Vulnerability data, open-source governance, and stock markets. Almost everything I build traces back to one of them.
GAdvisory and the CNA work come from the first. How I think about licensing and maintainer burnout comes from the second. GBoarse comes from the third.
That's not a coincidence. You end up building tools for the problems you keep walking into.
The interesting problem was never finding bugs. It is that advisory data gets stuck where it was published: easy to read on the platform hosting it, awkward everywhere else.
Running a CNA means living inside that. Assignment, scoring, weakness chains, record formats, disclosure timelines. GAdvisory exists because the friction in those workflows is not theoretical to me, and GAnalytics exists because I wanted to measure whether the programme as a whole is getting better or worse rather than guess.
Working on a project that is genuinely open source, next to a product line that is deliberately not, forces you to be precise about the difference.
GHub is open core and I say so. I do not call it open source, because it isn't. Postiz is open source and belongs to its maintainers, and my part in it is a contribution rather than a possession. Collapsing those two would misrepresent both.
Contribution Checker came out of the other half of this: popular repositories attract pull requests nobody asked for, and the expensive part of triaging them is not the code review.
The one thread with no professional justification, which is probably why it is the most fun.
GBoarse is a full market simulation with a real central limit order book, double-entry bigint accounting, and a deterministic replayable core. Markets are an unusually honest systems problem: the rules are written down, the failure modes are well documented, and the accounting either balances or it doesn't.
UI-first, everywhere. If the API can do it, the UI has to do it too. It costs more up front and I've never regretted it.
Self-hosting as the primary target rather than the afterthought. Bare metal ahead of containers where the choice comes up. Things that must survive a restart run on durable workflows rather than in-process timers, because a bot that restarts should not lose the auto-close it promised.
Germany, in German and English. Advisories, release notes and support replies go out in whichever one suits the person reading them.
Personal projects and the homelab sit under Gelhaus Solutions. The work page covers what runs there and why it is built that way.
Self-hosting and network engineering, mostly. Watching where the industry is actually going rather than where the press releases say it is.
No. Open core. The base version of every app is free, Pro and Enterprise aren't, and all of it sits under a proprietary licence I hold every right to. It isn't AGPL.
Postiz, where I work, is open source. My own line isn't, and I try to keep that clear.
Because a feature that only exists behind a CLI flag or an undocumented endpoint is a feature only maintainers really have.
It costs more up front. I've never regretted it.
Email, coordinated disclosure. You'll get an acknowledgement, a scoped and scored assessment, and a timeline we agree on. There's a PGP key published over WKD if you need to encrypt it.
Email if it needs a record. Discord if we are already mid-conversation. Those are the only two.
Yes, both, daily. Advisories, release notes and support replies go out in whichever one suits the reader.
The umbrella for my homelab and my personal and community projects. Separate from the Postiz role.
Because some changes only make sense for how I work, and asking a maintainer to carry them is not fair on either of us.
Vulnogram is the clearest case. The attachment handling and CVSS vector pasting I added fit the way I run advisory work, and would be noise for a CNA that works differently. Forking was cheaper than arguing for every change, and more honest about who the changes are for.
Where the upstream wants something, it goes upstream. Postiz and the OSV work are contributions, not forks.
Not published. It does not mean undocumented.
Some of it is client work, where somebody paid for it and the code is theirs rather than mine to hand out. The rest is my own work I decided not to open.
Either way the entry describes the problem and what was built to solve it, because that part is mine to talk about.
