Technical notes from the projects I build: how the algorithms work, the design decisions behind them, and what matters from a security point of view.
How Git stores data as hash-addressed objects (blob, tree, commit, tag), what refs and the reflog are, how to recover 'lost' commits, why deleted commits can still be found, the SHA-1 risk, and how to sign commits with an SSH key.
Market intelligence from open sources: pricing-page history in the Wayback Machine, job postings via the Greenhouse and Lever APIs, public financial filings, app reviews, and search trends, with the commands to run, how to rate confidence, and where the ethical lines are.
A summary of applied cryptography research: MD5 and SHA-1 collisions, padding oracles from Bleichenbacher to ROBOT, randomness failures, side-channel attacks, TLS downgrades, the Dual_EC_DRBG backdoor, crypto API misuse, and the move to post-quantum cryptography.
How the Wayback Machine works, the snapshot URL format, the CDX API for listing and filtering captures, comparing page versions, preserving evidence with Save Page Now, and the limits of archives and how to use them responsibly.
Technical notes on the Cryptotool live demo: the anatomy of a Fernet token, RSA-PSS with the maximum salt length, and converting PKCS#1 ↔ PKCS#8 keys so files work back and forth with the Python version.
Emails and time zones in Git commits, secrets left in repo history, GPS coordinates in photos, subdomains in Certificate Transparency logs, and .git folders that get deployed: how to check for and close the information leaks developers create most often.
Passive recon from open sources: Certificate Transparency logs, DNS, RDAP, the Wayback Machine, search engines, and device search engines, with the commands to run and how to record findings so they can be verified.
How the two classic steganalysis algorithms in Steganalysis Web App work, from pair-of-values histograms to regular and singular pixel groups, with results on two sample images.
A summary of social engineering research: the psychological principles behind it, phishing and USB drop experiments, large-scale phishing training studies, real cases from Twitter to the Arup deepfake, and technical defenses that don't depend on human vigilance.
A summary of Tor research: the onion routing design, traffic correlation and website fingerprinting attacks, malicious relays from Spoiled Onions to KAX17, onion service security, censorship and pluggable transports, and what it all means for developers.