i work on the parts of the stack people skip. low-level linux, security tooling, and the web when it has to do something unusual.
most of it started as a question about my own machine — what it says about me when i'm not looking, and how much of that i can turn off. the answer is usually less than you'd want. that's why the tools exist.
i say plainly what a thing does and doesn't do. rarer than it should be.
host gentoo · openrc · no systemd · @world built from source
kernel 6.18 dist-kernel · i tune the userland, not the config
dns dnscrypt, doh only. no plaintext fallback: if it goes down i want
it to fail loudly, not quietly downgrade
tunnel wireguard, nested. two hops so neither end sees both sides
browser policy-managed, 34 keys. telemetry off at the org level
disk not encrypted. i know.
metadata stripped on write, without being asked
analytics none — not here, not on anything i publish
what i work on
- security / privacy — anti-surveillance tooling, opsec, my own lab and ctfs
- linux / systems — gentoo daily driver, openrc and no systemd, source-built world, kernel and build tuning
- web + 3d — single-file sites with real motion. three.js, css physics, no framework
- self-hosting — an always-on server, game servers, sync, monitoring. all mine
stack — gentoo · openrc · bash · python · wireguard · nftables · dnscrypt · javascript · css · three.js · blender · cloudflare pages
things i've built
veil — linux anti-surveillance. reads what your machine is giving away, explains every gap, fixes what you let it. in development, source closed for now.
linux-network-privacy — nested wireguard, encrypted dns, hardened browser. exactly what runs on my box, keys stripped.
gentoo-tuning — openrc, no systemd, source-built world. real configs, not a blog post.
operational-security-notes — how people get found. mostly by accident.
lukasz-aep — my site. frutiger aero, a css radio that works, live server status.
three machines. one of them is always awake.