Software developer and Computer Science student at UCLA. I built Latch, a remote desktop over Tailscale, and Bruin Clubs, a directory of every UCLA student group, and I send patches to other people’s projects, including rclone, Sunshine and NVIDIA’s GPU Operator.
A desktop streamed full screen over Tailscale. Mac, Windows, Linux and a VPS container run the same Rust app; each lists the others, connects to them and can share its own screen. Tailscale is the network and the identity check: a machine answers only peers signed in to the same account.
It lists 1,863 groups, the whole official registry plus the 249 clubs, teams and ensembles that only exist on a school’s or UCLA Recreation’s own pages. A Go server on the standard library and SQLite renders each page in about a millisecond, behind a Cloudflare Tunnel with no port open to the internet.
A small OCI container registry for blobs, manifests, tags and referrers, with a SQLite index. Passes 75 conformance tests; oras works against it unmodified.
Records a Twitch stream in chunks and hands an editor a never-re-encoded master, its proxy, a word-timed transcript and a chat-backed report. Python standard library only.
An autonomous coding loop: each iteration starts with fresh context, and an independent verifier re-runs the project’s own tests before any “done” claim is accepted.
danielbae.me, bardbro.com and RUNE, served from six containers on one small ARM VPS behind a Caddy edge that only Cloudflare can reach.
jsonlcut, modwhy, envcheck, waitready and envdiff: each does one thing, writes JSON when asked, and exits 0 for yes, 1 for no, 2 for usage.
An offline, ad-free replacement for a popular single-message generator: Twitch-style layout, custom colours and badges, exported as a 2× PNG in the browser.
122 pull requests merged into projects I don’t maintain since September 2026. Most are small fixes; 22 are the same small change, a private vulnerability-reporting link in the issue chooser. Some of the projects:
I’ve done Hack The Box since June 2024 and write up retired machines on RUNE.
Build notes and Hack The Box walkthroughs from my blog, RUNE.
Step-by-step solutions for all 61 DEADFACE CTF 2026 challenges, from steganography and OSINT to memory forensics, VoIP decryption, Android and iOS reversing, and ROP.
DEADFACE CTF 2026, OSINT, 125 points. The git history is a decoy. The flag is hidden in Unicode tag characters inside a comment on a social-media post, and a short decoder reads it.
Why UCLA’s official registry lists only part of the student groups on campus, and how Bruin Clubs merges the rest into one dataset.
How bardbro.com, danielbae.me and RUNE are served: a tiny Caddy container per site, an edge that accepts only Cloudflare, a CSP that allows only its own origin, and a counter that reads the edge’s log.
How Latch uses one tailscale whois call to decide which machines may talk to a PC, and what pairing, clipboard sync, the relay and releases look like on top.
How the visitor numbers on these sites are counted: a Go program follows the edge server’s access log, hashes each visitor for one day, and renders a page, private to me, with no script, no cookie and no address kept.
net/http and html/template, SQLite and Postgres, server-rendered pages, Python data pipelines, the OCI distribution spec