NeXuS P2P — POINT2POINT¶
Definition¶
POINT — Points Of Identifying Network Telemetry
POINT2POINT — The NeXuS violation definition and point system for identifying, naming, scoring, and classifying every network telemetry exposure event across both ends of a transaction.
POINT identifies what is leaking. POINT2POINT tells you how bad it is and who can use it against you.
Every network transaction has two ends. Every end is an exposure event.
If it talks out, it talks about you. If it talks back, it confirms you.
Why P2P¶
A single outbound request is not just a request. It is:
- A declaration that you exist
- A disclosure of where you are
- A record of when you are active
- A fingerprint of what you are running
- A confirmation that you received the response
Between those two POINTs — the request and the response — is a complete surveillance transaction. Origin, destination, timing, content, confirmation of receipt. All logged. All linkable. All permanent.
That transaction is what POINT2POINT measures.
The Total Violation Baseline¶
To anchor the math we start at the ceiling — total violation.
Example: Logging into Google under your real name
- Real name entered
- Real IP address exposed
- Known device, known browser
- Browser fingerprint unique to you
- Geolocation confirmed by IP
- Session timing recorded
- Behavioral profile updated
- Third-party loggers on every asset
- No privacy stack, no routing, no mitigation
Every layer of identity confirmed simultaneously, both directions.
This is 100 POINT. The total violation score.
Everything else is measured against it.
The Five POINTs¶
Each POINT is a named, self-describing category of identifying telemetry. The name IS the definition. The definition IS the audit checklist.
| POINT | Full Name | What It Reveals |
|---|---|---|
| P | Physical Location | IP geolocation, GPS, timezone, city-level or better positioning derived from your connection |
| O | Operational Pattern | Session timing, uptime cadence, usage schedule, behavioral rhythm — the fingerprint of when you exist online |
| I | Identity Anchor | User-Agent, device ID, persistent cookies, real name, account handle — anything that creates a trackable, consistent identity across sessions |
| N | Network Path | Exit node, VPN provider, routing topology, ISP — the infrastructure between you and the destination |
| T | Technical Profile | OS, desktop environment, software versions, hardware specs — the fingerprint of what you are running |
Scoring a Component¶
Every software component, widget, service or daemon that makes network requests is scored against all five POINTs — twice.
Outbound POINT = what you reveal by making the request
Inbound POINT = what is confirmed about you by the response
Component Score = Outbound POINT + Inbound POINT
Outbound POINT Scoring¶
Score 0-5 outbound — one point per category triggered:
| Triggered | Score |
|---|---|
| P — Physical location revealed by request | +1 |
| O — Operational pattern exposed by timing/cadence | +1 |
| I — Identity anchor transmitted in request | +1 |
| N — Network path disclosed or unrouted | +1 |
| T — Technical profile leaked via headers/metadata | +1 |
Max outbound: 5
Inbound POINT Scoring¶
Score 0-5 inbound — one point per category confirmed by response:
| Confirmed | Score |
|---|---|
| P — Physical location confirmed by tailored response | +1 |
| O — Operational pattern logged by server cadence record | +1 |
| I — Identity anchor reinforced by session/account response | +1 |
| N — Network path confirmed reachable and recorded | +1 |
| T — Technical profile confirmed by version-specific response | +1 |
Max inbound: 5
Component Total¶
Multipliers¶
Not all violations are equal weight. Apply the appropriate multiplier:
| Class | Multiplier | Condition |
|---|---|---|
| User-Initiated | x1 | You triggered it manually |
| Automatic | x2 | Runs on a schedule without your action |
| Persistent | x3 | Creates or reinforces a long-term trackable identity |
Example — Weather Widget¶
| Check | Outbound | Inbound |
|---|---|---|
| P — Physical location | +1 (IP geolocation request) | +1 (local weather confirms location) |
| O — Operational pattern | +1 (polls every 30 min) | +1 (server logs your cadence) |
| I — Identity anchor | +1 (User-Agent identifies desktop) | +1 (consistent requester profiled) |
| N — Network path | +1 (clearnet, unrouted) | +1 (exit IP confirmed reachable) |
| T — Technical profile | +1 (widget version in headers) | +1 (version-matched response) |
| Subtotal | 5 | 5 |
A weather widget scores 20 POINT2POINT. It was removed from the NeXuS desktop.
System Score¶
Audit every component that makes network requests. Sum their scores. That is your system's current POINT2POINT exposure level.
Target for NeXuS systems: 0
Threat Capability Tiers¶
Threat models are defined by capability — not by agency name or jurisdiction. The ceiling is the maximum system score at which you remain protected against that capability.
| Tier | Capability | Max Tolerated Score | What They Can Do |
|---|---|---|---|
| APEX | Full signals intelligence | 0 | Passive collection, ISP access, legal compulsion, zero-day exploits, metadata analysis at scale, traffic correlation across the entire internet |
| PURSUIT | Active targeted deanonymization | 2 | Correlation attacks, exit node monitoring, targeted surveillance, account linking across platforms |
| HARVEST | Passive bulk collection | 10 | Behavioral profiling, ad network data aggregation, data broker records, browser fingerprinting |
| OBSERVE | Network-level visibility | 20 | ISP traffic analysis, same-network interception, DNS monitoring, unencrypted traffic inspection |
| SCAN | Opportunistic automated attacks | 40 | Port scanning, known vulnerability exploitation, non-targeted mass collection |
| OPEN | No adversary | 100 | Public internet, no privacy expectation, total violation baseline |
Reading the Table¶
If your threat model is APEX your system must score 0. Every component must be routed, every request must be user-initiated, every POINT must be mitigated. One weather widget running and you are already over your ceiling. You are exposed against that capability before anyone even tries.
If your threat model is HARVEST you can tolerate up to 10. A user-initiated, Tor-routed software check scoring 3 is acceptable. An automatic unrouted update notifier scoring 12 is not.
Mitigation Credits¶
Mitigations reduce a component's score. Apply credits before multipliers.
| Mitigation | Credit |
|---|---|
| Routed through Tor | -2 |
| Routed through I2P | -2 |
| Routed through Medusa | -1 |
| User-initiated only (no schedule) | -1 |
| No third-party server (self-hosted) | -2 |
| Encrypted transport (TLS minimum) | -1 |
Example — Tor-Routed Manual Update Check¶
Raw score: P+N outbound (2) + O+N inbound (2) = 4 Credits: Tor (-2) + User-initiated (-1) = -3 Mitigated score: 4 - 3 = 1 Multiplier: x1 (user-initiated) Final: 1 POINT2POINT — acceptable up to PURSUIT tier.
The Audit¶
To score your system:
- List every component that makes network requests
- Score each component outbound (0-5) and inbound (0-5)
- Apply mitigation credits
- Apply the multiplier
- Sum all final scores
- Compare against your threat model ceiling
If your total exceeds your ceiling — you have components that expose you to that adversary. Remove them, route them, or accept the risk with full awareness.
POINT2POINT and the NeXuS Desktop¶
The NeXuS desktop targets score 0 at all times.
- No weather widgets — scores 20, removed
- No update notifiers — automatic, unrouted, scores high
- No crash reporters — persistent identity anchor, scores high
- Clock reads local system time — no network request, scores 0
- Time sync via chrony over Tor — mitigated to acceptable
- All browsing through Medusa — N mitigated on every request
The desktop itself generates zero unsolicited outbound traffic. Every connection is intentional, routed, and auditable.
Summary¶
POINT = Points Of Identifying Network Telemetry
P = Physical Location
O = Operational Pattern
I = Identity Anchor
N = Network Path
T = Technical Profile
POINT2POINT = Outbound exposure + Inbound confirmation
Score 0 = APEX tier protection
Score 100 = Total violation
Every scheduled outbound call is a heartbeat. Heartbeats can be heard. NeXuS does not broadcast a heartbeat.
NeXuS — Sane • Simple • Secure • Stealthy • Beautiful