mrambossekandClaude Opus 5
e0428b4c84
The control plane now advertises the same name the web UI answers on. That is safe because the client authenticates by SPKI pin and explicitly does not verify the hostname — "pin is the trust, not the name" — so no certificate covers or needs to cover either name. The per-host name still means something, though, and the rule it encodes has to survive: pinning binds a client to one server's key, so fmr may be a CNAME to exactly one host and never a multi-address service record. A second server gets enrolled as fmr-2 explicitly, because a client that reaches a different key does not fail over, it fails. Minting a link was broken and had been since the authenticated admin UI replaced the old admin API: enroll-link.sh still posted to 127.0.0.1:8444/admin/enroll-tokens, an endpoint that no longer exists on a listener that no longer binds loopback. Rather than add a second unauthenticated door — which is how the old one ended up briefly reachable from the network — the binary mints its own link. Whoever can run it against the state directory already holds every privilege the server has, so authenticating them to themselves would be theatre. EnrollmentURI is shared with the running server's EnrollmentLink rather than reimplemented. Two copies of that encoding would eventually disagree, and the failure mode is a pin that looks right and surfaces as an inscrutable TLS error rather than as a bad pin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Echolot
Free software for detecting and debugging local network issues from an Android phone — built for people who actually know what a neighbor table is.
Most "wifi analyzer" apps show you signal bars. Echolot aims at the layer where home and office networks actually break: duplicate DHCP servers, broken IPv6 RAs, MTU black holes, NAT64 weirdness, multicast that dies at the AP, DNS that answers differently than it should. It records what it observed, separates observation from interpretation, and exports the whole run so you can argue with it later.
Status: pre-release. The capability prober runs on real hardware; the production app and the probe server are not built yet.
Repository layout
docs/ design docs — the contract for everything below
echolot-prober/ capability prober: validates the no-root feasibility matrix on real devices
The Go probe server and the production app land here as siblings.
Design docs
The three specs are draft-complete and reviewed; treat them as the contract.
| Doc | What it defines |
|---|---|
| docs/feature-catalog-and-feasibility.md | Full feature list + the no-root feasibility matrix |
| docs/measurement-schema.md | Archived/exportable measurement JSON (observation vs finding, two-clock rule, anonymization) |
| docs/probe-protocol.md | Client↔server wire protocol (pinned TLS control plane, binary UDP data plane, STUN, canary DNS) |
| docs/build-status.md | Running log of decisions and next steps |
Privilege tiers
Every result records which tier produced it:
app— no root, no special setup. The bulk of the functionality.shizuku— ADB-shell privileges via wireless pairing, no root. Shipped in v1.root— future optional module.
Licensing
| Part | License | Why |
|---|---|---|
| All code (app, prober, server) | GPL-3.0-or-later | The value here is the platform-API research; copyleft keeps derivative apps free |
docs/ (the specs) |
CC-BY-4.0 | A wire protocol and a measurement format should be implementable by anyone, without license anxiety |
Full texts: LICENSE (GPLv3) and docs/LICENSE (CC BY 4.0).
Sources carry SPDX-License-Identifier headers.
If you want to build a compatible server or client, the protocol and schema docs are deliberately permissive — go ahead.
Building
See echolot-prober/README.md. Short version, from echolot-prober/:
echo "sdk.dir=/path/to/Android/sdk" > local.properties
./gradlew :app:assembleDebug