Software architecture, Unix philosophy, and the demoscene. Selected articles by Vivian Voss.
Bytes of Art, a portrait of f07, the Function 2007 invitation demo by the Hungarian group Conspiracy, released on 5 August 2007. Gargaj and BoyC wrote the code, zoom made the graphics and xeno_cns the soundtrack. Conspiracy formed in 2002 and built their reputation on the 64 kilobyte intro, a form in which every texture and every note is generated at runtime inside 65,536 bytes; their intro Chaos…
IT Philosophy, on the category behind the job title Linux Administrator. From the perspective of the person administering it, an operating system is four things sitting on a kernel: a C library, a set of core utilities, an init system and a way of installing software. Alpine runs musl, BusyBox, OpenRC and apk; Fedora runs glibc, GNU coreutils, systemd and dnf; not one of the four layers is shared,…
Lean Software, an audit of the Docker Desktop subscription. On 31 August 2021 Docker published a subscription agreement effective the same day: any company with more than 250 employees or more than 10 million dollars in revenue needs a paid seat for every person running Docker Desktop, with a grace period to 31 January 2022. The tool did not change that morning and neither did the installed fleet;…
The Bench Marker, on what a build pipeline spends before it reaches any product code. An empty Next.js project generated with create-next-app declares 11 direct dependencies and receives 438 packages, 21,229 files and 468 megabytes on disk. Running the checks that guard that project on every push takes 12.4 seconds, made up of 6,962 milliseconds for npm ci against an empty cache, 961 for tsc,…
Unix Universe, on dynamic instrumentation and what it costs not to use it. In 2001 Bryan Cantrill, Michael Shapiro and Adam Leventhal began work at Sun Microsystems on a facility for instrumenting production systems; DTrace took twenty-three months and shipped with Solaris 10 in March 2005, and their USENIX paper of 2004 states the guarantees plainly: the ability to instrument user-level and…
Bytes of Art, a portrait of Laevitas, a Windows demo by the Swedish group Bitbendaz released on 15 August 2020. Mikael Stalvik wrote the code, java did the graphics, Comatron and Mygg made the music, and Daytripper performs the rap vocals; Demozoo tags the production breakbeat, graffiti, punk and rap. Unlike a 64K intro, which must fit everything into 65,536 bytes, a demo carries no size limit…
IT Philosophy, an examination of the sentence used to end technical discussions. In 1999 Benthorn and Frantzich observed an evacuation in a furniture warehouse in Helsingborg with two equidistant exits, and seventy-one per cent took the door they had come in by. Four years later The Station nightclub fire in Rhode Island had four exits, and the NIST investigation records that about two-thirds of…
Lean Software, an examination of what a dependency scanner actually answers and what it cannot. A measurement taken on a clean machine on 4 August 2026 with Node 26.0.0 and npm 11.12.1: five direct dependencies for a small React front end resolve to eighty-four installed packages, 45 MB and 5,925 files; adding a bundler, TypeScript and a linter takes nine direct dependencies to two hundred and…
The Bench Marker, a measurement of cloud cost against rented iron for a steady workload. One machine against one machine, matched on physical cores and memory: a Hetzner AX102-1 with sixteen physical cores, 128 GB of DDR5 and 3.84 TB of datacentre NVMe, traffic uncounted, at 308.21 euros a month, against an m7a.8xlarge in Frankfurt with 32 vCPU, being those same sixteen cores with simultaneous…
Unix Universe, on source package systems and where a hardening decision actually lives. The FreeBSD installer carries a hardening menu with ten switches, none of them on by default, and every answer lands in a configuration file that stays readable. The Handbook explains the ports collection with the observation that packages are compiled with conservative options because they must run on the…
Bytes of Art. Twenty-six productions ran in the PC demo competition at Revision 2026 in Saarbruecken, the largest pure demoscene event in the world, and one of them was named after the group that made it. Razor1911 won with 1,621 points against 1,259 for second place and took the crowd favourite award as well. Ten minutes on Windows, led by Dubmood and Goto80 over several months with roughly…
A thesis on what a code review approval actually proves. Somewhere in a repository history sits a commit carrying a reviewer's name in the approval field that the reviewer cannot remember: a long diff, a blocked colleague, green tests, a click. That is a description of the job rather than a confession, and what deserves examination is the mark itself, because everything downstream reads it as a…
An accounting of the strongest argument for keeping a build step in the browser, which is that whoever owns the build step also owns the cache invalidation, and that a browser may notice a raw file has changed while an optimised import is left exactly as it was. The mechanism earns its keep first: HTTP caching is unforgiving, older remedies such as query strings and hand-raised version numbers…
A measurement of what desktop applications weigh before they start, taken on one Mac running macOS 26.5.2 using du, with the bundled runtime measured separately from the application's own code and the bundled Chromium version read out of the framework binary. Proton Pass occupies 553 MB, of which 457 MB is the Electron framework and 1 MB is the application itself; Slack occupies 310 MB, of which…
A ladder of four answers to the question of what should happen when software needs other software, and a fifth position below its first rung. Slackware 1.00 shipped on 17 July 1993 on twenty-four floppy disks and is the oldest surviving Linux distribution; its package tools make no attempt to track dependencies, a refusal justified by the circular requirement and the unsatisfiable version conflict…
1995 is a PC demo by Kewlers and mfx, two Finnish groups who pooled their people for it, released on 5 August 2006 at Assembly in Helsinki. The demoscene splits its competitions largely by size: an intro is capped, at sixty-four kilobytes or fewer, while a demo carries no cap at all. 1995 is a demo, and that is its first quiet joke. Given every byte they wanted, Kewlers and mfx spent the freedom…
IT Philosophy, a thesis on the social evaluation penalty for AI use. The oldest working agreement of professional life: assistance is used by nearly everyone and acknowledged by nearly no one, because reputation is priced on the fiction of unassisted work; social psychology calls the stable form pluralistic ignorance. New in 2026 is that the punishment for breaking the silence has been measured.…
Lean Software, a cost audit of the decision that a website must be compiled before it may be a website. The concession first, in full: in 2012 half your visitors ran browsers that understood only ES5 and none understood a module; webpack began that year as a side project of a master's thesis, Babel arrived in 2014 as 6to5 to translate tomorrow's JavaScript for yesterday's browsers, TypeScript is a…
Unix Universe, the fourth and last of The Unix Family. For three Mondays this family was drawn by one measure: how faithfully a system keeps the Unix discipline, whatever its parentage. The certified members hold the paper; the BSDs keep the line without it; QNX kept the discipline with none of the blood. This one closes the family on the member hardest to place, largest by a distance and least…
IT Philosophy, the third and last of three Sundays on what we can no longer read. A correct answer arrives inside a minute, and she stops asking why it is correct. Understanding was never a possession; it is a practice, kept up only by use, and the doing is itself the knowledge. In 1983 Lisanne Bainbridge observed that automating a task leaves the operator to stop practising it, so the skill…
Bytes of Art returns, first of the reopened Saturday series. 0mix, by the Japanese scener 0b5vr, is a 64K intro: a seven-minute techno live set, music and moving image at once, running at 140 BPM in a browser tab from sixty-four kilobytes of code. Nothing is loaded because there is nothing to load, no textures, no models, no audio files. Every shape is built in code, some scenes modelled in…
The BSD Field Guide, first of three on The Ground. You install FreeBSD, and getting to the login prompt asks nothing you had to look up: no standoff over which bootloader, no negotiation over which daemon minds the network. The oldest question a new machine invites is where anything actually lives, and on FreeBSD that has a short answer. man hier is a single manual page that lays out the whole…
Lean Software, the sixth of eighteen Wednesdays on how we got here, and the first of five on npm, the registry read as a business. npm began in January 2010 as a small tool for fetching JavaScript packages from a registry anyone could write to, and that openness became the ground a business had to stand on when npm, Inc. was incorporated in Oakland in 2014 by Isaac Schlueter and Laurie Voss. The…
Unix Universe, the third of four portraits of the Unix family, the outsider with none of the blood. QNX is not descended from Unix; no line of it runs back to Bell Labs or Berkeley, and its kernel was written from nothing by two Waterloo students who shipped it as QUNIX in 1982 and renamed it QNX in 1984 to keep clear of the trademark. It went and got the certificate for the rules while holding…
IT Philosophy, the second of three Sundays on what we can no longer read, one layer beneath the code you did not write. A team wants a large language model without renting one by the token, so it reaches for a model described as open, downloads the weights, runs them on its own hardware and tunes them on its own data; it holds the finished loaf and almost nothing about how the loaf was made. A set…
Security Review, the third and last of three Fridays on what makes a server operating system dependable, and the close of the Boring on Purpose series. When one of these surfaces finally gives, who patches it, and how fast can you trust the patch? On 1 July 2024 Qualys published regreSSHion, CVE-2024-6387, a signal-handler race in OpenSSH's server. On FreeBSD it was answered in one advisory,…
Lean Software, the fifth of eighteen Wednesdays on how we got here, and the close of the diagnosis. This week takes the fourth of the four breaks, the layers, the subtlest of them, because layering is not a mistake but one of the genuinely good ideas in the field. In 1968 Edsger Dijkstra described the THE multiprogramming system as a strict hierarchy of levels, each built only on the one below, a…
Unix Universe, the second of four portraits of the Unix family, one branch per Monday. If the certified Unixes are a register of strangers who happen to share a word, the BSDs are the opposite problem, and the more interesting one: a family that forked as sharply as any, more than once out of a plain falling-out, and stayed a single thing. Fragmentation is supposed to be what forking produces, and…
IT Philosophy, the first of three Sundays on what we can no longer read, one layer above the silicon the previous series ended at. The scene has become a genre: at three in the morning a service is doing the wrong thing, someone runs git blame, a name appears, and the colleague it names admits they do not know why the line is the way it is, because they did not write it, they accepted it.…
Security Review, the second of three Fridays on what makes a server operating system dependable, and the difference between a capability that was planned and one that was retrofitted. eBPF lets you load a program that the kernel compiles and runs in Ring 0, and the only thing between that program and the kernel is a static analyser called the verifier, which proves it cannot touch what it should…
Lean Software, the fourth of eighteen Wednesdays on how we got here, and the third of the four breaks, the one most often mistaken for good practice rather than a workaround. In November 2009 Ryan Dahl presented Node.js at JSConf EU: a single-threaded event loop with non-blocking I/O, a genuinely good answer for an I/O-bound workload. It did not stay confined to that question; within a few years…
Unix Universe, the first of four portraits of the Unix family, one branch per Monday. On the last day of 2025 a certified Unix died: HP-UX 11i v3 reached end of support on 31 December, its Open Group certificate worthless once Intel's last Itanium (2021) left it nowhere to run. A certified Unix is one whose vendor paid The Open Group to be measured against the Single UNIX Specification, at UNIX 03…
IT Philosophy. Perfectionism, as the industry practises it, is the chase for the last ten per cent, and that last ten per cent costs more than the ninety that came before it; the polish rarely earns out because everything has a shelf-life, and the month spent perfecting a corner is gone when its span of validity ends. The word itself is a misnomer: the person who builds everything to the maximum…
Security Review, the first of three Fridays on what makes a server operating system dependable, judged through security by the trouble it does not invite. In 2023 Google switched io_uring off: out of ChromeOS, restricted in Android, disabled on its own production servers. The reason is a number: of the Linux kernel exploits submitted to Google's bounty in 2022, about six in ten exploited io_uring,…
Lean Software, the third of eighteen Wednesdays on how we got here. Last week took the count on its own; this week takes the second of the four breaks, the one the count quietly sets up. A node_modules directory has no responsibility line, and the security cost of that absence is one the architecture cannot fix. The instinct is to audit, read them, scan them, pin them, sign them, and as a primary…
Unix Universe, the third and last of three Mondays on what Unix is. Where Unix came from. The fifty-seven-year arc reduces to four small moments between 1969 and 1994. In the late 1960s AT&T's Bell Labs withdrew from the overrun Multics project; Ken Thompson, back from that work, found a little-used DEC PDP-7 minicomputer going spare and began a much smaller system. Brian Kernighan, by his own…
IT Philosophy, the third and last of three on European software sovereignty. The first Sunday mapped the licence layer, the second the architectural layer; this one reaches the floor they both rest on, the silicon. Below the operating system run three layers no licence reaches. The system firmware (UEFI, the modern BIOS) boots the machine; on some hardware the open coreboot can replace it, on most…
Security Review, Friday 19 June 2026. Between 01:12 and 02:39 UTC on 17 June, a dormant contributor account whose publishing rights to the @mastra npm scope were never revoked republished 144 packages, each with one added dependency: easy-day-js, a typosquat of dayjs. Its postinstall hook ran a cross-platform infostealer that swept browser data, 166 cryptocurrency wallet extensions, SSH keys and…
Lean Software, the second of eighteen Wednesdays on how we got here. Last week set out four things that broke at the same time in the modern web stack; this week takes the first on its own. The count: the fact that an ordinary install brings several hundred megabytes of code, a hundred-thousand-file directory and a fifteen-hundred-package transitive closure to a project that has not yet run a…
Unix Universe, the second of three Mondays on what Unix is. Last Monday's piece mapped where Unix runs in 2026; this one asks what it takes to be called Unix at all. Unix is not a vibe, it is a registration. The trademark UNIX belongs to The Open Group, a standards consortium based in the United States and the United Kingdom, which has kept the mark since 1996, when it was formed from the merger…
IT Philosophy, the second of three on European software sovereignty. Three properties travel under the single banner of open source and are not the same: permission (may I read, modify, fork this, answered by the licence), forkability (can I hold a local tree at a cost I can bear, answered by the architecture), and jurisdiction (who governs the upstream and under whose law, answered by the…
Security Review, Friday 12 June 2026. On 29 April 2026 a researcher at Theori disclosed CVE-2026-31431, named Copy Fail: a Linux kernel flaw that lets an unprivileged local user become root. The full exploit, written in standard Python, fits in roughly 732 bytes. It does not race. It does not crash. It runs on Ubuntu 24.04, Amazon Linux 2023, Red Hat Enterprise Linux 10.1, SUSE 16, Debian, Fedora,…
Lean Software, the first of eighteen Wednesdays on how we got here. Open a fresh terminal. Pick the most common starting point for a modern web project, the one a bootcamp will tell you to take this week: npm create vite@latest my-app, template react-ts. Three minutes later, npm install settles. The shell returns. The project has not yet run. What is on disk: roughly 250 to 400 megabytes for the…
Unix Universe, the first of three Mondays on what Unix is. Open the laptop in front of you. If it is a Mac, you are on certified Unix; every version of macOS from 10.5 Leopard (2007) through 15 Sequoia (2024) has been certified by The Open Group as conforming to UNIX 03. The phone in the pocket is Darwin underneath, the same family. The Netflix stream you watched on Friday came off an Open Connect…
IT Philosophy, the first of three on European software sovereignty. A great deal of procurement language at the moment treats open source as a sovereignty answer; the reasoning is that proprietary cloud providers are foreign-jurisdiction firms, open source is by contrast open, therefore open source is sovereign. The conclusion is louder than the premises warrant. Open and owned are not the same…
An editorial pivot post. After almost two hundred posts written under nine series labels (Technical Beauty, The Unix Way, By Design, In the Net, Not in the Brief, On Second Thought, Tales from the Bare Metal, Bytes of Art, The Invoice), the labels are coming off. None of the old bodies of work go away; the archive stands and the pieces remain readable, but no new pieces are being written under…
In the Net Episode 06. On 10 August 2023 HashiCorp announced that all future releases of Terraform, Vault, Consul, Nomad, Packer, Boundary, Waypoint and Vagrant would move from the Mozilla Public License v2.0 to the Business Source License v1.1; there was no consultation, the announcement was a press release. Forty-one days later, on 20 September 2023, the Linux Foundation accepted OpenTofu, a…
By Design Episode 07. In the summer of 1969 Ken Thompson had three weeks of uninterrupted time at Bell Labs while his family was visiting California, an empty PDP-7 with four kilobytes of memory and the lingering question of what a smaller, cleaner operating system might look like. By the end of those three weeks he had written the first version of what became Unix; with Dennis Ritchie and Rudd…
Tales from the Bare Metal Episode 06. At 09:30 on 1 August 2012 the New York Stock Exchange opened the Retail Liquidity Program; by 10:15 Knight Capital Group, one of the largest market makers on American equities, had ceased to function as a going concern. The forty-five minutes between cost the firm roughly $440 million in realised pre-tax loss, required around $400 million of emergency capital…
Technical Beauty Episode 38. A maintainer sends you a fix; not a branch on a server, not a pull request awaiting a token, not an invitation to fetch a remote you have not heard of, but a text file with plus signs and minus signs and a few lines of plain context around them, attached to an email or pasted into an issue. You drop it onto your tree, type one command, and your code is current; no…