Geyslan Gregório
I’m an Open Source Engineer at Aqua Security, working on Linux runtime security with eBPF. Day to day, I’m on Tracee (detection & forensics) and the eBPF tooling around it - libbpfgo, BTFhub - living at the kernel/user-space boundary. These days the work is as much about where the code should go as the code itself - design, technical direction, the sharp edges others route around. More and more of it is maintaining across repos, shaping designs before they harden, reviewing far more code than I write, and unblocking people so the right version ships. I still write plenty - I just care more about whether it’s the right code than how clever it is.
I’ve been at this a long time, low-level by preference. I got hooked on computers in my early teens and by around 2000 had turned that into my first paying job as a programmer. Back in 2013 I started poking at the Linux kernel purely out of curiosity - chasing bugs and small improvements for the fun of it - which quietly grew into 70-plus authored patches. Around then came a long dive into shellcode and x86 assembly, the odd crackme, and eventually a peer-reviewed paper on shrinking shellcode without changing its behavior that earned an honorable mention at SBSeg. Some of that work has since been referenced in academic research and security writeups - always a strange, nice surprise.
I spent years maintaining packages for Arch Linux (quieter on that front these days). I enjoy C and Assembly more than is probably healthy, write Go for a living, and keep an eye on Zig for where I believe systems programming heads next. Comfortable from NAND gates up to Go; happiest in the parts of the stack most people would rather not look at.
“Talk is cheap. Show me the code.” - so here’s the code.
Still an ordinary fellow who introduces the occasional 🐛 and expects to be paid for it (sometimes the bugs are free). I once rambled about all this on the Hacking Bits blog - long dormant now, but the old posts still stand.