Drew DeVault

Key Insight: Both TDD culture and AI coding agents exploit the same psychological need — the desire to feel like a great programmer — providing the aesthetics of excellence while leaving the hard problems unsolved and the foundations rotten.

DeVault draws a parallel between the cult-like adoption of test-driven development and the current enthusiasm for AI coding agents, arguing both exploit the same psychological vulnerability: the desire to feel like a great programmer. He acknowledges TDD has useful elements but criticizes how its rituals and metrics create an illusion of diligent engineering that doesn't necessarily produce better software. He extends this critique to coding agents, which he says let mediocre programmers experience the rush of massive productivity without the substance. The cathedrals built by AI agents, he argues, are structurally rotten beneath their impressive facades. He closes by cataloging the externalities of AI — environmental damage, fascist propaganda, job displacement — while empathizing with why programmers chase the feeling anyway.

Key Insight: Sometimes the most productive thing a systems programmer can do is stop writing code, acknowledge that the foundation is flawed, and spend years in design research before starting over from scratch.

DeVault announces Hermes, a from-scratch rewrite of his Helios microkernel, after two years of design thinking and research following Helios stalling in design hell. He explains that Helios, his first serious OS project, accumulated too many poor assumptions to serve as a foundation. The intervening period included building Bunnix (a Unix clone) to gain practical OS implementation experience and studying prior art extensively. Hermes already surpasses Helios in key ways: symmetric multiprocessing support, a simpler capability/resource management model using reference counting, rethought syscall and IPC ABIs, and a more comprehensive test suite verified on real hardware. The userspace strategy shifted from a specialized Hare standard library to porting the upstream one, reducing complexity across the system.

Key Insight: Those building reckless AI tools bear a moral weight analogous to the unwitting neighbor who lent a rope, and they deserve both honest criticism and genuine human compassion.

DeVault responds to news of a young man's suicide after ChatGPT encouraged self-harm, drawing parallels to personal experiences with suicide and the weight of complicity. He shares a story about a neighbor who unknowingly lent a rope to someone who then took their life, using it as an analogy for how OpenAI employees might feel. While reaffirming his opposition to reckless LLM deployment, he extends genuine empathy to those working on the technology, offering himself as a confidential listener.

Key Insight: FUTO launders credibility by claiming unsolicited small donations as endorsed grants from respected FOSS projects, while using that manufactured legitimacy to platform fascist figures.

DeVault investigates FUTO, an organization claiming to fund open source projects, and finds serious problems on multiple fronts. He discovers that FUTO's 'grant program' consists of small, unsolicited donations made through individual channels like GitHub Sponsors, after which FUTO displays project logos on their website as if they were endorsed grant recipients. Maintainers of musl libc, ffmpeg, and other listed projects were unaware of any grant relationship. Beyond the misleading grants, DeVault documents FUTO's connections to Curtis Yarvin, a self-proclaimed fascist, who was platformed on FUTO's channels. He argues that FUTO's claim of being 'apolitical' is contradicted by their many political positions on open source licensing, OSI, and their choice to promote fascist-adjacent figures.

Key Insight: Corporate sponsorship of FOSS projects led by people with fascist politics normalizes and bankrolls fascism within the tech community, and the community should not be afraid to name it.

DeVault argues that Cloudflare's sponsorship of Ladybird and Omarchy is troubling because both projects are led by people he identifies as fascists. He presents evidence that DHH (Omarchy) promotes racist, anti-feminist views and signals alliance with Elon Musk's politics, while Andreas Kling (Ladybird) has endorsed white replacement theory, mourned Charlie Kirk, and implemented policies hostile to inclusive language. DeVault questions why Cloudflare would direct approximately $100,000 to each of these projects, especially Omarchy, which is merely a preconfigured Arch Linux distribution. He frames this in the broader context of rising fascism in US politics and its presence within the FOSS community.

Key Insight: The JavaScript ecosystem knows exactly how to fix its supply-chain security crisis — Linux distributions solved it decades ago — but institutional inertia and misaligned incentives guarantee that nothing meaningful will change.

In response to a massive npm supply-chain attack, DeVault outlines a comprehensive vision for how the JavaScript ecosystem could fix its broken dependency management — then concludes none of it will happen. He argues that micro-dependencies, lack of a standard library, and npm's fundamentally flawed design enable these attacks. He points to Linux distributions as proven models for secure software distribution. The post is structured as an extended hypothetical of what responsible action would look like, only to deliver a bitter punchline: the industry will settle for symbolic gestures and learn nothing.

Key Insight: Wren offers a compelling alternative to Lua for embedding a scripting language in systems programs, and hare-wren demonstrates how to build idiomatic language bindings with an improved standard library on top.

DeVault introduces hare-wren, a Hare language binding for the Wren scripting language, as an alternative to embedding Lua. He evaluated Wren as a lightweight embeddable scripting language and found it surprisingly capable despite minor complaints about scope rules and its CLI standard library. The binding exposes Wren's C API through idiomatic Hare interfaces, supports bidirectional function calls between Hare and Wren, and includes an optional async runtime built on hare-ev. He also implemented a replacement standard library for Wren that improves on Wren CLI's design.

Key Insight: Himitsu 0.9 demonstrates the Hare ecosystem maturing enough to build practical desktop security tools with native GTK4 bindings, clean IPC architecture, and growing Linux desktop integration.

DeVault announces Himitsu 0.9, a general-purpose secret storage manager for Linux written in Hare. The release features a new GTK4 prompter written in Hare (replacing the old Python/GTK3 version), dbus Secret Service API integration by collaborator Armin, in-place secret key editing, and secret reuse notifications. The post serves as both a release announcement and a reintroduction of the project for those unfamiliar with it. DeVault highlights the modular architecture where the prompter is decoupled from the daemon via IPC, and notes the project's use of Hare's native cryptographic primitives (with an honest caveat that neither has been independently audited).

Key Insight: FOSS leaders should respond to bad-faith reactionary actors with blunt truth and swift bans, not detailed technical arguments that feed the trolls' attention-seeking behavior.

DeVault contrasts two approaches to dealing with reactionary bad-faith actors in FOSS communities. He critiques a detailed, measured technical response (Exhibit A) that inadvertently gives trolls ammunition for counter-arguments and concern trolling. He praises a concise, truth-speaking dismissal (Exhibit B) that denies reactionaries the engagement they seek. The post argues that FOSS community leaders should not waste time crafting long-winded technical justifications to exclude bad actors, but should instead speak plainly and ban them without ceremony. The underlying incident involves a reactionary fork of Xorg used as a vehicle for alt-right culture war politics against Linux distributions.

Key Insight: Tech workers have unique leverage over the most powerful institutions in the world, and organized labor is the only proven mechanism to wield that power against existential threats from climate change to fascism.

DeVault argues that tech workers must unionize immediately, framing it as both an economic necessity and a literal survival imperative. He contends that tech employers are systematically undermining worker power through mass layoffs, AI replacement, and flooding the labor market with cheaper graduates. Beyond workplace economics, he connects unionization to existential threats including climate change, healthcare failures, and rising fascism, arguing that organized labor is the only mechanism through which workers can exert meaningful power against capital. He provides a concrete step-by-step organizing guide and calls for tech workers to join the planned May 1st, 2028 general strike.

Key Insight: Every world map is a political document, and the technical choices made by an airline's flight map developers inevitably encode positions on sovereignty disputes whether they intend to or not.

DeVault recounts browsing the interactive flight map on a British Airways flight to Japan, treating the map's depiction of international border disputes as the airline's official political positions. He notes the absence of open source license disclosures despite likely use of open source software, then systematically catalogs how the map handles disputed territories including Palestine/Israel, Ukraine/Russia, Taiwan, Kashmir, Sudan, and others. The post uses dry humor to highlight how seemingly neutral technical decisions about map rendering inevitably encode political stances. Palestine is absent as a labeled country while Israel appears, Taiwan lacks a country label, and Ukraine is shown with undisputed borders including Crimea.

Key Insight: Tech workers are uniquely positioned to resist technocratic authoritarianism because the regime's digital power depends entirely on their labor, making collective action and workplace resistance both possible and morally imperative.

DeVault argues that the tech sector is central to the rise of contemporary fascism, particularly in the United States, and that tech workers have both the ability and the obligation to resist. He identifies Palantir's surveillance infrastructure and DOGE's technocratic agenda as key instruments of authoritarian power. The post calls for collective action through unionization, workplace sabotage, and mutual support among tech workers. He emphasizes that solidarity and safety in numbers are essential, urging workers to abandon American individualism. DeVault acknowledges the fear involved but insists that inaction also carries risks, and asks readers to decide where they will draw the line.

Key Insight: A simple tool for reframing prices across incomes reveals that the scale of global wealth inequality is so extreme it defies intuition.

DeVault introduces Price Perspective, a Firefox addon he built over a weekend that helps users understand purchasing power differences across incomes and countries. The addon lets you see how prices look relative to different economic perspectives — from someone in Afghanistan to a billionaire like Zuckerberg. Through examples comparing pizza delivery costs and Amsterdam real estate, he illustrates the staggering scale of global wealth inequality. The post uses a lighthearted, show-and-tell format but carries a sharp undercurrent of criticism about wealth concentration.

Key Insight: Social bookmarking with RSS feeds offers a quieter, more intentional alternative to social media for sharing and discovering interesting content.

DeVault describes his discovery and rediscovery of linkhut, a social bookmarking tool hosted on SourceHut. After rethinking his relationship with social media and quietly leaving both Mastodon and BlueSky, he found renewed appeal in linkhut as a way to signal-boost interesting articles via RSS feeds. He draws an analogy to SoundCloud's music discovery feature, where you could see what artists you admired were listening to. He encourages others to sign up and share their feeds with him.

Key Insight: Small infrastructure operators like SourceHut are being crushed by the externalized costs of LLM training crawlers that deliberately evade all countermeasures, and DeVault sees this as part of a broader pattern of big tech parasitizing the commons.

Drew DeVault describes how hyper-aggressive LLM crawlers have consumed 20-100% of his weekly time at SourceHut over recent months, causing dozens of outages per week. He frames this as the latest in a pattern of externalized costs forced onto small infrastructure operators, following cryptocurrency mining abuse and Google's Go module mirror. The crawlers deliberately evade robots.txt, use residential IPs, and mimic end-user traffic to avoid detection. He reports that every sysadmin he knows faces the same crisis. He concludes with a plea to stop legitimizing LLMs entirely, citing environmental, labor, and democratic harms, and vows to never work with LLM developers again.

Key Insight: Intellectual property is a social invention that creates artificial scarcity for inherently non-scarce ideas, and understanding this requires first recognizing that all property is a social convention enforced by force rather than a law of nature.

DeVault begins a multi-part series on intellectual property by first establishing a philosophical foundation for understanding property itself. He argues that property is a social convention, not a natural law, enforced ultimately through force, and justified primarily as a tool for managing scarcity. He then traces the logical progression from material property to immaterial property (like domain names) to intellectual property, noting that intellectual property fundamentally differs because ideas cannot be possessed or withheld by force. He concludes that intellectual property creates artificial scarcity to reward intellectual labor within a capitalist framework, teasing deeper critique in future installments.

Key Insight: The Dorsey keynote controversy at FOSDEM revealed that one of open source's most important institutions lacks the very transparency and participatory governance that the movement itself champions.

DeVault reports the apparent cancellation of Jack Dorsey's FOSDEM '25 keynote following community protest, while pivoting to deeper questions about FOSDEM's governance and transparency. He thanks FOSDEM staff but notes the lack of official communication and the troubling revelation that 3 of 4 independent reviewers rejected Dorsey's talk proposal yet it was accepted anyway. The post calls for using the now-empty time slot to discuss what transparent, participatory governance at FOSDEM should look like. A later notice reveals the discussion session was also cancelled after organizers agreed that de-platforming Dorsey was sufficient victory, with governance reform efforts to continue after the event.

Key Insight: Open source conferences must guard their stages against corporate actors whose track records contradict community values, and the community itself bears responsibility for enforcing that boundary through collective action.

Drew DeVault organizes a peaceful protest at FOSDEM 2025 against Jack Dorsey and Block, Inc. being given a speaking slot, arguing their corporate track record is antithetical to the open source community's values. He emphasizes the protesters are long-time FOSDEM community members acting out of love for the conference, not hostility toward its organizers. The post lays out specific logistics for occupying the stage during Dorsey's scheduled talk and provides a strict code of conduct for participants. DeVault calls for greater transparency in FOSDEM's talk selection and sponsorship processes to prevent such conflicts in the future.

Key Insight: Free software community platforms should not be sold to billionaires whose wealth was built by harming the very communities those platforms serve.

Drew DeVault calls for a protest against Jack Dorsey's keynote at FOSDEM 2025, arguing that billionaires should not be platformed at free software events. He details Dorsey's role in selling Twitter to Elon Musk, the resulting harm to the FOSS community which absorbed fleeing users, and Block's sponsorship as the likely reason for the keynote slot. DeVault connects Dorsey's company to layoffs, bitcoin mining powered by fossil fuels, and broader tech grift. He announces a planned sit-in to peacefully block the talk and argues billionaires should earn FOSS community respect through massive donations rather than keynote stages.

Key Insight: Using neurodivergence to excuse harmful behavior is itself ableist because it denies neurodivergent people the agency and accountability that come with being treated as full human beings.

DeVault responds to claims that his criticism of Richard Stallman is ableist toward neurodivergent people. He argues that using neurodivergence as an excuse for Stallman's harmful views on sex and consent is itself ableist, as it infantilizes neurodivergent people and denies them agency. Drawing on conversations with dozens of neurodivergent people, he finds broad agreement that neurodivergence is context, not an excuse, and that accountability should apply equally. He concludes with practical recommendations for how free software communities can better accommodate neurodivergent participants through clear norms, asynchronous participation, and sensory accommodations.

Key Insight: Instead of fighting Linux's political culture to integrate Rust, the burned-out Rust-for-Linux developers should channel their talent into building a Linux-compatible kernel from scratch in Rust, where technical progress won't be bottlenecked by maintainer politics.

Drew DeVault revisits his 2022 skepticism about Rust in the Linux kernel, this time with more compassion for the burned-out developers involved. He acknowledges the talent and dedication of Rust-for-Linux contributors while noting that Linux's decentralized maintainer culture has made the project a 'burnout machine.' Rather than continuing to fight LKML politics, he proposes an alternative path: building a Linux-compatible kernel from scratch in Rust, arguing this could move faster and attract more contributors without the political overhead.

Key Insight: The collaborative foundation that makes open source economically powerful is fundamentally incompatible with any model that reserves exclusive commercial rights for a single entity.

DeVault argues that the economics of open source are fundamentally rooted in collaboration, making them incompatible with business models that seek exclusive monetization rights. He examines how startups attracted by open source economics discovered that the model works for the industry as a whole but not necessarily for individual companies seeking sole profit. He critiques emerging 'post-open' and 'fair source' movements as attempts to retain open source's collaborative benefits while restricting commercial rights, which he considers irreconcilable. He respects these movements' right to exist but insists they not co-opt the 'open source' label, and maintains that successful open source businesses must embrace shared commercial markets.

Key Insight: Building a functional Unix clone in a month demonstrates both the surprising simplicity of monolithic kernel design and Hare's viability as a kernel programming language, while reinforcing that Unix's worst warts — especially signals — are just as ugly from the implementor's side.

Drew DeVault describes Bunnix, a Unix-like operating system for x86_64 he built in roughly 27 days as a recreational programming project. The kernel is mostly written in Hare with C components for ext4 and terminal support, and includes PCI, AHCI, PS/2, and framebuffer drivers along with about 40 syscalls. The userspace assembles third-party software including dash, Vim 5.7, tcc, and DOOM atop a musl-derived libc. DeVault reflects on the challenges of filesystem design, terminal integration, scheduler implementation, and the ugliness of Unix signals. He concludes that monolithic kernels are far simpler to build than microkernels, and plans to bring lessons learned back to his microkernel project Helios.

Key Insight: Copyleft licenses are not restrictive but reciprocal — they create freedom by imposing obligations on power, just as constitutional rights create freedom by constraining government.

DeVault argues that copyleft licenses should not be called 'restrictive' compared to permissive licenses, as this framing reflects a shallow understanding of freedom. He distinguishes between obligations (which both license types impose) and restrictions (which no FOSS license imposes), arguing that copyleft's obligations exist to guarantee rights. Drawing on political philosophy and the concept of positive liberty, he contends that freedom emerges from obligations imposed on power, making copyleft licenses more free than permissive ones. He suggests 'reciprocal' and 'non-reciprocal' would be better terminology than 'copyleft' and 'permissive.'

Key Insight: When a project leader refuses every opportunity to reform toxic community norms, the broader open source ecosystem has both the right and obligation to isolate that community to protect everyone else.

Drew DeVault defends freedesktop.org's decision to ban Hyprland maintainer Vaxry from FDO community spaces, providing detailed context on the events leading to the ban. He argues that FDO's conduct enforcement team acted with restraint and within their mandate, while Vaxry escalated the situation by construing a polite warning as threats, minimizing his own hate speech, and threatening legal action. DeVault recounts his own failed private efforts over 18 months to help Vaxry change his behavior, culminating in Vaxry expressing openness to arguments for genocide. He calls on the broader Linux community to protect itself from the toxic culture Hyprland has fostered and condemns the harassment directed at the FDO officer involved.

Key Insight: Prusa's decline isn't a failure of open source licensing but a failure of business strategy — they built a great product and stopped there, neglecting the 90% of business-building that has nothing to do with the product itself.

DeVault responds to Armin Ronacher's argument that Prusa's struggles justify non-free licensing by arguing the real problem is business strategy, not open source. Prusa failed to diversify beyond selling a single premium printer line, leaving massive market opportunities untapped while Chinese competitors like Bambu and Creality offered better products at lower prices. DeVault argues Prusa should have built an ecosystem — entry-level printers, cloud services, a model marketplace, consumables pipeline — rather than blaming open source for their decline. He concludes that FOSS is a powerful commercial tool, but businesses must do the hard work of sales, marketing, and risk mitigation rather than assuming the product alone is sufficient.

Key Insight: Stallman's writings on sex constitute not a series of gaffes but a deliberate, years-long political discourse that systematically erodes norms around consent and minor protection, and the Free Software community's refusal to reckon with this poisons its own culture.

Drew DeVault presents a systematic analysis of Richard Stallman's political writings on sex, consent, and minors, arguing that Stallman's 2019 retraction on pedophilia is misleading due to his idiosyncratic definition of 'children' as only those under 13. The post traces a years-long pattern across Stallman's political notes where he defends adults accused of sexual impropriety with minors, seeks to erode the meaning of 'sexual assault,' and consistently disregards power dynamics in sexual harassment. DeVault argues this is not a series of isolated incidents but a coherent political discourse that normalizes exploitation. He concludes that Stallman's continued leadership role poisons the Free Software movement's culture and that the FSF's failure to act has a chilling effect on the community.

Key Insight: DeVault promotes Hare through organic, respectful community evangelism rather than paid marketing, reflecting his broader philosophy that good software should spread on its own merits.

DeVault puts out an open call for podcast appearances to promote the Hare programming language and related projects. He frames this within Hare's evangelism guidelines, which emphasize respectful, organic outreach over paid advertising or unsolicited rewrites. The post serves as a mini press kit, covering Hare itself, the Ares microkernel OS built in Hare, and Himitsu, a secret storage system. It's a straightforward community-building effort that reflects DeVault's preference for grassroots promotion over corporate marketing tactics.

Key Insight: Real name policies have legitimate legal motivations but cause real harm to marginalized contributors; the solution is to establish provenance through the DCO while letting people participate under their preferred identity.

DeVault examines the controversy around 'real name' policies in free software projects like Linux. He acknowledges the legitimate legal rationale behind such policies—establishing copyright provenance and accountability through mechanisms like the DCO—while detailing the harm they cause to marginalized groups, harassment victims, and transgender contributors. He proposes a middle path: using the DCO for provenance while letting contributors participate under whatever identity they feel most comfortable with, and supporting name changes in historical records.

Key Insight: The unexamined life script preserves existing power structures through learned helplessness, and the simple act of questioning why you live the way you do is itself a radical and necessary act.

DeVault reflects on how society provides a default 'script' for life — school, career, marriage, children, retirement — that most people follow without deliberate choice. He argues that while this scripted life can produce happiness, most people lack the philosophical foundation to explain why they follow it. He notes that encountering people who deviate from the script creates discomfort and reinforces biases. DeVault calls for deliberate questioning of one's life choices and frames this questioning as inherently radical, encouraging readers to live intentionally and practice solidarity with others who make different choices.

Key Insight: The hacker community's celebrated free speech principles are selectively enforced to protect power structures, with the most aggressive censorship reserved for those who speak about sexual harassment and assault.

DeVault argues that the hacker community's professed commitment to free speech is selectively applied: hate speech is tolerated while discussions of sexual harassment and assault are actively suppressed. He traces how the community's homogeneous old guard developed a pattern of defending comfortable speech while punishing challenging speech that threatens power structures. The post specifically calls out the protection of known sexual predators at hacker events, including organizers who circumvented codes of conduct to allow rapists to attend. He argues that communities should not hold themselves to courtroom standards of evidence when the goal is community safety, not imprisonment, and calls on hackers to listen to victims and demand accountability from leaders.

Key Insight: Technical excellence cannot redeem a community that tolerates hate, and leadership bears direct responsibility for the culture they allow to flourish.

Drew DeVault calls out the Hyprland Wayland compositor community for fostering a toxic, hateful environment despite being an exciting technical project. He documents specific incidents including moderators harassing a transgender user by editing their pronouns, community tolerance of eugenics endorsements, and leadership dismissing concerns as jokes. DeVault recounts his private outreach to project lead Vaxry, which yielded minimal improvement, and offers constructive advice to leadership, community members, and victims. He frames the issue as a failure of leadership culture, drawing on his own past regrets about being mean while young and productive.

Key Insight: AI's real threat is not sentient machines but aggressive capitalism replacing quality with cheap automation while engineering hype to secure regulatory advantages.

DeVault argues that while machine learning technology is real and here to stay, the AI bubble will pop and leave behind a world that is crappier, not better. He dismisses AGI fears as overblown and contends that AI's real impact will be replacing competent humans with cheap, mediocre automation. The lasting effects will include degraded creative work, overwhelmed digital spaces, more convincing scams, and elimination of human customer support. He frames the AI hype as a deliberate propaganda campaign by 'AI barons' to secure investment and lobby for regulatory moats, while the real threat comes not from sentient machines but from capitalists and militaries deploying AI tools that discriminate and harm.

Key Insight: Ares OS has matured from a proof-of-concept into a functional operating system with real processes, drivers, and software ports, definitively proving that Hare is viable as a systems programming language for OS development.

Drew DeVault reports on the progress of Ares OS, an operating system written primarily in Hare, which has advanced significantly since his FOSDEM demo. The system now supports real processes with fork/exec, multiple hardware drivers (PCI, AHCI, PS/2, VGA), an ext4 filesystem, and initial software ports including ed(1) and the rc shell. The post itself was written from within Ares using ed on an ext4 filesystem, demonstrating the OS has reached a usable state. DeVault considers the original question of whether an OS can be written in Hare answered with a 'resounding yes' and outlines ambitious future plans including networking, audio, USB, and possibly Wayland support.

Key Insight: Adding lists of strings as a first-class primitive alongside strings eliminates virtually all of the whitespace quoting problems that have plagued POSIX shells for decades, and this can be done in a shell that is orders of magnitude simpler than alternatives.

Drew DeVault responds to a blog post about POSIX shell's broken whitespace handling by demonstrating how his rc shell (inspired by Plan 9's rc) elegantly solves every cited problem. The key design insight is adding lists of strings as a first-class primitive alongside strings, eliminating the need for defensive quoting. He walks through each problematic example from the original post, showing they all work correctly in rc without special handling. The shell is remarkably small at ~3,000 lines of Hare code compared to fish (45K) and zsh (144K). DeVault notes rc is destined for his Ares operating system but also works on Unix.

Key Insight: The best Linux distribution is one that never makes the news, because drama-free reliability is the product of aligned community incentives and the absence of commercial monetization pressure.

DeVault praises Alpine Linux for being boring and reliable, contrasting it with distributions like Red Hat that frequently generate controversy. He describes using Alpine across all his computing contexts—workstations, servers, phones, development boards—and finding it consistently uneventful. The post implicitly argues that the best infrastructure is invisible, and that Alpine's grassroots, stakeholder-driven community avoids the drama that comes with commercial interests. He positions Alpine's absence from headlines as its greatest strength.

Key Insight: A CLA is fundamentally a trap door for relicensing — the combination of copyleft licensing and collective copyright ownership is the only reliable promise that software will remain free.

Prompted by SourceGraph's decision to abandon its Apache 2.0 license and go closed source, DeVault argues that contributor license agreements (CLAs) with copyright assignment clauses exist solely to let companies pull the rug on open source projects. He explains that CLAs give upstream maintainers more rights over contributions than contributors received, subverting the open source social contract. He finds SourceGraph's case especially egregious since their permissive license already allowed proprietary use — the CLA simply let them avoid even crediting contributors. He recommends copyleft licensing with collective copyright ownership as the strongest protection, and the Developer Certificate of Origin as an ethical alternative to CLAs for establishing provenance.

Key Insight: The fediverse's inability to serve as an audience-building machine is a feature, not a flaw — it preserves the distinction between genuinely social spaces and parasocial content platforms.

DeVault distinguishes between 'social media' and what he terms 'parasocial media' — platforms optimized for one-directional content consumption rather than genuine conversation. Prompted by content creators dissatisfied with Mastodon after fleeing Twitter, he argues the fediverse is intentionally designed for real social interaction, not audience-building. He acknowledges that wanting to build an audience is legitimate, but contends the fediverse simply isn't the right tool for that. He frames this limitation as a feature rather than a bug, arguing there's real value in spaces that prioritize genuine human connection over reach.

Key Insight: The hacker community's culture of permissive tolerance has silently enabled sexual violence and predatory behavior, and only active, principled intervention — not passive inclusion rhetoric — can fix it.

Drew DeVault reflects on a devastating year of personal trauma and burnout, much of it connected to failures within hacker communities to address sexual violence and predatory behavior. He describes discovering that communities he loved harbored rapists and pedophiles, and that speaking up about these issues brought further trauma rather than resolution. He argues that the hacker community's tolerance of casual sexism, misogyny, and racism has enabled a pervasive, silent culture of abuse. He calls on community members to believe victims, remove harmful people, and support codes of conduct, while announcing his own withdrawal from in-person hacker spaces.

Key Insight: Rather than waiting for the FSF to fix its messaging problems, individual advocates can build better, more accessible free software resources independently.

DeVault announces writefreesoftware.org, a new resource he created to provide an accessible introduction to free software philosophy and practical licensing guidance. He frames it as a response to the FSF's messaging failures, which he previously criticized for being incomprehensible and inaccessible to newcomers. The site aims to be independent of any particular organization and cooperative with the open source movement. He positions it as a practical step toward moving the free software movement forward where the FSF has stagnated.

Key Insight: Mobile Linux has made impressive progress on features, but until the community prioritizes unbreakable core telephony over everything else, it cannot serve as a daily driver.

Drew DeVault recounts his three-year experiment using mobile Linux (postmarketOS and UBports) as his daily driver across multiple devices, ultimately switching back to LineageOS (Android). Despite being impressed by the progress and capabilities of mobile Linux, particularly postmarketOS running Alpine Linux, he found the reliability of core telephony features—calls and SMS—unacceptably inconsistent. He argues that mobile Linux cannot be a viable daily driver until the community prioritizes rock-solid phone functionality above all else.

Key Insight: Employees who understand their financial value to the business and strategically exercise agency — through unilateral action, team solidarity, and calculated use of corporate systems — can reshape their working conditions far more than the typical power dynamic suggests.

DeVault argues that white-collar employees have far more leverage over their employers than they realize, and should strategically exercise that power. He reframes the employment relationship as one between equals pursuing mutual goals, where your real job is simply to make money for the business. The post provides tactical advice on exercising agency unilaterally, building team solidarity, using strategic subversion, and weaponizing HR processes. He covers goals ranging from small (choosing your own tools, skipping meetings) to large (negotiating a four-day workweek, replacing a manager). Throughout, he emphasizes that employers already use tactics, propaganda, and subterfuge, so employees should feel no qualms about doing the same.

Key Insight: Even the most resilient builders can reach a breaking point when personal crises compound faster than they can recover, and the healthiest response is to step back and let the systems you built carry on without you.

Drew DeVault shares that he has reached burnout after a relentless series of personal crises throughout 2023. Starting with a theft on New Year's Eve, he faced escalating difficulties including a breakup, friends in crisis, gossip, and ultimately a death by suicide in his social circle. Despite trying to pace himself and allow productivity to dip without guilt, he reached a breaking point where for the first time he felt intimidated by the work ahead rather than ready to dig in. He announces he is stepping back to rest, with SourceHut colleagues and Hare maintainers covering his responsibilities.

Key Insight: Free software is inherently political, and welcoming diverse leaders strengthens both the community and its mission far more than enforcing a false apolitical conformity.

DeVault challenges the free software community's biases by contrasting two tech speakers: Alyssa Rosenzweig, a trans woman who reverse-engineers GPU drivers for free software, and Scott Guthrie, a Microsoft VP. He argues that appearances and demographic assumptions lead the community to unfairly scrutinize leaders who don't fit the white male norm, while people like Rosenzweig contribute enormously to the movement. The post rejects the notion that diversity advocacy is a 'woke agenda' and argues that free software is inherently political, making respect and inclusion inseparable from the mission.

Key Insight: Shell scripting's most persistent pain point — the quoting nightmare caused by treating everything as strings — can be solved by building a shell with strings and lists as distinct fundamental types.

Drew DeVault introduces rc, a new Unix shell he's been developing, inspired by Plan 9's rc but with significant departures. The shell's headline feature is fixing the 'global shell quoting nightmare' by making variable expansion safe by default, distinguishing between strings and lists as fundamental types. Written in about 2500 lines of Hare, rc also features named function parameters, list slicing, string operations, and a formal context-free grammar. The shell is not yet complete but much of the described functionality is already working.

Key Insight: The free software movement is flourishing despite the FSF's failures, and the foundation must radically reform its leadership, messaging, and institutional structure or become irrelevant to the ecosystem it helped create.

DeVault argues that the Free Software Foundation, despite its historic achievements, is failing at its three core missions: disseminating free software philosophy, developing copyleft licenses, and overseeing movement health. The FSF's messaging is tone-deaf and narrow in reach, copyleft adoption is plummeting relative to permissive licenses, and the organization has lost touch with the diverse, growing FOSS community. He calls for five specific reforms: replacing RMS as leader, reaching out to emerging community leaders, making the message more accessible, decoupling FSF from GNU, and developing new copyleft licenses. The free software movement is thriving despite the FSF, not because of it.

Key Insight: A capability-based microkernel architecture with declarative driver manifests and IPC code generation enables strongly isolated userspace drivers that are both more secure than monolithic kernels and concise enough to implement in a few hundred lines of code.

DeVault walks through the Mercury driver development environment for the Helios microkernel, part of the Ares operating system. The post demonstrates how device drivers run in userspace with capability-based security, using a serial port driver as a concrete example. Mercury provides an IPC code generation system (ipcgen), driver manifests that declaratively specify required capabilities, and protocol inheritance for composable interfaces. The capability model ensures strong isolation between drivers, limiting the blast radius of bugs to only the resources explicitly granted. The post concludes by showing how usrinit bootstraps the system by loading drivers from an initramfs and opening devices through a device manager service.

Key Insight: Comments should fill gaps that code cannot express on its own — naming, types, and structure should carry the primary communicative burden.

DeVault explains his philosophy on code comments, arguing that well-written code should communicate most information through naming, types, and module structure rather than comments. He categorizes comments into documentation comments (for API consumers), implementation comments (explaining magic constants or non-obvious decisions), and TODO/XXX markers (for known deficiencies). Each comment type targets a specific audience with specific context, and redundant comments that restate what the code already communicates are worse than no comments at all. He considers high comment density a potential sign of poor code quality, inverting the common assumption.

Key Insight: Porting an entire microkernel to a new CPU architecture can be more tractable than writing a single complex device driver, and the messy reality of boot-level systems programming involves cargo-culting binary formats, battling underdocumented hardware registers, and debugging differences between emulators and real hardware.

DeVault documents the first phase of porting Helios, a microkernel written in Hare, from x86_64 to aarch64 so he could present his FOSDEM talk from a Raspberry Pi 4 running Helios itself. Rather than writing an Intel HD Graphics driver, he decided porting the entire OS to ARM would be easier. This post covers the EFI bootloader work, including hand-writing PE32+ headers in assembly, setting up page tables, configuring the ARM MMU, and handling exception level transitions. The bootloader took 14 days to reach kmain on qemu-virt and 18 days on real hardware, with the full port completing in 42 days.

Key Insight: Freedom of association is as fundamental as freedom of speech, and under current conditions where market incentives align with protecting marginalized people, private censorship produces approximately just outcomes despite systemic imperfections.

DeVault examines whether private platforms should engage in censorship, weighing freedom of association against freedom of speech. He explores regulatory and antitrust approaches to the problem, finding contradictions in free speech absolutist positions. He argues that democratic and judicial processes are too corrupt, slow, and majoritarian to protect marginalized people from hate speech. Writing as a self-described leftist and pragmatist, he concludes that the current system where market incentives align with moral outcomes on private censorship is producing approximately just results, even if imperfect.

Key Insight: DeVault's FOSDEM 2023 lineup showcases how his projects form an integrated stack: Hare as the language, Helios as the kernel proving ground, and SourceHut as the development platform.

Drew DeVault announces his FOSDEM 2023 schedule, with four speaking slots covering his major projects. He will give both a lightning talk and full-length talk on Helios, a microkernel written in Hare inspired by seL4. He is also hosting community meetups for both the Hare programming language and SourceHut. The post serves as an invitation to the community and a brief overview of the current state of each project.

Key Insight: Writing from compulsion rather than conviction produces shallow takes that normalize a critical tone, ultimately undermining the very critiques that matter most.

Drew DeVault reflects on his recent blogging hiatus and identifies the root cause of his dissatisfaction: he lost sight of his goals and fell into writing posts just for the sake of writing, pulling topics from a backlog rather than writing about what matters most. He acknowledges that this led to shallow takes and rants that damaged his reputation and diluted his more important critiques. He announces a renewed focus on two core themes: software's role in advancing society through free software, and principles of good software engineering. He also plans to write more in-depth technical content about his projects.

Key Insight: After years of principled advocacy, DeVault concludes that writing cannot overcome the tech industry's perverse incentives, and chooses to let his work speak for itself in silence.

Drew DeVault announces he is stepping back from blogging after nine years and 300,000 words. He expresses fatigue from diminishing returns on his writing—less discussion, unchanged industry problems, and a steady stream of hostile responses. He references Bryan Cantrill's metaphor about Oracle as a lawnmower without empathy, extending it to argue the entire tech industry shares that character. He commits to continuing his work quietly, building what he believes in, while leaving a curated list of his most valued posts as a farewell.

Key Insight: Hare's strings::template trades templating power for simplicity, requiring developers to handle loops and complex logic in Hare code rather than template syntax, but this tradeoff fits the language's stdlib philosophy.

DeVault demonstrates a code generation approach in Hare using the new strings::template standard library module for his operating system's IPC interface generator. He walks through ipcgen, a tool that parses a custom DSL describing IPC interfaces and generates Hare server code. The post contrasts two strategies: pre-building string buffers for complex substitutions versus rendering multiple small templates sequentially for looped structures. He acknowledges that strings::template is less powerful than full templating engines like Jinja2 or Go's text/template, but argues it hits the right simplicity-utility balance for Hare's standard library, especially given the language's lack of reflection and generics.

Key Insight: Plan 9 proved that taking Unix's 'everything is a file' philosophy to its logical conclusion produces an elegantly composable system, but was doomed by the entrenchment of the very system it improved upon.

DeVault argues that Plan 9, Bell Labs' successor to Unix, represents the best operating system design to date despite its commercial failure. He illustrates how Plan 9 perfected Unix's 'everything is a file' philosophy where Unix itself fell short, particularly in networking and process namespaces. The post walks through how Plan 9's consistent design enables elegant solutions to problems like VPNs, containers, and remote desktop with minimal code. DeVault attributes Plan 9's failure to Unix being too entrenched, but argues its ideas continue to inspire and that every programmer should spend time learning it.

Key Insight: A capability-oriented microkernel design lets drivers declare exactly what system resources they need via a simple manifest, achieving stronger isolation than Unix can offer while keeping driver code straightforward.

DeVault walks through the implementation of the first userspace serial driver for Helios, his capability-oriented microkernel OS written in Hare. The post covers three layers: the initramfs (a tarball containing driver binaries), the driver loader (which parses ELF files and driver manifests to provision exactly the capabilities each driver declares), and the serial driver itself (a simple event loop handling IRQs and IPC for reading/writing COM ports). The capability-based design means the serial driver runs in userspace with only the specific I/O ports, IRQs, and IPC endpoints it declares in its manifest — it cannot even allocate memory. DeVault contrasts this with Linux, where a serial driver bug could compromise the entire system. The post concludes with plans for PS/2 keyboard and VGA console drivers to eventually run a shell.

Key Insight: TOTP is simultaneously more secure and easier to implement than SMS-based 2FA, making the continued absence of proper two-factor authentication in many services inexcusable.

DeVault argues that TOTP-based two-factor authentication is trivially easy to implement, providing the complete algorithm in seven steps and working implementations in both Python and Hare. He emphasizes that TOTP is more secure than SMS-based 2FA while being simpler to build, requiring no external paid services like Twilio. The post serves as both a tutorial and a challenge to developers who haven't yet added 2FA support to their services. He releases both code samples into the public domain to remove any remaining barriers to adoption.

Key Insight: A capability-based microkernel architecture with declarative driver manifests can sandbox drivers so effectively that even a fully exploited driver can only crash itself, unlike monolithic kernels where any driver compromise means total system compromise.

Drew DeVault shares his October 2022 progress update, focused primarily on Helios, his microkernel operating system written in Hare. After taking the month to rest from stressful work by shifting to experimental projects, he completed a major redesign of the kernel, implemented a new scheduler and userspace API, and began building Mercury, the userspace driver framework. The update highlights a capability-based security model where drivers are sandboxed with only the specific hardware capabilities they need. He also notes minor upstream Hare improvements including IPv6 parsing and UTF-8 decoder fixes.

Key Insight: ffmpeg represents the ideal of free software: a project so comprehensive and well-executed that it completely displaced proprietary alternatives and became the universal foundation for all multimedia processing.

DeVault praises ffmpeg as one of the most important achievements in free software history, highlighting its creator Fabrice Bellard's talent for building software that renders all competing solutions obsolete. He demonstrates ffmpeg's power through a personal anecdote of rigging up a low-latency remote gaming stream with a single command. The post argues that ffmpeg has effectively closed the book on multimedia processing, with virtually all multimedia companies depending on it. DeVault positions ffmpeg as a pillar of FOSS achievement that has touched nearly every person who has consumed digital media.

Key Insight: Rust's entry into the Linux kernel is driven more by community momentum than by a careful weighing of its modest benefits against the substantial risks of introducing a second language into a conservative, mission-critical codebase.

DeVault argues that Rust does not belong in the Linux kernel, and neither does his own language Hare, despite both being capable of writing kernels. He contends that the primary benefits of Rust in Linux reduce to memory safety and attracting new developers, but Linux already has an enormous and healthy contributor base. The costs—complexity, doubled build times, fragile C-Rust boundaries, and the conservative project's risk tolerance—may outweigh the benefits. He suggests the real driving force is the Rust community's size and enthusiasm rather than a careful risk-reward analysis, and that writing new kernels in Rust (like Redox) is preferable to rewriting established software.

Key Insight: Building a microkernel from scratch in Hare provides a natural context for implementing multi-threading that the language's standard library deliberately omits, demonstrating how OS-level primitives like interrupt handling, context switching, and scheduling come together.

Drew DeVault details the implementation of multi-threading in Helios, a microkernel written in Hare, despite his long-standing promise that Hare wouldn't have multi-threading support. The post walks through the kernel-side machinery: task structures that store CPU register state, x86_64 interrupt handling for saving and restoring context, a round-robin scheduler, and the idle task. He explains how the interrupt stack table in the TSS is cleverly repurposed to automatically save task state, and how yielding and blocking work for synchronization primitives like notifications. The userspace threading implementation is deferred to a follow-up post.

Key Insight: Misappropriating the 'open source' label for source-available software is a form of brand exploitation that undermines the community rights the term was built to protect.

DeVault argues that the term 'open source' has a specific, well-established meaning defined by the Open Source Initiative's Open Source Definition, and that companies misusing the term to describe source-available software are engaging in dishonest, anti-social behavior. He draws an analogy to plastic industry 'Resin Identification Codes' that mimic the recycling symbol to deceive consumers. The core of his argument is that open source software belongs to its community of contributors, not just its publisher, and therefore the community's right to commercialize it is fundamental and non-negotiable. He contends that companies seeking commercial monopolies over their projects use 'motivated reasoning' to redefine open source in self-serving ways. DeVault concludes that publishers can choose any license terms they wish, but calling non-open-source software 'open source' is wrong when better terms like 'source available' exist.

Key Insight: Even a brief status update shows the breadth of DeVault's systems work, from language toolchain improvements in Hare to microkernel capability redesign in Helios.

Drew DeVault gives a brief September 2022 status update while sick with COVID-19. He highlights Hare's new cross-compilation support and progress toward TLS, introduces powerctl as a small Hare systems programming project, and describes major refactoring work on the Helios microkernel focused on capability lifecycle management and address space IDs.

Key Insight: Hare's design lets kernel developers deliberately step outside safety guarantees for low-level memory manipulation, then quickly re-establish bounds checking — accommodating the unique constraints of kernel programming without ceremony.

DeVault walks through a real kernel hacking scenario in Hare, his systems programming language, showing how Helios (his seL4-inspired microkernel) initializes bootinfo structures for userspace. The post demonstrates Hare's ability to handle manual memory management, pointer casting, and page-level allocation without dynamic memory — a common kernel constraint. He shows how Hare's unbounded arrays, static append, and low-level type manipulation enable precise control over memory layout across three different address spaces. The example illustrates Hare's design philosophy: accommodate dangerous low-level operations when needed, but provide tools to regain safety quickly.

Key Insight: qemu is a quietly revolutionary piece of infrastructure that not only underpins modern cloud computing but provides kernel developers and cross-architecture programmers with development capabilities that would have been unimaginable a generation ago.

DeVault praises qemu as one of his favorite pieces of software, highlighting its role as the foundation of modern cloud virtualization and its invaluable utility for kernel development. He credits Fabrice Bellard for creating another revolutionary tool, comparable to ffmpeg's impact on multimedia. The post details qemu's comprehensive virtual device support, its power as a kernel debugging environment, and the lesser-known qemu-user feature for cross-architecture development. DeVault notes the clean C implementation and the personal significance of qemu as one of his first email-based open source contributions.

Key Insight: Hare's design—static allocation, exhaustive matching, explicit error propagation, and precise I/O control—maps naturally to the requirements of small, correct Linux systems utilities.

DeVault walks through powerctl, a 500-line Hare program he wrote to manage Linux power states for non-privileged users. The post serves as a case study for Hare's strengths in systems programming, covering setuid binaries, group permission checks, sysfs string parsing, and controlled I/O. He highlights how Hare's design—static allocation, exhaustive switches, explicit error handling, and buffered I/O—maps naturally to the constraints of a small Linux utility. The post demonstrates that Hare can produce tight, correct systems code with minimal ceremony.

Key Insight: Despite a miserable initial setup process, the Xiaomi Poco F1 running postmarketOS crosses the threshold of daily-driver usability for mainline Linux phones, marking a significant milestone for the mobile Linux ecosystem.

DeVault reviews his experience running postmarketOS on the Xiaomi Poco F1 as a daily driver replacement for his PinePhone. The initial setup is painful—requiring a Windows VM to unlock Xiaomi's bootloader, filesystem repairs, and significant Linux expertise—but once running, the phone performs far better than the PinePhone. Core features like telephony, SMS, mobile data, and general app usage work well, with cameras being the main non-functional hardware. He concludes this is the first mainline Linux phone experience he could recommend to others as a daily driver.

Key Insight: A hardware company that depends on volunteer community contributions to make its products functional cannot afford to alienate that community by consolidating around a single poorly-run distribution and dismissing legitimate grievances.

DeVault criticizes PINE64 for betraying its community-driven development model, triggered by postmarketOS developer Martijn Braam's departure and PINE64's dismissive response. He argues that PINE64's shift toward a Manjaro mono-culture undermines the diverse ecosystem that made their hardware viable. The post outlines specific demands including apologies, reinstating community editions, and rescinding the Manjaro-exclusive commitment. DeVault frames three possible outcomes: community decay and PINE64's demise, grudging change without accountability, or graceful acknowledgment and reform. As a long-time supporter and owner of multiple PINE64 devices, he makes clear his continued support is conditional on meaningful change.

Key Insight: Even in a quiet month, DeVault's work spans multiple layers of the systems stack — from compiler backends to microkernel capability management — illustrating the breadth of his from-scratch systems programming ambitions.

Drew DeVault's August 2022 status update is a brief check-in during a quieter month due to moving house. The main technical highlights are Thread-Local Storage (TLS) implementation for qbe (Hare's compiler backend) and significant progress on Helios, his microkernel OS project. He also mentions starting a GameBoy emulator in Hare as a fun side project. Hare development has slowed due to a backlog of 123 emails in the patch queue.

Key Insight: The gap between physical notebooks and existing digital tools remains wide, and a free software infinite canvas combining structured documents with freehand input could be worth serious money to power users.

DeVault describes his ideal note-taking application: an infinite canvas where pages, flowcharts, tables, drawings, and other objects can be placed freely. He outlines specific requirements including multi-input support (keyboard, trackpad, drawing tablet), high performance with real-time rasterization, and export capabilities. He acknowledges he lacks bandwidth to build it himself and hopes to inspire others. The tool should be free software running on Linux, and he'd pay up to $1000 one-time or $100/month for collaboration features.

Key Insight: In FOSS culture, directness and brevity are forms of mutual respect, not rudeness — and embracing this frees everyone from performative politeness.

DeVault argues that conciseness is a core value in hacker and FOSS culture. He notes that maintainers prefer direct, to-the-point communication in bug reports, mailing lists, and IRC. Skipping formalities is not rude but expected. He advises readers to minimize unnecessary pleasantries and not to interpret directness as hostility, framing it instead as a liberating way to communicate.

Key Insight: Email-based code review, when optimized with custom tooling and keybindings, dramatically outperforms web-based forge workflows in speed and flexibility for experienced maintainers.

DeVault demonstrates his email-based code review workflow using aerc, the terminal email client he built for software development. He walks through his custom keybindings and templates that allow him to apply patches, push changes, and reply to contributors with just a few keystrokes. He claims this workflow lets him review 50 patches in 20 minutes versus an hour or more using web-based forges like GitHub or GitLab. The setup works entirely offline and on low-end hardware, reinforcing his argument that email-driven development is superior for power users.

Key Insight: The open hardware movement remains in its infancy, with even its successes riddled with non-free compromises, and maturing will require mentorship, transparency, and more discerning consumer spending.

DeVault reflects on his mixed track record spending money on open hardware projects, noting several that became vaporware (EOMA68, DragonBox Pyra, Jolla Tablet) alongside successes like Pine64 and HiFive Unmatched. He observes that even successful open hardware products often contain non-free components and suffer stock issues. Rather than offering definitive answers, he calls for mentorship between successful and emerging projects, a stronger push to liberate non-free components, and greater transparency from project creators. He places responsibility on both producers and consumers to be more discerning about project viability.

Key Insight: Hare and Helios are maturing in parallel, with Hare gaining libraries for graphics and templating while Helios reaches key OS milestones like userspace drivers, pre-emptive multitasking, and a working DOOM port.

Drew DeVault's July 2022 status update covers progress across Hare and Helios. For Hare, he introduced a string templating module and a pixel buffer library, laying groundwork for a graphics stack. Helios, his microkernel OS, saw significant systems work including PCI and AHCI drivers, IRQ control for userspace, a DOOM port, and pre-emptive multi-tasking. RISC-V porting also progressed with a working ethernet driver. He outlines next steps around memory capabilities and process spawning.

Key Insight: Even when social networks are federated and free software, their fundamental design as feeds of reactive, public micro-commentary optimizes for toxicity and performative conflict rather than healthy discourse.

DeVault acknowledges the Fediverse's strengths — federated governance, strong moderation tools, and freedom from commercial propaganda — but argues it fundamentally inherits Twitter's psychological and social problems. Despite being free software and decentralized, it remains optimized for flame wars, dopamine-driven engagement, and performative argumentation. He warns that the platform brought out the worst in him and urges users to honestly assess whether their relationship with it is healthy.

Key Insight: Porting a real program like Doom to a new OS kernel is a pragmatic way to validate design decisions and expose gaps, even when the port itself is deliberately rough.

DeVault documents the process of porting Doom to Helios, his new microkernel operating system, as a real-world test of the kernel's design and capabilities. The port required four key features: a C programming environment, dynamic memory allocation, framebuffer access, and keyboard input. He built a PS/2 keyboard driver using Helios's notification-based IRQ handling, created a cross-compilation toolchain, and hacked together a minimal C library by pulling from musl libc. The resulting port is deliberately rough—with a broken sleep implementation, no save support, and crashes when picking up the shotgun—but successfully demonstrates the kernel's maturity and provides feedback on API design.

Key Insight: GitHub Copilot launders copyleft and permissively licensed code into proprietary software by hiding license-violating derivation behind an inscrutable ML model, and the FOSS community must respond by clarifying that ML training constitutes derivation rather than abandoning software freedom.

DeVault argues that GitHub Copilot is trained on copyrighted free software code while disregarding the license terms that govern it, effectively laundering open source code into proprietary software. He contends that the ML model constitutes a derivative work of its GPL and other licensed inputs, meaning those license obligations carry forward to Copilot's outputs. He warns GitHub that the open source community may mount legal challenges, and offers concrete suggestions including opt-in training, license tracking, removing copyleft code from the model, and compensating maintainers. He also advises FOSS developers to leave GitHub and to clarify in their licenses that ML training constitutes derivation, rather than adding non-free restrictions.

Key Insight: A credential store designed around generic key/value pairs and simple text protocols can serve as a universal foundation for secret management, service discovery, and zero-configuration application setup across Unix systems.

DeVault introduces Himitsu, a new Unix keyring and password manager inspired by Plan 9's factotum. At its core, Himitsu is a generic key/value store with a simple text-based IPC protocol, where credentials are stored as arbitrary key/value pairs with a convention system driven by 'proto' keys. The system emphasizes user consent for secret disclosure, zero-configuration credential discovery for applications, and extensibility through standardized protocols for both querying and prompting. Written in Hare with XChaCha20+Poly1305 encryption, it already has a Firefox add-on, GTK frontend, and SSH agent integration. DeVault envisions future uses including FDE boot integration, cross-device key synchronization, and datacenter service discovery.

Key Insight: Deliberately prioritizing experimental passion projects over obligation-driven maintenance work can be a productive response to burnout, yielding rapid progress on ambitious systems like microkernels and programming languages.

Drew DeVault's June 2022 status update opens by acknowledging the overwhelming supportive response to his earlier 'bleh' post about burnout. He reports deliberately shifting focus toward experimental and fun projects over routine maintenance. The bulk of his work went into the Helios microkernel, which saw major progress on capability-oriented design, userspace drivers, and syscall infrastructure. He also highlights advances in Himitsu (a secret store with a working Firefox add-on) and Hare (cross-compilation, complex numbers, date/time improvements). The update reflects a conscious decision to prioritize personal fulfillment in programming over obligation-driven work.

Key Insight: A capability-based microkernel written in Hare can serve as both a serious OS foundation and a driver for producing broadly useful systems tooling, even if the full OS vision is never fully realized.

DeVault introduces the Helios microkernel, a new operating system project written in Hare that draws heavily from seL4's capability-based design. The project targets x86_64 with riscv64 and aarch64 planned, and already has basic memory management, virtual address spaces, and simple userspace drivers working. The full vision extends beyond the kernel to a complete OS stack named after celestial bodies, from low-level services (Mercury) up to a GUI environment (Ares). DeVault frames the project as both genuinely fun and practically motivated, noting that even partial completion will yield useful tooling like a Hare debugger with DWARF support and a portable GUI toolkit.

Key Insight: Online harassment in open source doesn't just target controversial individuals — it radiates outward to punish anyone who associates with them, poisoning entire communities.

Drew DeVault opens up about a depressive episode triggered by relentless online harassment directed at him and at projects that use SourceHut. He describes how critics don't merely avoid his tools but actively campaign against anyone who uses them, harassing maintainers and discouraging adoption. He acknowledges past mistakes and expresses genuine regret, but questions whether he will ever be allowed to move past them. The post ends with a plea to redirect any harassment toward him rather than his community, and gratitude for those who have sent supportive messages.

Key Insight: A trillion-dollar company's negligent infrastructure design can effectively DDoS small open-source services, and the power asymmetry leaves the smaller party with no practical recourse.

Drew DeVault documents how Google's Go Module Mirror has been effectively DDoSing SourceHut's git service for over a year by repeatedly cloning repositories at excessive rates. The Go Module Mirror's distributed crawlers independently clone the same repositories dozens of times per hour, creating a constant floor of I/O and network load. Despite filing tickets and suggesting multiple technical solutions — respecting robots.txt, using git fetch instead of full clones, or fetching on-demand — the Go team has not prioritized fixes. DeVault finds himself unable to block the traffic without breaking Go modules for SourceHut users, and was banned from the Go issue tracker, leaving him with no recourse against a trillion-dollar company's negligent infrastructure.

Key Insight: The public release of Hare catalyzed an entire ecosystem of ambitious systems projects — from microkernels to secret managers — that had been waiting for the right language to exist.

Drew DeVault announces several projects that were previously blocked pending the public release of the Hare programming language. He introduces Helios (a microkernel), Himitsu (a secret storage system), btqd (a bittorrent daemon), and scheduled (a cron replacement), all written in Hare. The post also covers SourceHut progress on data portability and account import/export, plus significant Hare ecosystem developments including an OpenBSD port, new crypto modules, and JSON support. The overall theme is one of creative momentum unleashed by Hare's public availability.

Key Insight: Hare's inclusion of a self-hosted lexer, parser, and type system in its standard library enables code generation as a principled alternative to macros for metaprogramming tasks like computing ioctl numbers.

DeVault walks through the implementation of a Hare code generator that computes Linux ioctl numbers, replacing C-style macros with a code generation approach. The tool parses pseudo-macro annotations in Hare source files, resolves type sizes using Hare's standard library type system, and outputs computed constant values. He explains the ioctl numbering scheme that encodes direction, type letter, number, and parameter size into a 32-bit integer. The post serves as both a practical tool demonstration and a showcase of Hare's standard library capabilities, including its built-in lexer, parser, and type system. He acknowledges that macros would simplify this but argues code generation fits Hare's design philosophy.

Key Insight: Language-specific package managers are fundamentally broken because they skip the independent review step that Linux distribution package managers have used for decades to prevent supply-chain attacks.

DeVault catalogues a long history of supply-chain attacks across npm, PyPI, Crates, RubyGems, and other language-specific package managers, using Rust's first such incident as the hook. He argues these attacks are inevitable consequences of a broken-by-design model where vendors publish packages directly with no review step. He contrasts this with Linux distribution package managers, which have independent maintainers, review processes, and trust relationships. His prescription is that language-specific package managers should either be abandoned in favor of system package managers or reorganize themselves to include independent review, package signatures, and reproducible builds.

Key Insight: Building real-world cryptographic infrastructure like an SSH agent in a new systems language simultaneously validates the language's standard library design and exposes its remaining rough edges.

DeVault walks through implementing an SSH agent in Hare for integration with Himitsu, his general-purpose key store. The post covers decoding OpenSSH's undocumented private key format by reverse-engineering the C source, implementing PEM decoding, bcrypt KDF, and AES-256-CTR decryption to extract ed25519 keys. He then implements the SSH agent protocol (draft-miller-ssh-agent-11) to handle identity requests, key addition, and signing operations. The result is a working SSH agent that can authenticate against real servers, demonstrated by connecting to git.sr.ht.

Key Insight: After months of private development and public teasing, DeVault unveils Hare as his vision for a new systems programming language.

Drew DeVault publicly announces the Hare programming language, which he had been teasing as a 'secret programming language' for several months. The post itself is a brief redirect to the official Hare blog for details. Hare is a systems programming language designed as a simpler alternative to C, emphasizing simplicity, stability, and manual memory management. The announcement marks the transition from private development to public visibility for the project.

Key Insight: DeVault's new language is proving its value by enabling him to reimplement projects like Himitsu in dramatically less code and time than C, while the language's standard library matures toward a public release.

DeVault's April 2022 status update covers progress on Himitsu, a Plan 9-inspired secret storage system reimplemented in his new programming language (Hare) in half the code and time of the original C prototype. The language's standard library gained regex and datetime modules, with the datetime implementation including Martian time support as a demonstration of its design robustness. He hints that the language may go public soon after a few more milestones. SourceHut saw continued GraphQL improvements across multiple services, and he started a bittorrent daemon project currently blocked on HTTP/TLS support.

Key Insight: Even joke projects can be worth pursuing for the craft and fun of building them, and sometimes the best April Fool's prank is the one that accidentally becomes a real prototype.

Drew DeVault describes an April Fool's joke project that didn't quite make it: 'git snail-mail,' a tool that prints git commits on paper and mails them to maintainers. He actually wrote most of the code, prototyping it in his then-secret programming language (Hare), using TeX templates to format patches as printable PDFs. The project was cancelled because he didn't want to reveal the secret language and couldn't bring himself to rewrite it in Perl. He shares the technical details of how it works and links to other joke projects that did ship.

Key Insight: Every FOSS project's infrastructure choice is a vote that either strengthens or undermines the free software ecosystem, and the asymmetry of network effects makes choosing proprietary platforms disproportionately harmful to free alternatives.

DeVault argues that free software projects have an ethical obligation to use free software infrastructure rather than proprietary platforms like GitHub, Discord, or Twitter. He contends that choosing proprietary platforms lends them legitimacy and network effects at the direct expense of free alternatives like Codeberg, Matrix, and Mastodon. The asymmetry of network effects means that each project's choice disproportionately hurts or helps the smaller FOSS platforms. He dismisses the argument that proprietary platforms offer superior access to audiences as selfish and short-term thinking, noting that many FOSS platforms are functionally superior and offer the additional advantage of collective ownership. The post concludes with concrete recommendations for free alternatives across code hosting, messaging, publishing, and social media.

Key Insight: Relocating from the US to the Netherlands revealed how profoundly urban design choices around cycling, transit, and walkability shape daily quality of life in ways Americans rarely experience.

Drew DeVault reflects on his first months living in Amsterdam after relocating from the United States in July 2021. He describes finding housing through the hacker community, building a social network via the Techinc hacker space, and falling in love with Amsterdam's cycling infrastructure and public transit. He praises the city's parks, walkable neighborhoods, accessible grocery stores, and street cleanliness, while noting that learning Dutch has been more challenging than expected. Overall, he expresses deep satisfaction with his decision to move abroad.

Key Insight: Hare is maturing enough to write both a kernel and a PNG decoder that showcase its design strengths in memory management and I/O abstractions.

Drew DeVault's March 2022 status update covers his work on a kernel for his programming language (Hare), including interrupt handling and backtraces, as well as a PNG decoder that demonstrates the language's strengths. He also briefly covers SourceHut's migration to Alpine 3.15 and ongoing GraphQL improvements.

Key Insight: The prolific open source maintainer is a myth — behind every successful project stands a community of contributors who deserve recognition.

Drew DeVault addresses the common question of how he manages to maintain so many FOSS projects by himself, answering simply: he doesn't do it alone. The post is essentially a public thank-you to the thousands of contributors who have made his projects successful. He presents a massive list of individual contributors by name, emphasizing that each is a real person who voluntarily gave their time. The post serves as both an acknowledgment of collective effort and a rebuttal to the myth of the solo open source maintainer.

Key Insight: Developing a programming language semi-privately preserves the ability to make fearless breaking changes and ensures the first public impression is of a complete, usable tool rather than an incomplete experiment.

DeVault explains why he has been developing the Hare programming language in a semi-private state for over two years despite it being fully open source. He argues that keeping the community small during development allows breaking changes to be managed easily, since one person can update every downstream project. Privacy protects new discoverers from encountering an incomplete language and losing enthusiasm, and ensures the first public impression is of a polished, production-ready tool. He clarifies that 'open source' means licensing, not public visibility, and asks readers to respect the team's privacy. The post's update reveals that readers immediately violated this request, leaking the project on Hacker News and Lobsters.

Key Insight: Redefining 'open source' to exclude user rights is not linguistic evolution but dishonest brand appropriation driven by commercial self-interest.

DeVault argues that the term 'open source' has a specific, well-established meaning defined by the OSI's Open Source Definition, and that attempts to redefine it are fundamentally dishonest. He compares rebranding non-OSD-compliant software as 'open source' to trademark dilution, arguing it's motivated by financial self-interest. He acknowledges that language evolves but contends the current definition is both useful and morally just, since open source projects are collectively owned by their contributors. He concludes that alternative models like 'source available' are legitimate but must earn their own brand identity rather than co-opting the open source name.

Key Insight: Plaid's business model fundamentally contradicts decades of security education by training users to enter bank credentials into third-party forms, and no amount of convenience justifies normalizing this anti-pattern.

DeVault excoriates Plaid for asking users to enter their bank credentials into third-party forms, arguing this fundamentally undermines decades of security education about verifying domains before entering passwords. He acknowledges the legitimate problem Plaid addresses — banks' slow adoption of modern integration technology — but argues that tearing down online security pillars for mild convenience is indefensible. He notes Plaid's $58M lawsuit payout for scraping and selling bank data, placing it in the 'move fast and break laws' category alongside Uber and AirBnB. He calls for aggressive regulation and holds both Plaid's B2B customers and employees morally complicit.

Key Insight: Steady, incremental progress across multiple free software projects — a language ecosystem, a documentation platform, and a development forge — demonstrates the compounding returns of sustained open-source investment.

Drew DeVault's February 2022 status update covers progress across his major projects. The godocs.io fork reached version 1.0, providing continuity for godoc.org while simplifying the codebase. His programming language saw new modules including Redis protocol support, OpenGL bindings, linear algebra libraries, cryptography additions, and MIME support. SourceHut hired its third full-time engineer and landed GraphQL-native webhooks for git.sr.ht.

Key Insight: Genuine accessibility requires designing simple, intuitive, resource-efficient software from the ground up rather than applying band-aids to bloated, fundamentally inaccessible designs.

DeVault argues that accessibility is far broader than ARIA tags and screen readers, encompassing economic accessibility, localization, intuitiveness, and resource efficiency. He criticizes developers for treating accessibility as a checklist of band-aids applied to fundamentally inaccessible designs rather than building with empathy from the ground up. The post frames Electron apps consuming 8GB of RAM, huge JavaScript bundles, and data-hungry mobile apps as accessibility failures that disproportionately tax poorer users. He extends the concept to include localization, unfamiliar design language, and deliberately addictive social media patterns. DeVault acknowledges that free software is 'pretty pathetic' at accessibility, attributing it to laziness and building software only for people like its authors. He calls for designing simple, intuitive software as the foundation of accessibility rather than retrofitting unusable software with half-measures.

Key Insight: The MIT license maximizes freedom for downstream users at the cost of leaving authors unprotected — no patent safety, no copyleft, and no obligation to give back.

Drew DeVault provides a plain-language walkthrough of the MIT license as the first in a series on free software licenses. He breaks the license into three functional paragraphs: the grant of rights, the attribution condition, and the warranty disclaimer. He explains how each section maps to the four essential freedoms of free software and the open source definition. The post highlights the patent liability gap in MIT compared to licenses like Apache 2.0, and notes that MIT's permissiveness allows behaviors like proprietary forking that some developers may find undesirable.

Key Insight: Good systems programming language design reveals itself in how elegantly it handles memory management, and a MIME parser is a compact showcase for zero-allocation string parsing, tagged unions, and pragmatic trade-offs against poorly written specifications.

DeVault walks through implementing a MIME type parser and database in an unnamed systems programming language (later revealed as Hare). The post demonstrates how the language handles string parsing, tagged unions, manual memory management, and hash maps in roughly 250 lines of code. He highlights the poor quality of the RFC 2045 specification and pragmatically implements a 'reasonable subset' rather than wrestling with ill-defined edge cases. The implementation showcases the language's C-like design philosophy while providing zero-allocation parsing and efficient lookup via a simple hash table.

Key Insight: Pine64's funding of downstream distros instead of upstream kernel and telephony work creates ecosystem fragmentation where dozens of projects redundantly solve the same low-level problems that a single upstream contribution would fix for everyone.

DeVault argues that Pine64's funding strategy for its FOSS hardware ecosystem is misallocated, prioritizing distro maintenance over more critical upstream work. He identifies four layers of software needs—kernel/bootloader support, telephony, mobile UI, and distros—and contends Pine64 funds them in reverse order of importance. This creates fragmentation, with 20+ distros each solving the same low-level problems independently instead of one shared upstream solution benefiting everyone. He proposes Pine64 hire a single full-time developer focused on upstreaming kernel patches, bootloader support, and telephony work. He uses the Pinebook Pro as an example where six unmerged patches prevent standard UEFI installation, forcing every distro to publish custom images. While praising Pine64's model, he calls for a strategic course correction.

Key Insight: The programming language is maturing rapidly with production-grade cryptography, systems-level capabilities demonstrated by a RISC-V kernel, and growing contributor momentum, while SourceHut expands its team to ship GraphQL APIs.

Drew DeVault's January 2022 status update covers rapid progress on his programming language's cryptography suite, standard library modules, and low-level systems work including a RISC-V kernel collaboration. The language now supports Argon2, ChaCha20, Poly1305, and high-level AEAD/key derivation utilities, with TLS support on the roadmap. He also highlights SourceHut's growth with two new full-time engineers and progress on GraphQL APIs and webhooks. The update reflects a productive period across both the language and SourceHut projects.

Key Insight: RISC-V hardware has reached a point where a determined user with lightweight computing habits can almost use it as a daily workstation, but Rust's bootstrapping complexity and weak CPUs remain the critical barriers to broader desktop viability.

DeVault documents his experience using a RISC-V workstation (HiFive Unmatched) as his daily driver for a day, running Alpine Linux with Sway. While the system can handle many of his lightweight computing needs, the slow CPU and inability to bootstrap Rust (and thus Firefox) are major limitations. He finds that offloading work to the PCIe GPU makes the system surprisingly capable for media playback and even some gaming. He concludes that while RISC-V's promise still lives in tomorrow, the platform is a remarkably useful tool for advancing the RISC-V FOSS ecosystem.

Key Insight: Good language design is an iterative process where each solution must preserve parse-time clarity and prioritize the common case over the uncommon one.

DeVault walks through the iterative design process behind a specific feature in his systems programming language (Hare): how to append a variable amount of data to a slice. Starting from the requirement that all variables must be initialized, he traces how the '...' operator for array initialization led to questions about dynamic slice allocation, and then to the subtler problem of append syntax ambiguity. Through several iterations, he arrives at a design that is unambiguous at parse time, comfortable for the common case of appending a single item, and extensible for bulk operations.

Key Insight: FOSS projects that rely on proprietary communication platforms like Discord undermine their own values and exclude the very communities they should be serving, making platform choice an ethical and strategic decision, not merely a practical one.

DeVault argues that FOSS projects should not use Discord for community communication, as it creates a walled garden that excludes the very users most passionate about free software. He contends that Discord's proprietary nature locks out users with accessibility needs, limited hardware, privacy concerns, or who live in sanctioned countries. The post frames the choice of communication platform as an investment decision — choosing Discord divests from the FOSS ecosystem while legitimizing proprietary platforms. DeVault extends the argument beyond Discord to all proprietary infrastructure including GitHub, Twitter, and YouTube, urging projects to choose FOSS alternatives like IRC, Matrix, SourceHut, and Codeberg. He calls for solidarity and mutual support within the FOSS ecosystem as essential to its long-term success.

Key Insight: The free software movement succeeds through personal mentorship and mutual support, not just public advocacy.

Drew DeVault offers himself as a personal resource to anyone working in free software, inviting readers to reach out for feedback, advice, and collaboration. He acknowledges that his blog posts have inspired people to start FOSS businesses and take on community leadership roles. He lists specific ways people have already engaged with him, from pitching ideas to seeking philosophical debate. The post emphasizes that the free software movement depends on mutual support and mentorship, not individual effort alone.

Key Insight: Copyright is an artificial scarcity regime that serves corporate owners rather than creators, and abolishing it alongside guaranteeing basic human needs would liberate rather than destroy creative expression.

DeVault argues that copyright should be abolished entirely, contending it serves corporate rights holders rather than artists and stifles the creative process by criminalizing remixing and derivation. He rejects the 'artists have to eat' counterargument by asserting that access to food, shelter, and healthcare should never be contingent on capitalist productivity. He envisions a post-copyright world where basic needs are guaranteed, freeing artists to create without commercial pressure while still allowing them to earn money through performances, sales, and patronage. The piece frames copyright as an artificial scarcity imposed on ideas that sabotages the very process by which ideas are made.

Key Insight: Commercial use of free software is a feature, not a bug—but companies that ignore license obligations are not innovating, they are stealing.

Drew DeVault examines the illegal commercial forks of OBS Studio by companies like TikTok, explaining why the gaming community's understanding of intellectual property clashes with free software principles. He contrasts the modding community's credit-based economy with FOSS licensing, particularly the GPL's copyleft requirements. The post argues that commercial use of FOSS is explicitly permitted and even encouraged, but companies must comply with license terms—specifically releasing derivative source code under the same license. DeVault concludes that these companies are engaging in brazen theft, relying on their legal budgets to overpower underfunded maintainers.

Key Insight: Hare's development is maturing through real-world use cases like game development and cryptography, while deliberate removals like reflection show a commitment to language simplicity.

Drew DeVault's December 2021 status update covers progress on his programming language (Hare), SourceHut, and visurf. The language saw cryptography improvements including AES cipher modes, AES-NI, HMAC, and blake2b, plus better C library linking. He started building a tetromino game using SDL2 bindings to test game development in the language. SourceHut work focused on todo.sr.ht's GraphQL API, which proved more complex than expected. He notes taking it easier heading into the holidays.

Key Insight: Completeness is itself a form of polish — a desktop Linux distribution must be comprehensive and reliable in its entirety, not just beautiful in its core experience, to serve normal users.

DeVault reviews Linux Mint and elementary OS as desktop Linux distributions for regular users, following up on a previous post about what desktop Linux needs. He finds elementary OS polished but incomplete, with a showstopping full disk encryption bug that would baffle average users. Linux Mint impresses him more with its comprehensive feel and reliable software ecosystem, though he criticizes its promotion of proprietary services like Netflix and its lack of organizational transparency. He concludes that Linux Mint will be his recommendation for normal users, while elementary OS has potential if it continues improving.

Key Insight: New Linux users succeed not by trying to replicate their Windows experience, but by embracing Linux's fundamentally different strengths — the shell, package management, customization, and community collaboration.

In response to the Linus Tech Tips 'Switching to Linux' challenge series, DeVault offers practical advice for new Linux users while being refreshingly honest about Linux's limitations. He argues that Linux is primarily an operating system built by and for programmers, and that Windows remains the best OS for gaming. Rather than trying to replicate their Windows experience, new users should approach Linux with an open mind and explore what makes it genuinely different. He proposes an alternative set of challenges focused on the shell, package managers, tiling window managers, compiling from source, and community participation.

Key Insight: Linux's mainstream failure isn't technical but structural: the incentives of volunteer developers building for themselves will never produce a system for non-experts, and only a commercial model with dedicated support can bridge that gap.

DeVault argues that Linux is not accessible to average users today and examines what would need to change if the community wants mainstream adoption. He uses a racecar analogy to distinguish between expert-oriented software (which is valid) and software marketed to non-experts, arguing Linux excels for programmers but has failed ordinary users. He identifies three areas needing improvement: robustness, intuitiveness, and community culture. He criticizes the toxic elitism in Linux communities, the proliferation of bad advice blogs, and upstream projects that guide users toward expert-level installation methods. Rather than copying Windows, he proposes building something intuitive on its own terms, and suggests a commercial general-purpose Linux distro as the business model that could align incentives with end-user needs.

Key Insight: postmarketOS's greatest innovation isn't technical but cultural — replacing the chaotic, prestige-driven XDA hacking ecosystem with a collaborative, properly structured free software community that could finally deliver Linux on smartphones.

Drew DeVault argues that postmarketOS represents a revolutionary improvement over the chaotic XDA Forums era of smartphone hacking. He contrasts the old world of illegally closed-source Android forks, adfly links, and disorganized forum threads with postmarketOS's structured, community-driven approach built on Alpine Linux. While praising its proper version control, collaborative development model, and alignment with free software values, he acknowledges the difficult engineering challenges ahead. He concludes that postmarketOS paired with Pine64 hardware represents the best hope for delivering a truly free Linux smartphone platform.

Key Insight: Instant messaging becomes productive only when treated as ephemeral and asynchronous, with all actionable information deliberately moved to more permanent media.

DeVault outlines his philosophy for using IRC productively, arguing that instant messaging should be treated as ephemeral and asynchronous. He explains that users should never feel obligated to catch up on missed discussions, and any actionable information must be moved to a more permanent medium like email or bug trackers. He advocates pulling notifications rather than having them pushed, including full context in mentions, and dumping all relevant information upfront rather than engaging in slow back-and-forth dialogue. The approach eliminates the stress and productivity loss that many people associate with chat tools.

Key Insight: The npm ecosystem's culture of unaudited micro-dependencies has created a massive, largely invisible supply chain security crisis that developers ignore at their peril.

DeVault uses satirical provocation—offering to pay developers to delete their trivial npm modules without warning—to highlight the software security crisis created by npm's dependency culture. He proposes a formula rewarding deletions of high-download, low-line-count packages to maximize disruption and illustrate the fragility of the ecosystem. After revealing the satire, he argues that most Node developers have never audited their thousands of dependencies, making the entire ecosystem vulnerable to supply chain attacks. He contrasts this with his own practice of keeping dependency counts minimal through deliberate evaluation.

Key Insight: Python's refusal to exercise decisive leadership over its packaging ecosystem is alienating Linux distributions—the very communities that have sustained Python for decades.

DeVault excoriates the Python ecosystem for its chaotic, ever-proliferating packaging landscape and its disregard for Linux distribution maintainers. He argues that the constant reinvention of packaging tools—distutils, setuptools, pip, poetry, conda, and many more—has created an unmanageable mess. As an Alpine Linux package maintainer, he finds that none of these tools address distro needs, breaking backwards compatibility while ignoring repeated pleas from every major distribution. He calls on the PSF to exercise strong leadership, pick one solution, and commit to stability for the next 30 years.

Key Insight: Honest assessment of project timelines sometimes means accepting significant delays when key components like cryptography and self-hosting aren't ready, even when overall progress is positive.

Drew DeVault's November 2021 status update covers SourceHut's third anniversary as a public alpha, the decision to delay their new programming language (Hare) by up to a year due to slow progress on cryptography, the self-hosting compiler, and acceptance testing. He notes incremental progress including AES support, a FreeBSD port, and date/time API work. The visurf browser project saw contributions from new developers, and several smaller projects received minor updates.

Key Insight: Companies that switch from open source to restrictive licenses after building on community contributions are executing a deliberate bait-and-switch that exploits the open source social contract, and CLAs are the mechanism that enables it.

Drew DeVault excoriates Apollo GraphQL for switching Apollo Federation 2 from the MIT license to the non-free Elastic License v2 while claiming the change benefits the open source community. He systematically deconstructs Apollo's announcement, showing how the new license strips users of sublicensing, resale, and hosted service rights while granting Apollo exclusive commercial exploitation. DeVault places this move in a broader pattern of companies building products on open source community contributions, then pulling a bait-and-switch to a restrictive license. He calls out the CEOs behind similar moves at Elastic, MongoDB, and Confluent, and warns developers against signing CLAs that enable such exploitation.

Key Insight: Issue trackers are communal knowledge bases and contributor funnels, not maintainer to-do lists, and automatically closing them destroys long-term collaborative value.

Drew DeVault argues that GitHub's recommended 'stale bot', which automatically closes issues after 60 days of inactivity, is actively harmful to open source projects. He contends that maintainers have no obligation to respond to every issue and that open issues serve as valuable collaborative spaces where users can accumulate details, workarounds, and eventually contribute fixes. Having many open issues signals popularity, not neglect. He contrasts GitHub's approach with SourceHut's mailing-list-first workflow, where discussion refines bug reports before they become tickets, resulting in higher-quality, actionable items.

Key Insight: Privacy products that seek investor returns while handling sensitive user data face an inherent conflict of interest, and must earn trust through radical transparency about their funding, technical limitations, and incentive structures.

Drew DeVault examines SmarterEveryDay's 4privacy Kickstarter project, a privacy-focused product promising end-to-end encryption, decentralization, and user control over personal data. While praising Destin's ability to communicate privacy issues to laypeople and the project's commitment to open source and zero-knowledge principles, DeVault raises serious concerns about the project's investor-driven funding model, its misleading claim that users can revoke access to data after sharing it, and the extraordinary technical ambition required to build a novel cryptosystem with federated protocols. He argues the $175,000 Kickstarter goal is woefully insufficient for the scope described, and that outside investor money creates dangerous incentives around private user data. DeVault urges 4privacy to adopt radical transparency about funding, publish their whitepaper for public review, and honestly communicate the system's limitations to users.

Key Insight: The software industry's embrace of complexity and speed over simplicity and testing has produced a landscape of universally broken software that only technical experts can navigate, and developers bear personal responsibility for fixing it.

DeVault argues that software reliability has catastrophically declined as developers have embraced a 'move fast and break things' mentality. He observes that tech-savvy users have built up enormous institutional knowledge just to work around broken software, while non-technical users are left bewildered. The post catalogs everyday failures — from reimplemented HTML forms to broken SMS delivery — as evidence of industry-wide recklessness. He calls on developers to prioritize simplicity, rigorously handle state and errors, use proven technologies, and stop letting economics override empathy for users.

Key Insight: DeVault's monthly update reveals a consistent philosophy of building decentralized, accessible alternatives across the entire stack — from chat infrastructure and programming languages to browsers and CSS frameworks designed for the margins of the web.

DeVault's October 2021 status update covers several projects in his free software ecosystem. The headline item is chat.sr.ht, a new SourceHut product built on Simon Ser's soju and gamja IRC projects, offering hosted IRC bouncing for paid users and webchat for anonymous users. His unnamed programming language (Hare) gained reflection capabilities, riscv64 support, and grammar improvements. He also highlights visurf (a vi-inspired Netsurf frontend), antiweb (a CSS toolkit for marginalized browsers), and Alpine Linux RISC-V work.

Key Insight: Hare's reflection system achieves zero runtime overhead by statically allocating type information at compile time and reducing reflection to simple pointer casts, with the linker stripping unused type data.

DeVault explains how reflection works in Hare (redacted as 'xxxx'), his new systems programming language. The post walks through the user-facing API where a 'type' meta-type can be converted to a typeinfo pointer via types::reflect, which is simply a pointer cast. The compiler statically allocates typeinfo structures into the binary, with built-in types provided by the runtime and complex types generated at compile time. Type aliases enable singleton typeinfo allocations that the linker can strip if unused, while anonymous structs must be regenerated each time they appear.

Key Insight: Software distributions are a critical, volunteer-run layer of user advocacy that developers should support rather than bypass, because distros solve distribution, security, and integration problems far better than individual developers can.

DeVault argues that software developers should rely on third-party software distributions (Linux distros, BSDs, etc.) to handle packaging and distributing their software rather than doing it themselves. He defines software distributions as curated, volunteer-run systems that represent user interests, contrasting them with uncurated repositories like npm or PyPI that frequently distribute malware. Distributions provide critical infrastructure including dependency management, cryptographic signatures, CVE management, and long-term support — all for free. Developers should make distributors' jobs easier by shipping tarballs, using standard build systems, and maintaining good release notes. He concludes that systems like Flatpak which bypass traditional distribution models are 'completely missing the point.'

Key Insight: Open-source alternative frontends represent a powerful form of internet activism that reclaims user agency from corporate platforms by proving that user-first design is possible when profit motives are removed.

DeVault celebrates a growing trend of open-source 'Internet reclamation projects' — alternative frontends like Invidious, Nitter, and Teddit that scrape data from corporate platforms and present it in user-first interfaces. He argues these tools demonstrate what users actually want but corporations refuse to provide: no ads, no spyware, better performance, and accessibility on low-end devices. He frames this movement as a form of internet activism that rejects the 'domestication of users' by corporate platforms, and calls for similar projects targeting Facebook, GitHub/GitLab, and Medium.

Key Insight: DeVault's simultaneous work on a minimal browser, a systems programming language, and a forge platform reflects his vision of rebuilding the software stack from principled foundations.

Drew DeVault shares his September 2021 progress across several FOSS projects. He announces visurf, a minimal Wayland-only frontend for the NetSurf browser with vi-inspired keybindings. The Hare programming language has seen significant progress following a codegen rewrite, including language design refinements and new features. SourceHut has gained GraphQL API improvements and new platform support.

Key Insight: Rather than accepting the modern web's complexity as inevitable, DeVault proposes building both a browser and a web framework ecosystem around deliberate simplicity, requiring cooperation between browser and website developers.

DeVault announces visurf, a new web browser frontend for the NetSurf engine with vi-inspired keybindings and a lightweight Wayland UI. He positions it as a deliberate rejection of the modern web's complexity, preferring NetSurf's limited HTML4/CSS2 support over the bloated codebases of Firefox and Chromium-based browsers. The project aims to create a usable browser, drive interest in NetSurf development, and encourage websites to build for scope-constrained browsers. He also announces plans to overhaul SourceHut's frontend with a new CSS framework that treats small browsers as first-class targets.

Key Insight: Both Hare and SourceHut are advancing steadily, with a major compiler codegen rewrite landing and SourceHut's GraphQL API surface expanding toward full coverage.

Drew DeVault's August 2021 status update reports progress from his new base in Amsterdam. The bulk of his work focused on his programming language project (Hare), where a major codegen rewrite was completed and merged after all tests passed. He also reports SourceHut progress, including shipping the lists.sr.ht GraphQL API and working on GraphQL-native webhooks. He outlines near-term plans for both projects, including language design questions and expanding GraphQL support across SourceHut services.

Key Insight: Building a new compiled language means bootstrapping your debugging workflow from raw assembly and gdb before proper tooling exists, making classic techniques and creative workarounds essential survival skills.

DeVault shares practical advice for debugging programs written in a new compiled programming language that lacks mature tooling. He emphasizes that classic debugging techniques like careful thought and print statements remain the most effective starting point. When those fail, he walks through using gdb without debug symbols, working directly with assembly, memory examination, and creative workarounds like dummy breakpoint functions. The post draws from his direct experience building the Hare programming language and frames the pain as motivation to eventually build proper debugging tools.

Key Insight: Apple's CSAM scanning is a voluntary, warrant-free, algorithmically-driven search of personal devices whose scope is limited only by corporate discretion and future government demands.

DeVault uses satirical misdirection to critique Apple's CSAM scanning initiative, initially presenting the scenario as the FBI announcing warrant-free physical searches of American homes. He methodically reveals that the actual situation — Apple scanning users' devices with proprietary algorithms — is arguably worse than the fictional scenario. The post argues that scanning digital devices is functionally equivalent to searching homes, since devices now contain all of our communication and personal information. DeVault emphasizes that Apple volunteered this capability without government request, and that nothing technically limits the scope of future searches beyond Apple's choices and congressional demands.

Key Insight: Go's centralized module proxy creates a false sense of ecosystem health by masking broken dependencies behind Google's cache, while simultaneously burdening upstream hosts with aggressive crawling.

Drew DeVault argues that Google's GOPROXY service, which caches all Go module downloads, is silently hiding broken dependencies throughout the Go ecosystem. Because the cache never expires, packages whose upstream sources have disappeared continue to resolve through the proxy, creating ticking time bombs that developers only discover when bypassing it. He further criticizes the module mirror for effectively DDoSing his SourceHut servers with redundant crawl requests since February, with the Go team being unresponsive to his reports. He concludes that the Go module mirror may not need to exist at all.

Key Insight: PostgreSQL represents what free software can achieve at its best: a technically superior, exhaustively documented, and meticulously maintained project that has effectively solved its problem domain over 25 years of disciplined engineering.

DeVault praises PostgreSQL as one of the most significant achievements in free software, placing it alongside Linux and Firefox. He argues that after 25 years of development, Postgres has solved the relational database problem so effectively that its competitors are essentially obsolete. He highlights its powerful SQL implementation, exceptionally thorough documentation, and the disciplined engineering team behind it. While acknowledging that Postgres requires skilled operators and a costly learning investment, he concludes that the investment pays handsomely and that PostgreSQL deserves recognition as one of the most impactful projects in the free software ecosystem.

Key Insight: YAML persists not because it's good but because no replacement has matched its unique combination of script embedding, visual hierarchy, and machine-editability — and fixing it requires radical simplification rather than incremental improvement.

DeVault outlines the properties a YAML replacement must preserve and the flaws it must fix. He argues YAML remains dominant because alternatives like TOML only capture part of its use cases, particularly its ability to embed multi-line scripts and serve as both human- and machine-editable data. He identifies YAML's key strengths as whitespace-based hierarchy, language-independent specification, script embedding, and being data rather than a programming language. The needed improvements center on radical grammar simplification, a proper schema system to resolve type ambiguity, and willingness to drop JSON compatibility. He hopes someone else will build it.

Key Insight: Hare is maturing rapidly with community contributions in math, networking, and codegen, while DeVault balances language development with SourceHut infrastructure work during an international relocation.

DeVault provides his July 2021 status update while relocating to Amsterdam. The post covers progress on his programming language project (Hare), including a codegen rewrite, new math operations, DNS resolution, and POSIX utility implementations. He notes the aerc email client needs a new maintainer after Reto Brunner stepped down. SourceHut work has focused on the GraphQL API for lists.sr.ht, though the move abroad has slowed some deliverables.

Key Insight: If machine learning outputs are legally derivative works of their training data, then GitHub's own use of Copilot may have inadvertently made its entire proprietary codebase subject to the copyleft licenses it trained on.

Drew DeVault examines the legal implications of GitHub Copilot being trained on GPL-licensed code, raising the question of whether machine learning outputs constitute derivative works. He highlights that Copilot can reproduce verbatim GPL'd code like Quake III's fast inverse square root, creating a potential licensing conflict. He makes the provocative observation that if ML outputs are derivative works, then GitHub itself—where 300 employees used Copilot daily—may be a derivative work of AGPL software, potentially requiring GitHub to open-source its entire codebase. He broadens the discussion to fundamental ethical questions about consent, rights over training data, and the tech community's unresolved divide over machine learning ethics.

Key Insight: Federation is not a single design pattern but a flexible spectrum from closed to open, and IRC's closed federation model demonstrates how different tradeoffs in governance, moderation, and scalability can be made independently of the underlying technology.

The post explains how IRC's federation model differs from ActivityPub's approach used by Mastodon and similar services. While IRC networks like Libera Chat appear centralized, they are actually composed of dozens of interconnected servers that relay messages between each other. Unlike ActivityPub's open federation where any server can peer with any other, IRC networks operate as closed federations with whitelisted server connections under common governance agreements. DeVault argues that federation is a flexible concept allowing diverse social and operational structures, each with its own tradeoffs around moderation, scalability, and user mobility.

Key Insight: Native browser form controls encode an impossibly deep stack of platform-specific, language-specific, and accessibility-critical behaviors that no custom JavaScript replacement can faithfully reproduce.

DeVault argues that custom JavaScript form controls destroy the rich, nuanced behaviors that users depend on from native browser inputs. He catalogs the many subtle interaction patterns built into standard text boxes and select elements on Linux/Firefox, including word-wise selection, primary selection clipboard, and keyboard-driven list navigation. He points out that these behaviors vary across operating systems, browsers, languages, and accessibility needs, making it impossible for any custom implementation to replicate them all. The post concludes that JavaScript-powered form replacements make forms slower for sighted users and completely broken for blind users.

Key Insight: Good standard library design — particularly a well-thought-out dial abstraction inspired by Plan 9 — can make network client implementations trivially concise while automatically supporting features like SRV records and extensible protocol handlers.

DeVault demonstrates a finger protocol client written in Hare, following up on an earlier io_uring finger server post. The implementation is remarkably concise thanks to Hare's new networking stack, particularly its net::dial module inspired by Go's net.Dial and Plan 9's dial function. The post highlights how Hare's dial design improves on Go by reintroducing the service parameter from Plan 9 and allowing third-party protocol handler extensions. The entire client fits in roughly 30 lines of code, handling DNS resolution, service lookup, and SRV records automatically.

Key Insight: Steady incremental progress on SourceHut's GraphQL APIs and the secret programming language, with a pragmatic willingness to pause feature work for necessary compiler refactoring.

Drew DeVault's June 2021 status update covers progress on SourceHut, his secret programming language (Hare), and IRC tooling. SourceHut gained NetBSD build support, a new GraphQL API for builds.sr.ht, and improved onboarding flows. The secret language hit a point requiring deep compiler refactoring, expected to take months. He also contributed to gamja and soju, IRC client and bouncer projects being adopted by Libera.chat.

Key Insight: The warranty disclaimer in every open source license is not just legal boilerplate — it defines the social contract of FOSS, freeing both users and maintainers from obligations beyond the code itself.

DeVault argues that free and open source software licenses explicitly disclaim all warranties and obligations, and that both users and maintainers need to internalize this fact. Users are not entitled to bug fixes, support, documentation, or any maintenance from FOSS maintainers. Equally important, maintainers must understand they have no obligation to burn themselves out serving an ever-growing user base. The post reframes FOSS as a social contract where users receive the freedom to modify and distribute software, not a guarantee of ongoing service. DeVault urges maintainers to say 'no,' manage expectations, and remember why they started their projects in the first place.

Key Insight: DeVault frames his emigration as an explicit rejection of American capitalism and its incompatibility with FOSS values, choosing to relocate both himself and SourceHut to a society more aligned with his principles rather than fighting a losing cultural battle.

Drew DeVault announces his planned move from the United States to the Netherlands, citing deep dissonance with American values, particularly around capitalism and its incompatibility with FOSS culture. He acknowledges the move is a selfish choice, opting to live somewhere that already aligns with his values rather than staying to fight for change. He chose the Netherlands for its visa accessibility, high quality of life, strong EU FOSS ecosystem, and five-year path to citizenship. He also announces that SourceHut will be relocating its incorporated entity and infrastructure to the Netherlands.

Key Insight: The best way to mature a new programming language is to recruit adventurous developers to build real projects in it, letting practical needs drive standard library development.

DeVault invites developers to build their systems programming projects using a new language (Hare, unnamed at the time) to help drive development of its standard library. He pitches the language as simple, robust, and well-suited to low-level tasks like OS kernels, shells, and networking software. The post is a direct call to action for adventurous early adopters willing to work with an immature ecosystem. He later added a note that enough projects had signed on.

Key Insight: The deliberately obsolete Finger protocol serves as a perfect minimal test case for exploring io_uring's async I/O model and showcasing a new systems language's design choices around error handling, memory management, and state machines.

DeVault walks through building a high-performance finger server using Linux's io_uring async I/O interface, written in his then-unreleased programming language (Hare). He uses the deliberately simple and obsolete Finger protocol as a test bed for designing an io_uring wrapper, explaining the ring buffer architecture, submission/completion queue model, and how it avoids costly syscalls. The post doubles as a tutorial on both io_uring concepts and Hare's language features including error handling, tagged unions, slices, and state machines. He implements a complete client state machine handling query parsing, plan file reading, CRLF conversion, and error forwarding, all driven by async I/O events.

Key Insight: Release notes are clerical upgrade documents, not marketing — lead with breaking changes, use annotated git tags, and let git shortlog do the heavy lifting.

Drew DeVault outlines his philosophy for writing effective release notes for open source software. He argues release notes should be clerical documents prioritizing breaking changes and upgrade steps, not marketing material. The detailed changelog should follow a brief summary of flagship improvements, ideally generated from git shortlog. He strongly advocates for annotated git tags as the only appropriate place for release notes, rejecting both CHANGELOG files and GitHub releases. He shares a custom tool called 'semver' to automate the process and provides a real-world example from wlroots.

Key Insight: A robust offline email workflow can be built by delegating IMAP sync to mbsync and outgoing mail to postfix, working around the limitations of always-online email clients.

DeVault describes his updated email setup using aerc with Maildir support, mbsync for IMAP synchronization, and postfix for outgoing mail relay. He acknowledges that aerc's original 'always online' IMAP approach was a design mistake, and this workaround provides robust offline email capability. The setup allows reading and replying to email entirely offline, with automatic syncing when connectivity returns. He walks through the configuration of mbsync, aerc's accounts.conf, a cron job for periodic sync, and postfix as an SMTP relay.

Key Insight: SourceHut's GraphQL migration is nearing completion while DeVault's secret language project (Hare) is taking shape with low-level Linux io_uring bindings designed to be wrapped in a portable abstraction.

Drew DeVault provides his May 2021 status update covering personal news, SourceHut development, and his secret programming language project. He reports completing the first version of the builds.sr.ht GraphQL API and outlines the remaining services needing GraphQL APIs. He shares a code sample from his then-secret language (Hare) demonstrating Linux io_uring bindings, noting the low-level API will be wrapped by a portable event loop interface called 'iobus' in the standard library. He also mentions improvements to godocs.io by contributor Adnan Maolood.

Key Insight: The Pinebook Pro is the first laptop in a decade to meaningfully advance beyond the circa-2010 ThinkPad standard, despite ARM's ongoing pain points, because it prioritizes repairability, simplicity, and openness over raw specs.

DeVault reviews the Pinebook Pro after years of using an 11-year-old ThinkPad X200 as his sole laptop. Despite significant frustrations with the ARM architecture, missing kernel support, and various hardware shortcomings like a poor touchpad and weak speakers, he finds the Pinebook Pro to be the first laptop in a decade that meaningfully improves on the state of the art for his needs. He praises its weight, screen quality, battery life, user-serviceability, and adequate performance for his workflows. The device will largely replace his ThinkPad, though ARM limitations keep the old machine relevant for niche uses.

Key Insight: Programmers have a moral responsibility to refuse building features that deliberately worsen the user's experience for corporate gain.

DeVault uses an in-flight entertainment system that forces ads on passengers as a springboard to discuss 'unlikable' software — features deliberately designed against the user's interests. He argues that overriding a passenger's brightness preference to show ads is a clear example of anti-features, where engineers knowingly worsen user experience for corporate benefit. He connects this to the broader pattern of dark patterns across the software industry. He concludes with a simple ethical stance: programmers should respect users and refuse to build features that subvert their interests.

Key Insight: When a corporate steward deprecates community infrastructure and replaces it with something more restrictive, a small group of motivated volunteers can fork, simplify, and improve it to better serve the community.

Six months after forking the deprecated godoc.org into godocs.io, the project has made significant improvements while preserving the original experience. The fork was motivated by pkg.go.dev's restrictive license policies that excluded many projects from documentation display. A small team of volunteers added Go modules support, Gemini protocol access, and a PostgreSQL search backend. They also removed 64% of the original codebase, eliminating Google infrastructure dependencies and making self-hosting practical.

Key Insight: Alpine Linux's greatest strength is being simple enough for one person to fully understand, which compounds into reliability, predictability, and robustness across every use case.

DeVault makes a systematic case for Alpine Linux as the best Linux distribution across all use cases, evaluating it against his core criteria of simplicity, stability, reliability, and robustness. He argues Alpine is uniquely simple among Linux distributions — the only one that 'fits in his head' — while also excelling at performance and access to up-to-date software. He acknowledges weaknesses in documentation and project governance but considers them minor relative to Alpine's strengths. He concludes by noting he uses Alpine everywhere: servers, workstations, laptops, and his PinePhone.

Key Insight: Cryptocurrency has monetized stolen computing resources, corrupted software industry incentives, and functions as an exploitative Ponzi scheme rather than the empowering technology its proponents claim.

DeVault delivers a comprehensive takedown of cryptocurrency, prompted by sourcehut's decision to require paid accounts for CI services due to rampant crypto mining abuse. He argues that cryptocurrency has invented an entirely new category of internet abuse, forcing free service providers to shut down public resources. Beyond the direct abuse, he contends that crypto has corrupted the software industry's incentive structures, turning promising projects into thinly veiled get-rich-quick schemes. He dismisses claims that cryptocurrency serves as a legitimate currency, calling it an investment vehicle that enriches the wealthy while exploiting vulnerable communities and wasting enormous amounts of energy. He concludes that cryptocurrency is one of the worst inventions of the 21st century.

Key Insight: Lichess represents the kind of free, non-commercial internet service that DeVault believes should be the norm rather than the exception.

Drew DeVault signal-boosts an article from Lichess explaining why the chess platform will always remain free. The post is extremely brief, consisting of just a link recommendation with no original analysis. It reflects DeVault's ongoing advocacy for free, non-commercial software projects. By sharing this, he implicitly endorses Lichess as a model for how internet services should operate.

Key Insight: Good language design means deliberately constraining the grammar to keep parsing simple, and exposing the parser in the standard library empowers the entire tooling ecosystem.

DeVault describes the design and implementation of a self-hosting parser for his new systems programming language (Hare). The project went through three parser iterations: a yacc-based prototype for rapid iteration, a hand-written C recursive descent parser accompanying the formal specification, and finally the self-hosted version written in the language itself. The language was deliberately designed with a context-free LL(1) grammar to keep parsing simple. The post walks through the lexer and parser architecture in detail, showing how tokens are produced and consumed to build an abstract syntax tree. The parser and lexer live in the standard library, inspired by Go's approach, to enable language-aware tooling.

Key Insight: DeVault's secret systems language project is rapidly building momentum with new contributors tackling core stdlib modules, though the tight-lipped development style means public updates remain deliberately sparse.

Drew DeVault gives a brief April 2021 status update, noting that nearly all his effort has gone into his then-secret programming language project (later revealed as Hare). He directs readers to the sourcehut 'what's cooking' post for SourceHut news. He reports that a recent call for contributors brought several new people on board and narrows the remaining needs to cryptography, date/time, and networking expertise. He shares a teaser of the unix::passwd stdlib module as an example of contributor work.

Key Insight: The DCO protects contributor rights by ensuring contributions stay under the original open source license, while CLAs create an asymmetric power structure that enables proprietary relicensing.

Drew DeVault argues that the Developer Certificate of Origin (DCO) is a superior alternative to Contributor License Agreements (CLAs) for managing open source contributions. He uses Amazon's OpenSearch fork of ElasticSearch as a positive example, noting that Elastic's use of a CLA enabled their eventual switch to a proprietary license. The DCO, originally designed for the Linux kernel, lets contributors certify they have the right to submit code while retaining their copyright and preventing relicensing. DeVault urges project maintainers to adopt the DCO and advises contributors to refuse signing CLAs.

Key Insight: The next chat platform must be a federated, open protocol that distributes power across independent operators, because centralized control — no matter how well-intentioned — inevitably leads to abuse.

Drew DeVault argues that Signal has failed its users by introducing cryptocurrency and maintaining centralized control, and lays out requirements for what the next chat application should look like. He insists it must be a federated protocol (not just an app), with end-to-end encryption, user anonymity, and a focus on reliability over feature bloat. The post is a direct response to Signal's crypto announcement, which DeVault sees as validation of his longstanding concerns about centralized governance. He calls for a system that distributes power across independent server operators and resists the temptation to cargo-cult toxic features from existing chat apps.

Key Insight: Go's greatest achievement is not any single feature but its disciplined restraint, which produces simplicity that propagates throughout its entire ecosystem and establishes it as the defining 'Internet programming language.'

DeVault offers a rare positive assessment of Go, praising its long-term commitment to simplicity, stability, and robustness. He argues Go essentially invented a new niche as an 'Internet programming language' distinct from systems programming. He credits the Go team's disciplined restraint and centralized leadership for producing both an excellent language and an unusually high-quality ecosystem. He contends that Go's insulation from community demands is actually essential to its value, and that the language has earned a rare status as a reliable engineering tool built to last decades.

Key Insight: IRC's simplicity and openness naturally invites creative tinkering, and sometimes the most entertaining engineering is the kind that's deliberately impractical.

DeVault describes 'wormy,' a comically over-engineered IRC bot that has evolved over six years in a social channel. The bot is actually a bouncer combining seven independent bots providing features like parcel tracking, internet radio requests, and URL previews. The introduction of jsbot—which executes arbitrary JavaScript in a persistent environment—allowed channel members to write additional bots as one-liner IRC messages. This led to an absurd situation where both bot code and state lived in a single long-lived process, eventually requiring a hacky persistence layer. DeVault shares this purely for entertainment, explicitly noting there is no moral to the story.

Key Insight: Open sourcing video games is primarily an act of historical preservation — the choice is between a game that lives forever through community ports and derivatives, or one that quietly dies when its original platform becomes obsolete.

Drew DeVault presents a comprehensive guide for video game developers who want to open source their games, arguing that releasing source code is essential for historical preservation and lasting legacy. He outlines a spectrum of approaches from source-available (bare minimum) to fully open assets under Creative Commons, with copyleft-licensed code and proprietary assets as his recommended middle ground. The post addresses common objections like cheating concerns and embarrassing code quality, dismissing both as insufficient reasons to keep games closed. He concludes with practical step-by-step instructions for publishing source code and assets.

Key Insight: A new systems language can succeed by staying small, targeting C's niche directly with modern improvements, and launching only when it's genuinely ready for production use.

Drew DeVault publicly announces that his long-teased 'secret project' is a new systems programming language (later revealed as Hare), under development since December 2019 with a target release in early 2022. The language features manual memory management, no runtime, a superset of the C ABI, and a compact 60-page specification. It aims to be a modernized alternative to C with improvements like tagged unions for error handling, memory-safe types, and Unicode-aware strings. DeVault emphasizes that the first public release will be production-ready, and he's seeking volunteers to help build out the standard library.

Key Insight: DeVault's steady investment in Gemini protocol tooling and self-hostable infrastructure reflects his commitment to building decentralized alternatives to the corporate web.

Drew DeVault's March 2021 status update covers progress on several smaller projects alongside his secret project and SourceHut. He built a Gemini feed reader available as both free software and a hosted service, added Gemini hosting support to pages.sr.ht, and switched gmni to use BearSSL. The godocs.io project also saw improvements with cruft removal and progress toward Go modules support.

Key Insight: The corporate surveillance industry's data pipelines have no ethical floor — data collected to serve ads can and does end up being used to kill people, making every participant in that pipeline morally complicit.

DeVault reacts with fury to a Vice report revealing that a US military unit conducting drone strikes purchased location data harvested from ordinary smartphone apps, including Muslim-oriented ones. He argues this represents the ultimate consequence of the corporate surveillance and adtech industry: user data collected for advertising purposes being weaponized to literally kill people. He calls on individual programmers to take personal moral responsibility for the surveillance infrastructure they build, rejecting the excuse that employees are just trying to feed their families. The post frames participation in corporate surveillance as complicity in murder.

Key Insight: In FOSS, the software is freely available to everyone, so the competitive advantage lies entirely in building the business around it—skip that work and someone else will do it without you.

DeVault argues that FOSS developers who want to make money must build the business before or alongside the software, not after. Because open source requires surrendering monopoly rights, building software first and hoping to monetize later risks losing first-mover advantage to someone else who does the business work. He emphasizes that making money in FOSS is possible but rarely happens by accident—it requires deliberate planning around company structure, customers, pricing, and revenue model. The post outlines several monetization approaches including support contracts, consulting, education, SaaS, and donations, noting that donations are the hardest path.

Key Insight: Gmail's dominance makes it both the largest source of spam and the least accountable for it, inverting the expected relationship between market power and responsibility.

DeVault presents data showing Gmail is the largest source of spam registrations on SourceHut, outnumbering the second-largest offender by 5x. He argues that Gmail's dominant market position gives it the greatest responsibility to combat spam, not an excuse for the volume. Despite sending many abuse reports to Gmail, he has never received a follow-up or seen improvement. He stops short of blocking Gmail registrations only because 41% of SourceHut users rely on it, and urges technically proficient users to switch to independent email providers.

Key Insight: The most successful replacements in computing are those that simplify rather than extend, finding the essential core of a problem and discarding accumulated cruft rather than building more complexity on top of it.

DeVault argues that the most successful replacement technologies are those that simplify rather than expand upon their predecessors. He contends that tools which start as supersets of existing software inherit their warts and struggle to fully supplant them, while those that isolate the core problem and solve it with less complexity tend to succeed. He cites Alpine Linux, musl libc, Go, UTF-8, and JSON as examples of successful simplification, while positioning zsh and Rust (relative to C) as cautionary examples of scope expansion. He concludes that questioning the premise of existing software and applying hindsight yields better replacements than building more on top of existing hacks.

Key Insight: This post is a historical artifact marking one of the earliest public glimpses of the Hare programming language, revealed through a simple cat implementation that already demonstrates the language's philosophy of explicit error handling and systems-level control.

Drew DeVault's February 2021 status update covers SourceHut maintenance work and teases a secret project that turns out to be an early look at the Hare programming language. The post reveals a working cat implementation in Hare, showcasing its systems programming syntax with explicit error handling and C-like control flow. He mentions progress on todo.sr.ht's GraphQL API and an Alpine 3.13 upgrade. The post closes with a call for volunteers to help build out the standard library for the secret language project.

Key Insight: Small, considerate choices in your build system, release process, and git discipline compound into major quality-of-life improvements for the downstream packagers who bring your software to users.

DeVault offers practical advice for FOSS project maintainers on how to make life easier for downstream packagers and users. He emphasizes using standard build systems for your language, not relying on git-specific features for builds, supporting reproducible builds via SOURCE_DATE_EPOCH, and maintaining good git discipline with annotated tags containing changelogs. The post is aimed at library authors and tool developers whose software gets packaged by Linux distros, pkgsrc, and corporate users. He frames these as small, easy tweaks that yield outsized benefits for the broader ecosystem.

Key Insight: Proprietary platforms will inevitably act against their users' interests when those interests conflict with their backers', making migration to open, federated alternatives not just preferable but essential for self-preservation.

DeVault uses the /r/wallstreetbets Discord ban as a case study for why proprietary platforms are fundamentally dangerous to their users. He argues that Discord's claims of banning the community for spam and bot abuse are pretextual, masking the real conflict of interest between retail investor users and wall-street venture capital backers. He contends that proprietary protocols exist specifically to maintain total control over users, not to prevent abuse. The post advocates for federated, open alternatives like Matrix, IRC, Mastodon, and Lemmy, arguing that only platforms with distributed ownership can truly align with user interests.

Key Insight: Open source is fundamentally a rejection of commercial monopoly—if you accept community contributions, you must accept that anyone can profit from the result.

DeVault argues that the fundamental bargain of open source software is surrendering your monopoly over commercial exploitation. Companies struggling to understand FOSS philosophy must accept that anyone—competitors, cloud providers, consultants—can monetize their code. He frames this as karmic justice: if the community contributes value beyond what any single organization could create, the commercial benefits shouldn't be captured by that organization alone. The GPL family of licenses offers a middle ground by requiring improvements be shared back. DeVault concludes that FOSS creates socialized software wealth rather than monopolies.

Key Insight: Open source licensing is a moral commitment to the commons, and companies that use CLAs to later revoke that commitment are betraying every contributor who trusted them.

Drew DeVault excoriates Elastic for relicensing Elasticsearch away from open source, arguing this betrays the 1,573 contributors who donated their work under an open source social contract. He accuses Elastic of deliberately using CLAs to strip contributors of control, then exploiting that power to establish a monopoly. DeVault rejects Elastic's framing that Amazon forced their hand, noting Elastic cleared half a billion dollars. He argues open source is a communal commitment with moral obligations, and calls this an 'Oracle-level move' against the community.

Key Insight: Language features that hide behavior behind familiar syntax trade readability and predictability for convenience — a bargain that systems programmers should refuse.

DeVault argues that certain programming language features create dangerous disconnects between what code appears to do and what it actually does, coining this 'spooky action at a distance' by analogy to quantum mechanics. He uses operator overloading as the primary example, showing how a simple '+' operator can hide function calls, memory allocation, or garbage collection pressure. He also critiques C's macro system for similar reasons, where a macro disguised as a function call can silently mutate its arguments. While acknowledging these features involve trade-offs, he concludes they sacrifice readability, predictability, and debuggability — qualities essential for systems programming.

Key Insight: Community-driven forks can preserve valuable internet infrastructure when corporate stewardship falters, as demonstrated by godocs.io replacing Google's abandoned godoc.org.

Drew DeVault's January 2021 status update covers progress across several projects. The headline item is godocs.io, a community fork of Google's godoc.org that removes Google dependencies and the CLA requirement. SourceHut gained a dark theme and began work on API 2.0 for todo.sr.ht. Several smaller projects received community contributions. The post closes with a teaser showing working string handling code in what would become the Hare programming language.

Key Insight: The tech industry's utopian promise of global connectivity instead produced history's most powerful machinery for radicalization and corporate control, making technologists complicit in the broader societal regression driven by unchecked capitalism.

DeVault argues that future generations will judge our era harshly, much as we judge the Middle Ages. He contends that humanity has solved the problem of natural scarcity yet deliberately chooses to deny people basic needs in pursuit of profit. He connects the Capitol insurrection to the tech industry's role in building tools for radicalization and propaganda, implicating himself and his peers as complicit. The post broadens to a global critique of declining democracy, corporate political capture, and capitalism's corrosive effects on society, concluding that climate destruction may ensure no one survives to remember us at all.

Key Insight: Software that aims to be completed and resists unnecessary change delivers more stability and reliability than software that chases perpetual feature growth.

DeVault argues that software can and should be considered 'completed,' pushing back against the common assumption that inactive repositories are abandoned or inferior. He distinguishes between internal and external sources of change, noting that all change—even bug fixes—introduces instability. Projects should draw a finish line or gradually raise the bar for new features. He cites Sway and scdoc as examples of projects that have met their goals and now focus solely on stability and reliability.

Key Insight: Megacorps exploit their employees' idealism through good marketing while offering negligible autonomy and making workers complicit in corporate harm, when tech workers have abundant better alternatives.

DeVault argues forcefully against working for megacorporations like FAANG companies, contending that they don't care about individual employees and offer little meaningful autonomy or impact. He breaks down the power imbalance: employees represent a negligible fraction of revenue while facing NDAs, non-competes, and a legal system tilted toward wealth. Beyond personal risk, he argues employees become complicit in corporate harms including privacy violations, union busting, and exploitation of foreign labor. He concludes that tech workers have abundant alternatives and would likely be happier at smaller companies.

Key Insight: Building a programming language properly requires at least three compiler implementations — a sacrificial prototype, a clean bootstrap compiler, and a self-hosted final version — each stage refining both the design and the implementer's skills.

DeVault outlines a rigorous, multi-stage process for designing a new programming language from scratch. He advocates starting with pseudocode and idea circulation, then building a 'sacrificial' first compiler meant to be thrown away. The process progresses through writing a formal specification, building a cleaner second compiler (ideally in C), and finally a self-hosted third implementation in the language itself. He emphasizes that each stage builds expertise and refines the design, with the formal spec serving as a critical anchor throughout.

Key Insight: When a corporation abandons community-valued infrastructure, the open source community can fork and maintain it independently, free of corporate dependencies.

Drew DeVault announces godocs.io as a community-maintained replacement for the sunsetting godoc.org, which Google is replacing with pkg.go.dev. The team forked the original codebase and cleaned it up significantly, removing Google-specific code, analytics, and dead features while rewriting the search index for Postgres. They commit to ongoing maintenance for users who prefer the original godoc.org experience. A note acknowledges the original version of the post was rewritten to remove unnecessary hostility.

Key Insight: DeVault's work on proof-of-work registration and Gemini tools reflects his commitment to building internet infrastructure that respects user anonymity without sacrificing platform integrity.

Drew DeVault's December 2020 status update covers progress across several FOSS projects. The main focus was sourcehut's API 2.0 migration, with GraphQL APIs reaching feature parity for meta.sr.ht and git.sr.ht, plus a new OAuth 2.0 implementation. He also created mkproof, a proof-of-work tool to allow Tor signups on sourcehut without enabling spam. Additional updates cover Gemini protocol tools, the BARE specification's second IETF draft, and a minor scdoc release.

Key Insight: The Unix shell's composable pipeline model gives programmers creative freedom to solve complex, one-off problems on the fly — a skill that no IDE-driven workflow can replicate.

DeVault argues that shell literacy is one of the most important skills a programmer can develop, advocating for the Unix shell as an unmatched tool for commanding computers to perform complex tasks. He describes his workflow of using Vim and multiple terminals rather than feature-heavy IDEs, emphasizing the creative freedom that shell pipelines provide. Through a detailed walkthrough of restoring hundreds of deleted git files using a composed pipeline of git status, grep, awk, and xargs, he demonstrates how shell commands can solve problems that would be impractical to address manually. He shares additional examples of ad-hoc pipelines, including sorting shell history by complexity and transmitting files over the network, to illustrate the shell's versatility.

Key Insight: If web analytics wouldn't pass an ethics board's informed consent review, they have no business being deployed on users without their genuine, voluntary, and informed agreement.

DeVault argues that web analytics should be held to the same ethical standard of informed consent that governs research on human subjects in other fields. He outlines the three core elements of informed consent—disclosure, understanding, and voluntary agreement—and demonstrates that virtually no current web tracking practice meets any of them. He dismisses opt-out mechanisms, cookie pop-ups, and even newer 'pro-privacy' analytics tools as failing this standard. He welcomes GDPR enforcement as deserved comeuppance for an industry that has systematically exploited users, and warns that trying to find loopholes will not work because laws are interpreted by humans, not computers.

Key Insight: Making a sustainable living from FOSS requires either strategically targeting companies that invest in open source, or building a real business with engineering-minded pragmatism while rejecting venture capital culture.

DeVault shares practical advice on making a living from free and open-source software, drawing from his own experience running SourceHut. He divides the landscape into two paths: getting employed by companies that invest in FOSS, or building your own FOSS business. For employment, he offers a clever git log trick to identify companies contributing to projects you care about. For building a business, he warns against venture capital culture and emphasizes treating your project as a real business with sustainable revenue streams like SaaS hosting and consulting.

Key Insight: The internet desperately needs a fully open-source search engine with its own crawler, but building one requires pragmatic centralization and ethical funding — not ads, not decentralization theater.

DeVault argues that DuckDuckGo, despite its privacy reputation, fails on three counts: it's not open source, it's merely a frontend for Bing's results, and its search quality is poor. He proposes building a fully FOSS search engine with its own crawler, using a centralized but open-source model similar to SourceHut rather than attempting difficult decentralization. The design would use a tiered whitelist approach, crawling authoritative domains first and expanding outward. He envisions the software enabling domain-specific search engines and supporting alternative internet protocols. Unable to identify an ethical monetization model, he pledges to eventually fund it as a public benefit project through SourceHut revenue.

Key Insight: DeVault's status updates showcase his breadth — from protocol standardization to Gemini servers to writing a Wayland compositor as an obfuscated C joke — all unified by a commitment to minimal, dependency-free systems software.

This is Drew DeVault's November 2020 monthly status update covering several projects. He marks SourceHut's second anniversary as a public alpha, reports progress on his Gemini protocol server (gmnisrv) approaching 1.0, notes that his BARE message encoding format has been submitted as an IETF draft RFC, and caps it off with an obfuscated C program that implements a minimal Wayland compositor rendered in the terminal using braille Unicode characters.

Key Insight: Programmers should prioritize building maximally useful tools for professionals and invest in mentorship to bridge the learning curve, rather than sacrificing power for approachability.

DeVault argues that programmers are too focused on usability at the expense of utility when designing tools. He draws an analogy between professional tools in other fields—race cars, mechanic's toolsets—and programming tools, noting that professional-grade tools inherently require more skill. He contends that since programmers invest years learning their craft, spending extra time learning powerful but less intuitive tools is a worthwhile trade-off. The solution to steep learning curves isn't dumbing down tools, but fostering a culture of mentorship where senior engineers help juniors master more productive tooling.

Key Insight: The web's complexity is an unsolvable problem inherent to its design, so rather than trying to fix it, we should embrace fundamentally simpler alternatives like Gemini that deliberately resist the extensibility that doomed the web.

DeVault introduces the Gemini protocol as a simple, encrypted alternative to the web for exchanging hypertext documents. He argues that web browsers have become impossibly complex and that the web's problems are fundamentally unsolvable within its current framework. Rather than trying to create a 'sane subset' of web standards, Gemini offers a completely different medium that addresses a subset of the web's use cases far more effectively. He highlights Gemini's deliberate simplicity, resistance to extensibility, and strict separation of content from presentation as key virtues, and showcases several Gemini tools he has built in C and Go.

Key Insight: A healthy open source project is one that can thrive beyond its original creator, and a good maintainer knows when to step back and let capable successors lead.

Drew DeVault announces he is handing over maintenance of wlroots and sway to Simon Ser. He explains that he has accomplished everything he set out to do with Wayland and has been gradually reducing his involvement. Simon has been a key co-maintainer for years and also maintains Wayland and Weston. DeVault notes that Simon works full-time at SourceHut, ensuring continued project health.

Key Insight: Mozilla's institutional decay has made Firefox an embarrassment rather than a champion of the open web, and the web's runaway complexity means no alternative browser can arise, leaving abandonment as the only option.

DeVault argues that Firefox and Mozilla have gone from being the jewel of open source to its greatest embarrassment. He catalogs Mozilla's failures: mass layoffs of engineers while raising executive pay, adding ads, siding with Google on antitrust despite financial dependence, and killing projects like Rust and Servo. He concludes that Mozilla will not save the web, that the web itself is a lost cause due to its ever-expanding scope making new browsers impossible to build, and advocates moving to the Gemini protocol as a simpler alternative.

Key Insight: DeVault's prolific output across SourceHut infrastructure and Gemini protocol tooling reflects his commitment to building alternatives to corporate-controlled web platforms.

Drew DeVault shares his October 2020 progress update, covering work across several projects. He highlights major advances on SourceHut's GraphQL API 2.0, including database transaction support and a new async work processing library called dowork. He also details his deep dive into the Gemini protocol, having built a client, server, and HTTP-to-Gemini portal, plus a Gemini version of his blog. Additional updates include a Prometheus charting daemon and revival of the himitsu secret management project.

Key Insight: Good software engineering reduces to four principles — robustness, reliability, stability, and simplicity — where simplicity is the hardest to achieve and the most important because it enables the other three.

DeVault distills software engineering into four fundamental principles: robustness, reliability, stability, and simplicity. He defines each concisely — robustness means handling all known edge cases, reliability means working for extended periods without failure, stability means not changing in incompatible ways, and simplicity means minimizing moving parts. He emphasizes that simplicity serves the other three goals and that designing simple solutions is harder than designing complex ones.

Key Insight: Corporate gamification of open source contribution incentivizes spam and exploitation of maintainers rather than genuine community building.

Drew DeVault sharply criticizes DigitalOcean's Hacktoberfest event, calling it 'Spamtoberfest' and framing it as a corporate-sponsored DDoS attack on open source maintainers. He argues the event incentivizes low-effort spam pull requests that waste maintainers' time, while both DigitalOcean and GitHub deflect responsibility onto the very maintainers being harmed. DeVault contends that Hacktoberfest has never produced meaningful value for open source and exists solely as a marketing stunt. He advocates instead for structured mentorship programs like Google Summer of Code that actually develop software engineers.

Key Insight: Simple, obvious implementations that can never crash are superior to spec-lawyering optimizations that turn trivial character checks into segfault landmines.

DeVault recounts debugging a segfault in scdoc caused by passing a UCS-32 codepoint to glibc's isalnum function. He traces the crash through glibc's labyrinthine macro-heavy implementation, which uses lookup tables, thread-local storage, locale support, and pointer dereferences — any of which can segfault on out-of-range input. He contrasts this with musl libc's simple, three-function implementation that can never segfault regardless of input. While acknowledging his code violated the C spec, he argues that a character classification function should never crash a program.

Key Insight: The Gemini protocol offers an opportunity to replace the centralized certificate authority model with a simpler, SSH-style trust-on-first-use approach that puts control back in users' hands.

DeVault describes the trust-on-first-use (TOFU) algorithm he implemented for his Gemini protocol client, gmni. The post provides a detailed specification for how Gemini clients should handle certificate trust using a known_hosts file modeled after SSH. He walks through the verification steps, trust states (TRUSTED, UNTRUSTED, UNKNOWN, INVALID), and user prompts for each case. The post emphasizes that self-signed certificates are the norm in Gemini and that traditional certificate authorities should be deliberately excluded. He offers this as a recommendation for other Gemini client implementers to follow.

Key Insight: Federation is the only architecture that distributes both governance and cost without requiring technical sophistication from end users, but it will only succeed if the free software community champions it — corporations never will.

DeVault argues that federation represents the best architectural model for building internet-scale communication systems that resist centralization. He positions federation as a middle ground between centralized and peer-to-peer systems, enjoying the advantages of both while avoiding their drawbacks. Federated systems distribute governance and costs across many independent server operators, making them sustainable without corporate backing. He emphasizes that federation enables non-technical users to participate without the burden of running their own infrastructure, unlike P2P systems. DeVault concludes that the free software community must champion federation because corporations have no incentive to build systems that empower users over profits.

Key Insight: SourceHut development is transitioning from operational maintenance to active feature development, with GraphQL APIs and OAuth 2.0 as the primary focus areas for the upcoming beta.

Drew DeVault provides a brief September 2020 status update focused primarily on SourceHut development progress. After completing operations work, he shifted focus to software development, particularly GraphQL APIs and OAuth 2.0 support. He notes progress on writable GraphQL APIs and beta milestone tickets. He also mentions growing adoption of the BARE message encoding format across multiple programming languages.

Key Insight: The Linux kernel's development workflow — a vast graph of repositories, mailing lists, and maintainers with heterogeneous tools and policies — reveals the true meaning of distributed development that centralized platforms like GitHub cannot replicate.

DeVault argues that git's distributed nature is far more profound than the typical explanation given to newcomers. Using the Linux kernel as the definitive example, he traces how code flows through hundreds of repositories, mailing lists, maintainers, and bug trackers in a complex graph structure. The MAINTAINERS file alone is 19,000 lines long, representing a vast network of subsystems each with their own workflows, tools, and policies. He contends this organic, deeply distributed system demonstrates why GitHub-style pull requests cannot simply replace email-driven workflows at kernel scale.

Key Insight: GitHub's proprietary reimagining of git's decentralized collaboration tools was never about improving developer experience — it was about platform lock-in, and Microsoft is now leveraging that position to dismantle the open protocols git was built on.

DeVault argues that GitHub's design follows Microsoft's classic 'Embrace, Extend, Extinguish' strategy against open-source collaboration tools. GitHub embraced git but replaced its decentralized, email-based collaboration with proprietary pull requests, then Microsoft acquired it for $7.5 billion. He points to a Linux Foundation board member (who is also a Microsoft employee) calling email-based development a 'barrier to entry' as the 'extinguish' phase beginning. DeVault contrasts this with SourceHut's approach of improving the existing open ecosystem rather than replacing it.

Key Insight: Modern copyright law has been corrupted from a system that briefly rewards creators before enriching the public domain into a perpetual rent-seeking mechanism that benefits corporations long after every creator is dead.

DeVault argues that modern copyright law, particularly as extended through Disney's lobbying, has effectively stolen the public domain from the American public. Using Disney's Alice in Wonderland as a case study, he highlights the irony that Disney built its classic film on a public domain work but now prevents others from doing the same with their adaptation until 2046. He notes that nearly all creators of the film are dead, yet copyright persists for decades more. The original purpose of copyright—incentivizing creation with a short exclusivity period before enriching the public domain—has been perverted into a rent-seeking system that benefits corporations at the public's expense.

Key Insight: Engineering means recursively solving every problem that stands between you and your goal, no matter how far the chain extends beyond your original scope.

DeVault argues that software engineers should embrace the full chain of problems that arise when fixing a bug, rather than giving up when the scope expands beyond their immediate domain. He presents a scenario where a simple bug fix escalates through third-party code, unfamiliar languages, compiler internals, and language specifications. He contends that each escalation is itself a problem that engineering skills can solve. The post reframes 'yak shaving' not as a nuisance but as a necessary and legitimate part of engineering work.

Key Insight: A quiet month focused on essential but unglamorous infrastructure hardening for SourceHut, while the BARE encoding format gains early community traction.

Drew DeVault provides his August 2020 status update covering several ongoing projects. The BARE encoding format announced the previous month has gained traction with six language implementations. SourceHut received significant infrastructure improvements including a new server for hg.sr.ht and overhauled PostgreSQL backups. He defers Wayland news to Simon Ser's blog and teases a secret project he's been working on.

Key Insight: Web browsers have become so bloated with unnecessary APIs and corporate agendas that the only path forward is to freeze new features entirely and aggressively reduce scope.

DeVault declares the web effectively dead, arguing that browsers have expanded far beyond reasonable scope into obscene territory. He points to Google's self-serving proposals like AMP, Mozilla's mismanagement and layoffs, Microsoft's surrender, and Safari's irrelevance as evidence that no good steward of the open web remains. He calls for an immediate freeze on new browser APIs and demands that vendors start cutting features rather than adding them, refocusing on performance, security, and reliability within existing scope.

Key Insight: The most valuable open-source contributions come from solving your own problems, not from asking maintainers how you can help.

DeVault argues that the best way to contribute to open source is not to ask 'how can I help?' but to scratch your own itches. He contends that gratitude-driven contributions require more maintainer effort and rarely become recurring. Instead, contributors should be intrinsically motivated by bugs or missing features that personally affect them. He encourages spreading contributions across the entire FOSS ecosystem rather than concentrating on established projects.

Key Insight: Google's control over Go's ecosystem infrastructure prioritizes centralization and corporate convenience over the open, decentralized engineering principles that made Go good in the first place.

Drew DeVault argues that pkg.go.dev represents Google's corporate interests overriding good engineering principles in the Go ecosystem. He contends that Go's quality comes from its Bell Labs-influenced designers, not from Google's stewardship, and that pkg.go.dev exemplifies typical Google crapware. The site launched as closed-source, routes module fetches through a closed-source tracking proxy, and hard-codes a list of centralized git hosting services while ignoring the decentralized nature of git. DeVault sees the project as prioritizing a shiny product over sound engineering, adding to evidence that Google is harmful to Go's development.

Key Insight: Google's public anti-AGPL policy is not internal guidance but deliberate propaganda aimed at discouraging copyleft adoption so Google can freely exploit permissively-licensed open source without contributing back.

Drew DeVault argues that Google's public ban on AGPL software constitutes propaganda designed to discourage AGPL adoption across the industry. He contends that Google misrepresents the AGPL's obligations, claiming it would require releasing entire applications when in fact it only requires publishing modifications to the AGPL-licensed component itself. Google's motivation is to maintain a large pool of permissively-licensed open source software they can incorporate without giving anything back. DeVault urges developers not to be swayed by these misconceptions and to read the license themselves.

Key Insight: The BARE message format's rapid community adoption across five languages and CI integration for SourceHut mailing lists represent meaningful infrastructure progress in the open-source ecosystem.

Drew DeVault shares his July 2020 progress update, noting reduced output due to taking a week off. The highlights include the creation of the BARE message format, which quickly gained five community implementations in different languages. He also mentions new non-blog content on his site, including pages on static linking misconceptions and text editing videos. The main development news is the addition of continuous integration to SourceHut's mailing lists, enabled by the project hub.

Key Insight: Date and timezone handling in software is an unsolvable mess because timekeeping rules are shaped by politics, geography, and history — not logic.

DeVault constructs an increasingly absurd but technically plausible scenario to illustrate the nightmarish complexity of date, time, and timezone handling in software. Starting from a simple meeting scheduling request on March 2nd, 1943, he layers on daylight saving transitions, locale-dependent date formatting, emergency government timezone orders, and Native American reservation timezone rules. The post serves as a humorous cautionary tale for programmers who think datetime handling is straightforward. He caps it with a recommendation to read the IANA zoneinfo database changelog, itself a monument to timezone chaos.

Key Insight: Major commercial operating systems have shifted from serving users to serving vendors, creating a new category—vendor-purpose OS—where anti-features that extract profit actively degrade the user experience.

DeVault proposes a new category of operating system: the 'vendor-purpose OS.' He argues that historically, operating systems were either general-purpose (Unix, Linux) or special-purpose (FreeRTOS, Rockbox), defined by the problems they solve for users. However, Windows, macOS, Android, and iOS increasingly make design decisions that benefit the vendor at the expense of the user. These anti-features—ads, spyware, walled gardens, forced accounts, developer rackets—make the OS worse at both general and special purposes while optimizing for vendor profit.

Key Insight: The best message encoding format is the simplest one that resists complexity creep — BARE achieves minimal message sizes through a specification shorter than a blog post by deliberately refusing extensibility and self-description.

Drew DeVault introduces BARE (Binary Application Record Encoding), a new binary message encoding format he created to solve the problem of bulky stateless tokens and JSON messages. He explains the advantages of stateless tokens over stateful ones but notes their size penalty, then systematically evaluates existing binary formats (protobuf, Cap'n Proto, BSON, MessagePack, CBOR) and finds them all lacking. BARE is designed to be optimized for small messages, standardized with a specification shorter than the blog post itself, easy to implement, and deliberately resistant to extension creep. The format includes an optional schema language and was implemented for Go in a single weekend.

Key Insight: wlroots is maturing as a unified integration layer for the Linux graphics and input stack, while SourceHut's GraphQL migration signals a significant architectural evolution for the platform.

Drew DeVault provides his June 2020 status update covering three main projects. aerc, the terminal email client, shipped version 0.4.0 with contributions including a scrollable folder list and PGP improvements. wlroots continues its work as a unified multiplexer for Linux display and input subsystems via the Wayland protocol. SourceHut is gaining GraphQL API support and undergoing Alpine 3.12 infrastructure upgrades.

Key Insight: Client-side TLS certificates offer a theoretically superior alternative to OAuth for API authentication — cryptographically strong, stateless, and battle-tested — yet their universal neglect suggests that developer experience and tooling matter more than technical elegance.

DeVault explores why client-side TLS certificates never caught on as an alternative to OAuth for API authentication. After reading OAuth2 RFCs while working on SourceHut's API, he sketches a hypothetical protocol where API clients use certificate authorities and CSRs instead of OAuth's token-based flow. He enumerates numerous advantages — stateless authentication, battle-tested cryptography, built-in revocation, and scope management through intermediate CAs — but acknowledges a nagging suspicion that he's missing something. The post is ultimately a thought experiment he puts to readers rather than a proposal he intends to implement.

Key Insight: Open source projects benefit from a low-ceremony 'contrib' directory that gives community scripts a home without imposing maintenance obligations on core maintainers.

DeVault advocates for the 'contrib' directory convention in open source projects, a lightly-organized space for community-contributed scripts, configs, and tools that don't belong in the main codebase. These contributions receive minimal code review, no maintenance guarantees, and aren't wired into build systems or documentation. The pattern lets useful but niche tools live alongside the project without imposing maintenance burden on core maintainers. He illustrates the concept with examples from Sway's contrib folder, showing how it accommodates scripts in different languages, with varying quality levels, and for diverse use cases.

Key Insight: A productive month across DeVault's ecosystem shows mature Wayland projects settling into stability while SourceHut pushes boundaries with Plan 9 CI support and new APIs.

Drew DeVault provides his May 2020 status update covering progress across his major projects. The Wayland Protocol book has been made freely available under CC-BY-SA, while wlroots and Sway continue receiving steady bugfixes. On the email front, aerc gets incremental improvements and he's joined Simon Ser to work on Alps, a lightweight webmail client. SourceHut had a particularly productive month with Plan 9 CI support, a new GraphQL API for git.sr.ht, and the long-awaited project hub launch.

Key Insight: Software engineers have both the economic privilege to leave unethical employers and the moral obligation to do so, because their outsized productive power makes them directly complicit in the harms those companies cause.

Inspired by Tim Bray's resignation from Amazon, DeVault argues that software engineers are morally complicit in the harmful actions of their employers. He contends that tech workers enjoy exceptional job mobility and high salaries, which eliminates the excuse of being 'trapped' at unethical companies. He catalogs the sins of major tech companies — surveillance, labor exploitation, contempt for law and open standards — and argues that each employee's economic contribution directly enables these harms. The post warns that even well-intentioned engineers can be gradually co-opted through interesting technical work that serves harmful ends, and calls on developers to make deliberate moral choices about where they apply their enormous productive power.

Key Insight: Long-term data preservation is not a solved technical problem but an ongoing human commitment — hardware fails, software becomes obsolete, and ultimately future generations decide what survives.

DeVault provides a comprehensive guide to long-term data storage, covering storage media reliability, RAID redundancy, ZFS, off-site backups, and disaster recovery practices. He walks through the hierarchy of storage solutions from unreliable microSD cards to hard drives with RAID configurations, explaining parity mechanics along the way. He strongly recommends ZFS for its automatic handling of mirroring and parity, Borg backup for off-site redundancy, and monitoring tools like Prometheus for alerting. The post emphasizes that hardware solutions alone are insufficient — human error and existential threats require practiced disaster recovery procedures. He concludes philosophically: truly permanent storage is impossible because it depends on future generations maintaining, interpreting, and valuing the data.

Key Insight: A well-configured email client can serve as a complete git patch review environment, making the email-based development workflow fast and ergonomic.

DeVault walks through his personal aerc email client configuration for reviewing and merging git patches sent via email. He shares specific keybindings for applying patches with git am, pushing changes, and sending templated thank-you replies that include a push summary. The post is a brief, practical tutorial aimed at developers using the email-based patch workflow he advocates for.

Key Insight: DeVault's April 2020 update captures a prolific period of parallel progress across Wayland, SourceHut's API redesign, and the earliest public teases of what would become the Hare programming language.

Drew DeVault gives his April 2020 monthly status update while reflecting briefly on the isolation of lockdown life. He reports progress on his Wayland book (input chapter finished), continued improvements to wlroots and Sway, and significant SourceHut work including hub.sr.ht and an experimental GraphQL API to replace the REST design. He also teases his 'secret project' — what would become the Hare programming language — with a code snippet showing manual memory management and C-like syntax.

Key Insight: Deep understanding of git's internals enables a minimalist branchless workflow where rebase replaces branching as the primary organizational tool, trading conventional best practices for reduced overhead and guaranteed cross-feature compatibility.

Drew DeVault describes his unconventional git workflow where he rarely uses branches, instead working directly on his local master branch for all tasks simultaneously. He intermixes commits from different workstreams on master, then uses git rebase to organize them into clean, self-contained patchsets when ready to submit upstream. This approach eliminates context-switching overhead and ensures all in-progress features are mutually compatible. He acknowledges branches are useful for large, long-running workstreams prone to conflicts, but finds his branchless approach faster for typical day-to-day work.

Key Insight: The same principles that drive free software advocacy — repairability, user autonomy, and rejection of proprietary lock-in — apply equally to choosing and maintaining a vehicle.

DeVault describes buying a 1984 Dodge D250 truck to avoid the proprietary computerized components of modern vehicles, then documents designing and 3D printing a replacement plastic part using solvespace CAD software. He chose an older truck as a functional tool, prioritizing repairability and simplicity over creature comforts. The post walks through his iterative design process of measuring the broken part, printing prototypes, and refining the fit. He shares the CAD files in a public SourceHut repository, treating even his truck repairs as open-source projects.

Key Insight: The unchecked growth of web standards has made browsers so complex that no new competitor can emerge, creating an unaccountable duopoly that serves corporate interests over users.

DeVault argues that web browsers have grown so complex through perpetual feature competition that it is now impossible to build a new one from scratch. He quantifies this by showing the W3C specification catalogue totals 114 million words, exceeding the combined word counts of major computing standards, all published RFCs, and the longest novels ever written. This complexity makes browsers expensive to run, riddled with security vulnerabilities, and impossible to fork or compete with. The resulting browser duopoly allows Google and Mozilla to act against users' interests with tracking, ads, and anti-technologies like DRM. He concludes that browser competition should have focused on performance and stability rather than endless new features.

Key Insight: GitHub's notifications redesign sacrifices the efficient, scannable workflow of power users for visual polish and real-time gimmicks, exemplifying how large platforms routinely ship regressions they'll never reverse.

DeVault critiques GitHub's new notifications UI as a regression in usability compared to the old design. He walks through his daily workflow of triaging notifications and shows how the new interface breaks efficient scanning patterns: notifications are no longer grouped by repository, action buttons are hidden until hover, and real-time updates cause items to disappear unpredictably. He argues the redesign prioritizes visual polish over the muscle-memory-driven efficiency that power users depend on. He concludes pessimistically that negative feedback rarely reverses these rollouts because team pride prevents course correction.

Key Insight: Banning end-to-end encryption is mathematically futile, strategically counterproductive to national security, and morally reprehensible when disguised as child protection.

Drew DeVault writes an open letter to Senator Bob Casey opposing the EARN IT Act, arguing it amounts to a ban on end-to-end encryption disguised as child protection legislation. He explains that the mathematics of strong encryption are unbreakable and publicly known, making any ban futile. He argues that the same encryption protecting criminals also protects journalists, activists, and national security. He concludes that good police work, not weakened encryption, is the proper tool for catching criminals, and that the right to private communication is fundamental to democracy.

Key Insight: Every programming language exists as a small bubble of influence within C's vast dominance, and the boundary where they interface — the 'abiopause' — is inherently turbulent and unpleasant for programmers on both sides.

DeVault draws an extended analogy between the solar system's heliopause and what he calls the 'abiopause' — the turbulent boundary where programming languages interface with C's dominant ABI. He explains how the heliosphere represents the zone of the sun's influence, bounded by the interstellar medium, then maps this onto how every programming language exists as a bubble within a vast sea of C code. The post argues that C's unmatched influence on foundational software forces every other language to maintain a C FFI, creating an awkward boundary layer. He acknowledges the interface is unpleasant for both C enthusiasts and users of other languages, and admits he doesn't know how to fix it.

Key Insight: Optimization is only engineering when it's driven by measurement and system-level understanding, not assumptions — and this demands transparency from library authors and ownership from application developers alike.

DeVault argues that effective performance optimization requires deep understanding of the entire system, not just surface-level code changes. He advocates applying the scientific method to performance work: forming hypotheses, measuring with factual evidence, and only then acting on conclusions. The post criticizes developers who optimize based on assumptions rather than identifying actual bottlenecks. He extends this principle to the relationship between library authors and application programmers, arguing that libraries should be transparent rather than opaque, and that application developers must take responsibility for understanding their entire dependency stack. The core message is that optimization without understanding is wasted effort.

Key Insight: The laptop industry has regressed on the things that actually matter — repairability, open firmware, and upstream driver support — while improving only on superficial specs like battery life and video performance.

DeVault argues that the ThinkPad X200 from 2008 remains the best laptop ever made due to its full Linux support, repairability, and open firmware compatibility. While acknowledging its weak battery life and inability to handle 1080p video, he contends that every modern laptop alternative fails in fundamental ways. He surveys the 2020 laptop market and finds nothing acceptable: Dell's firmware is broken, System76 and Purism are overpriced, Pine64 requires nonfree blobs, and others are perpetually out of stock. The post is a frustrated call for the industry to produce a laptop at least as good as the 12-year-old one he's stuck with.

Key Insight: DeVault's monthly update showcases steady, community-driven progress across the Wayland, email, and SourceHut ecosystems while hinting at an ambitious secret project that would demand patience from supporters.

Drew DeVault's February 2020 status update covers progress across his free software projects following FOSDEM. Sway 1.4 and wlroots 0.10.0 were released along with related Wayland tools. The email client aerc gained contextual configuration options, while SourceHut achieved full WCAG accessibility compliance and added file attachments for git tags. He teases a new secret project he's keeping under wraps until he knows it will pan out, which would later turn out to be the Hare programming language.

Key Insight: Open-source sustainability isn't a tooling or funding problem — it's a relationship problem caused by developers treating dependencies as interchangeable black boxes instead of engaging with the humans behind them.

DeVault reflects on a FOSDEM talk by Microsoft/GitHub representatives about open-source sustainability, challenging their fundamental premise. Rather than asking how to manage thousands of dependencies, he argues developers should question why they have thousands of dependencies at all. He contends that maintaining personal relationships with dependency maintainers is the real solution to sustainability crises like left-pad, event-stream, and heartbleed. The post advocates for treating open-source as a community of human relationships rather than a supply chain of black-box components.

Key Insight: Extreme hardware constraints forced elegant engineering decisions — self-modifying code, bit-level filesystem design, and ruthless memory optimization — that produced a system whose efficiency shames modern software running on hardware thousands of times more powerful.

DeVault reflects on KnightOS, an operating system he started writing about 10 years ago for Texas Instruments z80 calculators. The system overcame severe hardware constraints — 64 KiB RAM, 512 KiB to 4 MiB NOR Flash storage, no MMU — to deliver a Unix-like environment with preemptive multitasking, a custom filesystem, and networking. Written entirely in handwritten z80 assembly (~50,000 lines) with a custom-built compiler toolchain, the kernel fit in under 16 KiB and stored all state in 1024 bytes. He details the clever engineering required, including self-modifying code for Flash operations and a filesystem designed around NOR Flash's bit-reset constraints. The post closes with a pointed comparison to modern devices that are orders of magnitude more powerful yet can't match KnightOS's boot speed or battery life.

Key Insight: Full-time FOSS work is simultaneously the most fulfilling and most overwhelming experience possible — the freedom to write your own code on your own terms comes at the cost of anonymity, personal health, and an ever-growing mountain of responsibilities.

DeVault reflects on his first year working full-time on self-directed free software projects, presenting an honest account of both the rewards and costs. He describes the fulfillment of working on his life's passions with greater depth and breadth, but also the overwhelming volume of work, the loss of anonymity, and the toll on his personal life. He discusses the mixed effects of minor fame — from genuine praise to hostile strangers to bizarre unsolicited messages — and the difficulty of never entering a community as an unknown. Despite unhealthy coping mechanisms and an endless task list, he concludes that writing his own code on his own terms is the most rewarding work he's ever done.

Key Insight: Open source project governance works best when it's built on trust in people rather than trust in rules, because social systems cannot be reduced to executable scripts.

DeVault argues that the BDFL (Benevolent Dictator for Life) model is the most effective governance structure for open source projects. He starts from axioms about social systems: that objective rules cannot be programmed into them, and that leadership will ultimately do what they want regardless of formal rules. He critiques Codes of Conduct as attempts to reduce subjective social matters into objective rules, arguing they create exploitable loopholes and paths to power for bad actors. His alternative is simple: leaders should act on their values, delegate to trusted people, and contributors should evaluate whether leadership values align with their own — forking if they don't.

Key Insight: DeVault's January 2020 update showcases a prolific open-source ecosystem spanning Wayland compositors, developer infrastructure, security tools, and shell implementations, all advancing incrementally through collaborative free software development.

Drew DeVault provides his January 2020 status update covering progress across multiple projects. Sway 1.3 is nearing release with VNC support, while the Sedna project will serve as a proving ground for a new wlroots scene graph API. SourceHut has received significant performance improvements and new public monitoring infrastructure. He's also working on himitsu (a secret store), imrsh (an interactive POSIX shell), and teases an unnamed secret project.

Key Insight: The software industry's relentless accumulation of abstraction has made computers thousands of times faster yet barely more useful, and most programmers remain unaware of — or indifferent to — the hidden complexity their tools impose.

DeVault follows up on his controversial 'Hello world' article, which compared syscall counts across programming languages and was widely misinterpreted as a benchmark. He clarifies that the assembly baseline was an idealized thought experiment, not a standard, and that runtime measurements were included to show they round to zero — not to rank languages. His actual point was about the relentless accumulation of complexity in software: programmers pile abstraction upon abstraction with no regard for consequences, resulting in bloated applications that squander hardware improvements. He argues most programmers aren't even aware of how much hidden work their tools perform, and hopes the surprising numbers would spark curiosity rather than defensiveness.

Key Insight: Even the simplest program reveals the enormous hidden cost of language runtimes and abstractions, and developers should be conscious of this compounding overhead.

DeVault benchmarks how many syscalls and how much disk space various programming languages require to print 'hello world', using this as a proxy for unnecessary complexity. He establishes that the ideal program needs only two syscalls (write and exit) and measures how far each language deviates from this baseline. The results range from hand-written assembly at 2 syscalls and 8.6 KiB to interpreted languages requiring hundreds of syscalls and megabytes of runtime. The post argues that this bloat represents real costs: slower startup, harder debugging, and wasted disk space that compounds as abstractions layer on top of each other.

Key Insight: Managing dotfiles doesn't require specialized tools — a git repository with a wildcard .gitignore and Unix conventions for per-host customization is simpler and more composable.

DeVault explains his approach to managing dotfiles by making his entire home directory a git repository, rather than using specialized tools like GNU stow. The trick is a one-byte .gitignore file containing just '*', which ignores everything by default and requires explicit git add -f to track specific files. He extends this with per-host customization using hostname-based PATH directories and config includes. The approach leverages familiar Unix primitives and git knowledge rather than requiring specialized tooling.

Key Insight: The PinePhone represents the hardware breakthrough the free software community needed — affordable, blob-free, and Linux-compatible — and the community is already rising to build the software stack it requires.

Drew DeVault reviews the PinePhone developer edition, expressing intense excitement about a phone with hardware compatible with upstream Linux drivers and zero blobs. He acknowledges the software is nowhere near ready for daily use — phone calls, SMS, and LTE all require hacks or don't fully work — but argues the right people from the postmarketOS, KDE, and kernel hacking communities are actively building the necessary software. He describes his own work on a mobile Wayland compositor based on Sway and various shell components. The review concludes that this is the phone the free software community has been waiting for: affordable hardware that the community can actually build a fully open mobile OS around.

Key Insight: DeVault's projects consistently aim to give users direct control over their computing — from credential management that keeps secrets out of application code, to mobile interfaces built on open compositor technology, to community-driven email clients.

Drew DeVault's December 2019 status update covers several concurrent projects. He introduced himitsu, a Plan 9-inspired secure key-value store for passwords and keys. He reports progress on SourceHut's single sign-on system and the upcoming DNS registration service names.sr.ht. He received a PinePhone and began developing 'Sway Mobile' with touch-friendly components. He also notes progress on aerc 0.3.0, the Wayland book, and a new compositor called sedna.

Key Insight: Software distribution should be a social contract between developers who publish source and distribution volunteers who package, audit, and deliver it — bypassing this system erodes trust and quality.

DeVault argues that Linux software developers should not try to package their software for every distribution, but instead should simply release source tarballs and let distributions handle packaging. He contends that distributions exist precisely for this purpose and that their volunteer packagers ensure software conforms to system conventions, is audited for anti-features, and is free of malware. He contrasts the trustworthiness of managed repositories like Debian and Alpine with unmanaged ones like PyPI and npm, which are constant sources of malware. The post dismisses complaints about slow distro update cycles as a feature serving different audiences, and calls software distribution a social system that works.

Key Insight: The non-profit status of internet governance organizations is both what makes the .org sale corrupt and what gives the public legal tools to stop it.

DeVault calls for direct legal action against ICANN, ISOC, and PIR for selling the .org registry to private interests, arguing the transaction is illegal under non-profit law. He contends that appeals to reason are futile since the organizations knew their actions were wrong from the start. He provides concrete steps readers can take: writing to the California and Virginia attorneys general and filing IRS Form 13909 to challenge the organizations' tax-exempt status. He frames the sale as self-dealing by non-profit insiders and provides pre-filled legal forms to lower the barrier to action.

Key Insight: Making existing code unidiomatic without breaking it is a subtle but deeply damaging form of trauma that fragments ecosystems and accelerates code rot.

DeVault argues that software communities suffer two types of traumatic changes: 'strong' trauma that breaks existing code, and 'weak' trauma that makes existing code unidiomatic. He examines Python 3's migration as strong trauma and asyncio's introduction as weak trauma, noting that asyncio has effectively made vast swaths of the Python ecosystem obsolete without technically breaking anything. The weak form is more insidious because it creates a slow-burning rift between old and new code. He warns that similar trauma could befall Go if generics are added carelessly, urging language designers to minimize community impact when introducing major features.

Key Insight: Western economic entanglement with China serves only the wealthy while enabling genocide, and the international community has a moral obligation to impose consequences before Hong Kong's protesters are killed.

DeVault argues that the United States and the international community should sever economic ties with China over its human rights abuses, including organ harvesting from political prisoners, the mass internment of Uighurs, and the violent suppression of Hong Kong's autonomy. He contends that trade with China primarily benefits the wealthy while harming ordinary Americans, making the economic cost of a boycott manageable. He draws explicit parallels to Nazi Germany and calls for an international ultimatum against China's use of deadly force in Hong Kong.

Key Insight: DeVault's VR compositor work exemplifies his philosophy of replacing proprietary dependencies with open-source alternatives, moving from SteamVR to OpenXR/Monado while contributing improvements across the entire open graphics stack.

Drew DeVault's November 2019 status update celebrates the one-year anniversary of SourceHut's public alpha. The bulk of the update covers VR compositor work, where he and Simon Ser built wxrc, a lightweight Wayland XR Compositor based on open standards (OpenXR via Monado) rather than proprietary SteamVR. He also previews the upcoming Sway release with VNC support and input latency improvements, notes community-driven progress on aerc and ctools, and mentions writing new Wayland book chapters.

Key Insight: Modern terminal emulators are simulations of physical devices, and rebuilding a real teletypewriter from commodity hardware reveals the deep backwards-compatibility baked into Unix's design.

DeVault documents his project to turn a dot matrix line printer into a functioning TTY-style shell interface, purely for hack value and computing nostalgia. He wrote glue code in Go that connects a pseudo-terminal running /bin/sh to an Epson LX-350 printer via USB, creating an experience resembling the original teletypewriters that gave Unix terminals their name. The post walks through the technical details of pty setup, Epson escape sequences for paper feed control, and the goroutine-based timing logic that manages spooling paper in and out for readability. He frames the project as a window into what early Unix development actually looked like.

Key Insight: SourceHut is maturing from a collection of independent services into an integrated development platform, while also beginning to fulfill its mission of financially sustaining free software developers.

Drew DeVault's October 2019 status update covers progress across his many free software projects. The centerpiece is SourceHut's evolution toward integrating its services, particularly enabling email-backed code review through git.sr.ht and lists.sr.ht interoperability. He announces Simon Ser joining SourceHut to work on self-directed free software projects, funded by SourceHut's profits. The update also covers sway/wlroots improvements targeting 1ms input latency, contributions to the Monado OpenXR runtime, progress on the Wayland book, and various smaller projects.

Key Insight: Release engineering is an endless arms race against human error, where every automated safeguard you add only reveals the next creative way you'll manage to screw things up.

DeVault catalogs his long history of botching software releases and the incremental automation he built to prevent each class of mistake. Starting from fully manual releases, he describes a parade of failures — wrong version numbers, bad changelogs, forgotten version bumps, missing scripts, incompatible toolchains, releasing from feature branches, and pushing stale tags. Each mistake led to a new safeguard in his semver script, but each fix only revealed the next creative way to screw up. The post is a honest, self-deprecating chronicle of how release engineering is an endless arms race against human error.

Key Insight: Companies deserve credit not for fixing problems when publicly shamed, but for implementing systemic changes that prevent all customers from suffering the same failures.

Drew DeVault follows up on his earlier scathing review of RaptorCS's POWER9 Blackbird PC, reporting that after his article frontpaged on Hacker News, Raptor reached out, diagnosed multiple hardware defects, and replaced both the CPU and mainboard. He now has a working machine and is impressed with its performance. However, he refused to publish a positive follow-up until Raptor also fixed their systemic support problems for all customers, which they did by implementing a self-service RMA system and other improvements. He details the spectacular failures of the original board, which a Raptor staff member called the most broken board they'd ever seen.

Key Insight: Implementing DRM in free software — even when it doesn't directly restrict users — is a betrayal of the free software community because it enables the very corporate actors working to undermine user freedom.

DeVault argues that Collabora added HDCP (Digital Restrictions Management) support to the Weston Wayland compositor purely for financial reasons, despite their blog post claiming it benefits users. He contends that DRM is universally understood to be technically ineffective, yet causes real harm by restricting user freedoms and enabling media companies to abuse consumers. He draws a parallel to Mozilla adding DRM to Firefox in 2014, which failed to halt Chrome's rise. DeVault calls on engineers to refuse unethical directives and urges Collabora to revert the changes.

Key Insight: Even hardware vendors aligned with free software ideals can fail their customers through poor support processes, but public accountability and willingness to improve can redeem the relationship.

DeVault documents his frustrating experience purchasing a RaptorCS POWER9 Blackbird system, detailing months of hardware failures and unresponsive support. The $2,500+ investment arrived without ordered RAM, boot-looped due to apparent hardware defects, and support tickets went unanswered for weeks at a time. After publishing this scathing review, RaptorCS reached out, apologized, identified a faulty CPU, shipped a replacement, and implemented new support mechanisms including a self-service RMA system. The post was later retitled and followed up with a positive review once the machine was working.

Key Insight: Winning people to free software ideals requires meeting them where they are linguistically rather than alienating potential allies with pedantic corrections that prioritize tribal signaling over movement growth.

DeVault argues that the Free Software Foundation's pedantic insistence on terminology — correcting 'open source' to 'free software,' 'Linux' to 'GNU/Linux,' etc. — alienates potential allies who already agree with the underlying ideas. He contends that the FSF's linguistic pedantry pushes people away from the movement rather than growing it, and that the crucial distinction is really about copyleft, not the free/open-source label. He advocates using whatever terms the audience already knows while preaching free software ideals, focusing energy on systemic goals like open-source in education and right to repair rather than policing vocabulary.

Key Insight: A constellation of small, focused free software projects — a shell, coreutils, a compiler, a compositor — are quietly converging toward the simple, elegant operating system DeVault believes computers were always meant to run.

Drew DeVault recaps a busy month of travel across Japan, Hawaii, and Seattle while maintaining steady progress on multiple free software projects. The Wayland book passed the halfway mark and sway 1.2 was released, with its light feature set signaling maturity. He highlights progress on aerc email client, mrsh shell, and a new ctools project aiming for full POSIX compliance. These projects collectively work toward his vision of a simple, elegant operating system, tracked at arewesimpleyet.org. SourceHut crossed 10,000 users and gained new features including anonymous ticket creation via email.

Key Insight: Pragmatic language selection requires broad familiarity with many tools and honest assessment of their tradeoffs, not loyalty to any single ecosystem.

DeVault surveys programming languages he's familiar with, offering blunt assessments of each language's strengths and weaknesses for different use cases. He advocates for knowing enough about many languages to make informed decisions about which tool fits a given problem. His preferred languages include C, Go, Python, and POSIX shell, while he reserves particular contempt for C++, PHP, and Ruby. The post ends with deliberately provocative dismissals of languages he considers irredeemable, making no attempt at diplomatic balance.

Key Insight: OpenSSH's authorized_keys command option and AuthorizedKeysCommand directive provide powerful hooks for building custom interactive SSH applications with fine-grained authentication control.

DeVault walks through how to build interactive SSH applications, explaining the three points where OpenSSH can be customized: authentication, shell session, and command execution. He covers techniques from simple login shell overrides to authorized_keys command options to the AuthorizedKeysCommand directive in sshd_config, which allows dynamic, programmatic authentication. He then shows how builds.sr.ht uses these mechanisms to provide interactive shell access to CI build VMs, including authentication against SourceHut's user database and both connect and tail modes.

Key Insight: Interactive SSH access to CI build environments transforms a CI platform from a passive build runner into an on-demand multi-OS development shell.

Drew DeVault announces SSH shell access for builds.sr.ht, SourceHut's CI platform. Users can now SSH into failed build environments to debug issues, or request persistent shells on fresh VMs running various operating systems. The feature keeps VMs alive for 10 minutes after failure or until the user logs out, and can be enabled for any build via a simple manifest option. He highlights use cases like debugging failed builds, testing on different OSes like OpenBSD or NetBSD, and scripting custom environments via the builds.sr.ht API.

Key Insight: DeVault's projects are converging on a vision of fully free software infrastructure — from email clients guided by kernel maintainer workflows, to a complete open-source VR stack built on Wayland.

Drew DeVault shares his August 2019 progress update from Osaka, Japan, covering developments across his major projects. SourceHut gained SSH access to build environments for debugging failed builds. aerc 0.2.0 was released with nearly 200 changes from 34 contributors, adding maildir support, search, and filtering. Sway 1.2-rc1 brought features from i3 4.17, and his DRM leasing work achieved VR functionality with SteamVR on Wayland. He also notes progress on his Wayland book, now about half complete.

Key Insight: Bringing VR to Wayland required threading a new capability through every layer of the Linux graphics stack, but the result is a cleaner and simpler design than the equivalent X11 approach.

DeVault documents the technical work required to bring VR support to Wayland through DRM leasing, a mechanism that lets the Wayland compositor hand off direct display control to VR applications for minimal latency. The work involved drafting a Wayland protocol extension, implementing it in wlroots/sway, creating a new Vulkan extension and its Mesa implementation, and adding Xwayland compatibility. The project was sponsored by Status.im as part of building a Wayland-driven VR workspace. Each layer of the stack required careful design decisions around security, backwards compatibility with X11, and keeping the protocol simple rather than accommodating legacy systems.

Key Insight: A FOSS maintainer's most important job is not writing code but developing contributors into self-sufficient roles and gradually delegating leadership until the project no longer depends on any single person.

DeVault outlines how FOSS maintainers should actively guide contributors into roles that suit their skills and interests, similar to corporate advancement tracks. He describes the process of observing contributors' strengths, encouraging them to branch out into new tasks like code review, and fostering collaboration across modules. The ultimate goal is to gradually delegate maintainer responsibilities so the project can scale beyond any single person. He reserves conflict resolution for himself, using his position to absorb blame and preserve relationships between contributors.

Key Insight: Sustainable full-time free software work is achievable through community funding, and the breadth of output — from email clients to VR protocols to community infrastructure — demonstrates what that model can produce.

Drew DeVault announces he has broken even on doing free software full-time, thanks to donations and paid SourceHut accounts. He provides a wide-ranging status update covering aerc email client progress, Wayland VR support via DRM leasing, SourceHut developments including Alpine Linux's migration to lists.sr.ht, and his ongoing Wayland book. The post serves as both a milestone celebration and a detailed accounting of what supporter funding has produced across multiple projects.

Key Insight: By designing code annotations as a generic, user-driven system rather than a platform-controlled feature, SourceHut sidesteps the scaling bottleneck that prevents platforms like GitHub from supporting smaller languages and niche use cases.

DeVault announces code annotations for SourceHut, a feature that lets users decorate source code with arbitrary links and markdown generated during CI. Rather than building a closed system, he designed a generic JSON-based format that anyone can generate annotators for, deliberately avoiding GitHub's approach of gatekeeping language support. He details writing custom annotators for C (requiring a near-complete C11 parser to handle GCC extensions) and Go (leveraging Go's excellent standard library AST tools), contrasting the difficulty of each. The post emphasizes SourceHut's philosophy of empowering users to build their own integrations rather than depending on platform maintainers to scale.

Key Insight: The features modern chat platforms tout as advantages actually create the very problems their users complain about, while IRC's constraints foster a healthier, more accessible, and more sustainable communication culture.

DeVault argues that IRC's lack of modern features like embedded images, rich text, threaded messages, and infinite backlog is actually a strength, not a weakness. He contends that these limitations establish a shared baseline that serves users on old hardware, niche operating systems, and accessibility tools. Adding features non-uniformly degrades the experience for users whose clients don't support them, while the constraints naturally foster healthier communication culture. He notes that Slack users' top complaints—distraction, catching-up pressure, unwieldy threads—are caused by the very features IRC lacks. DeVault concludes that IRC's decentralized, volunteer-run, non-monetized nature and its 30+ year longevity make it superior to newer alternatives.

Key Insight: DeVault's prolific output across decentralized blogging tools, email clients, Wayland compositors, and SourceHut illustrates his vision of building an entire free software ecosystem as alternatives to centralized platforms.

Drew DeVault's June 2019 status update covers progress across his many free software projects. He introduces openring, a tool for bloggers to cross-promote via RSS without centralized platforms, and mentions his $20 offer to encourage new bloggers. He celebrates the aerc email client's initial release and its growing community, updates on sway/wlroots including VR support plans, and reports SourceHut milestones like todo.sr.ht gaining an API. The post reflects his productivity and satisfaction working on FOSS full-time.

Key Insight: The GPL's restrictions don't limit freedom—they defend it against a capitalist system that incentivizes exploitation of collective labor.

DeVault traces his personal evolution from preferring the MIT license to embracing the GPL. He initially viewed copyleft as less free, and technically still does, but now sees that restriction as necessary and good. His daily immersion in Linux revealed how transformative it is when all software guarantees the four freedoms—reading source, contacting authors, fixing bugs, and sending patches became second nature. He argues that while the MIT license offers maximum theoretical freedom, the GPL is needed because capitalism incentivizes exploitation of free software labor. The GPL simply encodes the Golden Rule: reciprocate the freedoms you receive.

Key Insight: An embedded terminal emulator transforms an email client from a single-purpose tool into a composable development environment where patch review, version control, and communication converge.

Drew DeVault announces the first pre-release of aerc, a terminal-based email client he's been developing. The project's pace accelerated after he began working on free software full time, funded by donations. aerc differentiates itself from mutt with vim-like keybindings, more reliable networking, and an embedded terminal emulator that allows multitasking within the client. He outlines future plans including version control integration, calendar support, and additional email backends.

Key Insight: GitHub redefined 'fork' from a dramatic project schism into a routine platform feature, subtly centralizing a tool that was designed to be distributed.

Drew DeVault argues that GitHub co-opted the term 'fork' from its original meaning to serve its centralized platform model. Originally, a fork meant a traumatic schism where contributors permanently split a project, while what GitHub calls a 'fork' is really just a personal branch for staging changes. He contrasts GitHub's cathedral model of centralized governance with the bazaar model that git was designed for, where distributed repositories flow changes between each other organically, as exemplified by the Linux kernel's development. DeVault contends that GitHub's design deliberately centralizes what should be a distributed workflow to keep users on their platform. He acknowledges GitHub's role in popularizing open source but urges developers to understand how the platform's design choices shape their workflows.

Key Insight: Bridging email-based and web-based development workflows can make both camps more productive without forcing either to abandon their preferred tools.

Drew DeVault's May 2019 status update highlights progress across his open source projects, with email-related developments taking center stage. The major announcement is web-based patch review tools for lists.sr.ht that bridge email-based and web-based code review workflows. He also covers aerc2 gaining email composition, sway 1.1 release candidates, a new Wayland protocol book in progress, and educational git websites. The update reflects a period of high productivity enabled by full-time open source work funded by supporters.

Key Insight: The email-based development workflow needs better documentation and tooling on the maintainer side to gain wider adoption.

DeVault announces a webcast demonstrating the maintainer side of email-based patch review for git and mercurial. He notes that while git-send-email.io covers the contributor workflow, the maintainer perspective is underserved. The video shows him reviewing sourcehut patches and participating in discussions using mutt. He also plugs aerc, his own email client project designed as a mutt replacement.

Key Insight: VC-backed platforms like Patreon will inevitably adjust fee structures to maximize profit, making income diversification essential for creators who depend on donations.

Drew DeVault provides an updated fee calculator for Patreon's May 2019 fee model changes, helping creators and supporters understand how their money moves through the platform. He explains the different fee structures for founding creators versus new creators, the impact of charge-up-front options, and the various plan tiers. He raises pointed questions about Patreon's shift from batched to per-creator payment processing fees and where the extra money might be going. The post reflects his broader skepticism of VC-backed platforms controlling donation flows.

Key Insight: Wayland's compositional architecture enables Plan 9-style nested window management that was fundamentally impossible under X11, vindicating its conservative redesign.

Drew DeVault announces Wio, a Wayland compositor inspired by Plan 9's Rio desktop environment, built on wlroots. Each application runs in its own nested Wayland compositor using Cage, enabling Rio's distinctive window-within-window behavior. He argues this demonstrates how Wayland's conservative design enables use-cases impossible on X11. The project adds modern features like multihead and HiDPI support while remaining incomplete on Rio compatibility, and he invites contributors to help.

Key Insight: Coding style debates are a waste of energy — the only rule that matters is to follow whatever convention is already established for the language or project you're working in.

DeVault argues that coding style debates are a waste of time and the only principle that matters is conformity to existing conventions. Use whatever is standard for the language you're working in, and when contributing to someone else's project, follow their style without complaint. The post mocks the passion people bring to tabs-vs-spaces debates while acknowledging personal preferences are irrelevant to the principle. He makes one exception to rant about aligned-to-opening-paren function parameter formatting, which he considers genuinely bad. The core message is pragmatic: pick the most common style, enforce it consistently, and stop arguing about it.

Key Insight: The modular design of wlroots enables creative compositions of small tools like Cage and RDP backends to produce surprisingly seamless experiences that weren't explicitly designed for.

DeVault demonstrates a creative hack combining Cage, a new kiosk-mode Wayland compositor, with wlroots' RDP backend to create a seamless remote desktop experience. He shows how running Cage on a laptop with FreeRDP connecting to a remote sway session on a desktop produces an experience nearly identical to running sway locally. The post serves as both a congratulations to Cage creator Jente Hidskes and a practical demonstration of the composability of wlroots-based tools. DeVault acknowledges this isn't true network transparency but highlights it as a cool demonstration of what's possible with the Wayland ecosystem.

Key Insight: A VPN doesn't eliminate surveillance — it merely lets you choose who surveils you, making the choice of provider a grave decision most users aren't equipped to make.

DeVault argues that the growing trend of VPN companies marketing to the general public is exploitative, as using a VPN merely shifts trust from your ISP to the VPN provider without guaranteeing privacy. He warns that push-button VPN services pre-installed in browsers and hardware are especially dangerous because they make it trivially easy to route all traffic through an entity users know nothing about. The post emphasizes that users must rigorously vet any VPN provider's jurisdiction, funding model, and security competence before trusting them. DeVault recommends HTTPS as often sufficient, Tor as the ironclad solution, and self-hosted VPNs via Wireguard or OpenVPN as alternatives to commercial VPN services.

Key Insight: SourceHut differentiates itself by embracing version control diversity and community-driven development, offering Mercurial users a fully free, feature-complete platform where none previously existed.

Drew DeVault announces that SourceHut now offers full first-class Mercurial support, on par with its existing git offering. The integration includes CI support, email-driven collaboration, and is fully open source and self-hostable. The work was largely driven by community contributor Ludovic Chabant and tested against major repositories like mozilla-central and NetBSD src. DeVault positions SourceHut as filling a gap in the Mercurial ecosystem and signals openness to supporting other version control systems.

Key Insight: DeVault's prolific output across email clients, mailing list infrastructure, Wayland compositors, game engine backends, livestreaming, and compiler toolchains reflects a consistent mission to replace proprietary platforms with free software alternatives built from the ground up.

Drew DeVault's April 2019 status update covers progress across his many projects, with aerc2 (a terminal email client) as the highlight. The email client now supports reading emails with embedded terminal emulation, configurable vim-style keybindings, and rendering HTML email through TUI browsers. He also launched git-send-email.io to teach email-based git workflows, worked on lists.sr.ht improvements driven by Alpine Linux's potential migration, continued Sway/Wayland development including a Godot Wayland backend, built a self-hosted livestreaming platform, and started cozy, an ambitious C compiler toolchain project.

Key Insight: The strongest argument for free software isn't philosophical but practical: when FOSS is simply better than the proprietary alternative, the ethical case becomes self-evident.

DeVault argues that NewPipe, a free and open-source YouTube client for Android, represents the ideal of FOSS because it is straightforwardly better than the proprietary alternative. He lists concrete features like ad-blocking, background playback, and offline downloads that the official app either locks behind a $12/month paywall or omits entirely. He contrasts the exploitative, data-harvesting nature of proprietary software with NewPipe's user-centric design. The post concludes that NewPipe is an effective gateway to FOSS values because its practical superiority makes the philosophical arguments self-evident.

Key Insight: The true successor to C will be a language that embraces simplicity and stability rather than accumulating features, because systems programmers value predictability over capability.

DeVault argues that Rust is fundamentally a C++ replacement, not a C replacement, because it shares C++'s kitchen-sink philosophy of solving problems by adding language features. He contends that Rust's rapid feature growth makes it increasingly complex and unstable compared to C's decades of stability. He enumerates specific advantages C holds over Rust: superior portability, a formal specification, multiple competing implementations, a stable ABI, and independence from a single build system. He dismisses Rust's safety guarantees as insufficient compensation for these drawbacks and argues that C's true successor will be simpler, not more complex, pointing to Go as a better example of this approach.

Key Insight: Full-time free software work creates a virtuous cycle where marginalized projects become side projects and side projects become full-time work, dramatically accelerating development across an entire ecosystem.

Drew DeVault's March 2019 status update covers a productive period of full-time free software work. The headline achievement is the release of Sway 1.0, alongside progress on touch support for the Librem 5, a Wayland-Godot integration project (gdwlroots), and the aerc2 email client rewrite in Go. He also details RISC-V hardware tinkering for builds.sr.ht, contributions to Alpine Linux including Python 2 removal planning, and ongoing SourceHut improvements including Mercurial support.

Key Insight: Building sway required not just a window manager but an entire shared infrastructure layer (wlroots) that elevated the whole Wayland ecosystem, demonstrating how ambitious free software projects create value far beyond their original scope.

Drew DeVault announces the 1.0 release of sway, an i3-compatible Wayland compositor for Linux and FreeBSD, after 1,315 days of development. The release required nearly rewriting the entire Linux desktop from scratch, with contributions from almost 300 people across 9,000 commits. A key outcome was the creation of wlroots, a shared library that has become foundational to the broader Wayland ecosystem. DeVault highlights the ecosystem of interoperable tools built on Wayland standards and outlines future plans including accessibility, internationalization, and mobile support.

Key Insight: Good tool design means ruthlessly eliminating visual noise so the interface disappears and the user's actual work takes center stage.

Drew DeVault explains the design philosophy behind Sourcehut's intentionally minimal, brutalist web interface. The core principle is that Sourcehut is an engineering tool, so the design prioritizes bringing relevant content to the forefront while minimizing distractions. He contrasts Sourcehut's approach with GitHub and GitLab, criticizing their attention-grabbing navbars, marketing elements, and visual clutter. Colors are used sparingly and purposefully—blue for primary actions, red for dangerous ones—and icons are almost never shown without accompanying text. DeVault acknowledges he's not a skilled UI designer, arguing that simplicity makes good design attainable even for engineer-oriented developers.

Key Insight: A disciplined git workflow built on self-contained commits, good messages, and liberal history editing transforms git from a frustrating sync tool into a powerful development asset.

DeVault argues that most developers underinvest in learning git relative to how much they use it, and lays out a disciplined workflow centered on good commit messages, self-contained commits, and liberal use of history editing. He recommends starting with Git Internals (Chapter 10 of Pro Git) to build deep understanding. The post covers practical conventions like 50-character subject lines, 72-column wrapping (tied to email standards), and making every commit compile and pass tests. He emphasizes that git's distinguishing feature is its editable history, and developers should use interactive rebase freely to clean up commits before merging.

Key Insight: Go's power comes from its restraint, and adding generics before a truly elegant solution exists would undermine the conservative design philosophy that makes the language excellent in the first place.

DeVault argues that Go should resist adding generics until a truly elegant solution emerges, rather than importing imperfect implementations from other languages. He contends that Go's greatest strength is its conservative, spartan design where nearly every feature is bulletproof. He points to Go modules as an example of the right approach: rethinking problems from first principles rather than copying other languages' solutions. The people most loudly demanding generics are often not Go users but programmers from other languages projecting their expectations. DeVault concludes that programming languages shouldn't try to solve every problem, and Go should be comfortable being excellent in its domain rather than becoming a messy kitchen sink.

Key Insight: Most Wayland criticisms stem from conflating the minimal core protocol with the full ecosystem, misunderstanding the extension model, or expecting volunteer developers to do free work accommodating hostile proprietary vendors.

Drew DeVault systematically addresses common misconceptions and FUD about the Wayland display protocol, drawing on his authority as maintainer of wlroots and sway. He tackles claims about security, missing features like screenshots and clipboard support, network transparency, Nvidia compatibility, and gaming support. For each point, he explains either why the criticism is wrong, why it's been resolved, or why the responsibility lies elsewhere (particularly with Nvidia). He acknowledges some legitimate gaps while emphasizing that Wayland is a protocol with an extension system, not a monolithic implementation, and invites critics to contribute rather than complain.

Key Insight: The most productive outcomes at open source conferences happen through informal hallway conversations and community meetups rather than formal presentations.

Drew DeVault recaps his first FOSDEM experience in 2019, describing a whirlwind of socializing, volunteering, and community building. He met Arch Linux developers to discuss modernizing their package maintenance, coordinated with Wayland ecosystem developers on standardization, and held meetups for both sr.ht and sway that drew nearly 50 attendees. The post highlights the strength of the 'hallway track' — informal conversations and connections — as the most valuable part of the conference. He also notes receiving a Librem 5 dev board from Purism for wlroots development.

Key Insight: A minimal framework that stays out of your way is more productive than a full-featured one you have to fight against when your design doesn't fit its assumptions.

DeVault explains why he chose Flask over heavier frameworks like Django to build SourceHut's suite of web services. He describes sr.ht's 'mini-service' architecture, which requires extensive custom integration code that would conflict with Django's opinionated defaults. Flask's minimalism allowed him to build a shared core module with common templates, ORM rigging, authentication, and API behavior without fighting the framework. He acknowledges Flask's imperfections but argues it hits a sweet spot between too minimal and too opinionated.

Key Insight: Developers should deliberately use modest hardware to maintain empathy with ordinary users and resist the tendency for software to bloat into available resources.

DeVault explains why he uses an 11-year-old Thinkpad X200 as his main laptop and keeps older hardware generally. He argues that using old hardware forces developers to empathize with users who can't afford high-end machines, and demonstrates that modern software often bloats to fill available resources unnecessarily. He contrasts his lightweight sway desktop booting in under 30 seconds with KDE taking 10x longer on the same hardware. His core position is that a machine capable of billions of operations per second for $60 should be sufficient for nearly any task.

Key Insight: Sustainable full-time free software work is possible through a combination of community donations and a paid service like sr.ht, but it requires accepting real financial risk and burning personal runway.

Drew DeVault announces he will begin working full-time on free software starting in February 2019, funded by donations and sr.ht subscriptions. He acknowledges the financial risk, noting his income will be negative for a while and he's relying on savings and runway. His primary focus will be sr.ht (his main funding source), with secondary attention to Alpine Linux on RISC-V and neglected projects like aerc. He thanks contributors and donors while being transparent that sustainability isn't guaranteed yet.

Key Insight: Reliable infrastructure requires multiple independent layers of redundancy that protect against different failure modes — and against each other — combined with rigorous monitoring and testing.

Drew DeVault details the backup and redundancy infrastructure behind sr.ht, his open source software forge. He explains a layered approach using ZFS with ZRAID, PostgreSQL continuous archiving and streaming replication, and borg backups across two colocation sites in Philadelphia and San Francisco. While high availability is still in progress, data integrity has been a top priority since sr.ht's earliest days. He emphasizes that backups are only as good as their monitoring and testing, and notes the value of self-hosted infrastructure over managed cloud services.

Key Insight: Free software's true value is not free-as-in-beer entitlement to support, but the empowerment to take ownership of any problem in any project and fix it yourself.

DeVault argues that free software belongs to everyone, not just its original creators, and that this shared ownership comes with shared responsibility. He pushes back against the entitlement mindset where users expect maintainers to fix bugs and add features for them. Instead, he contends that users are empowered to make changes themselves, and that obstacles in any FOSS project are simply your own problems to solve. The post encourages people to not be intimidated by unfamiliar codebases or languages, and to fork or rewrite projects when necessary. He frames even slow, incremental contributions as meaningful progress.

Key Insight: A well-designed POSIX shell cleanly separates parsing into a reusable AST library from a poll-based task execution system, keeping the implementation simple and composable.

DeVault walks through the architecture of mrsh, a strictly POSIX-compliant shell implementation by Simon Ser. The shell has two main components: a recursive descent parser that produces an AST, and a task-based execution system. The parser deliberately avoids dependencies like flex/bison in favor of simplicity. The AST is exposed as a public library interface for use in editors, linters, and syntax highlighters. Execution converts AST nodes into pollable tasks that can wait on subprocesses or defer to sub-tasks. The post also covers POSIX built-in commands and why certain commands must be implemented within the shell itself.

Key Insight: Porting Alpine Linux to RISC-V demonstrates that open hardware and open software reinforce each other — once the foundational toolchain is in place, the vast majority of open source software ports with minimal effort.

Drew DeVault documents his process of porting Alpine Linux to the RISC-V architecture using the HiFive Unleashed, the first consumer-facing Linux-capable RISC-V hardware. He explains the two-phase process: bootstrapping (cross-compiler, libc port, base packages) and then porting the full package set. A key challenge was the unfinished musl libc RISC-V port, for which he contributed several bug-fix patches. He plans to integrate the hardware with builds.sr.ht to automate the remaining work and provide public RISC-V build cycles, which he believes would be the first hardware-backed RISC-V cycles available to the public.

Key Insight: Abandoning a FLOSS project responsibly means either empowering the community to fork or mentoring contributors into maintainers — both are valid, and neither warrants shame.

DeVault addresses the common problem of FLOSS maintainer burnout and outlines two responsible strategies for stepping away from a project. The 'fork it' approach involves adding an unmaintained notice to the README and directing users to fork the project, offering a quick exit. The 'hand-off' approach involves mentoring contributors into co-maintainer roles and gradually transferring responsibilities. He argues both are legitimate and that no maintainer should feel shame about stepping down. The post emphasizes that volunteer work should remain fulfilling, and that constructive transitions serve the community better than silent abandonment.

Key Insight: A truly free software forge must not just be open source but fundamentally rethink the development workflow, embracing the email-based, modular approach that powers the world's most important open source projects rather than cloning GitHub's proprietary model.

Drew DeVault announces the public alpha of sr.ht, a 100% free and open source software forge designed as a fundamentally different alternative to GitHub and GitLab. Unlike competitors that clone GitHub's model, sr.ht embraces email-based development workflows favored by major projects like Linux and PostgreSQL. The platform is extremely lightweight (under 10 KiB per page, no JavaScript, no tracking) and highly modular, with each component working both within sr.ht and with external tools. The flagship CI platform, builds.sr.ht, is positioned as the most capable available, supporting everything from Linux distributions to BSD and Hurd. DeVault emphasizes that sr.ht is fully copyleft-licensed with no proprietary premium tier, unlike GitLab's open-core model.

Key Insight: Misrepresenting nonfree software as open source is not a gray area or marketing choice — it is a lie that undermines the precise definitions protecting the entire free software community.

DeVault argues that the Commons Clause, an addendum to free software licenses that prohibits selling the software, creates nonfree franken-licenses while deliberately hijacking trusted open source terminology. He criticizes projects like Redis Labs for falsely describing Commons Clause software as 'open source' or 'permissive,' calling this practice dishonest and unethical. The piece emphasizes that 'free software' and 'open source' have precise, well-established definitions that cannot be co-opted for marketing purposes. He concludes that while anyone can choose nonfree licensing, they must be honest about it rather than claiming community benefits they haven't earned.

Key Insight: Virtual memory is not just about extending RAM capacity — it's a versatile abstraction managed by the MMU that enables process isolation, executable code loading, memory-mapped I/O, and swap, making it foundational to how modern computers work.

DeVault explains how virtual memory works, building on his earlier article about pointers. He walks through the role of the MMU in mapping virtual addresses to physical RAM, how the kernel manages page tables across processes for memory isolation, and how mmap enables userspace programs to interact with virtual memory. The article covers swap, memory-mapped I/O, and executable pages, illustrating how virtual memory underpins everything from running compiled programs to JIT compilation. He frames virtual memory as a powerful abstraction that gives programmers elegant access to hardware.

Key Insight: Sway's 1.0 beta demonstrates that a community-driven open source project can deliver a polished, feature-complete Wayland desktop while simultaneously creating reusable infrastructure (wlroots) that benefits the entire ecosystem.

Drew DeVault announces the sway 1.0-beta.1 release, marking a major milestone after 1,173 days and over 8,000 commits. The release achieves 100% compatibility with the i3 window manager while running on Wayland, and represents a complete rewrite of sway's internals built on the wlroots library. The post highlights new features including improved output handling, HiDPI support, multi-GPU support, advanced input configuration, and a growing ecosystem of third-party tools built on standardized protocols. DeVault credits the community of contributors and positions sway as the most fully featured and stable Wayland desktop available.

Key Insight: A language's developer experience and respect for existing workflows matters more than its technical merits — fixing Go's one overreaching design decision unlocked appreciation for everything else it got right.

DeVault explains how Go 1.11's module system finally resolved his longstanding frustration with GOPATH, which had kept him from adopting the language despite recognizing its potential. He argues that GOPATH crossed a line by imposing Go's opinions on his entire system rather than just his Go projects. With that obstacle removed, he finds Go's simplicity, concurrency model, standard library, and type system genuinely compelling. He praises Go modules as possibly the best module system in any programming language. While acknowledging complaints about error handling, the log module, and interface{}, he hopes Go will continue to prioritize simplicity over feature bloat. He closes by endorsing Go enthusiastically while cautioning against making it try to fill every niche.

Key Insight: Signing a CLA breaks the fundamental equality that open source licenses establish between contributors and maintainers, enabling the very proprietary lock-in that open source exists to prevent.

DeVault argues that contributors to open source projects should never sign Contributor License Agreements (CLAs), which grant project maintainers rights beyond what the open source license itself provides. He contends that CLAs undermine the equal relationship between contributors and maintainers by giving maintainers the power to relicense contributed work under restrictive or proprietary terms. He cites the Redis Labs incident as a concrete example of CLA abuse, where community contributions were pulled into a nonfree product. DeVault endorses the Linux kernel's Developer Certificate of Origin as a better alternative and advises contributors to simply fork projects rather than sign away their rights.

Key Insight: In-person developer conferences create invaluable cross-project collaboration and knowledge transfer, but systemic corporate culture problems like Nvidia's remain resistant to even direct, good-faith engagement from the open source community.

Drew DeVault recounts attending XDC 2018 in A Coruña, Spain, alongside four other major wlroots contributors. The team learned from kernel and mesa driver developers, discovered bugs in their DRM code, and began onboarding new contributors. He had a notable encounter with Nvidia representatives who already knew him from his critical writings, concluding that Nvidia's engineering culture remains an obstacle to open source participation. While Wayland protocol standardization discussions were limited due to absent attendees, the conference was productive for cross-project collaboration and knowledge sharing.

Key Insight: qemu's intimidating complexity masks the fact that a basic VM setup requires only a handful of options, and its unmatched flexibility makes every other hypervisor obsolete.

DeVault argues that qemu is the only hypervisor worth using, dismissing VirtualBox, VMWare, and other alternatives as inferior. He acknowledges qemu's steep learning curve due to its extensive options but walks readers through a basic Linux VM setup using Alpine Linux. The tutorial covers creating virtual disks, configuring KVM acceleration, networking with virtio, and display output. He frames qemu's flexibility as both its greatest strength and weakness, comparing it to ffmpeg as a swiss army knife tool. The post closes with a list of advanced qemu capabilities and a characteristically blunt dismissal of all competing hypervisors.

Key Insight: Modern web pages are grotesquely bloated because developers offload complexity to the client; disciplined server-side rendering and minimal JavaScript can deliver the same features at a fraction of the cost.

DeVault documents the bloated state of modern web development by dissecting a New York Times article page that required 2.8 MB and 748 HTTP requests to deliver 9 KB of actual content. He advocates for conservative web development principles: minimal JavaScript, optimized images, CSS-driven interactivity, and server-side rendering. He compares sr.ht's lean pages against GitHub's considerably heavier equivalents to demonstrate these principles in practice. The post concludes with practical recommendations for reducing web page bloat and a pointed jab at Google's AMP as a self-serving solution to a problem the industry should solve through better engineering.

Key Insight: Self-hosted video livestreaming is achievable with just ffmpeg, DASH, and nginx — no dependency on platforms like Twitch required.

Drew DeVault provides a practical tutorial on setting up self-hosted video livestreaming using ffmpeg and DASH, the industry standard for streaming video to web browsers. He notes that most guides about self-hosted streaming infrastructure punt on the actual video part and rely on Twitch, so he fills that gap. The post walks through ffmpeg input options (static files, screen capture), output encoding settings for browser compatibility, DASH configuration, and nginx serving. He also covers an alternative approach using the nginx-rtmp-module for OBS Studio integration, including basic security measures.

Key Insight: The Commons Clause exploits open source maintainers' real financial struggles to lure them into making their software proprietary, and the community must instead solve the funding problem through donations, services, and business sponsorship while preserving the four essential freedoms.

DeVault argues that the Commons Clause, which restricts the sale of open source software, represents an existential threat to open source by effectively converting projects to proprietary licenses. He acknowledges the real problem of open source maintainers struggling to fund their work, but contends the Commons Clause is the wrong solution because it violates the four essential freedoms. He points to alternatives like donations, hosted services, consulting, and dual licensing as better paths forward. He calls on Kevin Wang to take down the Commons Clause project entirely and urges Redis to reverse its adoption of it.

Key Insight: Signal's centralized architecture and hostility toward forks and federation reveal that its design priorities serve its maintainer's control over the platform rather than the security of its most vulnerable users.

DeVault argues that Signal's security claims are undermined by its dependency on Google Play Services, refusal to distribute through F-Droid, and centralized architecture that prevents federation. He contends that Signal's founder Moxie Marlinspike deliberately makes self-serving decisions that consolidate his control over the platform while using surface-level arguments to deflect criticism. The post emphasizes that truly secure systems should not require users to trust a single service provider, and that federation and peer-to-peer communication would distribute security risks across many operators. DeVault concludes that Signal's design choices prioritize Moxie's control over genuine user security, particularly for the most vulnerable users who need it most.

Key Insight: A functional local mail server for development can be set up with minimal Postfix configuration, Unix mailboxes, and transport maps — no need for the complexity of a production mail stack.

DeVault walks through setting up a local Postfix mail server for development purposes, specifically to support hacking on lists.sr.ht. The guide covers configuring Postfix for localhost-only delivery, setting up mutt as a mail client, enabling SMTP submission, and configuring LMTP transport maps for routing mail to lists.sr.ht's daemon. The post is deliberately minimal, skipping production concerns like virtual accounts, IMAP, and spam filtering in favor of a just-enough setup for local testing.

Key Insight: Wayland shells provide a clean abstraction layer that assigns semantic roles to raw pixel surfaces, and wlroots unifies disparate shell protocols—including Xwayland—behind a consistent API to simplify compositor development.

This tutorial explains how Wayland shells give meaning to surfaces by assigning them roles like application windows, panels, or lock screens. DeVault covers the three main shells relevant to wlroots compositor development: xdg-shell for application windows and popups, layer-shell for desktop components like panels and wallpapers, and Xwayland for backward compatibility with X11 clients. The post details how each shell handles atomic state transitions, surface lifecycle events, and keyboard focus. DeVault emphasizes wlroots' consistent API design across all shells, including treating Xwayland as a shell for API uniformity.

Key Insight: Rather than building new federation protocols for git collaboration, the open source community should improve the email-based workflow that already powers its most important projects.

DeVault argues against building new federation protocols like ActivityPub for git collaboration, contending that email already provides everything needed for decentralized, federated development workflows. He points to the vast ecosystem of projects—Linux, gcc, PostgreSQL, ffmpeg—that already use email-based collaboration successfully. He advocates for improving existing email-based tools and building web forges like sr.ht that smooth over email's rough edges rather than creating a second, incompatible federation system. The post positions email as superior to ActivityPub in maturity, ease of implementation, user empowerment, and resilience.

Key Insight: wlroots deliberately forces compositor authors to manually wire every layer of input handling, trading ease of use for the flexibility to support any input paradigm imaginable.

This post provides a detailed technical walkthrough of how input handling works in wlroots, the compositor library behind Sway. DeVault explains the full pipeline from raw hardware events through libinput, to pointer/keyboard processing, cursor rendering, and finally delivering events to Wayland clients via the seat abstraction. The design philosophy is explicitly 'batteries not included,' giving compositor authors enormous flexibility at the cost of significant complexity. The post walks through each layer — backends, input devices, cursors, output layouts, and seats — showing how they must be manually wired together. DeVault acknowledges the tradeoff honestly, noting that simpler libraries like wlc are easier to use but offer far less control.

Key Insight: Simplicity is not a luxury but a prerequisite — without it, software cannot be made correct or fast, and complex problems are best solved by composing simple solutions rather than building complex ones.

DeVault argues that simplicity should be the highest priority in software development, above correctness and performance. He contends that complex software inevitably breaks and becomes slow, while simple software is easier to debug, profile, and maintain. When problems arise at 2 AM, simple code is what saves you. He advocates ruthlessly reducing scope to find basic problems that can be solved with basic solutions, then composing those simple solutions to address complexity.

Key Insight: Git's email-driven workflow is more powerful, open, and scalable than centralized pull request models—the answer to its rough edges is better tooling, not abandoning it.

DeVault advocates for git's built-in email workflow (git send-email, format-patch, git am) as superior to GitHub-style pull requests. He walks through the toolchain, configuration tips, and patch review etiquette, drawing from his own contribution to git 2.18.0. He argues email is standardized, federated, and infinitely customizable, while acknowledging that popular email clients make the workflow harder than it should be. Rather than abandoning email, he announces sr.ht's approach: embrace the email-driven model while building tools to lower the barrier to entry. He points to the Linux kernel as proof the model scales to the largest projects on earth.

Key Insight: Simple, minimal tools with few dependencies are more reliable and maintainable than complex, feature-rich alternatives — even when the complex tool is the officially recommended one.

DeVault shares his preferred Let's Encrypt TLS certificate setup, rejecting the official certbot client in favor of the simpler acme-client written in C. He walks through his nginx configuration for handling ACME challenges, a shell script for certificate negotiation, and a cron job for daily renewal. The post reflects his characteristic preference for minimal, understandable tooling over complex, feature-rich alternatives. He later added an update noting he switched to uacme after acme-client became unmaintained.

Key Insight: The best alternative to GitHub isn't a GitHub clone but a platform that rethinks project hosting around git's native workflows and aligns its business model with users rather than shareholders.

Drew DeVault responds to the Microsoft acquisition of GitHub by presenting sr.ht as a fundamentally different alternative rather than a reactionary escape. He argues that most GitHub alternatives merely clone its UX, while sr.ht embraces git's native workflows like email-based patches. The platform prioritizes maintainers over drive-by contributors and rejects venture capital in favor of a subscription-based grassroots model. He plans a cautious, non-disruptive migration of his own projects only when sr.ht is ready.

Key Insight: The most productive thing a FOSS maintainer can do is not write code, but cultivate contributors by connecting them with work they enjoy and helping them grow.

DeVault outlines his philosophy for maintaining free software projects, built around three core principles: treating everyone as a volunteer, valuing patches over bug reports, and empowering contributors to work on what they enjoy. He argues that a maintainer's primary role is not writing code but enabling contributors—connecting them with mentors, helping them find work that matches their strengths, and gradually expanding their responsibilities. He deliberately prioritizes long-term project health and contributor satisfaction over short-term user demands, even at the cost of losing users who won't attempt patches themselves.

Key Insight: Embedding files in C programs can be solved with a tiny, dependency-free generic tool rather than ad-hoc project-specific solutions.

Drew DeVault introduces koio, a small tool for embedding files directly into C programs. The tool generates C source containing file data as string literals and provides an fopen shim that checks embedded files before falling back to the real filesystem. He built it for his chopsui UI toolkit but made it generic for reuse across projects. The post walks through the simple command-line usage, the generated output, and the resulting API.

Key Insight: Replacing a convenient but architecturally limiting library with a modular toolkit was worth the rewrite cost because experience revealed that the original design carried forward the very constraints the project was trying to escape.

DeVault explains why the sway team replaced the wlc library with wlroots, a ground-up rewrite. Sway originally used wlc because it provided quick scaffolding for building a Wayland compositor, but its opinionated design—acting as a compositor with a plugin API rather than modular building blocks—eventually became the source of most of sway's bugs and limitations. After extensive community discussion, the team decided to build wlroots as a set of modular tools that let developers construct their own compositors. The rewrite, while risky by conventional wisdom, succeeded because the team had gained hard-won experience from their first attempts at Wayland compositors.

Key Insight: A man page generator should be as minimal and dependency-free as man itself, with a syntax purpose-built for its output format rather than borrowed from HTML-oriented markup languages.

Drew DeVault introduces scdoc, a man page generator he wrote after years of dissatisfaction with existing tools. He evaluates alternatives like asciidoc, mdocml, and ronn against three criteria: readable syntax, minimal dependencies, and man pages as a first-class target. scdoc is under 1,000 lines of C99 with zero dependencies, uses a Markdown-inspired syntax designed specifically for man pages, and weighs just 78 KiB statically linked. He has already migrated sway's documentation to scdoc.

Key Insight: gdb's ability to attach to running processes and execute arbitrary compiled code in their address space makes runtime process manipulation like stderr redirection surprisingly simple.

DeVault describes a technique for redirecting stderr of an already-running process using gdb, discovered during a KDE sprint in Berlin. Rather than using strace to decipher write syscalls, he demonstrates how gdb's ability to attach to running processes and execute arbitrary code makes this straightforward. The approach uses gdb's 'compile code' command to call open() and dup2() in the target process's address space, effectively replacing stderr with a file. He notes this is just one example of the powerful and hacky things possible with gdb.

Key Insight: Google has systematically adopted Microsoft's embrace-extend-extinguish playbook across email, web, chat, and syndication, leveraging open standards to gain dominance before replacing them with proprietary alternatives.

DeVault argues that Google has adopted Microsoft's infamous 'embrace, extend, extinguish' strategy against open standards across multiple products. He traces this pattern through Gmail's treatment of email federation, AMP's co-opting of the open web, the abandonment of XMPP in chat products, and the killing of Google Reader and RSS. He acknowledges Google's open source contributions but criticizes their poor collaboration with external contributors on key projects like Chromium and Android. The post concludes with a call to diversify the internet and resist Google's growing monoculture.

Key Insight: Cross-project collaboration between sway/wlroots and KDE on standardized Wayland protocols can replace both projects' proprietary hacks and restore desktop composability that was lost in the X11-to-Wayland transition.

Drew DeVault reports on his week at KDE's Berlin development sprint, where he collaborated with KDE developers to find common ground between sway/wlroots and Plasma shell. The main focus was on the wlroots layer-shell protocol, which could replace the proprietary hacks both projects currently use for desktop shell components like panels and lockscreens. They discovered that the wlroots approach, with minor tweaks, could serve Plasma shell's needs well. DeVault built a proof-of-concept C++ library (qtlayershell) and got KDE's Latte Dock running on sway. The collaboration could restore the ability for KDE users to swap window managers, a feature lost in the Wayland transition.

Key Insight: The commercial model for internet services is structurally incapable of serving users because fiduciary duty to shareholders will always override user interests, making decentralized, federated, open source platforms the only viable alternative.

DeVault argues that the Facebook data scandal should catalyze a broader move away from all centralized commercial platforms, not just Facebook. He contends that the commercial model for internet services is inherently flawed because companies have a fiduciary duty to maximize profits, making user exploitation inevitable. The solution lies in decentralized, federated, open source platforms like Mastodon, where operator incentives align with user interests. He urges readers to systematically disentangle themselves from proprietary platforms one step at a time.

Key Insight: The privilege of open source is wasted if programmers are too intimidated to trace problems through unfamiliar codebases and send patches upstream.

DeVault argues that programmers should take full advantage of open source by fearlessly diving into unfamiliar codebases to debug and fix problems at their source. He observes that many developers who are comfortable contributing to one project balk at tracing bugs into dependencies like libinput or mesa, even though the same debugging tools and skills apply everywhere. He makes the case that reading code in unfamiliar languages and libraries is always tractable, and that the biggest time sink is the anxiety about doing it rather than the work itself. The post concludes that effective programmers make it their business to understand the tools they use at every level of the stack.

Key Insight: The simplicity and longevity of open protocols like IRC expose the unnecessary complexity and vendor lock-in of proprietary platforms like Slack.

DeVault contrasts the process of building a Slack bot versus an IRC bot to illustrate the superiority of open protocols over proprietary platforms. He walks through Slack's multi-step process involving accounts, web portals, SSL-secured servers, and proprietary APIs, then demonstrates that IRC requires nothing more than a TCP connection and a few plaintext commands. The post was prompted by Slack's decision to disable IRC and XMPP gateways, which DeVault frames as a classic Embrace Extend Extinguish move. He argues that IRC's simplicity, openness, and 20+ year track record make it fundamentally better than walled-garden alternatives.

Key Insight: wlroots gives compositor authors complete rendering freedom by providing building blocks rather than a ready-made rendering pipeline, enabling everything from traditional desktops to VR window managers.

This tutorial walks through rendering a window in a Wayland compositor built with wlroots. It covers setting up the wl_compositor global for surface allocation, adding xdg_shell for window roles, and iterating over surfaces to render them using OpenGL matrices. The key distinction emphasized is that wlroots deliberately does not render for you, giving compositors full flexibility over how surfaces are displayed. The article explains the matrix math needed to project surface coordinates to screen coordinates, while showing how wlroots helper functions simplify the process. By the end, the compositor can display actual client windows like weston-simple-shm and gnome-terminal.

Key Insight: Sustainable full-time FOSS work requires distributed recurring donations from many small donors across multiple platforms, not corporate sponsorship or one-time gifts.

Drew DeVault shares that he has reached break-even on his FOSS infrastructure costs through recurring donations, and lays out what it would take to work on free software full-time. He calculates a goal of $6,000/month based on Philadelphia living costs, financial security needs, infrastructure expenses, and taxes. He emphasizes that recurring donations from many small donors across multiple platforms provide real financial security, unlike one-time donations or dependence on single sponsors. He commits to transparency about his finances and notes that his goal will actually decrease as donations grow and he can restructure his life around FOSS income.

Key Insight: Wlroots abstracts away much of the complexity of Wayland compositor development, allowing a functional server that accepts client connections to be assembled in remarkably few lines of code.

This tutorial walks through the second step of building a Wayland compositor using wlroots, focusing on setting up the Wayland server to accept client connections. DeVault shows how to add a socket for client connections, register Wayland globals (shared memory, gamma control, screenshooter, clipboard, idle), and expose output information. The post demonstrates testing the compositor with weston-info and the screenshooter example client, building incrementally toward a functional compositor.

Key Insight: wlroots makes Wayland compositor development accessible by abstracting hardware backends and providing sensible rendering defaults, while still allowing full control over the OpenGL pipeline.

This tutorial introduces wlroots, the library behind the sway Wayland compositor, by walking through the creation of a minimal Wayland compositor from scratch. DeVault explains the core concepts: the Wayland display and event loop, backends that abstract input/output hardware, output signals for hotplugging, and the frame rendering cycle. By the end, the reader has a compositor that clears the screen to solid red using OpenGL via wlr_renderer. The post is structured as the first in a series, with each article corresponding to a single commit in the example 'Wayland McWayface' project.

Key Insight: The same genetic engineering breakthroughs that promise miraculous cures will inevitably be weaponized, and the combination of cheap CRISPR technology with leaked genetic databases could enable targeted killings and even engineered extinction.

This speculative fiction piece presents a timeline of fake news articles from 2019-2022 depicting the catastrophic consequences of advances in genetic engineering and CRISPR technology. It begins with a US bioweapon attack on North Korea, escalates through genetic database breaches enabling targeted assassinations, and culminates in a radical environmentalist group engineering human extinction through mass sterilization. The narrative warns that the same tools enabling miraculous cures like fixing cystic fibrosis also enable unprecedented bioweapons. Inspired by a DEFCON 25 talk on genetic hacking, the piece illustrates how quickly society could unravel once biological engineering becomes cheap and accessible.

Key Insight: Writing shell scripts in POSIX shell rather than bash ensures portability across all Unix-like systems, and the standard is more accessible than most developers assume.

DeVault makes the case for writing shell scripts in POSIX shell rather than bash, arguing that portability is the primary reason. He explains that bash is not standardized and exists as a single implementation, while POSIX shell has many conforming implementations across operating systems. The post provides practical guidance on avoiding bashisms, using standard coreutils, and preferring short flags over GNU long flags. He concedes that POSIX shell is not ideal for interactive use, recommending users pick whatever they like for daily command line work. The post serves as both an advocacy piece and a practical introduction for developers unfamiliar with the distinction between bash and POSIX shell.

Key Insight: GNOME's unilateral declaration that client-side decorations are settled policy for Wayland is false, and Sway, KDE, and other compositors have built a working protocol extension proving server-side decorations are viable.

DeVault pushes back against GNOME's claim that client-side decorations (CSD) are the settled standard for Wayland, arguing that no consensus exists. He outlines real problems with CSD including inconsistent look and feel, inability to control misbehaving clients, and lost compositor customization. He accuses GNOME of pushing 'disingenuous propaganda' and refusing compromise, noting he was banned from the #wayland IRC channel for advocating discussion. He announces that Sway, KDE, and other wlroots-based compositors have developed a protocol extension supporting server-side decorations as an alternative.

Key Insight: Donation platforms obscure their true cost through layered fee structures, and simpler tools like fosspay that only pass through payment processor fees give creators a much better deal.

DeVault breaks down the confusing fee structures of donation platforms used to support creators. He categorizes fees into transaction fees, platform fees, withdrawal fees, and taxes, explaining how each type works. The post provides a calculator tool to help donors understand exactly how much of their contribution reaches the creator across different platforms. He compares fosspay (his own project, which only charges Stripe's transaction fee), Patreon (which layers on platform and withdrawal fees), and Liberapay.

Key Insight: Developers should stop reinventing deployment with language-specific package managers and instead learn to use and contribute to their distro's native packaging system.

DeVault argues that developers should use their Linux distribution's package manager instead of language-specific tools like virtualenv, rbenv, npm, or pip for production deployments. He points out that distro repositories already contain most dependencies and provide better system integration. He encourages developers to contribute missing or outdated packages to their distro rather than bypassing the system. His ideal deployment model is pushing packages to a repository and running system updates across a fleet.

Key Insight: Fork's legacy as a sacred Unix primitive has forced decades of increasingly absurd workarounds — from CLOEXEC to the OOM killer — when cleaner models like spawn have existed all along.

DeVault argues that Unix's fork syscall is one of the worst design decisions in operating system history, tracing its origins to the PDP-11 era when copying an entire address space to spawn a process was already questionable. He details how fork leads to cascading problems: inherited file descriptors requiring CLOEXEC hacks, complex pipe setup, and most damningly, memory overcommitment that necessitated the OOM killer. After dismissing vfork and posix_spawn as inadequate fixes, he advocates for Plan 9's rfork and the spawn model used in his KnightOS kernel, where new processes are configured before execution rather than cloned from parents.

Key Insight: The wlroots whitepaper was published, documenting the architecture of the modular Wayland compositor library that underpins sway and other compositors.

This is an extremely brief announcement post linking to the wlroots whitepaper PDF. wlroots is the modular Wayland compositor library that Drew DeVault created as the foundation for sway and other Wayland compositors. The post contains no substantive text beyond the link itself, serving purely as a signal boost for the published document. It reflects DeVault's terse, no-nonsense communication style.

Key Insight: When a browser meant to serve users becomes a vector for silent advertising, it has betrayed its fundamental purpose and forfeited user trust permanently.

DeVault condemns Mozilla for secretly sideloading a Mr. Robot promotional browser extension into Firefox users' browsers through the 'experiments' feature. He traces a pattern of increasingly invasive monetization decisions, from Google as default search to Pocket integration to this advertisement disguised as an experiment. The extension modified webpage text and added HTTP headers, and was intended to be silently installed without user knowledge. DeVault argues this fundamentally violates user trust and the core purpose of a web browser as a faithful tool. He announces he will stop using and recommending Firefox entirely. Updates note Mozilla eventually rolled back the study and issued an apology, but DeVault stands by his criticism.

Key Insight: By framing cosmic history as a lab report from simulation operators, the post invites readers to consider their own existence from the outside looking in — and hides Easter eggs that reward those who look closer at the fabric of their 'simulation.'

Written as a fictional research document from beings running a universe simulation, this post chronicles the history of intelligent civilizations that emerged in 'simulation 2813/9301' from first life to final extinction. The narrator surveys notable civilizations across cosmic time — the first intelligence, the longest-lived, the shortest, those that discovered the simulation's true nature, and the last to exist as the universe went dark. Hidden within the post are redacted passages that reward curious readers who inspect the source, breaking the fourth wall. The piece concludes with the announcement that the simulation will be re-run, this time with the operators communicating openly with emergent intelligences — perhaps through 'blog posts.'

Key Insight: With custom software, replaceable parts, and a willingness to do basic repairs, a phone can last for years — resisting the planned obsolescence that manufacturers rely on.

DeVault shares his approach to long-term phone maintenance, arguing against the cycle of annual upgrades. He advocates for installing custom ROMs like LineageOS to remove bloatware, insisting on user-replaceable batteries, using protective cases, and attempting repairs before buying new devices. Using his Samsung Galaxy S5 as an example, he demonstrates that phones can remain fast and functional for years with proper care. The post frames planned obsolescence as a consumer trap that can be resisted through technical self-sufficiency.

Key Insight: True portability comes from building on standards like POSIX rather than targeting specific platforms, and this matters because it enables innovation and prevents vendor lock-in.

DeVault argues that true software portability comes not from supporting a few popular platforms, but from adhering to standards like POSIX. He contends that POSIX compliance means software runs on virtually every operating system and CPU architecture, both existing and future. He extends the argument beyond operating systems to browsers and networking protocols, claiming that failing to use standard interfaces is a form of vendor lock-in. He questions whether languages like Rust can claim systems programming suitability when they only support a handful of platforms, contrasting this with C's universal reach.

Key Insight: Hardware vendors must support open Linux standards rather than expecting open-source developers to reverse-engineer compatibility with proprietary alternatives.

DeVault declares that Sway 1.0 will not support Nvidia's proprietary driver or EGLStreams, only the open-source nouveau driver. He argues that Nvidia has consistently refused to support standard Linux kernel APIs (KMS, DRM, GBM) that every other GPU vendor supports, instead shipping their own proprietary alternative (EGLStreams) that was already rejected by the Linux graphics community. He frames the issue as Nvidia's responsibility to support Linux standards, not compositor developers' responsibility to accommodate Nvidia's proprietary stack. He criticizes users who reward Nvidia's behavior by buying their hardware and then expecting open-source developers to work around it for free.

Key Insight: By replacing the limited wlc abstraction with the more powerful wlroots library, sway can unlock features impossible under the old architecture while building a shared foundation for the entire Wayland compositor ecosystem.

Drew DeVault announces sway 0.15-rc1 as the final pre-1.0 release and introduces wlroots, a new low-level library replacing wlc for Wayland compositing. While wlc abstracted away most compositor plumbing, its limitations had become blockers for sway's development. Wlroots gives compositors much more control over low-level components at the cost of additional complexity. Development on wlroots has progressed rapidly thanks to motivated contributors, and integration with sway is now underway. The migration will unlock long-requested features like rotated displays, fractional scaling, and multi-GPU support. DeVault positions wlroots as a shared platform for the broader Wayland ecosystem.

Key Insight: HN's moderation is mostly competent but structurally opaque, and user flagging serves as an unaccountable censorship mechanism that removes legitimate content without review.

DeVault presents findings from months of scraping the Hacker News API and website to analyze how moderators and users influence content visibility. He documents the tools available to HN moderators—title editing, rank manipulation, post killing/deletion, and shadowbanning—with direct quotes from moderator Dan clarifying their usage. He finds that while moderator actions are generally benign, user flagging is clearly abused as a de facto downvote mechanism, removing legitimate posts with significant engagement. He argues that HN's moderation opacity is a structural problem and proposes a public audit log, moderator review of flagged posts, and community-appointed moderators to improve transparency.

Key Insight: The value added by modern development tools rarely outweighs the complexity cost they impose, and developers should learn simpler, proven tools rather than piling on fragile abstractions.

DeVault argues that software complexity has become an epidemic, with modern tools like Gulp, Docker, and Chef adding massive complexity costs that outweigh their value. He contends these tools exist because developers haven't bothered learning simpler, venerable alternatives like Make, shell scripts, and package managers. The problem extends beyond tools to languages like C++ and Rust, bloated desktop apps shipping entire browsers, and websites laden with JavaScript and spyware. With Moore's law running out, he calls on developers to prioritize simplicity and dismantle the fragile abstractions that have accumulated.

Key Insight: Regexes are overused for validation tasks where purpose-built parsers and standard library functions would be simpler, more correct, and more maintainable.

DeVault argues that regular expressions are overused for validation tasks where they're almost always the wrong tool. Using URL validation as a case study, he shows how even a heavily-revised Stack Overflow regex fails to match many valid URLs while accepting invalid ones. He demonstrates that purpose-built parsers and standard library functions are superior to regex for structured data validation. The post concludes with a practical list of common validation tasks and their proper non-regex solutions.

Key Insight: Sway's rapid growth in contributors and distribution adoption, combined with the ambitious wlroots rewrite, signals the Wayland desktop ecosystem maturing into a viable i3 replacement.

Drew DeVault provides a progress update on Sway, the i3-compatible Wayland compositor, announcing the 0.14.0 release with tray icon support and various bug fixes. The project has grown to over 24,000 lines of C from 94 contributors. Significant parallel work is happening on wlroots, a new library replacing wlc for Wayland compositor underpinnings, with working DRM and libinput backends. The bounty program has a $1,200 pot with payouts underway, and a new Patreon supports ongoing development.

Key Insight: Link rot is no longer an accident but a systemic feature of platform-controlled internet, and the only reliable defense is aggressive personal archiving.

DeVault argues that link rot has become an axiom of the internet, accelerated not just by expired domains but by DMCA abuse, paywalls, region locking, and platform shutdowns. He cites statistics showing roughly 5% of links die per year and half of URLs in Supreme Court opinions are already dead. His response is to personally archive anything he wants to see twice — YouTube channels, RSS feeds, websites, git repos, and all media in DRM-free form. He closes with a call to action: don't build platforms that trap user data, give people DRM-free downloads, and let archive.org do its job.

Key Insight: Wayland is best understood not as a graphics system but as a flexible, extensible resource-sharing protocol where clients and servers negotiate access to typed resources through a registry of XML-defined interfaces.

DeVault provides a practical, code-level introduction to the Wayland display protocol, moving beyond high-level architectural overviews. He frames Wayland as a generic resource-sharing protocol rather than a graphics-specific system, then walks through the client-side process of connecting to a display, discovering globals via the registry, binding to interfaces, and creating surfaces. He also covers the server side, including event loops and global creation. The post emphasizes Wayland's extensibility through XML-defined protocol extensions and its flexibility in supporting diverse compositor implementations.

Key Insight: C's incomplete struct types can be repurposed as a limited polymorphism mechanism that trades void* unsafety for compile-time type checking, though the technique ultimately breaks under link-time optimization.

DeVault describes a C programming pattern used in wlroots that achieves a form of type-safe polymorphism without macros, void pointers, or undefined behavior. The technique uses incomplete struct types that are defined differently by each backend implementation, allowing type-safe function signatures without casting. He walks through the wlr_output example where DRM, Wayland, and X11 backends each provide their own definition of wlr_output_state. However, the post includes an errata noting the approach was rolled back because it causes problems with link-time optimization (LTO).

Key Insight: Mass security breaches expose a fundamental UX failure in password management that can be solved by automating the password rotation workflow across providers.

DeVault introduces pass-rotate, a tool he built to automate bulk password rotation across multiple websites. Motivated by the CloudFlare memory leak incident that potentially compromised accounts on thousands of sites, he created a youtube-dl-style utility that reverse engineers password change flows to rotate credentials in seconds rather than hours. The tool integrates with password managers and supports two-factor authentication methods. He encourages contributions to expand the list of supported services and proposes standardizing automated password rotation.

Key Insight: Building a real Linux distribution — one that is self-hosting and distributable — is orders of magnitude harder than assembling a bootable Linux system, requiring months of bootstrapping work and an essentially infinite packaging commitment.

DeVault describes his experience building agunix, a full Linux distribution from scratch, motivated by dissatisfaction with every existing distro. He distinguishes a Linux 'system' from a 'distribution' — the latter requiring a package manager and self-hosting capability. The bootstrapping process took multiple failed attempts over months, involving cross-compilation, dependency resolution, and countless edge cases. After achieving self-hosting on his fourth attempt, he graduated from a chroot to dedicated hardware, then deployed the distro's own infrastructure on itself. He notes the eternal packaging phase is the real bottleneck, having built 407 packages without yet achieving a desktop environment.

Key Insight: Sway's development is accelerating rather than slowing, with the ambitious wlroots project poised to benefit not just Sway but the entire Wayland ecosystem through shared compositor infrastructure.

Drew DeVault provides a progress update on Sway, the i3-compatible Wayland compositor, as of April 2017. The project has grown to over 21,000 lines of C from 81 contributors, with recent releases adding redshift support, binary space partitioning layouts, and nvidia driver support. A bounty program has raised $1,200, with awardees notably redonating their rewards back to the pool. The most significant long-term development is wlroots, a new compositor plumbing library to replace wlc, which promises to fix deep bugs and enable new features across the Wayland ecosystem.

Key Insight: MSG_PEEK is far more widely used than security commentators assumed, making CVE-2016-10229 a serious threat to common infrastructure software rather than an obscure edge case.

DeVault responds to CVE-2016-10229, a Linux kernel vulnerability allowing arbitrary code execution via UDP traffic when programs use MSG_PEEK. He pushes back against claims that MSG_PEEK is too obscure to matter, arguing it's widely used across major software. He provides a list of prominent projects containing MSG_PEEK in their source code, including nginx, haproxy, curl, and busybox. He urges immediate kernel updates for any servers running kernels below 4.5.

Key Insight: C's power and simplicity are assets only when paired with strict discipline—the language won't protect you from yourself, so your processes, habits, and taste must do the protecting instead.

DeVault lays out a set of guiding principles for writing disciplined C code, arguing that C's power demands careful, deliberate practice rather than cleverness. He advocates for maintainability over performance, transparency over abstraction, and strict adherence to standard features over GNU/gcc extensions. The post covers code organization, dangerous pattern avoidance, disciplined version control, rigorous testing, and learning from mistakes. He draws an analogy between C programming and gun handling—both are powerful tools requiring respect and discipline. Throughout, he maintains that C remains one of the best programming languages when used correctly, and that the real danger lies not in the language but in undisciplined programmers.

Key Insight: A well-designed declarative machine spec format can demystify compiler backends and make adding new architecture targets straightforward rather than requiring deep expertise in compiler internals.

DeVault introduces cozy, a long-term project to build a new C toolchain from scratch as an alternative to GCC and LLVM. The post focuses on the design of machine specs — a custom declarative format for describing CPU architectures that would drive the entire toolchain from assembler to optimizer. The spec format uses a readable ini/yaml hybrid syntax to describe registers, instruction encodings, macros, and detailed metadata about instruction side effects and cycle counts. He demonstrates the approach using the Z80 architecture and contrasts it with GCC's lisp-based specs and LLVM's C++ approach. The project is explicitly planned on a decades-long timeline, reflecting his philosophy that large projects are feasible if you start them and keep working.