enfp & les / 92li.uk / 漫漫星河，有一颗是我。
Writing code that respects freedom, exploring hardware that others left behind.
Hi there! Welcome to my digital backyard.
I'm a 19 y.o developer obsessed with what happens under the hood of our devices. I transitioned from writing simple Bash scripts to diving deep into system kernels and firmware. Whether it's building secure environments or finding exploits in closed systems, I love the process of dissecting complex technology.
When I'm not making commits, I'm likely reviving discarded electronics, poking holes in iOS security mitigations, and delving into the internal mechanisms of other operating systems.
If something has a bootloader, I probably want to unlock it. 🔓
I believe in open ecosystems, the right to repair, and the idea that one person's "e-waste" is another's weekend project.
- Diving into Linux / AOSP and researching GrapheneOS, QubesOS and SecureBlue.
- Fascinated by niche open-source POSIX systems like OpenIndiana and Haiku, currently administering Haiku's Simplified Chinese localization.
- Tinkering with coreboot to liberate hardware firmware.
- Exploring iOS internals and jailbreak techniques.
- Proudly collecting "e-waste" — giving vintage electronics a second life. 💖
Feel free to reach out for tech discussions, open-source collaborations, or just to share some cool electronic junk!
I recently published a comprehensive defense guide for users facing extreme threat models (state-sponsored coercion, supply-chain attacks, etc.). If you rely on closed-source OS mitigations or blindly trust OEM firmware, you might want to rethink your trust chain.
👉 写给高威胁模型下用户的安全与防御指南 (A Guide to Security and Defense for Users Under High-Threat Models)
“安全不始于系统安装完成的那一刻，而始于你决定信任什么。”
(Security doesn't begin when the OS installation finishes; it begins the moment you decide what to trust.)
Key topics covered:
- The Compromised Host Problem & Out-of-band Verification.
- Why GrapheneOS (Pixel) is currently the most accessible Root of Trust.
- Shattering the UEFI illusion: SMM ghosts and the necessity of coreboot/Heads.
- Hardware OPSEC & verifiable trust chains from the ground up.
I use LLMs in my workflow. If that concerns you, read this first:
AI is neither a messiah nor a boogeyman; it is simply a tool. Like an IDE or a compiler, it scales the intent and capability of its operator—outputs garbage for the lazy, scales brilliance and scaffolds masterpieces for the disciplined.
Code has no origin; it only has quality. Correctness and maintainability are the ONLY metrics that matter, regardless of whether it was typed by human fingers or generated by a neural network. Even if there's a cat walking on a keyboard — Does it compile? Does it pass tests? Is it secure? Is it maintainable? That's all that matters.
Blindly opposing AI is not just outdated dogma; it is an active security liability. Entities like Cellebrite and various threat actors are already weaponizing AI at scale to hunt 0-days. Blindly banning AI in open-source development isn't "protecting" anything; it's burying our heads in the sand and disarming ourselves. To defend effectively, we need AI to scale our code reviews, write comprehensive tests, and deploy patches faster.
If you see hallucinated function calls, broken control flows, or off-topic issues, that is not an LLM's fault — that is a human problem. It’s the failure of the human operator to review their own work. The model may have generated the mistake, but the person submitting it owns the change. Blame the meatbag who copy-pasted it without reviewing, not the matrix math. AI is not a scapegoat.
I can sympathize if you are pestered daily by terrible AI-generated requests; you are right to reject submissions that are unreviewed and untested by the sender. However, “AI-generated” is not, by itself, a complete quality assessment. Dismissing functional software as "AI slop" without reading a single line of code is not quality control. It is the laziest possible gatekeeping. The drive-by label itself is the real slop.
I once shared a technical explanation on Flathub where an LLM was involved, but strictly as a tool to polish the phrasing. Before posting, I carefully went over every single sentence to make sure it was technically sound and accurately reflected what I wanted to say. However, a Flathub reviewer dismissed it rather harshly, simply because it "read like AI." As it turned out, my points were entirely correct; it was actually the reviewer who lacked a proper understanding of the Flatpak permissions model.
Later, when I pointed this out, he didn't take it very well. He ended up locking the PR conversation, leaving just a single letter "L". But that’s a story for another day, so I won't dwell on it here.