🔴 Radar status: 3 findings today

---

I build and break things around systems where the obvious explanation is often not quite true.

Usually it starts with:

"Is that actually what happens?"

Then I go find out. friction → investigation → hypothesis → tool. The tool is just the artifact.

---

Resolution divergence (gai doctor per-domain reality check) - last run 2026-09-19 09:57 UTC

92 divergence(s) in the last 24 days across 14 tracked domains -- most recent on 2026-09-19. (mostly anycast/GeoDNS edges disagreeing between two queries -- full per-domain log for 2026-09-19)

README integrity · signed 2026-09-19 10:41 UTC · verify

SHA256: d2fd8aca0a6a468b… · my PGP key Zero Trust isn't just for infra. Don't trust this file either -- verify it.

Most disagreeing domains (30 days)

Domain	Divergences
google.com	23
ipv6.google.com	23
github.com	18
netflix.com	17
akamai.com	11

---

We usually treat trust as a fact. Turns out, it's something systems have to fucking keep proving.

• khm
  known_hosts is not just a cache. It's a database of server identities.
• cfzt
  Zero Trust is less about replacing a VPN and more about identity, reachability and continuously verifying state.
• gai
  dig working doesn't mean your process resolves the name the same way. Reconstructs the actual getaddrinfo() decision path.
• burnafterread
  sharing a secret doesn't have to mean giving the server access to it. live

We usually treat latency as noise. Turns out, sometimes the measurement is the attack surface.

• sidecheck
  remote timing side-channel detection using statistics instead of a stopwatch.

Packets are evidence, not truth.

Network Forensics Series

• ospf-postmortem
  reconstruct the OSPF FSM and find why an adjacency got stuck. live
• dhcp-postmortem
  reconstruct DORA and detect failures from packet evidence. live
• stp-postmortem
  reconstruct STP/RSTP behaviour, topology changes and root causes. live
• dns-postmortem
  DNS traffic, anomaly detection and tunneling analysis. live

Everything runs locally in the browser. PCAPs never leave the machine.

Some problems look like parsing or automation problems until you look closer. But most "automation" is just someone's assumptions, hardcoded and left to rot.

• netconv
  configuration conversion is about semantics, not replacing keywords.
• pcap-frame-parser
  packet formats have decades of edge cases hiding behind deceptively simple structures.
• platform-infra
  self-service infrastructure for small teams, without turning the sysadmin into an API.

---

A few libs extracted from the tools

Library / Package	Version	Docs	Downloads
gai-core
gai-probe
sidecheck-core
netconv-core
pcap-frame-parser
burnafter		—
@lighthouse-explorer/light-parser		—

---

PGP · Stack

---