Engineering, mostly at the edges of intuition

🔴 Radar status: 5 findings today

---

I build small tools around systems where the obvious explanation is often not quite true.

DNS, SSH, Zero Trust, timing, packet captures, configuration formats, infrastructure - things we've had for years and think we already understand.

Usually it starts with:

"Is that actually what happens?"

Then I go find out. friction → investigation → hypothesis → tool. The tool is just the artifact.

---

Live Radar (based on gai)

Resolution divergence (gai doctor per-domain reality check) - last run 2026-08-29 11:58 UTC

14 divergence(s) in the last 3 days across 14 tracked domains -- most recent on 2026-08-29. (mostly anycast/GeoDNS edges disagreeing between two queries -- full per-domain log for 2026-08-29)

README integrity · signed 2026-08-29 12:34 UTC · verify

SHA256: 01b86f71e20cdccc… · my PGP key Zero Trust isn't just for infra. Don't trust this file either -- verify it.

Most disagreeing domains (30 days)

Domain	Divergences
github.com	3
google.com	3
netflix.com	3
ipv6.google.com	3
akamai.com	2

---

Trust & Identity

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

• khm - known_hosts is not just a cache. It's a database of server identities.
• cfzt - Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
• gai - dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.
• burnafterread - sharing a secret doesn't have to mean giving the server access to it. live

Measurement

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

• sidecheck - remote timing side-channel detection using statistics instead of a stopwatch.

Network Forensics

Packets are evidence, not truth.

Network Forensics Series

• ospf-postmortem - reconstruct the OSPF FSM and find why an adjacency got stuck. live
• dhcp-postmortem - reconstruct DORA and detect failures from packet evidence. live
• stp-postmortem - reconstruct STP/RSTP behaviour, topology changes and root causes. live
• dns-postmortem - DNS traffic, anomaly detection and tunneling analysis. live

Everything runs locally in the browser. PCAPs never leave the machine.

Semantics & Infrastructure

Some problems look like parsing or automation problems until you look closer. But most "automation" is just someone's assumptions, hardcoded and left to rot.

• netconv - configuration conversion is about semantics, not replacing keywords.
• pcap-frame-parser - packet formats have decades of edge cases hiding behind deceptively simple structures.
• platform-infra - self-service infrastructure for small teams, without turning the sysadmin into an API.

---

A few libs

Library / Package	Version	Docs	Downloads
gai-core
gai-probe
sidecheck-core
netconv-core
pcap-frame-parser
burnafter		—
@lighthouse-explorer/light-parser		—

---

PGP · Stack

---