1 files changed, 10 insertions, 0 deletions
diff --git a/profiles/noTunnels.nix b/profiles/noTunnels.nix
index f8f5154..292b034 100644
--- a/profiles/noTunnels.nix
+++ b/profiles/noTunnels.nix
@@ -1,4 +1,14 @@
 { }: {
+  meta.description = ''
+    Take reasonable precautions against the use of a proxy, or an encrypted DNS tunnel.
+
+    This can make sense if we do DNS-level filtering, and the user does not have full control
+    over the device they're using.
+
+    If a motivated user has local write and execution privileges, it is unlikely that we can prevent
+    them from circumventing these restrictions.
+  '';
+
   policies = {
     DNSOverHTTPS = {
       Enabled = false;