Work
A few projects explained briefly rather than a wall of logos. For each one you’ll find what I built and what can be verified.
Enterprise and public-sector experience
I delivered these projects as an employee and senior consultant. I don’t name the clients here: that clearance is theirs to give, not mine. In conversation I’ll happily tell you who they are. Experience, then, not a client list of BobaTR.
- A telecommunications groupFull-stack development on a corporate project as a senior consultantsince 2021
- A DAX-listed logistics groupWeb and server development with Java, Vue and PHP2017–2019
- A food retail groupFull-stack development in an enterprise setting as a senior consultantsince 2021
- State agency, Mecklenburg-VorpommernJava development for the state administration2020
Live under broadcast pressure
9.5 hours, no second take
On 5 September 2026, German national broadcaster ZDF aired “Der Quiz-Champion – Das Spenden-Special” with a parallel Twitch programme for the first time. The interactive show technology for the hosts’ companion stream came from BobaTR.
What the system handled
What BobaTR built
Four interactive show formats with their own animations and sound effects, plus the control panel for all four. The audience voted, guessed along and triggered overlays. Every input was evaluated at once and the result played straight back on screen, more than 25,000 times that night.
The control panel wasn’t run by me but by the team behind the scenes. They described the interface as intuitive, and across nine hours nothing went wrong. That is the part that transfers to a business application: software somebody touches for the first time under pressure and still gets right. The hosts commissioned me, by the way, not ZDF.
Broadcast facts 9.5 h live broadcast from prime time until 5:45 a.m.2.82 M TV viewers, 16.0% audience share€4.6 M donations for German Cancer Aid1st Twitch companion show in the format’s history Public figures about the television broadcast as a whole, not BobaTR’s reach.
Events run left to right, all the way onto the stream. The operations band underneath is what lets you swap out one box at 2 a.m. without the others noticing.
What comes up again in your project
-
01
Usable without trainingThe control panel ran in someone else’s hands, first time, under time pressure. A business application has the same problem, just with more fields and less adrenaline.
-
02
Real-time under loadControl room, hosts and audience see the same state, milliseconds apart. The same mechanics keep a dashboard in sync when a whole department is looking at it at once.
-
03
ResilienceFailover, load testing and monitoring before launch, not after. Where there’s no second attempt, you find out quickly which of those were optional.
Sources: ZDF press office, DWDL.de, Studio Hamburg Production Group, Deutsche Krebshilfe, Quotenmeter (all September 2026). ZDF, “Der Quiz-Champion”, Tim Horus and Rosemondy are named as factual references only. BobaTR has no business relationship with ZDF.
Side projects
I usually can’t show client work in detail, but I can show my own. Here are a few projects that show how I work. The numbers come from the code, as of September 2026.
2 GB uploads without a server process
Guests at a party upload photos and videos and download the lot as one ZIP. The catch was large files on a basic hosting plan, with no background processes and no cloud storage. So the upload resumes in chunks, a hand-written ZIP writer streams while downloading, and checksums are combined without a second pass over the data.
- Chunk checksums are combined mathematically (crc32_combine as in zlib) instead of reading two gigabytes again.
- The ZIP writer deliberately writes without data descriptors so that Java programs and Android extractors open the archives too.
- File locks that behave the same on Windows and Linux, and HTTP range requests served correctly so videos play on the iPhone.
- 145
- API tests
- 55
- browser tests
- 0
- server processes
In use on a client domain, password-protected.
Bit for bit identical, on every device
Two game projects, one principle: a physics engine with a fixed time step, and a particle simulation that produces exactly the same world on any machine in the world from a short seed code. You need that wherever two machines have to reach the same result independently, in a game just as much as in a calculation an auditor will later retrace.
- Physics at a fixed 120 steps per second, independent of the frame rate. Tests prove it: same input, same result, everywhere.
- A level generator that plays every level itself first (234 simulations per candidate) and only ships solvable ones.
- Spatial hash grid and struct-of-arrays instead of naive pair checks: around 1,600 particles at 60 fps in the browser.
- 120 Hz
- fixed simulation rate
- 234
- test shots per level
- 60 fps
- at ~1,600 particles
Built on broadcast day, in use that evening
A tool that shows the ZDF stream and the Twitch stream at the same time and switches the audio with one key. Three very different players sit behind one shared interface, and streams that drop reconnect on their own. No back end, no database, no build. One file that runs anywhere.
- One adapter interface for three player types (HLS, Twitch, iframe). Audio and layout logic don’t know which source is playing.
- Automatic recovery on network and media errors instead of a black screen.
- When swapping, both players stay where they are in the DOM and only the classes change. Otherwise the streams would reload.
- 3
- player adapters
- 15
- keyboard shortcuts
- 0
- server dependencies
Reported without reading any content
On one online service, other people’s documents could be reached through sequential IDs, number one in the OWASP API Security Top 10. I proved the flaw and reported it to the provider, who closed it within three days. I review code with the same eye.
- Evidence via HEAD requests and 1-byte ranges only, dry run as the default.
- Hard request caps and an immediate stop on rate limits, so the service never noticed a thing.
- OWASP #1
- weakness class
- 1 byte
- never more than that per document
Provider and affected parties stay anonymous. Details in confidence on request.