I build security and infrastructure tools, take Go systems apart to see how they work, and publish the useful pieces.

Right now I lead VM scanning at Aikido Security, build products at CloudAid, and contribute to Syft

I also wrote Go at Scale, 528 pages on building production Go systems.

Website · Latest writing · Book · LinkedIn · X

• ☁️ CLOUD-IP: a daily-refreshed map of 63 cloud, CDN, SaaS, VPN, and crawler networks; 460K+ CIDRs with ready-to-use firewall formats.
• 🔎 sbomlyze: git diff for SBOMs; catch dependency, metadata, and package-integrity drift in CycloneDX, SPDX, and Syft documents.
• 📘 Go at Scale: production patterns for concurrency, microservices, event-driven systems, observability, and testing, with companion code.
• 🧪 The workshop below: small CLIs, learning builds, browser tools, macOS experiments, and libraries. Pick a rabbit hole.

• 🛡️ Security research: sometimes I dig through open-source Go projects for security flaws and responsibly report what I find Published advisories
• 🧾 sbomlyze: compare SBOMs, detect same-version/different-hash tampering, and gate CI with human, JSON, or SARIF output.
• 🧰 Awesome Security Pipeline: CI-tested open-source controls organized into a practical GitHub Actions security pipeline.
• 🕸️ Network Vulnerability Scanner: an educational Go build covering port scanning, service detection, and vulnerability identification.
• 🔗 Go Dependency Scanner: build a dependency scanner from scratch and understand what the real tools are doing.
• 🔬 HTTPS Traffic Inspector: a Go intercepting proxy for seeing the HTTP calls hidden inside SDK operations.
• ✉️ go-is-disposable-email: fast, embeddable disposable-email detection for Go services.

• 🌍 cloud-provider-ip-addresses: the source dataset behind CLOUD-IP; I rebuild it every day in 13+ machine- and firewall-friendly formats.
• 👀 ip-watch: sync changing provider ranges into Nginx, Caddy, HAProxy, nftables, iptables, or UFW without breaking a running config.
• ⚡ Cloud IP SDKs: offline provider lookup for Go, JavaScript/TypeScript, and Python, backed by a compact MessagePack database.
• ⚖️ simple-load-balancer: round robin, weighted routing, and health checks using only Go's standard library.
• 💸 CostSweep: find and price AWS waste, print the annual total, and fail CI above a budget threshold; read the three-part build log.
• 🔭 real-time-system-monitor: a terminal dashboard for CPU, memory, network activity, and hungry processes.
• 📡 Zero-configuration service discovery: a small Go implementation for learning how services find one another without a central registry.
• ⚡ Reverse Cache Proxy: a small Go reverse proxy I built to explore HTTP caching—TTL expiration, size-aware eviction, compression negotiation, Cache-Control rules, and live hit/miss stats

• 🚀 axios4go: an Axios-inspired Go HTTP client with interceptors, retries, caching, progress tracking, and configurable instances.
• 🔭 goroscope: htop for goroutines; collapse pprof dumps into live stack groups and spot the one that keeps growing.
• 💽 partition-analyzer: parse MBR and GPT partition tables in Go, then try the WebAssembly version without uploading a disk image.
• 🍎 macOS hardware detection: inspect Mac hardware from Go without reaching for a heavyweight framework.
• ⏱️ TimeTrackCLI: private, local-only automatic time tracking with a terminal dashboard, goals, and reports.

• 🧠 VocabAmp: AI-assisted flashcards with FSRS spaced repetition; source.
• 🕰️ CityChime: a small macOS city-hall clock app I built to learn Go.
• 💡 virtual-light: control a virtual Go light from Apple's Home app through HomeKit.
• 🏊 Pool Water Planner: a browser-based pool chemistry calculator, built for my own pool rather than a product roadmap.
• 🧹 diskfree: an APFS-aware Go disk scanner that finds what is really consuming space—including sparse files, rebuildable caches, and Time Machine snapshots—and lets you clean it up interactively
• 📐 MyMeasure: iOS experiment that earned a permanent place on my phone—and a few friends' phones—for LiDAR measurements, photo annotations, and 2D/3D room scans
• 🗺️ MyExplore: iPhone experiment that turns everyday movement into a private fog-of-war game—walk or drive to reveal the map while every breadcrumb stays offline on your phone
• 🏠 MyHouse: the iPhone app I built to remember how my own house works—what needs maintenance, where the shutoffs are, which contractor fixed what, and when appliances may need replacing

Browse all repositories, newest activity first →

I write implementation-focused series: 50+ articles on DEV, plus field notes and interactive tools on my own site.

• 🔐 Go's crypto package: 14 parts, from primitives and encryption through TLS, password hashing, constant-time code, and real applications.
• 🗂️ Go's fs package: 9 parts on interfaces, traversal, custom filesystems, embed.FS, and testing.
• 🕐 Go's time package: 10 parts on clocks, durations, time zones, timers, calendars, and production pitfalls.
• 🌐 Go's net/netip package: 7 parts on addresses, prefixes, CIDR set operations, and AddrPort.
• 🔤 Inside strconv: 7 parts from parsing integers and floats to allocation-aware append APIs, quoting, and Unicode utilities.
• 💸 Finding AWS waste in Go: a 3-part build from Cost Explorer calls to a $4,204 demo report and CI gate.
• ☸️ Enhancing Kubernetes Event Management with Custom Aggregation: my Kubernetes Blog guide to building event watchers, correlation, storage, and pattern detection in Go.
• 🛡️ SBOM integrity drift: why matching versions can still hide changed package contents.
• 🧵 Build a live goroutine visualizer: turn pprof noise into groups you can inspect while a process runs.

All field notes · All DEV articles · HackerNoon stories · AWS Community Builders posts

• ☁️ CloudAid: the cloud and DevOps company I founded in 2020.
• 📞 PBXDom: the call-analytics platform I launched in 2015; it has analyzed 14B+ calls for 500+ companies.
• 🧰 HTTPfy: 40+ small browser tools for networking, DNS, security, data conversion, and everyday DevOps work.
• 📈 StatusAid: website health monitoring across DNS, TLS, servers, email, performance, and content integrity.
• 📱 CloudAid Studio / Motively: a mobile motivation app with 100,000+ hand-picked quotes.

• ✍️ DEV: 50+ posts, including work with AWS Community Builders.
• 📰 HackerNoon: stories about hashing, load balancers, dependency scanners, and SBOM diffing.
• 💬 Stack Overflow: an archive of practical answers from years of debugging AWS, S3, Node.js, and cloud infrastructure problems.
• 📚 Go at Scale: the book and its open companion repository.