sha:df1f3fd
NAILS
Linux anti-forensics against offline disk examination: a hidden session on a decoy NixOS, Debian or Ubuntu system, entered with a soft-reboot.
hostwitteshadovv.devsurfacestatic / low-jstelemetrynoneruntimeminimal js
Cyber Security Engineer · Linux systems engineer
WitteShadovv
Building NixOS-first systems, security tools, and repeatable infrastructure.
Based in Zürich and working as a Cyber Security Engineer. MSc in Information Security from Stockholm University. Background in Linux systems engineering, automation, and security work, with current public projects on NixOS, privacy-focused system design, and forensic testing.
- whoami
Cyber Security Engineer · Linux systems engineer
- role --current
Cyber Security Engineer based in Zürich
- study --completed
MSc in Information Security · Stockholm University
- build --with
NixOS first · Rust for core tooling · Python and Bash for automation
- work --history
8+ years with Linux systems · 4 years at ETH Zürich
- maintain --upstream
nixpkgs · Portmaster package and NixOS module
- base 8+ years Linux-heavy environments
- current Zürich Cyber Security Engineer
- public 2 projects NixOS and security work
- bias deterministic builds, boundaries, and inspectable systems
selected work
sha:2bf0cd8
deferred-apps
Download apps on-demand while still showing them as installed to keep the host lighter
Repository data from GitHub as of 2026-10-22.
Toward Plausibly Deniable Dual-Environment Computing
MSc thesis · Stockholm University · 2026. The academic groundwork behind NAILS. Combines declarative NixOS configuration and overlay filesystems into a reproducible dual-environment design, with a forensic evaluation of what traces remain.
- nixpkgs · portmaster merged 2026NixOS/nixpkgs#442904
Packaged the Portmaster application firewall and wrote its NixOS module. Maintained in nixpkgs since August 2026.
- brave · tor window fixed in 1.96.60Brave's Tor window fetched sidebar favicons outside Tor
Adding a page to the sidebar from a Tor window fetched its favicon from the real IP. Reported on HackerOne, fixed in a stable release six days later.
tools / approach
platform
What I use most right now.
- Linux and NixOS as the current default base
- Rust for systems code and core tooling
- Python and Bash for automation and day-to-day glue
infrastructure
How I build and run systems.
- Nix is the current default for reproducible builds and host setup
- Puppet and Ansible are part of earlier infrastructure work
- Docker and Kubernetes when packaging and orchestration help
security work
Security work tied to real systems and real investigations.
- digital forensics and systems that can be examined after the fact
- security architecture, hardening, and review of system boundaries
- systems kept readable during testing and review
operating bias
The defaults behind my design choices.
- repeatable builds over one-off fixes
- clear system boundaries over vague promises
- tools people can understand and maintain
site
- static-first
- minimal JS
- no analytics
- semantic HTML
- anchor-based navigation
Static public site. Minimal JavaScript, used only for the theme toggle.
contact / verification
- General best first routecontact@witteshadovv.dev
Plain email is the best first contact for general questions.
- Security reporting routesecurity@witteshadovv.dev
Use the security address for disclosures or anything sensitive.
- GitHub code trailgithub.com/WitteShadovv
Primary public code and repository trail.
- HackerOne disclosureshackerone.com/witteshadovv
Vulnerability reports made through HackerOne programs.
- Keyoxide identity graphKeyoxide proof profile
Cross-link proof and identity graph.
- PGP openpgpOpenPGP public key
Fingerprint: FCEB 73CE 73A7 00A8 8548 F25D CB4B BA75 1B7B 4D4D
- Signal secondarySignal contact link
Secondary channel when needed.
- Matrix secondary@whiteshadow332:matrix.org
Secondary channel when needed.
- Policy publishedSecurity disclosure policy
Scope, how to report, response times, and safe harbor.