I am an IT specialist at a healthcare provider in Springfield, Missouri, where I look after the network, the servers, the endpoints and the security of both. I am finishing a BS in Information Technology on the IT Infrastructure track at Missouri State University in May 2027.
I’m most passionate about working with things that people actually depend on. I operate a public NTP server and my own mail server. I’ve also found multiple security vulnerabilities in deployed software, including one that was a risk to patient safety.
Experience
IT Specialist, – present ✦ IT Intern, –
Health Hub Clinic & Health Guardian Imaging
IT for a clinic and an affiliated imaging practice, in an environment subject to HIPAA.
Infrastructure
Replaced end-of-support Windows Server 2016 file server and Active Directory domain controllers with Samba on Debian Linux, avoiding at least $3,000 in licensing and upgrade costs.
Migrated an aging PACS gateway to a virtualized environment after its hardware began to fail, ending recurring downtime for imaging.
Replaced a double-NATing consumer wireless router with managed access points, and migrated an end-of-support SonicWall TZ600 firewall to a TZ670.
Moved an off-site VPN-connected NAS onto the on-site LAN and reintegrated it with the firewall, the Windows clients and the imaging system clients.
Restored server access within two hours of storm damage to a jumpbox by tracing the fault to electrical pitting on a RAID controller pin and shimming the connection.
Produced the first documentation of the network, which had none, using Nmap, firewall configuration review and physical cable tracing.
Security
I discovered an unauthenticated endpoint allowing attackers to HTTP PATCH patient charts, including medications and allergies. I also found a PHI-exposing authentication bypass vulnerability in the in-house EMR, and found three other vulnerabilities in other in-house software: stored XSS via poorly sanitized UGC, and two instances of broken access control exposing private messages. I fixed two and escalated three to developers. I then verified the findings were completely remediated.
Deployed Wazuh SIEM with agents on the office servers, roughly twenty workstations and the PACS gateway.
Configured Microsoft Intune compliance baselines and Entra ID Conditional Access policies supporting HIPAA compliance for Windows, Office and Teams.
Discovered long-standing unenforced DMARC and broken SPF on one domain, demoed spoofing of sender addresses, then brought company domains to an enforced DMARC policy and corrected SPF records.
Ran an authorized phishing simulation end to end, including the pretext and landing page, and briefed leadership on the results.
Discovered and remediated other security issues: SMB signing was disabled, EoS software was running on multiple endpoints, and unencrypted DICOM was traveling on the general office LAN.
Independent security research
Manifold Markets — double-spend in dependent multiple-choice markets
Discovered and responsibly disclosed. Bug bounty awarded.
Manifold’s dependent multiple-choice markets are ones where exactly one option is expected to resolve YES and the rest NO, so the automated market maker continuously rebalances the options to sum to 100%. Because the AMM could be made to fill several of a user’s resting limit orders in a single rebalance, all of them executed, even when the account held only enough balance to cover one. For example, on a three-way market sitting at 33/33/33, a YES purchase on the first option drives the AMM to push the other two down together, which could fill two orders waiting there and spend the same money twice.
OpenEMR — integrity issue
Independently discovered and reported. Credited as Finder on the GitHub Security Advisory. Public disclosure and CVE assignment pending.
Infrastructure I run
Public NTP and NTS server
A stratum 2 time server in pool.ntp.org, serving plain NTP on UDP/123 and NTS on TCP/4460, running chrony on Debian. It currently holds the maximum pool monitoring score of 20.
VLAN segmentation with a Wazuh SIEM instance collecting logs and flagging anomalous traffic.
Log collection for legacy machines too old to run the Wazuh agent, which Windows gives no native syslog path off of. I wrote the shipper and the parser myself in Perl, with local Qwen models summarizing the results.
A market analysis tool and price tracker for the Old School RuneScape in-game economy. Go backend, SQLite storage.
Ingests the OSRS Wiki real-time prices API into a tiered archive with a five-year backfill: dual-pool WAL SQLite with nightly rollup, prune and compaction.
Accountless, cookie-based identity: 128-bit tokens encoded in Crockford Base32, with only SHA-256 hashes of the tokens stored server-side.
One shared document model; make a change in one place and render every page to HTML, gemtext, Gopher maps and plaintext.
A concurrent esoteric programming language in which all control flow is predicated on waiting for something to die, after the fictional ~ATH language from Homestuck. Loops wait on the death of an entity and run their body in the death callback.
Self-hosting: the transpiler is written in !~ATH and emits C89 through a continuation-passing style transform. Around 19,000 lines of !~ATH and 497 test cases.
Entities include timers, processes, connections, file watchers and raw IPv4 sockets. The language supports networking, I/O and a C FFI. Targets Linux, Windows and WebAssembly.
!^CAKE, a companion schema definition language about baking, fills a hole in !~ATH’s FFI, which could marshal scalars and pointers but not aggregates. A recipe describes a C-compatible byte layout, recipes compose through merge and tagged-union operators, and every recipe reduces deterministically to an eight-character code that two peers can compare over a wire before exchanging any payload.
An X11 server that renders its framebuffer as ASCII art in a terminal, so ordinary X clients can run over SSH or in headless environments.
Built on the Kdrive backend, and using libcaca for rendering.
Synthesizes evdev scancodes from libcaca character events to give X clients keyboard and mouse input, both over SSH or locally.
Selectable dithering algorithms and character sets, with brightness, gamma and contrast controls, and terminal cell aspect ratio detected at startup through TIOCGWINSZ.
In progress. Converts pages from the game Hypnospace Outlaw into real web pages, which meant reverse engineering the game’s undocumented page format first.
Documented the .hsp format completely: a Construct 2 array export whose three axes carry elements, states and properties, including the conditional state resolution the game uses to swap page content on story flags, and the coordinate and layout rules across all 1,292 shipped pages.
Reimplemented the game’s tracker music playback well enough to convert each .hsm module down to an audio file: pattern sequencing, per-pattern BPM, the instrument table, note pitch, per-step volume, pan and note gating.
Currently rewriting the rendering logic so accessibility features work properly, rather than mimicking the game’s behavior as the first pass does.
In progress. A terminal multiplexer built around a desktop window manager metaphor: floating windows with title bars, draggable borders, minimize and maximize buttons, edge snapping and a taskbar, each running its own program in a dedicated PTY. Roughly 11,000 lines of C. Built on notcurses, libvterm, libsixel and GPM.
Fully rebindable keymap with an in-application settings panel covering keybindings, theming, scrollback and user-defined desktop icons, backed by an XDG-style config file.
ilo toki nasa
An 11M-parameter smolGPT-style decoder trained from scratch on Toki Pona. I built the corpus from the kulupu lapo poki corpus, stripping metadata and using programmatic grammar analyzers to remove text that was not actually Toki Pona. Output is approaching coherence.
A general-purpose programming language I am co-creating with Jade K..
Self-hosting compiler: the lexer, parser, code generator and diagnostics are written in Oboe and transpile to C.
Toolchain and package manager with a lockfile, plus reedbed, the package registry servers.
Open source
Upstream contributions
Pull requests merged into other people’s projects include:
dinky, a terminal text editor: added GPM mouse support, tty appearance improvements, a horizontal scrollbar with autohide and mouse capture, and mouse tab reordering with reflow animations.