River Caudle
OT / ICS security · field research & frameworks
On this page
  1. § 01Principles
  2. § 02What I build
  3. § 03How it ships
  4. § 04Where this leads

Software · Code that earns its place

Tools you can ownand audit.

Code you can read and run yourself.

A platform is something you rent and can't see inside. A tool is something you own and can read. The software I write is owned capability. It runs on your iron, on your terms, and it does one job you can verify by hand.

If you can't audit it, you don't own it. You're trusting it.

River Caudle · Riverman · OT/ICS Security Practice

§ 01. Principles

Small, legible, no phone-home.

Software earns its place by being small enough to read, plain enough to reason about, and quiet enough that you know everything it talks to. A tool that needs a license server, a telemetry endpoint, or a vendor's cloud to function isn't a tool you own. The constraints below are not limitations. They are the design.

What every tool must be

  • Small: readable end to end in an afternoon.
  • Legible: plain language, no clever indirection.
  • Silent: no phone-home, no telemetry, no license check.
  • Auditable: source you can read before you trust it.

What that buys you

  • Trust by inspection: not by reputation.
  • Offline by default: runs where the plant runs.
  • No dead-vendor risk: it keeps working without me.
  • Ownership: the point of the whole exercise.
"If you can't audit it, you don't own it. You're trusting it."

§ 02. What I build

Tools for the work, not a product line.

The software follows the engagements. Each tool exists because a piece of the work needed it and nothing buyable would do the job without a subscription or a black box. These are categories, not a catalog.

Categories

  • Visibility: read what's on the wire, locally.
  • Baseline: capture and diff the known-good state.
  • Design: turn an accumulated network into a drawn one.
  • Verification: prove a control is real, not asserted.

What each one is not

  • Not an agent that calls a cloud.
  • Not a dashboard you rent by the seat.
  • Not a scanner that needs a feed to work.
  • Not a platform that grows until it owns the budget.

§ 03. How it ships

Source-available, self-hostable.

How software reaches you is part of whether you own it. Proprietary binaries and hosted SaaS are dependence with a delivery mechanism. Source you can read, build, and run on your own iron is the only model that survives the vendor.

Not this

  • Proprietary binary you can't inspect
  • Hosted SaaS that holds your data
  • License server that can revoke you
  • Updates pushed without your knowledge

This

  • Source-available, read before you run
  • Self-hostable on your own infrastructure
  • No license check, no kill switch
  • You decide when and whether to update

§ 04. Where this leads

Software is doctrine, compiled.

A tool is only useful if it serves the work. Each link below is where this software shows up. In engagements, in the frameworks that structure them, and in the wider argument for industrial independence.

"Code earns its place by being small enough to read and quiet enough to trust."

River Caudle · river@riverman.io · Houston, Texas