$ whoami
typo — independent security researcher, developer, semi-professional prompt wrangler
$ cat ./policy
point AI at a problem. read the diff. keep what survives contact with reality.This is where the AI runs wild.
Everything published here started as something I actually needed — a thing that broke in the wild, a gap in my own tooling, a problem I got tired of solving by hand. The machine did most of the typing. I picked the direction, argued with it, and kept the parts that held up.
It's not only slop. It's also definitely not hand-carved, artisanal, small-batch code. It's the honest middle: fast to build, tested harder than you would expect, and published because it turned out to be genuinely useful.
| project | status | what it is |
|---|---|---|
| statics | live |
Static Linux troubleshooting binaries for the machine with no package manager, no libc you trust, and no network you control. 13 architectures, musl + pinned Zig, rebuilt monthly, SBOMs and Sigstore attestations on every release. |
| glacialcast | pre-1.0 |
End-to-end-encrypted, low-bandwidth Wayland screen viewer with bounded history. Rust, native portal + PipeWire capture, VA-API H.264, CENC fMP4 over MPEG-DASH, browser viewer on MSE and Clear Key. The relay never sees your key. |
| scanr | 1.0.0-rc.3 |
Proxy-aware TCP connect scanner that always leaves a record you can audit. Rust, no async runtime, SOCKS5 and HTTP CONNECT native — one proxy, a chain through several, or a pool spread across them. Measures what your proxy can actually tell you instead of assuming, and says so when it can't (HTTP proxies have no "refused"; ssh -D sends no reply at all). Resumes an interrupted scan exactly, reads what open services volunteer without sending a byte, and — only if you ask — sends one documented ClientHello (offering TLS 1.3 and 1.2) and reads the certificate it's handed: subject, chain, alternative names, validity, key type, cipher, ALPN — read, never trusted, since trust is tlsx's job. --tls-versions then asks SSLv2 through TLS 1.2 for themselves and names a box only an old client can reach, with the flag that reaches it. The record states both sides of every handshake — every cipher, ALPN, group and signature it offered, and what each server picked — so a reader trusts the file, not the tool's memory. Hands the open ports to nmap -sV instead of pretending to fingerprint them. ~10× nmap -T5 on the same terms; through a proxy, the proxy is the limit. Static musl binary, checksummed, on every tag. |
| mimic | public beta |
Upstream transport-identity proxy for security research. A self-contained Go binary with TOML configuration, JA4-verified browser and device TLS profiles, HTTP identity shaping, HTTP/HTTPS interception, SOCKS5, Unix sockets, live control, and bounded allowlisted TLS 1.0/1.1 fallback. It sits behind a browser, Burp, or its native Caido bridge and control page so those tools keep the message-editing workflow while Mimic owns the final connection. |
AI wrote a lot of that. AI does not get to skip the reproducibility check.
glacialcast is published, not finished. It runs three 1440p screens on my desk every day;
pre-1.0means the wire format can still move under you.
scanr is a release candidate: the record format, CLI and config are frozen, pinned by a corpus of real scan records that every reader must still read back byte-for-byte, and soaking on real engagements. 1.0 follows a quiet month. It will not tell you what a service is — it records what one volunteers and, if asked, what one ClientHello learns: the certificate, read and never trusted, TLS 1.3 included; and with
--tls-versions, which SSL/TLS versions a box still speaks and how to reach one too old for a modern client. The rest goes to nmap, which has two decades of signatures and does not need a worse copy. The tutorial walks ten use cases with real output, and says at each what nmap does instead.
mimic is a transport research tool, not a complete browser clone. Its ClientHello profiles are checked against their expected JA4, but JavaScript state, HTTP/3, and browser-identical HTTP/2 framing remain outside its claim. The operator tutorial walks through direct-browser, Caido, Burp, routing, profile capture, and narrowly scoped legacy-TLS workflows in a disposable lab.
- If it's here, it works. For me. On my hardware. Under my assumptions. Your mileage is a research opportunity.
- Verification is not negotiable. Sources pinned by digest, actions pinned by SHA, base images pinned by hash. The model is fast and confident, which is exactly why the gates exist.
- Bugs are welcome. Open an issue. I will point AI jesus at it and read the resulting diff with appropriate suspicion.
- No warranty, no roadmap, no vibes-based release schedule. Just cron.
$ ./typo --status
[ OK ] builds ............ reproducible
[ OK ] supply chain ...... pinned, digested, attested
[ OK ] copilot ........... enthusiastic
[WARN] humans in the loop 1
[ OK ] status ............ shipping anyway