I build small tools around systems where the obvious explanation is often not quite true.

DNS, SSH, Zero Trust, timing, packet captures, configuration formats, infrastructure - things we've had for years and think we already understand.

Usually it starts with:

"Is that actually what happens?"

Then I go find out.

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

• khm - known_hosts is not just a cache. It's a database of server identities.
• cfzt - Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
• burnafterread - sharing a secret doesn't have to mean giving the server access to it.

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

• sidecheck - remote timing side-channel detection using statistics instead of a stopwatch.
• gai - dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.

We usually treat packets as what happened. Turns out, they're just evidence of what happened.

Network Forensics Series

• ospf-postmortem - reconstruct the OSPF FSM and find why an adjacency got stuck.
• dhcp-postmortem - reconstruct DORA and detect failures from packet evidence.
• stp-postmortem - reconstruct STP/RSTP behaviour, topology changes and root causes.
• dns-postmortem - DNS traffic, anomaly detection and tunneling analysis.

Everything runs locally in the browser. PCAPs never leave the machine.

Some problems look like parsing or automation problems until you look closer. Turns out most "automation" is just someone's assumptions, hardcoded and never questioned as shit.

• netconv - configuration conversion is about semantics, not replacing keywords.
• pcap-frame-parser - packet formats have decades of edge cases hiding behind deceptively simple structures.
• platform-infra - self-service infrastructure for small teams, without turning the sysadmin into an API.

Library / Package	Version	Docs	Downloads
gai-core
gai-probe
sidecheck-core
netconv-core
pcap-frame-parser
burnafter		—
@lighthouse-explorer/light-parser		—

I don't usually start with:

"What tool should I build?"

It's more often:

"Why the hell does this work like that?"

Then:

friction → investigation → hypothesis → tool

The tool is just the artifact.

PGP · Stack