Uplink -- Public Wi-Fi Footprint Reducer

The goal is to make a Unix laptop as quiet on an untrusted network as a hardened phone. A shared, platform-agnostic core drives one sink per OS, which reads and changes the identifiers the device broadcasts. The tool observes before it mutates: it shows exactly what leaks before it touches any interface, and the scan doubles as the before/after read that each harden step is checked against. It is not a VPN or anonymity tool: it reduces device identifiers, not what your traffic contains.

• The scan command collects all 11 identifier categories: MAC, IPv4, IPv6, hostname, DHCP, mDNS, DNS, listening services, connectivity checks, OS/TCP-stack fingerprint and telemetry (NTP).
• Each finding is rated for exposure (info, fingerprintable or identifying) and records whether Uplink can reduce it. Findings it cannot reduce are still reported, not dropped.
• Needs no privileges. --json emits the same report for scripting.

• The harden command neutralises the hostname across DHCP and mDNS, and repoints DNS at a bundled local forwarder that sends queries upstream over DNS-over-TLS (rustls). --dry-run prints the planned changes and touches nothing (run it as root on Linux for a complete preview).
• Changes apply as a transaction: if any step fails, the steps already applied are rolled back before harden returns (tested against a simulated sink).
• Every change records the value it replaced in a root-only journal, so restore puts back each prior value or removes what Uplink created.
• The diff command compares before and after scans. The status command needs no root and reports clean, hardened or stale, so you can see if DNS was left broken.
• Planned: MAC and IPv6 hardening (milestone M4).

• Rust workspace with a shared core, Linux and macOS sinks, and a CLI crate that selects the active sink.
• The sinks share a core but have different capabilities. macOS blocks userspace MAC changes on much recent hardware, so on macOS the scan checks Apple's Private Wi-Fi Address and tells you when to turn it on.
• Validated on real hardware: scan and hostname hardening on both OSes, and the full harden → scan → restore cycle on macOS. Linux DNS hardening is unit-tested and still awaits a hardware run.
• 267 tests (plus 3 opt-in live-network tests), with CI running fmt, clippy, tests, build and docs.