No silent DNS hijacking: how do we prove it to skeptics?

The manifesto promise is no silent DNS hijacking: no root certificates, no system-wide proxies, no compulsory DNS replacement. People will not believe a promise, they will believe a measurement.

Proposal for a public claim check anyone can run on their machine after installing YU Connect:

• Compare resolver settings before and after.
• Compare the trusted certificate list before and after.
• Compare proxy settings before and after.
• Listen to outgoing connections for a ten minute session.

We publish a script and a short checklist. If any line changes, we fail the release. Who wants to help write the checklist for Windows, macOS and Linux?

Linux part I can do: resolv.conf, systemd-resolved state, certificate store hash, environment proxies. Will keep it read-only, the script must never modify anything.

I have three machines with different Windows versions in the garage. They are slow, which is a feature for testing. Count me for Windows.

Suggestion: print the result as a small card people can screenshot. 'Verified: nothing changed on this computer'. Shareable trust.

Nice, but careful with wording: 'nothing changed in these checks', not a blanket guarantee. Honest claims age better.

I can test macOS on an older laptop and write down what a non-expert sees. Fresh eyes are cheap.