Engineering, mostly at the edges of intuition

I build small tools around systems where the obvious explanation is often not quite true.

DNS, SSH, Zero Trust, timing, packet captures, configuration formats, infrastructure - things we've had for years and think we already understand.

Usually it starts with:

"Is that actually what happens?"

Then I go find out.

What I'm digging into

Trust & Identity

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

khm - known_hosts is not just a cache. It's a database of server identities.
cfzt - Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
burnafterread - sharing a secret doesn't have to mean giving the server access to it.

Measurement

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

sidecheck - remote timing side-channel detection using statistics instead of a stopwatch.
gai - dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.

Network Forensics

We usually treat packets as what happened. Turns out, they're just evidence of what happened.

Network Forensics Series

ospf-postmortem - reconstruct the OSPF FSM and find why an adjacency got stuck.
dhcp-postmortem - reconstruct DORA and detect failures from packet evidence.
stp-postmortem - reconstruct STP/RSTP behaviour, topology changes and root causes.
dns-postmortem - DNS traffic, anomaly detection and tunneling analysis.

Everything runs locally in the browser. PCAPs never leave the machine.

Semantics & Infrastructure

Some problems look like parsing or automation problems until you look closer. Turns out most "automation" is just someone's assumptions, hardcoded and never questioned as shit.

netconv - configuration conversion is about semantics, not replacing keywords.
pcap-frame-parser - packet formats have decades of edge cases hiding behind deceptively simple structures.
platform-infra - self-service infrastructure for small teams, without turning the sysadmin into an API.