index.html

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; media-src 'self'; base-uri 'none'; form-action 'none'">
<title>Tim Conrad</title>
<meta name="description" content="Tim Conrad does security research and builds browser games. This site holds two games, his thoughts, the CVE-2022-46166 write-up, his tools and a PGP key.">
<link rel="canonical" href="https://t7d.dev/">
<meta property="og:type" content="website">
<meta property="og:title" content="Tim Conrad">
<meta property="og:description" content="Tim Conrad does security research and builds browser games. This site holds two games, his thoughts, the CVE-2022-46166 write-up, his tools and a PGP key.">
<meta property="og:url" content="https://t7d.dev/">
<meta property="og:image" content="https://t7d.dev/assets/og.png">
<meta name="twitter:card" content="summary_large_image">
<link rel="alternate" type="application/rss+xml" title="Tim Conrad · Thoughts" href="/thoughts/feed.xml">
<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
<link rel="preload" href="/assets/fonts/barlow-condensed-700.woff2" as="font" type="font/woff2" crossorigin>
<link rel="stylesheet" href="/assets/site.css">
<script src="/assets/theme.js"></script>
<script src="/assets/site.js" defer></script>
</head>
<body>
<a class="skip" href="#main">Skip to content</a>

<header class="nav">
  <div class="wrap nav__in">
    <a class="brand" href="/">Tim Conrad</a>
    <nav class="nav__links" aria-label="Sections">
      <a href="#games">Games</a>
      <a href="/thoughts/">Thoughts</a>
      <a class="opt3" href="#research">Research</a>
      <a class="opt2" href="#verify">PGP key</a>
      <a class="opt2" href="#contact">Contact</a>
    </nav>
    <button class="toggle" id="theme-toggle" type="button">dark</button>
  </div>
</header>

<main id="main">

<section class="hero">
  <div class="hero__main">
    <p class="label">Sheet 1 · Overview</p>
    <h1>Tim Conrad</h1>
    <p class="lede">I do security research and build browser games. This site holds two games, the ideas I am working through, one vulnerability write-up, the tools I published and my PGP key.</p>
  </div>
  <dl class="tb">
    <div><dt>Site</dt><dd>t7d.dev</dd></div>
    <div><dt>Contents</dt><dd>2 games, 2 thoughts, 1 write-up, 1 tool</dd></div>
    <div class="wide"><dt>Contact</dt><dd><a href="https://de.linkedin.com/in/tim-c-94397a200/de" rel="me noopener">LinkedIn</a>, <a href="https://github.com/Tim-Conrad" rel="me noopener">GitHub</a></dd></div>
    <div class="wide"><dt>PGP fingerprint</dt><dd class="mono">A886 6CB1 6B07 9685 5615<br>74B2 A91D ABBE C996 7390</dd></div>
  </dl>
</section>

<section class="section" id="games">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 2 · Games</p>
      <h2>Games</h2>
      <p>Two games. Both run in the browser, and both can be played on this site.</p>
    </div>
    <div class="projects">
      <a class="proj" href="/projects/kleinbahn/">
        <p class="label">three.js · sandbox</p>
        <h3>Kleinbahn</h3>
        <picture>
          <source media="(prefers-reduced-motion: reduce)" srcset="/assets/projects/kleinbahn-1.jpg">
          <img src="/assets/projects/kleinbahn-loop.webp" width="640" height="360" loading="lazy" decoding="async" alt="Gameplay: a steam train runs through a town, past a carousel and a level crossing.">
        </picture>
        <p>An island-railway sandbox in three.js, built for phones. You lay track and place things; trains, people and boats do the rest.</p>
        <span class="proj__more">Details and live demo</span>
      </a>
      <a class="proj" href="/projects/wortzauber/">
        <p class="label">word game · German and English</p>
        <h3>Wortzauber</h3>
        <picture>
          <source media="(prefers-reduced-motion: reduce)" srcset="/assets/projects/wortzauber-1.jpg">
          <img src="/assets/projects/wortzauber-loop.webp" width="640" height="360" loading="lazy" decoding="async" alt="Gameplay: the word apfel is traced letter by letter, then an apple appears on the meadow.">
        </picture>
        <p>A letter-tracing word game for children, in German and English. Write a word, trace each letter, and the thing appears.</p>
        <span class="proj__more">Details and live demo</span>
      </a>
    </div>
  </div>
</section>

<section class="section" id="thoughts">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 3 · Thoughts</p>
      <h2>Thoughts</h2>
      <p>Ideas I am working through. Each one keeps its sources and a list of what changed. All of them are on <a href="/thoughts/">the list</a>, and in the <a href="/thoughts/feed.xml">RSS feed</a>.</p>
    </div>
    <div class="projects">
      <a class="proj" href="/thoughts/humans-md/">
        <p class="label"><time datetime="2026-11-10">10 Nov 2026</time> · draft · working with models</p>
        <h3>A humans.md for working with models</h3>
        <svg class="dg" viewBox="0 0 640 360" role="img" aria-labelledby="hm-t">
          <title id="hm-t">Two files side by side: CLAUDE.md for the agent, HUMANS.md for me, with a log per model.</title>
          <rect class="bx" x="50" y="56" width="240" height="220"/>
          <text x="72" y="98" class="t-l">CLAUDE.md</text>
          <rect class="bx-s" x="72" y="122" width="190" height="12"/>
          <rect class="bx-s" x="72" y="148" width="150" height="12"/>
          <rect class="bx-s" x="72" y="174" width="170" height="12"/>
          <rect class="bx-s" x="72" y="200" width="120" height="12"/>
          <text x="50" y="316" class="t-l t-m">for the agent</text>
          <rect class="bx-i" x="350" y="56" width="240" height="220"/>
          <text x="372" y="98" class="t-l t-inv">HUMANS.md</text>
          <rect class="bx" x="372" y="122" width="190" height="12"/>
          <rect class="bx" x="372" y="148" width="150" height="12"/>
          <rect class="bx" x="372" y="190" width="196" height="64"/>
          <line class="ln" x1="372" y1="211" x2="568" y2="211"/>
          <line class="ln" x1="372" y1="232" x2="568" y2="232"/>
          <text x="350" y="316" class="t-l t-m">for me</text>
        </svg>
        <p>My repositories tell the agent how to work with me, but nothing tells me how to work with the agent. A first version of that file, and what changes when a new model ships.</p>
        <span class="proj__more">Read the thought</span>
      </a>
      <a class="proj" href="/thoughts/encrypted-patches/">
        <p class="label"><time datetime="2026-11-10">10 Nov 2026</time> · draft · updates · key release</p>
        <h3>Encrypted patches, unlocked on patch day</h3>
        <svg class="dg" viewBox="0 0 640 360" role="img" aria-labelledby="bc-t">
          <title id="bc-t">The encrypted bundle reaches every host before patch day; at T only the key is published.</title>
          <text x="400" y="50" text-anchor="middle" class="t-h t-l">patch day T</text>
          <line class="ln-s" x1="400" y1="66" x2="400" y2="300"/>
          <rect class="bx-s" x="40" y="92" width="360" height="56"/>
          <text x="60" y="128" class="t-l">encrypted bundle</text>
          <rect class="bx-i" x="400" y="92" width="36" height="56"/>
          <text x="452" y="128" class="t-l t-m">install</text>
          <rect class="bx-i" x="406" y="176" width="220" height="56"/>
          <text x="422" y="212" class="t-l t-inv">diff → exploit</text>
          <g transform="translate(388,256)"><circle class="bx" cx="10" cy="10" r="9"/><line class="ln-t" x1="19" y1="10" x2="44" y2="10"/><line class="ln-t" x1="36" y1="10" x2="36" y2="18"/></g>
          <text x="376" y="274" text-anchor="end" class="t-l t-m">key at T</text>
          <line class="ln" x1="40" y1="314" x2="600" y2="314"/>
          <text x="40" y="344" class="t-l t-m">−7 days</text>
        </svg>
        <p>Ship a security fix early as ciphertext and publish the key on patch day, so teams can stage it and apply it together. Games, a design with signed keys, open source in private, and the patents.</p>
        <span class="proj__more">Read the thought</span>
      </a>
    </div>
  </div>
</section>

<section class="section" id="research">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 4 · Research</p>
      <h2>Research</h2>
      <p>Vulnerabilities I found and reported.</p>
    </div>
    <div class="projects">
      <a class="proj" href="/research/cve-2022-46166/">
        <p class="label">CVE-2022-46166 · Dec 2022 · CWE-94</p>
        <h3>Remote code execution in Spring Boot Admin</h3>
        <img src="/assets/img/exploit-poster.jpg" width="1600" height="890" loading="lazy" decoding="async" alt="Spring Boot Admin in the browser: the applications page, at the start of the exploit recording.">
        <p>The Microsoft Teams notifier read one of its settings as an expression template, and a signed-in user could change it. I reported it in November 2022; the fix and the advisory followed 11 days later.</p>
        <span class="proj__more">Read the write-up</span>
      </a>
    </div>
  </div>
</section>

<section class="section" id="tools">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 5 · Tools</p>
      <h2>Tools</h2>
      <p>Small tools I built for my own work and published. All of them are on <a href="/tools/">the list</a>.</p>
    </div>
    <div class="projects">
      <a class="proj" href="/tools/papercuts/">
        <p class="label">v0.1.0 · MIT · coding agents · feedback</p>
        <h3>Papercuts</h3>
        <svg class="dg" viewBox="0 0 640 360" role="img" aria-labelledby="pc-t">
          <title id="pc-t">A page with a tab at its edge and a terminal both send a report to one GitHub issue.</title>
          <rect class="bx" x="40" y="40" width="250" height="150"/>
          <rect class="bx-s" x="62" y="70" width="150" height="12"/>
          <rect class="bx-s" x="62" y="96" width="190" height="12"/>
          <rect class="bx-s" x="62" y="122" width="120" height="12"/>
          <rect class="bx-i" x="272" y="80" width="18" height="70"/>
          <text x="40" y="214" class="t-l t-m">page</text>
          <rect class="bx" x="40" y="236" width="250" height="84"/>
          <text x="62" y="284" class="t-l">$ papercuts add</text>
          <text x="40" y="344" class="t-l t-m">terminal</text>
          <line class="ln" x1="290" y1="115" x2="380" y2="170"/>
          <line class="ln" x1="290" y1="278" x2="380" y2="210"/>
          <rect class="bx-i" x="380" y="120" width="220" height="140"/>
          <text x="402" y="162" class="t-l t-inv">issue #12</text>
          <rect class="bx" x="402" y="184" width="170" height="12"/>
          <rect class="bx" x="402" y="210" width="130" height="12"/>
          <text x="380" y="290" class="t-l t-m">one place</text>
        </svg>
        <p>One place where my coding agents and I report friction on local sites and in the terminal. Each report becomes a GitHub issue.</p>
        <span class="proj__more">Read about the tool</span>
      </a>
    </div>
  </div>
</section>

<section class="section" id="verify">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 6 · PGP key</p>
      <h2>PGP key</h2>
      <p>Use this key to verify anything published under my name. Compare the fingerprint before you trust the key.</p>
    </div>
    <div class="verify">
      <div class="fpr">
        <p class="fpr__hex" id="fpr" data-text="A8866CB16B079685561574B2A91DABBEC9967390" aria-label="Fingerprint A886 6CB1 6B07 9685 5615 74B2 A91D ABBE C996 7390">
          <span>A886</span><span>6CB1</span><span>6B07</span><span>9685</span><span>5615</span><span>74B2</span><span>A91D</span><span>ABBE</span><span>C996</span><span>7390</span>
        </p>
        <p class="fpr__meta"><span>RSA 3072</span><span>Created 4 Dec 2020</span></p>
        <div class="btn-row">
          <a class="btn" href="/key.asc">Download key.asc</a>
          <button class="btn btn--ghost" type="button" data-copy="fpr">Copy fingerprint</button>
        </div>
      </div>
      <div class="code">
        <div class="code__bar"><span>Check the fingerprint</span><button class="copy" type="button" data-copy="verify-cmd">copy</button></div>
<pre id="verify-cmd"><code><span class="l">curl -O https://t7d.dev/key.asc</span><span class="l">gpg --show-keys --with-fingerprint key.asc</span><span class="l"><span class="c"># expect: A886 6CB1 6B07 9685 5615  74B2 A91D ABBE C996 7390</span></span><span class="l">gpg --import key.asc</span></code></pre>
      </div>
    </div>
  </div>
</section>

<section class="section" id="contact">
  <div class="wrap">
    <div class="section__head">
      <p class="label">Sheet 7 · Contact</p>
      <h2>Contact</h2>
      <p>Message me on LinkedIn. My code is on GitHub.</p>
    </div>
    <div class="btn-row">
      <a class="btn" href="https://de.linkedin.com/in/tim-c-94397a200/de" rel="me noopener">LinkedIn</a>
      <a class="btn btn--ghost" href="https://github.com/Tim-Conrad" rel="me noopener">github.com/Tim-Conrad</a>
    </div>
  </div>
</section>

</main>

<footer class="foot">
  <div class="wrap">
    <span>Tim Conrad</span>
    <span>No cookies, no trackers, no third-party requests</span>
  </div>
</footer>

</body>
</html>