s1nkhole@sector:~$

s1nkhole

Systems and security engineer. I build capability-isolated operating systems and defensive tooling, aiming for a junior malware analyst or antivirus lab role.

handle s1nkhole sector Russia // meatspace faculty School 21 [Sber / École 42 network] stage cybersecurity track — in progress focus capability isolation, sel4 clearance redacted

Selected work

Four projects, from a capability-isolated microkernel OS to a wearable with real-time audio DSP. Code first, hardware second.

CapGuardOS

In active development · private repository

A capability-isolated operating system in C, built on the seL4 microkernel.

Aimed at two use cases: workstations that need to keep secrets — password managers, crypto wallets, signing keys — genuinely isolated, and purpose-built secure devices like HSMs and secure terminals. Every component runs with only the authority it needs, so a compromised process gets a small, explicit set of capabilities instead of the whole machine.

root (dispatcher + fault supervisor) -> console (owns serial, highest priority) -> shell (IPC only, no serial capability) -> worker / storage (isolated services)
  1. Root process boots and prints over serial
  2. Allocator, VKA, and VSpace initialized
  3. First isolated child process, communicating over an IPC endpoint
  4. Real serial I/O moved to a dedicated console component
  5. Interactive shell with command history and cursor editing
  6. Fault supervisor: badged fault endpoints let root identify which component crashed, without taking the rest of the system down
  7. Storage service: an isolated in-memory filesystem, reachable only through a narrow IPC protocol

Continuous integration builds from a clean checkout and boot-smoke-tests every component in QEMU on every push. A Dockerfile reproduces the full toolchain on any host, independent of the local dev machine.

url-uptime-monitor

Public

A health-check aggregator with a REST API, background polling, and full observability.

Polls a set of target URLs on a schedule, stores the check history, and exposes results over a REST API built with FastAPI and SQLAlchemy. Metrics feed into Prometheus and Grafana, infrastructure is defined in Terraform, and CI runs lint and test on every push. Built as a portfolio project for an SRE internship interview.

Networking lab project

Public · graded 100/100

VLSM subnetting, a GNS3 topology, and traffic analysis in Wireshark.

Designed and documented a subnetted network topology in GNS3, then used Wireshark to verify traffic behavior at each hop. Submitted early to School 21 and graded 100 out of 100.

Voice-changer mask

In development

A wearable firmware project: real-time voice DSP on an ESP32-S3.

A cosplay mask that disguises the wearer's voice in real time and can also listen for a wake phrase, photograph nearby text, translate it, and speak the translation back through a small earpiece speaker. The audio chain runs a high-pass filter, a pitch shift, a ring modulator, a soft clipper, and a short echo, entirely on-device.

ESP32-S3 · INMP441 microphone · MAX98357A amplifier · 2000 mAh battery

Capabilities

What I actually reach for, grouped by area rather than listed as a wall of tags.

systems
C, the seL4 microkernel, capability-based isolation, Arch Linux internals, systemd-boot with Unified Kernel Images, LUKS full-disk encryption, btrfs.
security & hardening
AppArmor, USBGuard, firewalld, Secure Boot signing, Wazuh, Fail2Ban, iptables, home-lab honeypots.
networking
GNS3, VLSM subnetting, Wireshark, MikroTik.
firmware & hardware
ESP32-S3, embedded C, real-time audio DSP, RF and SDR tooling.
delivery & infra
Docker, GitHub Actions, Terraform, Prometheus and Grafana.

In the lab

Ongoing builds that don't have a finished write-up yet.

Hardened workstation

An Arch Linux laptop running two kernels side by side — stock and linux-hardened — with a Landlock, Lockdown, Yama, and AppArmor LSM stack, LUKS encryption, and a small home SOC built on Wazuh and honeypots.

Off-grid cyberdeck

A portable diagnostics rig in progress: Raspberry Pi 5, an RTL-SDR receiver, a mini oscilloscope, and a component tester, built into a rugged case.

Powered exoskeleton

Early-stage design work on a full-body powered exoskeleton — a ground-reaction load path, electric actuators, and force-following control.

Get in touch

Open to junior malware analyst and antivirus lab roles, and to conversations about capability-based security in general. GitHub is the one channel that's open — everything else stays off this page.