Background on the tools I build, the ones I discover elsewhere, and other things I'm learning.
A side project I built just for fun - a hold-and-release arcade jumper where every level is a different networking or sysadmin idea. It started as a derivation of 100 Jumps, with its author's blessing, and grew into 27 levels of packet-pushing nonsense.
Read moreA worked example of running OnionShare CLI as a boot-time systemd service: a persistent Tor onion address for sharing or receiving files, with no torrc edits and no web server to write.
Read morePushing real-time updates to browser clients is easy. Doing it securely - with proper token auth, multi-tab support, and a clean fan-out - is less easy. This is a Node-RED flow that does all three, using a 'secure hello' pattern where the client sends a short-lived token after connecting.
Read morephp-sqlcipher has been building drop-in SQLCipher-linked PHP packages since early 2013. What started as a sed-and-compile script is now a Docker + gvisor/runsc pipeline inside a QubesOS VM, tracking SQLCipher across PHP 7.4-8.5 and five Debian/Ubuntu releases.
Read moreGuardUtils is a suite of four small Python CLIs by Marco D'Aleo (SysMD) that share a common philosophy: take the irreversible, mistake-prone commands every sysadmin runs daily and make them reversible, previewable, and fail-closed. chguard, mirro, resrm, and filedust each address a different jam.
Read morecspresso uses Playwright's headless Chromium to crawl a site, observe what loads, and emit a draft Content-Security-Policy header. Over its first few releases it gained CSP bypass, policy evaluation, and non-HTML filtering.
Read moreWhen a server drifts, you want to know now - not the next time you run a compliance audit. This is a small Node-RED flow that catches Enroll diff webhooks, formats the changes into a readable summary, and sends it to your phone via Signal. Nine nodes, one honest security note.
Read moreA practical case study in SQLite transaction tuning: why each implicit insert is its own transaction, how BEGIN IMMEDIATE changes the picture, and the monitoring that proved the fix worked.
Read moreJinjaTurtle started as a quick way to turn TOML and INI files into Jinja2 templates and Ansible defaults. It now handles seven config formats, generates loops from repeated structures, and neutralises template metacharacters to prevent injection from harvested config.
Read moreEnroll started as a way to snapshot a snowflake server's /etc into Ansible roles. After months of development and several security audits, it's a hardened harvesting tool with remote mode, SOPS encryption, drift detection, and a focus on fail-closed safety.
Read more