srdusr

typerpunk

Sun, 09 Aug 2026 22:09:18 +0200

cerberus

Sun, 09 Aug 2026 22:09:18 +0200

dotfiles

Sun, 09 Aug 2026 22:09:18 +0200

About

Sun, 09 Aug 2026 22:09:18 +0200

Contact

Sun, 09 Aug 2026 22:09:18 +0200

Projects

Sun, 09 Aug 2026 22:09:18 +0200

Defending Yourself With What You Know About Attackers

Fri, 24 Jul 2026 00:00:00 +0000

The attacks I read about for work are not reserved for interesting targets. The same credential stuffing, the same phishing, the same stolen device: they arrive at ordinary people every day, and knowing how they work is only an advantage if you turn it around and point it at your own life.

A stolen laptop is what made me start writing any of this down. What follows is what I actually do, in the order the effort pays back.

Testing Yourself Beats Re-Reading

Sat, 16 May 2026 00:00:00 +0000

Trying to recall something strengthens the memory of it more than reading it again does. Re-reading notes feels productive because the material feels familiar, but familiarity is not the same as the ability to produce the answer under exam conditions. The feeling of fluency while reading is the trap.

Why it holds

Memory is strengthened by the effort of retrieval, not by exposure. Each time you pull a fact out of memory without looking, you make the next retrieval easier and more durable. Reading provides no such effort; it lets you recognise the material without ever producing it, and recognition is not what an exam tests. A past paper done under time is retrieval practice; re-reading the chapter is not.

Notes on Film

Sat, 02 May 2026 00:00:00 +0000

There’s a discipline to a roll of 36 that a full memory card doesn’t teach you - you slow down, you actually look before you shoot, and you live with the shots that don’t work out instead of just deleting them. It’s the same instinct that shows up in fencing, or in debugging something without shortcutting to a rewrite: sit with the problem before reacting to it.

This is a placeholder entry for longer-form, non-technical work - film photography, books, fencing, whatever else is worth thinking through in public. More of these once there’s something real to say.

A Note Is Worth What It Links To

Wed, 29 Apr 2026 00:00:00 +0000

An isolated note is a fact you have to remember exists in order to find it. A linked note is reachable from everything near it in meaning. The value of a knowledge base is not the number of notes; it is the number of useful connections between them.

Why it holds

Retrieval is the whole point of an external memory, and you retrieve by association, not by recalling a filename. A note linked from three related notes surfaces whenever you work on any of them. A note linked from nothing surfaces only if you already remember it, which defeats the reason for writing it down. So the link, with a sentence saying why the two ideas connect, carries more of the long-term value than the note body does.

Through the Viewfinder

Fri, 10 Apr 2026 00:00:00 +0000

Not everything here needs to be about breaking or building systems. Some of it is just paying attention - to a street at the wrong hour, a skyline that only looks right for about four minutes, the kind of light that makes an ordinary corner worth stopping for.

This is a placeholder entry for that side of things - photography, mostly, and whatever else doesn’t fit neatly into a technical writeup. Real frames go here once there’s a proper set worth sharing.

En Garde

Wed, 18 Mar 2026 00:00:00 +0000

Fencing gets a mention on the about page and not much else so far - it deserves more than a one-liner. The parallel to this line of work is real: most bouts are won by the person who waited a half-second longer, not the one who swung first.

Placeholder for now. Photos and notes go here once there’s something worth showing from the strip.

25.7 Million Runs at a ClientHello

Sun, 08 Mar 2026 00:00:00 +0000

Most web traffic is TLS now, which for a passive analyzer means most of the interesting bytes are gone. One field survives: the Server Name Indication in the ClientHello. It is sent in cleartext, in every TLS version, before encryption starts, and it answers the question you usually have - what was this connection to?

Getting it out means parsing four levels of nested, attacker-supplied length fields. It is the most structurally complex hand-rolled parser in packeteer, and the one I trusted least.

Encryption Gives Confidentiality, Not Integrity

Fri, 27 Feb 2026 00:00:00 +0000

Encrypting data hides it. It does not prove the data was not changed. These are two different properties, and assuming the first provides the second is the root of a whole class of real vulnerabilities.

Why it holds

A cipher maps plaintext to ciphertext so an eavesdropper cannot read it. Nothing in that mapping detects tampering with the ciphertext. In CBC mode an attacker can flip bits and, given feedback on whether the result decrypts to valid padding, recover and forge plaintext without the key. That is the padding oracle attack, and it exists precisely because the system checked confidentiality but never integrity.

Home Lab Build Log

Sun, 22 Feb 2026 00:00:00 +0000

The home lab gets referenced elsewhere on this site as infrastructure - this is meant to be the more physical side of it: what the rack actually looks like, what broke, what got rebuilt.

Nothing to show yet. First real entry goes up once there’s a build worth documenting instead of just describing.

Margin Notes

Fri, 30 Jan 2026 00:00:00 +0000

A lot of thinking-through-a-problem happens with a pen in hand, not a keyboard. This is where the leftover margin scribbles would go, if any of them were worth scanning in.

Empty for now.

An OOM in My Own pcapng Reader, Found on the First Fuzz Run

Thu, 22 Jan 2026 00:00:00 +0000

packeteer reads and writes pcapng, so it can open a capture somebody else made. That sentence is the whole threat model: a capture file is untrusted input, and the reader is the code that touches it first.

I had written the reader, tested it, and used it. Then I wired up libFuzzer harnesses for every hand-rolled decoder in the project, plus the pcapng reader and the full summarize_packet() pipeline. The reader harness found a bug on its first run.

Reading List

Sun, 14 Dec 2025 00:00:00 +0000

Not every hour off the clock goes into a terminal. This was meant to be a running log of what’s actually being read - less a review section, more a receipt.

Nothing logged yet.

Thorough Enumeration Beats Clever Exploitation

Tue, 02 Dec 2025 00:00:00 +0000

More machines fall to finding the thing that was already there than to a clever exploit. When a box is stuck, the fix is almost always to enumerate harder, not to reach for a more advanced technique. The winning path was usually visible at hour one and dismissed.

Why it holds

An exploit needs a target, and finding the target is enumeration. A service on a high port, a virtual host that only answers to its name, a comment in the page source, a readable share: each is a foothold that no exploit skill substitutes for. Enumeration also compounds. Every credential and hostname found sends you back to enumerate something new, so the surface grows as you work.

Vulnerabilities Cluster at Trust Boundaries

Fri, 14 Nov 2025 00:00:00 +0000

A trust boundary is any point where data crosses from a less-trusted context into a more-trusted one: user input into a query, a request into a privileged process, one tenant’s data into another’s view. Almost every vulnerability class is a failure to re-establish trust at such a crossing.

Why it holds

Injection is untrusted input crossing into an interpreter without being made safe for it: SQL injection into a database, command injection into a shell, template injection into a template engine, cross-site scripting into another user’s browser. Authorisation bugs are a principal crossing into data it should not reach. Even privilege escalation, whether through a SUID binary or a potato attack, is a low-trust process crossing into a high-trust one. Naming the boundary tells you what defence is missing: encode for the destination context, or check the right to cross.

Late Shift

Sat, 08 Nov 2025 00:00:00 +0000

There’s a specific kind of quiet after midnight that shows up in both this work and in a decent photo - everyone else has stopped paying attention, which is usually when it gets interesting.

No frames worth keeping yet. This one waits for a proper camera, not a phone held out a car window.