skip to content
naft.pink
naftpink's avatar

naftpink

@naftpink

I build things that have to stay up.

Mostly web and backend work in TypeScript, plus a fair amount of Rust lately. Right now that means a server hosting platform, a diary app that collects nothing, and a game with its own scripting VM.

  • Software Dev 🎀
  • Coding in Midnight & Pink
  • DMs open 🫰
  • TypeScript
  • React
  • Next.js
  • Rust
  • C++
  • Node
  • Fastify
  • Express
  • Git
  • sh

elsewhere

what I'm building

all projects

Codename ███████

in development

A server hosting platform for games and small services, still being built. Billing, provisioning, and a browser console already work; the isolation and pricing model are the current design target, not a finished claim.

  • Stripe billing works end to end — payments, coupons, and a customer balance.
  • Provisioning a server and getting a noVNC console for it in the browser both work.
  • Server lifecycle management works: start, stop, restart, reinstall, backup.
  • Aiming for bare metal with NVMe and per-instance isolation instead of oversold shared VMs — that part is design intent, not shipped yet.
  • NextJS
  • TypeScript
  • Drizzle
  • Docker
  • PVE
  • Stripe

more

Yunoa

early

An encrypted diary and habit tracker for mental health. Closest thing to it is IAmSober, except this one has no ads and collects nothing.

  • Entries are encrypted, so they stay yours and stay on your device.
  • No ads, no analytics SDKs, no account required to write something down.
  • Habits and streaks live next to the journal instead of in a separate app.
  • TypeScript
  • React-Native
  • Expo

more

Unnamed Unreal Engine game

early

The game the scripting VM exists for. Also unnamed, mostly because naming it would make it feel real.

  • A small stack-based virtual machine in Rust, ported out of C++, with a compiler for the gameplay scripting language.
  • The point is to hot-reload game logic without rebuilding the whole project.
  • Written while learning Rust, so it gets rewritten roughly every other month.
  • Rust
  • C++
  • Unreal Engine

more

2021BeePack2021Java obfuscator & deobfuscator2023Casino sim2023ShareX image host2023TrackYourPack2024Art Gallery2024Codename ██████2024keroton.in2024School Tinder2025Unnamed Unreal Engine game2025Self-hosted encrypted chat2026Codename ███████2026Yunoa

notes

all notes

  • the only honest test of an obfuscator is writing the deobfuscator

    I built a Java obfuscator and the tool that undoes it, both on ASM. Writing the second one is what told me which parts of the first were protection and which were just mess.

  • in an encrypted app, the wire schema is the threat model

    I'm rewriting my chat app instead of resuming it. The reason isn't the encryption — it's that there was never a written-down shape for a message, and in an end-to-end encrypted system that's not untidiness, it's an unauditable security boundary.

  • string encryption ships you the key

    My Java deobfuscator targeted ProGuard and Allatori jars. This is old enough — 2021/2022 — that I'm writing it from memory, not from the code, and I've had to correct details I got backwards the first time I wrote this up.