SinkHole

A local privacy event horizon for ads, trackers, and Windows telemetry.

Comment

What it does

SinkHole is a cosmic-themed Windows privacy proxy that makes an invisible part of ad blocking visible: whether browser traffic is actually connected to the blocker.

The app runs a local Rust HTTP/HTTPS CONNECT proxy at 127.0.0.1:8118. With one switch, it connects the current Windows user's browser traffic, checks destination hostnames against locally compiled privacy lists, and sinks known advertising, tracking, and Windows telemetry endpoints before a connection is made. It never installs a root certificate or decrypts HTTPS content.

SinkHole separates three states that privacy tools often blur together:

  1. The filter engine is enabled.
  2. Windows browser traffic is routed through the proxy.
  3. The proxy has actually observed traffic.

The cosmic dashboard reports those states independently, separates ads, trackers, and telemetry into clear counters, manages privacy lists and allowed domains, and includes a local sinkhole.test proof page. A compact WARP-style tray popover exposes the same truthful state without opening the dashboard. A bounded, memory-only activity view shows recently blocked hostnames without storing URLs, payloads, or browsing history.

How we built it

SinkHole uses Tauri v2, Rust, React, TypeScript, and Tailwind CSS. The Rust proxy evaluates genuinely hostname-wide rules from EasyList, EasyPrivacy, and HaGeZi's Windows/Office telemetry list. HTTPS stays encrypted because filtering occurs at the CONNECT hostname boundary.

Windows proxy settings are backed up before connection and restored on disconnect or normal tray quit. The packaged proxy was stress-tested with 3,000/3,000 blocked requests and verified to keep representative ad-block test sites loadable.

How Codex and GPT-5.6 were used

Codex with GPT-5.6 acted as an implementation partner across the project: inspecting the original Tauri architecture, extending categorized rule matching, designing reversible Windows proxy handling, adding TCP-level and regression tests, creating the tray workflow and cosmic interface, diagnosing whole-site false positives caused by browser-only path rules, generating the original visual identity and demo assets, and preparing documentation, packaging, and CI.

GPT-5.6 helped reason across Rust concurrency, React state and motion, Windows networking, filter-list semantics, accessibility, privacy boundaries, and product truthfulness as one system.

Challenges

  • Safely changing a system proxy without losing the user's previous configuration.
  • Keeping “filter enabled” distinct from “browser connected” and “traffic observed.”
  • Avoiding whole-site blocks when EasyList rules are path-specific or conditional.
  • Keeping HTTPS private while blocking known destinations at the hostname boundary.
  • Designing a tray-sized interface that remains understandable at a glance.

Accomplishments

  • Categorized ad, tracker, telemetry, and custom-rule counters.
  • One-click Windows connection with proxy backup and restoration.
  • Memory-only recent-block activity with no full browsing history.
  • Local connection proof page and compact tray control.
  • Windows MSI/NSIS packaging, strict Clippy, Rust tests, and packaged proxy stress testing.
  • Original cosmic branding, icon, motion design, and accessible reduced-motion behavior.

What we learned

A privacy dashboard should not claim protection merely because a background process is running. The useful state is a chain: proxy listening, browser routed, request observed, destination classified, and block recorded. We also learned that browser-only path rules must not be promoted into hostname-wide blocks by a proxy.

What's next

  • A browser-extension companion for cosmetic filtering and browser-only rules.
  • Per-app routing.
  • Signed installers and a crash-safe proxy watchdog.
  • Privacy-preserving historical charts with no cloud analytics.

Honest limits

SinkHole blocks known hosts. It does not remove cosmetic page elements, inspect encrypted URL paths, or stop applications from collecting data locally.

Built With

Share this project:

Updates