:toc:
:icons: font
:author: Jonathan D.A. Jewell
The README makes claims. This file backs them up, traces the critical paths, and tells a reviewer exactly where to look.
DNS record randomization tool for deprecated HINFO and LOC records. Built with Ada for maximum security and type safety.
How it works:
The production implementation is the Ada crate at
hinfo_loc_fluctuator_ada/. The core type definitions are in
src/dns_records.ads — Ada’s package specification (.ads) is a pure
interface, with the body in the corresponding .adb file.
The type safety claim is literal: Ada’s range-checked fixed-point types are
used for all geographic values. Latitude_Degrees is declared as
delta 0.000_001 range -90.0 .. 90.0 — any value outside this range raises
Constraint_Error at runtime (and can be proven absent by SPARK). Similarly,
TTL_Seconds is range 1 .. 604_800 makes a zero-TTL or week-plus-TTL a
compile-time type error. DNS string fields use Ada.Strings.Bounded to enforce
the 255-character DNS field limit.
The randomisation engine is in src/randomizer.ads/adb. It loads three data
pools from data/: machines.txt (68 CPU types), operating_systems.txt
(77 OS names), and locations.csv (52 geographic coordinates). On each
fluctuation cycle, it picks randomly from these pools to generate a new
HINFO_Record or LOC_Record.
The Scheduler package (src/scheduler.ads/adb) uses Ada’s native task type
for periodic fluctuation — an Ada tasking construct that runs concurrently
without external threads library.
Honest caveat:
The CSV parser in randomizer.adb (Load_Location_Pool) reads the file name
but does not yet parse CSV content — it is marked in CLAUDE.md as a known
stub. The dns_update.adb (RFC 2136 dynamic DNS UPDATE) is framework-complete
but actual DNS server communication is not yet implemented. SPARK formal
verification is on the backlog (PROOF-NEEDS.md).
Make your server appear to exist in quantum superposition - simultaneously as different hardware in multiple locations! Serious Uses: Honeypot obfuscation (make honeypots appear to move), attack response and deception, privacy enhancement for public DNS records, security research and education.
How it works: HINFO (RFC 1035) and LOC (RFC 1876) records are deprecated per RFC 8482 — intentionally. Their deprecation means they appear in DNS responses but are ignored by most resolvers, making them ideal for decoy/obfuscation signals without affecting production resolution of A/AAAA/MX records.
The security model layers are:
-
src/secure_auth.ads/adb— Permission system with five levels (None,Read_Only,Modify_Local,Modify_Remote,Admin). Uses constant-time password comparison to prevent timing-based credential inference. 30-minute session timeout. Nonce-based replay attack detection. -
src/firewall_manager.ads/adb— Port rotation with a time-based algorithm; service scheduling so the attack surface changes on a schedule aligned with DNS fluctuation. -
src/sdp_controller.ads/adb— Zero-trust Software-Defined Perimeter with Single Packet Authorization (SPA). -
src/logger.ads/adb— Thread-safe audit logging via Ada protected objects.
The Elixir prototype under hinfo_loc_fluctuator/ was the original
implementation. It was superseded by the Ada implementation after identifying
that DNS infrastructure modification warrants Ada’s compile-time safety
guarantees over Elixir’s dynamic model.
Honest caveat:
Demo credentials (admin/user/operator) are hardcoded in secure_auth.adb
with placeholder hash values. These MUST be replaced before any real deployment.
Real crypto (bcrypt/Argon2) is not yet integrated. Actual DNS server
communication requires TSIG authentication (RFC 2845) which is specified but
not cryptographically implemented.
| Repo / System | How the fluctuator is used | Status |
|---|---|---|
|
Shares DNS record type knowledge; LOC record model is reference for Hesiod HS-class positioning |
Design reference |
|
Planned: fluctuator’s deception-tech patterns inform Hypatia honeypot-detection rules |
Planned |
Security research |
Used to demonstrate "quantum server" for educational/conference material |
Live (manual) |
Personal DNS infrastructure |
Intended for public-facing DNS obfuscation on hyperpolymath.org zones |
Intended |
| Path | What’s There |
|---|---|
|
Primary implementation — the Ada codebase (RECOMMENDED) |
|
Critical path. Core type definitions: |
|
Data pool loading and random record generation; reads |
|
Authentication: five permission levels, constant-time compare, nonce-based replay detection |
|
Ada |
|
Text-based menu TUI for interactive operation |
|
BIND zone file generation (RFC 1035 format) |
|
Thread-safe audit logger via Ada protected objects |
|
RFC 2136 DNS UPDATE framework (TSIG stub) |
|
Port rotation and service scheduling |
|
Zero-trust SDP with Single Packet Authorization |
|
Entry point; bootstraps TUI and scheduler |
|
68 CPU type strings for HINFO randomisation |
|
77 OS name strings for HINFO randomisation |
|
52 geographic locations for LOC randomisation |
|
GNAT project file (compiler flags, safety checks enabled in all modes) |
|
Build targets: |
|
Detailed honeypot/deception/privacy use case scenarios |
|
Enterprise feature guide (SDP, protocol management) |
|
Original Elixir prototype — reference only, NOT recommended for production |
|
SPARK formal verification backlog |
|
Build recipes: |
|
Reproducible environment (includes GNAT compiler) |
|
Contractile trust/dust/intend check files |
|
A2ML state, meta, ecosystem, agentic, neurosym, playbook manifests |