3

Replay the last day against a rule and list what it would have refused, before it refuses anything. The data is already there; it has only ever explained the past.

What leaves the Mac, before it leaves 0.9.4

Before the first row reaches a collector: the destination, whether it's encrypted, which fields travel and whether any are headers — the disclosure Flowlight demands of everything else, applied to itself.

+
What an agent did besides the network 1.0

A file leaving is a read and then a send, and only the send is visible today. Recording what an agent's tools opened, wrote and spawned would make read the private key, then talked to paste.example one finding instead of two screens. Not a resource monitor: CPU and memory are Activity Monitor's job. Needs Apple's EndpointSecurity entitlement, and needs the inspection budget above to exist first.

Linux, then Windows

The analysis core is portable Swift; capture isn't. A Linux daemon with a local web UI comes first, on eBPF rather than macOS APIs.