Owned the in-flight computer configuration for a high-performance UAV. Designed and shipped firmware for the microcontroller-driven afterburner and water-injection subsystems. Stood up the supporting telemetry, comms and license servers, and held the line on a clean Linux-based build/deploy pipeline for the team.
Real-time control logic for UAV flight systems. Linux server administration for internal infrastructure. C/C++ on bare-metal targets, Python on supporting tooling.
Firmware contributions to the rocketry electronics stack. Hybrid work in Garching, alongside a strong embedded community.
Tutored Mittel- and Oberstufe students through the German curriculum up to Abitur.
Summer internship inside a large university IT operation. First serious exposure to real production systems administration.
Computer Science, leaning toward operating systems, computer architecture and security.
Higher Level focus: Mathematics, Physics, English, German.
Team built a social-media platform deployed to the Solana devnet. Posts were hashed and committed on-chain, full set of social features layered on top. 36-hour build, end-to-end. Certificate of participation issued by TUM.
Hands-on session with real LHC data.
Astroparticle physics workshop at the German Electron-Synchrotron.
LLM-powered static analysis tool for finding bugs, exploits and crashes in security-critical codebases. Eight-pass workflow: SAST (Semgrep / cflow / Bandit) + tree-sitter function extraction + NetworkX call-graph and risk scoring + multi-lens local-LLM analysis (Ollama / gemma4:31b on an RTX 5090) + a judge pass to filter false positives + SARIF / HTML reporting. ~7,400 lines of Python, SQL, Bash and YAML; 43 unit tests; native systemd deployment, no Docker. Functionally complete; first real-world runs queued against the OpenBSD source tree and the I2P Java codebase.
Minimalist verifier for unencrypted boot partitions in high-risk environments. Cryptographically validates the bootloader before the OS loads to mitigate Evil-Maid attacks. Designed to ship on a portable Void Linux + MUSL ISO carried separately — relevant when committing the boot partition to a dedicated USB isn't acceptable, e.g. preserving Qubes' sys-usb.
Python crawler that walks the I2P network through a local i2pd daemon on 127.0.0.1:4444, logging every reachable destination and harvesting any .onion and clearweb links it encounters along the way. Slow and primitive on purpose — clearweb links are recorded but never followed, so the crawler never reveals itself outside the anonymity network.
Command-line utility that splits an ASCII password into n independent strings; the original is only recoverable when all n shares are recombined. Useful for distributing high-value secrets across locations or trustees. Early project — written in C++ before I knew what constant-time meant — kept around for the idea, not the implementation.
Daily-driver across init systems and unices. Each picked for what it does well, none worshipped. Self-host bias on principle — own mail, own DNS, own git, own monitoring. no SaaS unless I have to.
Cryptographic primitives — implemented from scratch in C (some Python or Rust) for the sake of understanding the things, not just calling them. The stuff below is hand-rolled at least once; not all of it is production-grade, that is not the point.
In production: libsodium when I get to choose, OpenSSL when I don't. Mail: gpg. Files-at-rest: age. KDFs: argon2id (the gate on this very page is one).
Privacy is structural, not a feature you opt into. These are small contributions on principle; the network only works if enough of us run something.
Isolation note: every service here runs in its own FreeBSD jail — the three Tor relays, the Monero node, the i2pd floodfill, and this website each have a separate jail with no shared filesystem or process namespace. Compromise of one does not imply compromise of another.
view source
onionoo.torproject.org at page load
gpg --armor --export 0xAF271E3E47F9945F-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEafSSlRYJKwYBBAHaRw8BAQdApkpiTYutnE6Mmegh7n3YwAd8KFjoEfv1pvHy 40K4SH60LUNsZWFybmV0IGlkZW50aXR5IDxsZW9udGlpLm1ha3NpbW92QHR1dGEu Y29tPoiWBBMWCgA+FiEE/zQK48CEmGRX0c+wrycePkf5lF8FAmn0kpUCGwMFCQWk 0wsFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQrycePkf5lF8r6QEApbkvih36 3qaAFV8a/vTCARSq6p9TeY+/JRceAxMXloIBAMVRg++SqZu2Lo+zmXlg8pKcSx+f 4MzJbu8942i0EXQIuDgEafSSlRIKKwYBBAGXVQEFAQEHQI8+H0k3oZq9uU5ua81h 2O9V4+o6LBsJEWvea0QtoAgUAwEIB4h+BBgWCgAmFiEE/zQK48CEmGRX0c+wryce Pkf5lF8FAmn0kpUCGwwFCQWk0wsACgkQrycePkf5lF8KZgD+IEwu5/edkn0maRj/ HgKTkRG2oLQRMy9K+0Hb8pOw5GYBALT/Si2PX4wvgOlrHYDTDXuwd8lVPyKBFuvV GXrdTnkF =mCZR
Full CV is gated behind argon2id. Ask me for the passphrase if we've spoken.
./decrypt-cv --pass <passphrase> --kdf argon2id