Engineering, mostly at the edges of intuition

🔴 Radar status: 5 findings today

---

I build and break things around systems where the obvious explanation is often not quite true.

Usually it starts with:

"Is that actually what happens?"

Then I go find out. friction → investigation → hypothesis → tool. The tool is just the artifact.

---

Live Radar (based on gai)

Resolution divergence (gai doctor per-domain reality check) - last run 2026-09-09 10:24 UTC

58 divergence(s) in the last 14 days across 14 tracked domains -- most recent on 2026-09-09. (mostly anycast/GeoDNS edges disagreeing between two queries -- full per-domain log for 2026-09-09)

README integrity · signed 2026-09-09 11:05 UTC · verify

SHA256: 8e53b608f7614196… · my PGP key Zero Trust isn't just for infra. Don't trust this file either -- verify it.

Most disagreeing domains (30 days)

Domain	Divergences
ipv6.google.com	14
google.com	13
netflix.com	12
github.com	10
akamai.com	9

---

Trust & Identity

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

• khm
  known_hosts is not just a cache. It's a database of server identities.
• cfzt
  Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
• gai
  dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.
• burnafterread
  sharing a secret doesn't have to mean giving the server access to it. live

Measurement

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

• sidecheck
  remote timing side-channel detection using statistics instead of a stopwatch.

Network Forensics

Packets are evidence, not truth.

Network Forensics Series

• ospf-postmortem
  reconstruct the OSPF FSM and find why an adjacency got stuck. live
• dhcp-postmortem
  reconstruct DORA and detect failures from packet evidence. live
• stp-postmortem
  reconstruct STP/RSTP behaviour, topology changes and root causes. live
• dns-postmortem
  DNS traffic, anomaly detection and tunneling analysis. live

Everything runs locally in the browser. PCAPs never leave the machine.

Semantics & Infrastructure

Some problems look like parsing or automation problems until you look closer. But most "automation" is just someone's assumptions, hardcoded and left to rot.

• netconv
  configuration conversion is about semantics, not replacing keywords.
• pcap-frame-parser
  packet formats have decades of edge cases hiding behind deceptively simple structures.
• platform-infra
  self-service infrastructure for small teams, without turning the sysadmin into an API.

---

A few libs extracted from the tools

Library / Package	Version	Docs	Downloads
gai-core
gai-probe
sidecheck-core
netconv-core
pcap-frame-parser
burnafter		—
@lighthouse-explorer/light-parser		—

---

PGP · Stack

---