Unintended computations, sideways thinking, rigorous craft.
I'm a software security engineer, and this is my personal website.
I love hunting for beauty and accidental logic where neither belongs.
I turn printers into game consoles, specs into bugs, and Swiss mountains into GPX routes. Selected pieces:
Computation - Computation in unexpected places
Hacking as challenging assumptions about a system's usage, implementation and what it can actually compute.
🇦🇹 2026-11-19 Unintended Computations @ DeepSec
🇱🇺 2026-10-21 Unintended Computations @ hack.lu (slides, video)
Security - Specifications, implementations, and wrong assumptions
💥 CVE-2026-86925: Apple QuickLook Exposes iCloud Document Paths
💥 CVE-2026-112554: Apple IOStorageFamily Kernel Memory Leak
💥 CFXMLParser crashes on a 7 bytes input
💥 IPC Panic, a four-call kernel panic in Apple XNU, up to macOS and iOS 26 included
💣 Parsing JSON is a Minefield (2016–2018)
The spec fits on a business card, yet no two parsers agree on what valid JSON is. Widely cited since 2016.
Drawing - Computational graphics, maps and visual experiments
🗺️ Cartopolis (July 2026)
OpenStreetMap compiled into static binary packs that a browser rasterizes in 1999-style GIFs. No server, no post-processing. The aesthetic emerges from enforced constraints.
PostScript - A programming language disguised as a document format
🖨️ Programming in PostScript (2025)
This printer language is a full programming environment. Enough to run Tetris and Sokoban, or even chess directly on the printer.
Contact: nicolas at seriot dot ch.