I'm Andy Dixon. I build software that holds up.

Prefer email? [email protected]. The code lives on GitHub.

• 29years professional, since 1997
• 26verifiable certificates
• 20+products, tools and extensions

Selected
projects.

Five things I designed and built. Each links to the full write-up.

• OPENSOURCE

  New: a text editor, done properly

  Apex

  A native text editor written in Rust, in the spirit of Sublime Text. A window in about 0.2 seconds, a thousand cursors at under 4 ms a keystroke, tree-sitter for 30 languages, git built in properly and a Vim mode. No telemetry, no account, works offline, and open source.

  Why it exists: my employer doesn't allow Sublime Text, and a few of us couldn't face working without it. So we're building our own. (If you can use Sublime, do, and buy the licence. It's brilliant.)

  What it shows: performance work you can measure, from a rope buffer and viewport-only layout to incremental highlighting that re-colours an edit in a quarter of a millisecond.

• 

  Forensics, in a browser tab

  Leviathan

  A binary analysis and forensics workbench that runs entirely in the browser. A hex editor, an entropy map, a carver, structure parsers and twenty-odd other tools all work on the same bytes, share the same bookmarks and evidence log, and upload nothing.

  Why it matters: forensics usually means a dozen disconnected tools on a machine where you can't install anything. Leviathan needs a browser and nothing else, and labels every result as solid, partial or a guess.

  What it shows: twenty separate utilities rebuilt around one shared data model, with a hex editor that stays smooth on files of several hundred megabytes.

• OPENSOURCE

  Post-quantum encryption

  vault

  A command-line vault that encrypts your files with post-quantum cryptography and hides their names, sizes and dates. Give it a decoy passphrase and it opens a different set of files, for the day someone makes you open it.

  Why it matters: encrypted data stolen today can be kept and attacked later. vault wraps every key with FrodoKEM-640 and ML-KEM-768, so an attacker has to break both.

  What it shows: careful cryptography in a tool normal people can use: one Rust binary for Linux, macOS, Windows and FreeBSD, crash-safe whatever order things fail in.

• 

  Identity without passwords

  BlackWall

  An OAuth 2.1 and OpenID Connect server where passkeys are the only way in. There is no password field, so there is no password to steal, phish or reuse.

  Why it matters: most identity providers keep passwords as a fallback, which leaves the weakest route in permanently open. BlackWall removes it, with multi-tenant isolation, revocation and audit logging designed in.

  What it shows: standards-correct work on security-critical infrastructure: mandatory PKCE, real introspection and revocation endpoints, every authorisation decision logged.

• OPENSOURCE

  Terminal client

  Nexus

  A desktop client for people who live in the terminal. SSH and SFTP, Telnet, serial, VNC and RDP desktops, IRC and GitHub in one native Rust app, with an encrypted vault for the secrets and profile sync between machines. Now open source.

  Why it matters: terminal clients tend to be either a bare SSH wrapper or a heavyweight tool with strong opinions. Nexus sits between the two: jump hosts, port forwarding, broadcast input and session recording, without a fight.

  What it shows: sustained product engineering, getting dozens of small things right at once, from reconnect behaviour to how often the vault asks for a passphrase.

Expertise.

The short version. The long version involves a BBC Micro.

• Software engineering

  Go, Rust and PHP, from single-binary command-line tools to multi-tenant services. Small and correct beats large and half-finished.

• Security

  Vulnerability assessment, root cause analysis, applied cryptography, and ISO 27001 and ISO 9001 work that survives the audit.

• Applied AI

  Practical LLM tooling such as Squish and Basilisk, and AI that helps people rather than demoing well.

• Infrastructure and operations

  AWS, Prometheus, Grafana, Docker and disaster recovery, kept boring in the good way. Plus being the escalation route when a problem crosses team lines.

Articles.

1. Rust

   Why Your Rust Vec of Futures Runs Sequentially Until You Spawn Them

   A Vec of futures does nothing until polled. See why awaiting them in a loop is sequential, and when to use join_all, spawn or buffer_unordered.

2. Networking

   Why Your Port Scan Misses Half the Open Ports on a Go Target

   Five reasons nmap reports fewer open ports than a Go service really has: port ranges, IPv6, bind addresses, UDP and a full accept backlog, plus ss to check.

3. Linux

   Why rename() Is Atomic Within a Mount and mv Across Mounts Is Not

   rename(2) is atomic because it only edits directory entries. Across mounts it fails with EXDEV and mv copies then deletes. Here is the safe pattern.