Cybersecurity
Explainable DNS and browser policy, durable URL intelligence, and a searchable live synthetic activity dashboard.
ORIGINAL CONTRIBUTIONS
TRY THE PRODUCT
Live synthetic activity, searchable decisions and customizable filters. No browsing traffic is filtered.
MRGI Web Fabric / What’s the Point / SYSTEM MAP
SYSTEMS DESIGN & OWNERSHIP
The Rust service separates its in-memory classification cache from a SQLite WAL queue and record history. Configured domains and URL terms supply evidence; unknown records remain explicitly unclassified. Query parameters remain intact for enforcement and are excluded from retained intelligence.
The Chromium gate checks top-level GET navigation before allowing it; DNS supplies a separate domain baseline. The portfolio reuses console styles, rendering helpers and URL utilities in an isolated local adapter. It models a visual subset and cannot establish identity or enforce a decision.
The laboratory exposes a controllable clock, exact-URL decision cache and an outage switch. Cached blocks remain, permits expire after five minutes, and uncached destinations deny. Classification history advances only when the explicit demo worker runs.
INSPECT THE WORK
EXPLORE THE ARCHITECTURE
Authenticated administrative mutations → SQLite policy → DNS decisions → encrypted upstream. Portfolio evaluation does not alter host DNS or firewall settings.
Manage rules and explain individual decisions.
ImplementationAxum routes expose rule mutations, audit queries and /api/test.
Security & failure behaviorMiddleware checks configured host/origin, session expiry, request header and CSRF token for cookie-authenticated mutations. Invalid sessions, origins, domains or mutation tokens fail before privileged handler execution.
TradeoffPaired-control authentication has a separate session path; its boundaries need independent review.
Persist policy, sessions and audit records.
ImplementationSQLx-backed database initialization and migrations feed application state.
Security & failure behaviorAdministrative sessions store token digests; rule mutations are audited by API handlers. Database failures propagate rather than fabricating configuration success.
TradeoffLocal durable state simplifies deployment; multi-node state synchronization is not shown.
Return a decision, matching domain and reason.
ImplementationExplicit allow rules at any ancestor precede blocks; domain suffix boundaries avoid substring matches.
Security & failure behaviorInput normalization rejects URLs, IP addresses and malformed labels at policy administration boundaries. Invalid rule/list input fails validation; no matching block defaults to allow.
TradeoffAllow-first precedence is intentional and can override a more specific block.
Apply filtering to DNS questions and alias answers.
ImplementationUDP/TCP service checks client scope, policy and cache; allowed questions use HTTPS upstreams. Cached aliases are re-evaluated.
Security & failure behaviorBlocked or unauthorized questions do not reach upstream; upstream answers undergo protocol validation. Blocked names receive NXDOMAIN; exhausted encrypted upstreams produce SERVFAIL.
TradeoffDNS decisions cannot inspect encrypted URL paths; browser policy enforcement is a separate code path.
TECHNICAL CASE STUDY
Apply explainable DNS and browser filtering rules consistently, including URLs whose spelling differs but identifies the same DNS host.
Policy precedence, identity requirements, domain and URL path matching, deterministic decisions, and safe reserved-domain tests without modifying host networking.
Rust policy evaluator, endpoint/control crates, and a browser extension. Source includes management and transport components; this replay only verifies the pure evaluator.
Identity and organization policy are inputs to decision logic. Browser host canonicalization must happen before all domain/category/path rules. A browser replay is not proof of privileged endpoint enforcement.
Four baseline commits are attributed to charlesderek. The reviewed contribution scope is the custom Rust evaluator and its tests. An exhaustive independent authorship audit remains outside this cycle.
DNS feed matching and explicit exceptions, browser URL domain/category/path rules, policy explanations, and required-user checks are exercised by the deterministic Rust example.
Signed device policies, TLS pairing, encrypted DNS upstream behavior, and production authentication were not exercised in this replay. Platform enforcement remains outside these results.
Malformed URLs fail validation. A double root dot is rejected. Domain boundary and IPv4/IPv6 behavior are regression-tested. The replay runs serially and establishes no throughput claim.
37 Rust workspace tests and 3 extension JavaScript tests passed. Formatting and strict Clippy passed. Two added root-dot regressions failed against the original implementation.
Before: https://restricted.example./ bypassed a domain block. After: one root dot is canonicalized before rule matching and multiple terminal dots are rejected. Local commit 711b1b1.
Independent endpoint and management code. The website loads a JSON replay exported from actual Rust logic; no host DNS or firewall settings are changed.
Canonicalize at the URL parser boundary so all rule types agree. Repeating suffix stripping independently in every matcher would invite inconsistent behavior.
The Browser policy replay exposes ten named fixtures with exact verdicts and reasons. Run cargo run --locked --offline --example policy_replay. This browser presents captured results rather than a live backend.
ENGINEERING SCOPE
Original custom policy and control implementation reviewed in local history; external libraries and feeds retain attribution.