🔴 Radar status: 5 findings today

I build small tools around systems where the obvious explanation is often not quite true.

DNS, SSH, Zero Trust, timing, packet captures, configuration formats, infrastructure - things we've had for years and think we already understand.

Usually it starts with:

"Is that actually what happens?"

Then I go find out. friction → investigation → hypothesis → tool. The tool is just the artifact.

Resolution divergence (gai doctor per-domain reality check) - last run 2026-08-29 11:58 UTC

14 divergence(s) in the last 3 days across 14 tracked domains -- most recent on 2026-08-29. (mostly anycast/GeoDNS edges disagreeing between two queries -- full per-domain log for 2026-08-29)

README integrity · signed 2026-08-29 12:34 UTC · verify

SHA256: 01b86f71e20cdccc… · my PGP key Zero Trust isn't just for infra. Don't trust this file either -- verify it.

Most disagreeing domains (30 days)

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

• khm - known_hosts is not just a cache. It's a database of server identities.
• cfzt - Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
• gai - dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.
• burnafterread - sharing a secret doesn't have to mean giving the server access to it. live

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

• sidecheck - remote timing side-channel detection using statistics instead of a stopwatch.

Packets are evidence, not truth.

Network Forensics Series

• ospf-postmortem - reconstruct the OSPF FSM and find why an adjacency got stuck. live
• dhcp-postmortem - reconstruct DORA and detect failures from packet evidence. live
• stp-postmortem - reconstruct STP/RSTP behaviour, topology changes and root causes. live
• dns-postmortem - DNS traffic, anomaly detection and tunneling analysis. live

Everything runs locally in the browser. PCAPs never leave the machine.

Some problems look like parsing or automation problems until you look closer. But most "automation" is just someone's assumptions, hardcoded and left to rot.

• netconv - configuration conversion is about semantics, not replacing keywords.
• pcap-frame-parser - packet formats have decades of edge cases hiding behind deceptively simple structures.
• platform-infra - self-service infrastructure for small teams, without turning the sysadmin into an API.

A few libs

Library / Package	Version	Docs	Downloads
gai-core
gai-probe
sidecheck-core
netconv-core
pcap-frame-parser
burnafter		—
@lighthouse-explorer/light-parser		—

PGP · Stack