Engineering, mostly at the edges of intuition

I build small tools around systems where the obvious explanation is often not quite true.

DNS, SSH, Zero Trust, timing, packet captures, configuration formats, infrastructure - things we've had for years and think we already understand.

Usually it starts with:

"Is that actually what happens?"

Then I go find out.

What I'm digging into

Trust & Identity

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

khm - known_hosts is not just a cache. It's a database of server identities.
cfzt - Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
gai - dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.
burnafterread - sharing a secret doesn't have to mean giving the server access to it.

Measurement

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

sidecheck - remote timing side-channel detection using statistics instead of a stopwatch.

Network Forensics

We usually treat packets as what happened. Turns out, they're just evidence of what happened.

Network Forensics Series

ospf-postmortem - reconstruct the OSPF FSM and find why an adjacency got stuck.
dhcp-postmortem - reconstruct DORA and detect failures from packet evidence.
stp-postmortem - reconstruct STP/RSTP behaviour, topology changes and root causes.
dns-postmortem - DNS traffic, anomaly detection and tunneling analysis.

Everything runs locally in the browser. PCAPs never leave the machine.

Semantics & Infrastructure

Some problems look like parsing or automation problems until you look closer. Turns out most "automation" is just someone's assumptions, hardcoded and never questioned as shit.

netconv - configuration conversion is about semantics, not replacing keywords.
pcap-frame-parser - packet formats have decades of edge cases hiding behind deceptively simple structures.
platform-infra - self-service infrastructure for small teams, without turning the sysadmin into an API.