Two Tiny Distractions
Made from scratch, no audio files, no external code. Click the snake to steer; type look in the adventure to begin.
Snake: click anywhere on the board to steer · arrow keys also work · ♫ toggles a soft 8-bit chiptune. Adventure: original 16-room text dungeon set on the Whitby coast — no Infocom code, no Open-Adventure derivation, just a tiny parser. Both games together: ~14 KB inline.
Featured Research & Findings
macOS Security Research Framework
A complete six-phase methodology distilled from 35 years of practice. Eleven chapters covering vendor disclosure, the Darwin/XNU landscape, and the discipline of proof.
Read & Download (Free)Metis: Binary Vulnerability Toolchain
A sophisticated automated pipeline for discovering vulnerabilities in Darwin/XNU binaries. Uses spectral modeling and pattern-based analysis. Free for non-commercial use.
View on GitHubPoppy: XPC Observability & Fault Injection
Dynamic analysis toolkit for macOS daemons. Trace XPC messages, map entitlement checks in real-time, and perform targeted fault injection via Frida and DTrace.
View on GitHubNTAG 424 DNA SDK for macOS
The first native macOS SDK for NXP NTAG 424 DNA NFC authentication. Full EV2First protocol, Secure Dynamic Messaging, key management. Zero dependencies.
View on GitHubWhat I'm Building Now
Current work at the intersection of cryptography, heritage, and community safety.
Whitby Jet Provenance Platform
Cryptographic verification for genuine Whitby Jet jewellery. Each piece carries an NFC tag with an unforgeable AES-128 signature. Customers tap with any phone — no app required.
authenticwhitbyjet.co.uk →Maritime Cyber Security — Whitby
Plain-English cyber security advice for Whitby's maritime community. GPS spoofing risks, marine insurance cyber gaps, onboard network security, and UK GDPR compliance for small operators.
maritime-security.html →Data Protection — Pro Bono
Background and experience in data protection: DPIAs, LIAs, clinical trial systems, law firms, retail, and family support. Not a services page — a record of what I know. Pro bono community help only.
data-protection.html →Scratchpad
A hyperlocal clipboard for macOS. Press CMD+SHIFT+X and move text between screens instantly. No cloud, no accounts, no tracking. 462 lines of Swift.
github.com/jetnoir/scratchpad →What I've Delivered
Over forty years across defence, healthcare, finance, and government.
TfL Contactless Travel Security
Designed the cryptographic key management architecture for London's contactless payment network. ISO 27001 and PCI DSS compliant. 22,000 readers, 8 million daily transactions.
NHS National Cryptographic Standards
Authored cryptographic security standards for the NHS national programme. Smart card infrastructure analysis, key derivation protocols, protecting 60 million patient records.
Cyber Security & Data Protection
GDPR implementation, security architecture, penetration testing, and incident response across financial services, retail, and critical national infrastructure.
Four Generations of Whitby Craft
The threads that connect Victorian jet workshops to AES-128.
Robert Dixon — Victorian Whitby Jet Worker
My four-times great-grandfather Robert Dixon worked Whitby Jet in the Victorian era, in the heart of the jet trade. The 1911 Census records him as a jet worker in a town where the material defined the economy and identity of its people.
When I moved to Whitby, I didn't plan to build a provenance platform. But standing on the same streets where my ancestor shaped jet by hand, the idea felt inevitable: use what I know — cryptography — to protect what he helped create.
William (Bill) Steele — Signals, Convoys, Cold War Scarborough
My grandfather William (Bill) Steele served as a radio officer in the Merchant Navy during the Second World War, trained by the Marconi Company in Aberdeen. On convoy duty across hostile waters, he was responsible for receiving and relaying messages about submarine attacks — signals that kept ships and their crews alive. It was skilled, dangerous work conducted under fire and in extreme conditions.
After the war he was recruited into what was then called the Government Spy School — a signals intelligence agency — and ended up in Scarborough, where he spent the Cold War listening in on Russian Navy Morse code transmissions, helping to protect British interests at the height of the Cold War. There is still a government listening station in Scarborough to this day.
I didn't grow up thinking of encryption as a family trade. But somewhere between Bill's wartime radio set and the AES-128 keys I work with now, the thread is there.
These don’t bend.
Not a values slide, I promise. Six things I check my own work against, in the small hours, with the coffee going cold. If a job, a brief, or a person asks me to bend one of them, I tend to walk. Twice I’ve run.
Provenance
Where it came from is most of the question. The rest is what it does next. Pieces of Whitby Jet, NHS data sets, audit findings — same rule.
Heritage
Some skills, places, and objects only happen once. Whitby Jet. A well-written man page. The person who wrote it. Make sure they survive the next bit.
Honesty
What it is. What it isn’t. What I’m still not sure about. All three on the page, all three labelled. The third one is the one that matters most.
Craft
Build it well enough that you’d be glad to find your own work twenty years from now, with the lid off. I have. It is mortifying when the lid comes off something I made tired. So I try not to make tired things.
Accessibility
If it only works for some of us, it doesn’t really work. That includes the version of you having a difficult day, the version of me on hour eleven of a flare, and the eight-year-old who hasn’t been taught the jargon yet.
Independence
Pro bono only. No investors, no retainers, no fees, no extraction. Written-first, async, at the pace my health and capacity will bear. The simplest of the six. Probably the most expensive.
Qualifications
Professional certifications.
Privacy & Data Protection
Security
Sometimes Serious. Sometimes Not.
All the hats. The cryptography is real; the pirate isn't.
Some decorative images on this site are AI-generated and labelled as such.
A Note on Working With Me
Being honest upfront saves everyone time.
I’m neurodivergent — ADHD, autism, RSD. Over 35 years I’ve had more than 75 jobs. I’m not a conventional worker. I do my best work on things that genuinely interest me, on my own terms, at my own pace.
Not available for commercial work. This site is a record of what I’ve done, what I know, and what interests me — not a shop window. I share knowledge pro bono when health and energy allow, for community, charity, or research purposes.
Written communication only. No phone calls, no video meetings, no real-time chat. Async, at my pace. I may not respond quickly. I may not respond at all. That isn’t rudeness — it’s capacity.
Get in Touch
Based in Whitby. Not available for commercial work. Happy to share knowledge pro bono when health and time allow, written enquiries only.
stuartpaulthomas@gmail.com