I gave my first DEF CON talk at fourteen. Most of my life since has been spent on one side or the other of the systems built to keep people out: first breaking them, then keeping automation running against them at scale.
For the better part of a decade I built and maintained large-scale scraping and automation infrastructure: collection layers serving thousands of clients across millions of accounts, run across Google Cloud, AWS, Hetzner, DigitalOcean, Linode, a few other providers, and bare metal. Most of the work was unglamorous: reverse-engineering Akamai, PerimeterX, and Datadome, then fixing the drop in success rate whenever a vendor shipped a new challenge, and keeping the platform up as traffic grew.
I’m independent and between roles right now. These days I study those same systems more to understand how they’re built than to get around them. The full history, including a recent stint on reproducible build pipelines for regulated medical-device software, is on the work page.
What I’m digging into
Lately I’ve been going deeper into ECMAScript itself: the spec, the engines, the parts of the language most people never need to touch. I got there through reverse-engineering anti-bot scripts, which turns out to be a fast way to learn how malware hides itself and moves data around. Defenders and attackers use a lot of the same techniques; reading one side teaches you the other.
How I work
I work mostly in JavaScript, TypeScript, and shell. Somewhere in the Automatiq years I learned to read Elixir and ended up genuinely fond of functional programming: it keeps state easy to follow and makes failures predictable. I like systems built to survive: fault tolerance, backpressure, and the assumption that anything upstream can fail or send bad data at any time.
Beyond the keyboard
I love literature, history, and the liberal arts. I think a public with no grounding in them is worse off for it, and that no amount of technology is going to solve the basic problems of being human. I write about where that meets security and software on the blog, and on mindwise when the subject is purely infosec.
One standing shoutout: FUTO. They fund and build consumer software on the idea that computers should belong to the people who own them, and they’re one of the few organizations putting real money behind it. I’ve worked with them locally on tooling and applied-security projects, and I’d point anyone at what they’re doing.
Selected recognition
- Featured by Krebs on Security for identifying the point of compromise in the Jason’s Deli breach: card-fraud clustering, later cited in their reporting (2017).
- DEF CON 20, “Not-so-Limited Warranty: Target Attacks on Warranties for Fun and Profit,” presented at fourteen (2012).
- 1st place, Instructables Explore Science Contest, for a high-altitude research balloon that reached 100,000 feet (2015).
- MIT Promise of the Future Award (2012).
Certifications
Google Cloud Professional Cloud Architect · CompTIA Security+ · Burp Suite Certified Practitioner.
Reaching me
Preferred contact is Signal. Email works too, or any of the links below.
sourcehut · LinkedIn · X · Mastodon · nicomee@riseup.net
Verify me
For anything sensitive, encrypt to my OpenPGP key (RSA-4096, fingerprint AE6A C300 720E A9E7 4C50 C8EB 4D3D B4CF 4DAD 6115). It lives on the /pgp page and at /pgp.asc, on Keybase and keys.openpgp.org, and gpg --locate-keys nico@nicomee.com resolves it over Web Key Directory. Security reports go to security.txt. Verify the fingerprint out of band before you trust it.