⚠ the procfs-stupid module has been tested against kernel 6.8 and should be considered unsafe on everything else.
A portfolio · est. 2019 · rev 47
This is a working archive of tools, one-liners, and deliberate misuses of Unix primitives. Some of them solved a real problem. Some were built to find out what would happen if you pointed mmap(2) at something that clearly did not want to be mapped. A few are still running on somebody's laptop years after I forgot about them.
Curated by an independent systems programmer working out of a damp room in the Pacific Northwest. No frameworks, no telemetry, no venture funding. Written in C99, Rust stable, POSIX sh, and whatever else the problem asked for.
Thirteen programs, loosely ordered by how often I still think about them. Names are mine; blame is mine.
C99 · libpcre2 · 2021, rev 2025
A grep replacement tuned for source trees with millions of files and nothing interesting in most of them. Builds a compressed skip index keyed on 3-gram shingles; queries run against the index before falling back to scan. About 14× faster than naïve recursive grep on a monorepo the size of a small industry, assuming the index isn't stale. It is almost always stale.
Rust · eBPF · 2023
A passive drift detector for long-running Linux hosts. Snapshots /etc, the dpkg/rpm database, loaded kernel modules, and a handful of eBPF-traced runtime signals, then shows everything that has quietly diverged from the image you think you're running. Ships as a single static binary under 3 MB.
POSIX sh · 40 lines · 2020
A shell script that draws a histogram from stdin using U+2581…U+2588 block-drawing characters. Does one thing, does it in a pipe, respects $COLUMNS. I still use it more than any other tool I've written, including the ones that took four months.
Go · 2022
A tiny service mesh for people who don't have a mesh problem but like the word. Resolves service addresses through a gossiping DNS sidecar, falls back to /etc/hosts, logs every lookup as a one-liner you can grep. 912 lines total. Used in production by exactly one team that I know about. They seem fine.
C · 2020
Reads bytes from stdin and tries to tell you what they are. Cascades through Shannon entropy, byte histograms, known magic numbers, linguistic trigram frequency, and a small catalogue of ciphertext priors. Wrong often enough to be interesting. Most usefully wrong on Base64 of compressed data.
Rust · 2024
Plain-text double-entry bookkeeping viewer. Takes a directory of journal files in a dialect close to, but intentionally not identical to, the usual hledger grammar. Produces balance sheets and trial balances in your terminal, never modifies anything. Written after three months of being annoyed by the alternatives. Still annoyed.
C · raw sockets · 2019
ICMP echo with a better histogram. Bucket widths adapt to the observed distribution, not fixed powers of ten. Added as an afterthought, became the reason people actually use it. Needs CAP_NET_RAW or setuid, neither of which is anybody's favourite solution.
Python · 2022
Given a state machine written in a seven-keyword DSL, produces a diagram, a transition test matrix, and a dead-state report. Built for a client's billing system; the dead-state report found two latent bugs on day one and one embarrassing one on day three.
Linux kernel module · 2023
An out-of-tree kernel module that exposes meaningless but internally consistent data through /proc/stupid/. Built as a teaching aid for a workshop on kernel interfaces. Not recommended for production. Not recommended for anything, really. See the warning at the top of this page.
Rust · 2024
A terminal timeline renderer. Takes events with timestamps from stdin, draws them as a horizontal ASCII chart, collapses dense regions into bracketed counts. Good for incident postmortems when you don't feel like opening a dashboard and watching the colour palette make your points for you.
C · perf_event_open · 2021
A sampling profiler that only reports the path from main() to the currently-hottest leaf. No flame graphs, no interactive UI, just a single line that updates at 4 Hz. Useful when you want to optimize something and not think about anything else.
C · capstone · 2020
A streaming disassembler. Point it at a region of memory, a binary offset, or /dev/stdin and it keeps emitting instructions until you stop reading. Mostly exists because I got tired of scrolling in other tools. Happily disassembles data as though it were code; this is a feature on Tuesdays.
C · /proc walker · 2025
Polls /proc/<pid>/fd at a configurable interval and reports file descriptors that appear, linger, and never close. Named because every time I build something like this I swear I already own one. I have now owned four.
Two active retainers and a diligence file this quarter. The intake queue for new consulting work is closed until after the next ritual build; the Bench notes give a sense of the shape of engagements that tend to go well, and Broken by design gives a sense of what I decline to fix on principle.
Remote-first. Inbound via a former colleague only — I do not read unsolicited email, and the catalog has never had a contact form for reasons that should be obvious from the rest of the site.