Now
Last updated: 2026-08-20. A living page, in the spirit of nowness.ist.
Building
-
Nullsec (https://nulls.ec) - a mobile reverse-engineering playground: on-demand research devices, agents, and the orchestrator that drives them. Most of my waking hours go here.
-
Untrust Labs (https://untru.st) - account intelligence: give it one identifier (email, phone, username, crypto address) and it resolves the accounts behind it, with virtual investigation devices to run the workflow end to end.
Research
-
One advisory is in coordinated disclosure: a 21-byte crash in a widely used HTML sanitizer, filed privately on 2026-08-20 (GHSA-jm4j-9c88-3hxm, in triage). The write-up is embargoed until it publishes.
-
Reading up on parser differentials in HTML sanitizers: the same spec-vs-implementation gap keeps paying out across ecosystems.
Elsewhere
-
Hand-built this site: one Go binary, AsciiDoc, no client-side JavaScript. New member of hotlinewebring.club, petitioned geekring.
-
Petitioning webrings and nursing a growing badge wall, like it is 1996.
