$ whoami

I build the protocols that move the internet.

I'm Felix — I like understanding systems all the way down and owning the ones I depend on, from bare-metal operating systems to protocol security to my own infrastructure.

View projects Publications github

// now

> Building independent surveillance infrastructure for DNSSEC
> Simulating operating systems
> Developing start-up support infrastructure in Germany

// stack & tools

Rust

TypeScript

Python

Bash

React

TailwindCSS

Vite

WebAssembly

Node.js

PostgreSQL

Redis

NGINX

Linux

Docker

Kubernetes

Cloudflare

Nix

GitHub

GitHub Actions

Neovim

Wireshark

Git

VS Code

Vim

Tmux

Zsh

Make

Bazel

Jetbrains

Figma

Notion

Slack

Jira

Rust

TypeScript

Python

Bash

React

TailwindCSS

Vite

WebAssembly

Node.js

PostgreSQL

Redis

NGINX

Linux

Docker

Kubernetes

Cloudflare

Nix

GitHub

GitHub Actions

Neovim

Wireshark

Git

VS Code

Vim

Tmux

Zsh

Make

Bazel

Jetbrains

Figma

Notion

Slack

Jira

// Languages

Rust

TypeScript

Python

Bash

// Frontend

React

TailwindCSS

Vite

WebAssembly

// Backend

Node.js

PostgreSQL

Redis

NGINX

// Cloud & DevOps

Linux

Docker

Kubernetes

Cloudflare

Nix

GitHub

GitHub Actions

// Tools

Neovim

Wireshark

Git

VS Code

Vim

Tmux

Zsh

Make

Bazel

Jetbrains

Figma

Notion

Slack

Jira

// featured

Selected projects

ls projects/ →

ds-watch

active

A DNSSEC transparency observatory: downloads the DS records of entire gTLD zones every day and publishes every change to the DNS trust chain as an append-only, registry-signed event log — the Certificate Transparency model, applied to DNSSEC.

pythondnsdnssec

// latest

From the blog

cat blog/ →

2026-09-08

ds-watch: a transparency log for DNSSEC's trust chain

Certificate Transparency has watched the web PKI since 2013. DNSSEC has the same structural problem and no equivalent. I built a small observatory, ds-watch, that photographs the DNS trust chain every day and publishes every change as a public, registry-signed log. It's now running in production against three gTLD zones.