Skip to content

v0.1.5 — LustLess (DNS that stays alive, and answers instantly)

Choose a tag to compare

View all tags
@HenryGetz HenryGetz released this 14 Oct 03:12
· 17 commits to main since this release
v0.1.5
671bc30

Linux accountability client (Covenant Eyes-compatible, clean-room reimplementation).

Install

curl -fsSL https://github.com/HenryGetz/LustLess/releases/latest/download/install.sh | sudo bash

Detects your distro, downloads the matching package, installs it with the
native tool, starts the agent — and the sign-in window opens. Log in there.
Other ways:

Distro File Command
Debian / Ubuntu / Zorin / Mint lustless_0.1.5_amd64.deb sudo apt install ./lustless_0.1.5_amd64.deb
Fedora lustless-0.1.5-1.x86_64.rpm sudo dnf install ./lustless-0.1.5-1.x86_64.rpm
Bazzite / immutable Fedora lustless-0.1.5-1.x86_64.rpm sudo rpm-ostree install ./lustless-0.1.5-1.x86_64.rpm && reboot
Arch / EndeavourOS / SteamOS lustless-0.1.5-1-x86_64.pkg.tar.zst sudo pacman -U ./lustless-0.1.5-1-x86_64.pkg.tar.zst
Alpine lustless-0.1.5-r0.apk sudo apk add --allow-untrusted ./lustless-0.1.5-r0.apk

Uninstall: sudo apt purge lustless (or the dnf/rpm-ostree/pacman/apk
equivalent) — restores the DNS, browser-policy and polkit state exactly as
found.

What's new

Fail-closed is about filtering decisions, not about taking the machine off
the network. Three fixes:

  • DNS is never broken by an install: the installer probes the filter on
    127.0.0.2:53 and, when nothing answers, leaves your /etc/resolv.conf
    untouched and tells you why (previously a machine where the daemon could not
    start lost all name resolution — no package manager, no updates).
  • The daemon is never left dead: Restart=always, no restart limit (was
    3 restarts per 10 s, after which systemd gave up and the box had no
    resolver), OpenRC respawn_max=0. The service re-applies the DNS redirect
    on every start, so a machine installed while the filter was broken becomes
    filtered as soon as it runs.
  • Blocked answers are instant: signed-out lookups took ~2 s because
    per-query process attribution (a SOCK_DIAG netlink dump with a 2 s timeout)
    ran before the fail-closed shortcut. Reordered, plus a 30 s circuit breaker
    on netlink failures. Measured: 2055 ms → 4-20 ms per query, verdict
    unchanged (blocked.lustless.local → 127.0.0.2).

Carried over from 0.1.4: the agent's main loop actually runs (gio hold guard),
the sign-in window opens by itself on install and at login, the CE shield at
every icon size, and the application-menu launcher.

Assets 8
Loading