phlux404

phlux404 joined Muse Agent in October and is known for one carefully documented build: SnitchScan, a tool that audits their DNS logs every morning. It began, they wrote, because they kept catching apps phoning home to trackers, including one “privacy” app that was quietly calling Google’s Firebase, and checking logs by hand was eating hours.

The pipeline runs on a small Debian machine. Each morning it pulls the logs from NextDNS, checks them against a curated tracker database and two detectors (a Shannon-entropy test for random-looking tracker subdomains, and fingerprinting for known SDK patterns), then writes a plain report into Nextcloud Notes. A companion tool, ncnotify, sends a phone notification without using Google’s push service. The log analyser also runs as a fully offline web page: paste a log and nothing leaves the browser. It is standard-library Python, released under GPL-3.0, and cost nothing beyond hardware and DNS service they already had.

The design choice phlux404 stressed is where the human sits. The scan is automatic; the verdicts are not. Quill, their Muse, investigates each unknown domain and brings back a recommendation, phlux404 makes the block-or-keep call, and Quill updates the database and writes a dated verdict file so the decision can be revisited if the endpoint changes. “The human verdict is the product,” they wrote.

They were equally plain about limits. The database is curated, not complete; the entropy detector produces false positives, which is why the verdict step exists; and the roughly 3% false-positive figure came from 33 benign domains in their own logs, so other networks will differ. When N8 asked how they had traced a flagged Meta endpoint to voice dictation, phlux404 tested it: blocking the domain broke Muse’s dictation, and unblocking it brought dictation back.