Dictionary

Name: Integrated by Design
ISBN: 978-3-9828652-0-1

Short, precise definitions of IT terms and people referenced across this site. Hover any highlighted term in a blog article to see its definition. Click to jump here.

Terms

4klang: A modular software synthesiser for 4k intros, written by Dominik Ries and Paul Kraus of Alcatraz and released in June 2009. It compiles into the executable and generates the music while the intro plays, which is how a four-kilobyte production can carry a soundtrack.

64K intro: A demoscene production whose entire compiled program must fit within 65,536 bytes (64 KB). Everything the viewer sees and hears is generated from that code at runtime, since there is no room to store textures, models or audio.

4K intro: A demoscene production limited to 4,096 bytes in total. Everything visible and audible is computed by the program itself.

10-K: The annual report a company listed in the United States files with the Securities and Exchange Commission: audited accounts, risk factors and the line items, such as sales and marketing against research and development, that show what a software firm actually spends its money on.

4.4BSD: The last Berkeley release of BSD Unix, from 1993 and 1994, ancestor of FreeBSD, NetBSD and OpenBSD; the sysctl interface first appeared there.

A

ambient occlusion: A shading effect that darkens corners and crevices where less light would reach. In sphere tracing it is approximated from how close a ray passed to surfaces on its way, at almost no cost.

Akronyme Analogiker: A demogroup with Amiga roots that signs its readmes as the paladins of procrastination; its work runs from an Amiga invitation for Evoke 2018 to a Commodore PET demo in 2024, and its 4K intro Hartverdrahtet won the PC 4K competition at Revision 2012.

ARP: Address Resolution Protocol. Maps an IPv4 address to the MAC address of the machine that holds it on the local network; neighbours keep the answers in their ARP cache.

apt: The Advanced Package Tool, the package manager of Debian and Ubuntu, which installs packages from the archives and repositories an administrator has configured.

Application Streams: Red Hat's mechanism, since RHEL 8, for offering several versions of the same software, such as PostgreSQL or PHP, on one operating system release, each with a published end of support. New streams arrive with the point releases.

Azure: Microsoft's public cloud platform, launched in 2010.

Amazon: The American company whose cloud division, Amazon Web Services, began renting virtual machines through EC2 in 2006 and remains the largest public cloud.

agent pipeline: A chain of language models, or of functions wrapped around them, in which one model's output becomes the next one's input and the chain decides what happens next without a person reading in between. Where the models pass prose, each reader interprets whatever the previous writer happened to say.

Alcatraz: A demo group founded on the Amiga in Switzerland in 1988 and later active on the PC. Its members wrote 4klang, the synthesiser widely used in 4k intros.

Approximate: Demoscene group whose 64k intro Surge Response placed fourth in the PC 64k competition at Revision 2017, thirty-two points ahead of H - Immersion and fifty behind Engage.

AB 316: A 2025 California statute, signed in October 2025 and in force from January 2026, barring a defendant who developed, modified or used an artificial-intelligence system from arguing that the system autonomously caused the harm. It removes the machine-did-it defence without creating strict liability.

ABI: Application Binary Interface. The low-level contract between a binary and the operating system: syscall numbers, calling conventions, data layout. Determines which binaries run on which kernel.

accton: The command that switches on process accounting, after which the kernel records every process that runs along with the resources it used. Read back with sa and lastcomm, it answers what ran and what it cost.

ACID: Atomicity, Consistency, Isolation, Durability. The four guarantees a database transaction must provide for reliability.

ACME: Automatic Certificate Management Environment. The protocol Let's Encrypt uses to issue and renew TLS certificates without manual intervention.

advertising clause: The third condition of the original four-clause BSD licence, requiring that advertising materials acknowledge the University of California. Berkeley struck it on 22 July 1999 because the acknowledgements had become unmanageable as BSD code spread.

AGPL: Affero General Public Licence. A copyleft licence that closes the GPL's network gap: if users interact with the software over a network, they must be offered its source. Written for server-side software the GPL's distribution trigger never reached.

AI bill of materials: A proposed provenance record, an AI-SBOM, that tags each generated component with the model that produced it, along with the prompt and generation metadata, so a line can later be traced to its origin. An emerging practice rather than a settled standard.

alert fatigue: The condition in which operators stop reacting to alarms because too many of them are wrong, late or irrelevant. Usually described as a human failing, though a fair share of it originates in query expressions that return plausible but incorrect numbers.

Alexandra Noonan: The engineer who wrote up Segment's return from more than 140 services to a single one in July 2018, in unusual detail and including what the move cost them. The write-up remains the reference work on the subject.

Alpine: A small, security-oriented Linux distribution built on musl and BusyBox rather than glibc and GNU coreutils. Widely used as a minimal container base image. One of the userlands that share the Linux kernel and little else.

Alpine.js: A lightweight JavaScript framework, around ten kilobytes, for adding client-side behaviour directly in HTML attributes. A smaller, declarative alternative to the large single-page-application frameworks.

amalgamation: The single C source file, together with one header, into which the whole of SQLite is concatenated for distribution. It compiles as one translation unit, which lets the compiler optimise across what would otherwise be file boundaries, and it means the library arrives as one artefact with one provenance rather than as a tree of sources to be assembled by whoever builds it.

Amazon EFS: Amazon's managed shared file system, launched in 2016. It speaks NFSv4.1 on the wire, replicates across availability zones and is billed per gigabyte-month; the Standard tier costs 0.30 dollars per gigabyte-month against 0.08 for gp3 block storage in the same region.

Amazon SES: Amazon's Simple Email Service, the cheapest of the large providers at ten cents per thousand messages a la carte and sixteen cents on the entry plan, with attachment data billed separately.

Amiga: Commodore's 16-bit machine of 1985, with custom chips for graphics and sound that made smooth scrolling and multi-channel music routine. The platform on which the demoscene came of age.

Andrew Tanenbaum: The computer scientist who wrote MINIX in 1987 as a teaching operating system, and Linus Torvalds' opponent in the well-known 1992 debate over microkernel versus monolithic kernel design.

Andromeda Software Development: Greek demogroup, founded in the early 1990s, whose demo LifeForce won the combined demo competition at Assembly 2007.

Ansible: An agentless automation tool for configuration management, application deployment, and orchestration. Uses YAML playbooks over SSH.

Anthropic: American AI company. In June 2026 it complied with a US Commerce Department directive to suspend its two most capable models for all foreign nationals, three days after launch, withdrawing them from every customer. Cited as evidence that the institutional lever reaches proprietary, paid software as readily as open source.

Apache 2.0: A permissive open-source licence with a patent grant and no copyleft, granting broad rights to use, modify and distribute. Applied to a model's weights, as with Mistral's 2026 flagships, it removes licence restrictions but still grants only the numbers, not the training data or pipeline.

apropos: The command that searches manual page descriptions by keyword. On FreeBSD it is the same binary as mandoc, reading the index that makewhatis wrote.

ASIL D: The highest automotive safety integrity level of ISO 26262, applied to functions whose failure would most likely be fatal. Certification at that level requires a bounded, provable worst case, which is what a small kernel with drivers outside it is built to deliver.

aTom: Demoscene handle of a farbrausch graphician, credited on fr-063: Magellan and the member who pointed people towards the hidden parts in the settings window.

AUTH_SYS: The default authentication flavour of NFS, in which the client simply states which numeric user and group identifiers it is acting for and the server takes it on trust. It authenticates nothing, which is why identifiers must be kept synchronised across every host that mounts a share.

automounter: A daemon that mounts remote filesystems on demand when a path is first touched and unmounts them after idling, so a machine need not hold every share open permanently. On FreeBSD this is autofs, configured through auto_master.

Azure NetApp Files: Microsoft's managed file service built on NetApp technology, offering NFSv3 and NFSv4.1 volumes alongside SMB, commonly used to back ReadWriteMany volumes in Azure Kubernetes Service.

bill of materials: In software, the inventory of every component a product contains, with versions and origins. The machine-readable form is known as an SBOM. The Cyber Resilience Act makes one mandatory for products on the Union market from 11 December 2027.

blacklistctl: The control and query tool for blacklistd. blacklistctl dump -a lists every address the daemon currently holds along with its failure count and the time the block expires, which makes it the quickest way to find out whether a machine has been quietly defending itself without anyone noticing.

central syslog: An arrangement in which every machine forwards its log messages to one collector, so a fleet's events sit in a single place. One line on the clients and one flag on the collector, both in the base system.

CRA: Short for Cyber Resilience Act, the EU regulation on products with digital elements. Its reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and its essential requirements, including the bill of materials, from 11 December 2027.

Crinkler: A compressing linker for small Windows executables, by Loonies and TBC. It replaces the ordinary linker, compresses as it links using context modelling, and carries a decompressor of roughly 220 bytes that counts against the same size budget.

CSIRT: Computer Security Incident Response Team. Under the Cyber Resilience Act each member state designates one as coordinator, and manufacturers file their notifications of actively exploited vulnerabilities with it and with ENISA through a single reporting platform.

date-fns: A JavaScript library of small, individually importable functions for parsing, formatting and calculating with dates, widely used as a lighter alternative to Moment.js.

epoll: The Linux event notification interface, introduced in 2002. Watches file descriptors and leaves timers, signals and file events to separate mechanisms, which is why it is a smaller body of code than kqueue: 1,615 lines without comments against 2,709. Three system calls rather than two.

exporter: A small program that translates a system's own numbers into the format a metrics collector expects. It adds an agent to every machine being watched, which is one of the layers a self-contained approach avoids.

exports: The FreeBSD configuration file, documented in section five of the manual, that lists which filesystems an NFS server publishes and to which clients, with the options governing each export.

farbrausch: A German demoscene group formed in 2000, known for extreme size reduction and for building its own tools rather than using others'. Produced .kkrieger, a first-person shooter in 96 kilobytes, and the werkkzeug tool chain. Released most of its tools and several productions on GitHub in 2012 under a BSD licence.

fault isolation: The property that a failure in one component cannot take the others down with it. A genuine benefit of splitting a system up, and the thing Segment knowingly gave up when it moved back to one service.

golden snapshot: A filesystem snapshot of a known-clean state, used as the starting point for repeatable measurements. Rolling back to it before each run guarantees that nothing from earlier work contaminates the result.

Google Cloud Filestore: Google's managed file storage service. It speaks NFS and nothing else, offering no SMB option at all, which makes the underlying protocol unusually visible for a managed product.

gp3: Amazon's general-purpose SSD volume type for EBS, attached to a single instance and priced at 0.08 dollars per gigabyte-month in Northern Virginia. The block-storage baseline against which shared file storage is measured.

groff: GNU roff, the GNU project's implementation of the troff typesetting system. It renders manual pages among many other document types, with eight preprocessors and eight output devices, and its helper scripts require a Perl interpreter.

hard mount: An NFS mount option under which processes touching an unreachable server wait indefinitely, in a state that resists interruption. Safe for data integrity, and capable of freezing a room full of machines that were only listing a directory.

integrity hash: A cryptographic checksum stored for each dependency in a lock file, which lets the package manager verify that a downloaded package is byte for byte the one originally resolved. It proves what arrived, and says nothing about who published it.

kb: Demoscene handle of Tammo Hinrichs, farbrausch musician and coder, known for the V2 software synthesiser. Credited with additional help on fr-063: Magellan and with melwyn for the music of its hidden parts. Not added to the auto-linking database because the two letters collide with ordinary use.

Kerberos: A network authentication protocol from MIT in which a trusted third party issues time-limited tickets, so machines can prove who they are without sending passwords across the wire. The proper answer to NFS identity, at the cost of running a realm.

lastcomm: Prints the accounting record of recently executed commands: which program, which user, how much processor time, at what hour. Forensics for the question of what was running when the machine misbehaved.

lock file: A file written by a package manager that pins the exact version, source and checksum of every installed dependency, so that a later install reproduces the same tree. For npm it is package-lock.json, which records what was installed and has no field for who maintains it.

Log4Shell: The remote code execution vulnerability in the Java logging library Log4j, disclosed in December 2021 as CVE-2021-44228. Its reach through transitive dependencies made it the standard example of how long organisations take to find out what their software actually contains.

makewhatis: The program that walks a manual tree, parses every page and writes the index that apropos and whatis search. On FreeBSD it is the same binary as mandoc, invoked under a different name.

manual page: A manual page: the reference document for a command, system call, library function, file format or driver, shipped with the software it documents and readable offline with the man command.

Mandelbulb: A three-dimensional analogue of the Mandelbrot set, found in 2009 by raising spherical coordinates to a power. Popular in graphics work because it produces intricate organic surfaces from a short formula and no stored geometry.

mandoc: A compiler for manual pages, written in C under the ISC licence and begun by Kristaps Dzonsons in November 2008. It parses the mdoc and man macro languages semantically rather than running them through a general typesetting engine, and it ships in the base systems of FreeBSD, OpenBSD, NetBSD, DragonFly, illumos and macOS.

marching cubes: An algorithm that turns a field of numbers into a surface: space is divided into cubes, each corner is tested for being inside or outside, and a triangle patch is fitted to the boundary. The standard way to draw a simulated liquid or a fractal solid, since neither has a mesh of its own.

maxretry: The fail2ban setting that determines how many matching failures from one source within the observation window are required before the configured action fires. The default for SSH is commonly three.

mbuf: The FreeBSD kernel's buffer structure for network data. Drew Gallatin's work on external-page and not-ready mbufs is part of what lets a single machine serve four hundred gigabits per second.

mdoc: The semantic macro language BSD manual pages are written in. It first appeared as a troff macro package in 4.4BSD and describes what each element is, a command name or a flag or a file path, rather than how it should look.

melwyn: Demoscene handle of a farbrausch musician, credited with kb for the music of the hidden parts in fr-063: Magellan.

mount_nfs: The FreeBSD command that attaches a remote NFS filesystem to the local directory tree. Part of the base system rather than any package, which pkg which will confirm.

Munin: A light-weight monitoring system that collects values from nodes and draws graphs on a web page. Master and node together weigh 2,533,160 bytes on FreeBSD, doing the graphing job for which much heavier stacks are usually installed.

NetBSD: A BSD operating system descended from 386BSD, known for running on an unusually wide range of hardware architectures. Adopted kqueue from FreeBSD, one of the five kernels that ship it.

node_exporter: The Prometheus agent that reads a host's own counters, processor time, memory, disks and network, and serves them over HTTP for a collector to scrape. It reports the state of the machine and carries no process names, which is why a metric can show a pinned core without naming what pinned it.

object store: Storage addressed by key rather than by path, where a write replaces a whole object and there is no notion of opening a file, seeking within it or locking it. Excellent for write-once read-many workloads, awkward as a substitute for a shared filesystem.

octree: A tree in which each node divides space into eight smaller boxes. Used to avoid work in empty regions: a renderer or a simulation descends only into the boxes that contain something.

Open Connect: Netflix's own content delivery network, built from appliances that the company places inside internet providers. The software on them is FreeBSD, and the kernel work done for them went back into the FreeBSD tree.

open-source steward: A category introduced by the Cyber Resilience Act for legal persons, typically foundations, that support free software intended for commercial use without being its manufacturer. Stewards carry lighter obligations than manufacturers and are not subject to administrative fines.

packet filter: Software that inspects network packets against a ruleset and decides whether each may pass. A stateful filter also remembers the connections it has admitted, which is what allows a short ruleset to cover both directions of traffic.

pfctl: The single administrative interface to pf: it loads a ruleset, shows the active rules, manipulates tables and reports state. The -n flag parses a configuration and reports on it without applying anything, which is what makes editing a firewall on a live machine survivable.

pfsync: A FreeBSD and OpenBSD pseudo-interface that replicates the pf state table between machines. Paired with carp it allows a failover in which established connections continue through the second machine, because the new machine already knows about them. Entered FreeBSD in 5.3, the same release that brought pf.

pNFS: Parallel NFS, introduced with version 4.1, which separates metadata from data so that a client can read and write across many storage servers at once rather than funnelling everything through one.

PromQL: Prometheus's query language, used to select time series and compute rates, percentiles and aggregations across them. Powerful within Prometheus and portable nowhere else, which makes it a skill that stops paying the day a house changes tooling.

raymarching: A rendering technique that draws a scene by stepping a ray out from the camera until it reaches a surface, using a function that gives the distance to the nearest object. It needs no stored geometry, which is why size-limited productions rely on it.

ReadWriteMany: A Kubernetes persistent volume access mode allowing many nodes to mount the same volume for writing at once. A single block device cannot serve it safely, so the driver underneath is nearly always NFS.

Rebels: A Danish demoscene group active since the Amiga era, still releasing on PC. Took second place at The Ultimate Meeting 2010 with Rumours And Facts, thirty-two points behind farbrausch.

recharts: A charting library for React that builds SVG charts from composable components, and a common dependency in dashboards and admin interfaces.

RFC 1094: The 1989 specification in which Sun published NFS version 2 openly, letting anybody implement the protocol without a licence. The decision that turned a workstation feature into an industry default.

RFC 8881: The specification of NFS version 4.1, covering sessions, delegations and parallel NFS. The version that the managed cloud file services speak on the wire.

roff: The family of text formatting languages descended from RUNOFF, in which Unix manual pages have been written since 1971. A roff document is plain text interspersed with macro requests that begin with a full stop.

RPCSEC_GSS: The security framework that lets NFS use Kerberos for real authentication, integrity and privacy instead of trusting the client's word. Correct and rarely deployed, because standing up a Kerberos realm is a project rather than an afternoon.

ryg: Demoscene handle of Fabian Giesen, coder in farbrausch and later a graphics programmer in the games industry. Wrote much of the group's compression and tooling work, and published the group's source repository in 2012.

S3: Amazon's object store, addressed by key rather than by path. Excellent for write-once read-many data, and a poor place to hand frames between components, since every handover becomes a paid request.

SBOM: Software Bill of Materials. A machine-readable inventory of the components and dependencies in a software product, typically in SPDX or CycloneDX format. SBOM tools produced clean reports for the backdoored XZ versions, illustrating that bills of materials list packages but do not audit them.

self-pipe trick: An old Unix idiom for waking a process that is blocked waiting on file descriptors: create a pipe, add its read end to the set being watched, and write a byte to the write end from a signal handler or another thread. Retired on BSD by EVFILT_USER, which lets one thread wake another through the queue it already waits on.

sharenfs: A ZFS dataset property that publishes the dataset over NFS. Setting it makes the pool itself the record of what is shared, so the filesystem and the share cannot drift out of step.

SMB: The file sharing protocol of the Windows world, also implemented by Samba on Unix systems. The alternative to NFS in mixed environments, and notably absent from Google Cloud Filestore.

smoothed particle hydrodynamics: A way of simulating a liquid by treating it as a crowd of particles, each of which asks the particles near it what they are doing and adjusts accordingly. Pressure, viscosity and gravity fall out of those local exchanges. The expensive part is finding the neighbours, usually solved with a spatial hash.

soft mount: An NFS mount option under which operations return an error instead of waiting when the server stops answering. Kinder to the machine and dangerous for applications never written to expect a failed read.

spatial hashing: A way of finding which objects are near each other without comparing every pair: space is chopped into cells, each object is filed under the cell it falls in, and neighbours are looked up cell by cell. Turns a quadratic problem into something close to linear.

state table: The record a stateful packet filter keeps of connections it has already decided about, so that the reply traffic of a permitted connection needs no rule of its own. It is also the part that makes a firewall failover hard: without the table, the standby machine drops every session in flight.

Step Functions: An AWS service that coordinates other services as a state machine, paying per state transition. Convenient for orchestrating small pieces, and the meter runs on every step, which is what made Prime Video's frame-by-frame pipeline expensive.

strongSwan: An open-source IPsec implementation and the usual reference point when IPsec is compared with newer tunnels. Its source tree runs to roughly 395,000 lines, which is the price of the standard's breadth.

chaos: Demoscene handle of the farbrausch coder who wrote the simulation side of fr-063: Magellan, including the smoothed particle hydrodynamics and the memory management behind the blob geometry. Not added to the auto-linking database because the word appears in ordinary prose elsewhere.

Curve25519: An elliptic curve for key exchange, also by Bernstein, offering strong security at a 32-byte key size. WireGuard uses it for the handshake, which is why a peer's public key fits on one line of a configuration file.

apEx: The demotool built by the Hungarian group Conspiracy, developed between the summer of 2010 and the spring of 2021 and used for eight of their productions between 2014 and 2023. Its source was published in November 2023 under a Creative Commons non-commercial licence, with the stated intent that others could learn from it.

apk: The package manager of Alpine Linux: small, fast and built for the distribution's musl and BusyBox userland.

AppArmor: A mandatory access control system for Linux that confines programs by path-based profiles, generally regarded as simpler to configure than SELinux and correspondingly less granular.

AppImage: A Linux application format that bundles a program and its dependencies into a single executable file, which is why it runs on any distribution and why its bundled libraries are only ever updated when the author rebuilds it.

ARC: The Adaptive Replacement Cache, ZFS's page cache. It replaces the least-recently-used algorithm most filesystems use with one weighing both recency and frequency, and it returns memory to applications on demand.

Arch: A rolling-release Linux distribution following a minimalist, do-it-yourself philosophy. Ships current packages continuously rather than in fixed versions, leaving system composition to the user. Like every distribution, an assembly of independently-governed projects rather than a single tree.

architecture sniffer: A rule engine that checks whether code respects the intended layering and module boundaries of a framework. Necessary wherever the architecture is a convention that the framework itself cannot enforce.

ARM: A processor instruction-set architecture designed in Cambridge and licensed, core by core, to chip makers worldwide; the most widely deployed ISA on Earth, owned since 2016 by Japan's SoftBank.

AS IS: The capital-letter clause in nearly every software licence declaring that the software comes without warranty of any kind. It is the industry's founding document on liability: the user accepts the artefact in whatever state it arrives.

ash: The Almquist shell, a compact POSIX shell of BSD origin; BusyBox ships a variant of it as /bin/sh on Alpine and most minimal container images.

Assembly: One of the oldest and largest demoparties in the world, held in Finland since 1992 and traditionally in Helsinki, with competitions for demos, intros, music and graphics.

async runtime: A library that drives non-blocking, event-driven tasks and schedules them across all cores inside one process, giving a language the concurrency for which a container is often used as a substitute. Tokio is the common one for Rust.

automerge: A configuration option in dependency bots such as Renovate and Dependabot that merges a pull request automatically once the required checks pass, with no human interaction at the moment of merging.

awk: A pattern-matching and text-processing language created by Alfred Aho, Peter Weinberger and Brian Kernighan at Bell Labs in 1977. The name is an acronym of the authors' surnames. The language has remained substantially unchanged for nearly fifty years and ships in every Unix-like operating system.

AWS: Amazon Web Services. The dominant cloud computing platform offering IaaS, PaaS, and managed services.

AWS Amplify: Amazon Web Services' platform for building and deploying modern front-end and full-stack applications, alongside Vercel and Netlify in the deployment-economy tier whose business depends on the heavy stack.

APM: Application performance monitoring. The layer of an observability platform that traces requests through an application, listed by Datadog at thirty-one dollars per host per month.

AsiaBSDCon: An annual conference on BSD-based operating systems, held in Tokyo. The venue for the 2024 paper benchmarking DTrace on FreeBSD against eBPF on Linux.

B

Brainstorm: A demogroup; Shoal, with Traction, took second place in PC 4K at Revision 2012.

backports: Newer versions of selected packages, rebuilt for an older stable release. In Debian they live in a separate archive section that an administrator enables deliberately, and they cover a small part of the archive.

BASIC-CLOUDINIT: The family of official FreeBSD virtual machine images prepared for clouds. They switch nuageinit on in rc.conf and add a single package, firstboot-freebsd-update, so that the first boot fetches security fixes.

Babel: A JavaScript compiler that transforms modern or non-standard syntax into widely-supported JavaScript. A near-universal part of the standard front-end toolchain, alongside Webpack, ESLint and Jest.

backdoor: A hidden path into a system, placed deliberately and designed to survive review. The xz incident of 2024 is the reference case for a backdoor delivered through maintainership rather than through code injection.

Banno: A digital banking platform, part of Jack Henry, whose engineering team published a production account of using import maps for cache management, reporting that unchanged parent files keep their hashes and their cached copies while the map points them at new children.

Base System: In FreeBSD and the other BSDs, the kernel, C library, userland utilities, documentation, toolchain and release-engineering process maintained together in one source tree by one project and shipped as one tested snapshot. Contrasts with a Linux distribution, which assembles several hundred independently-governed projects. Base means what is shipped together; system means integrated whole.

base image: The distribution layer a container is built on top of, such as Debian or Alpine, carrying a userland, package manager and its own attack surface into every image derived from it.

Bash: The GNU Bourne-again shell, the default interactive shell on most Linux distributions. Its conveniences, arrays, process substitution, double brackets, go beyond POSIX sh and fail on stricter shells.

BBR: Bottleneck Bandwidth and Round-trip propagation time, a congestion control algorithm that models the path rather than reacting to packet loss. Developed at Google and available in FreeBSD alongside RACK.

Bell System Technical Journal: The research journal of Bell Labs, published from 1922 to 1983. Its July to August 1978 issue was devoted to Unix and opened with the foreword by McIlroy, Pinson and Tague that set down the rules later quoted as the Unix philosophy.

Berkeley: The University of California, Berkeley, and in particular its Computer Systems Research Group, where the Berkeley Software Distribution was developed from the late 1970s. The second wellspring of Unix after Bell Labs; the BSD family carries Berkeley's code to this day.

Berkeley Software Design: Berkeley Software Design Inc. (BSDi), the commercial spinoff that sold a Net/2-based product from 1992 and was sued by AT&T's Unix System Laboratories in USL v. BSDi.

Berkeley Software Distribution: The line of Unix begun in 1977 by Berkeley's Computer Systems Research Group as modifications to AT&T Unix; over fifteen years it became a fully alternative line, 1BSD through 4.4BSD, and the root of today's FreeBSD, NetBSD, OpenBSD and DragonFly.

Big Sleep: A vulnerability-research agent built jointly by Google Project Zero and Google DeepMind, which reads source code and reasons about it rather than mutating inputs. In October 2024 it found a stack buffer underflow in a development build of SQLite, in a function where a sentinel value of minus one reaches a field the surrounding code assumes will be positive. Google's own team had already spent 150 CPU-hours fuzzing the same code without result; SQLite fixed the fault the same day and no release ever carried it.

Bionic: Android's C library and low-level runtime, used in place of glibc. One of several userlands that share the Linux kernel and little else, alongside GNU, musl and BusyBox.

BIOS: The traditional system firmware that initialised a PC at power-on before handing control to the operating system; today largely replaced by UEFI.

Black Valley: Norwegian demoparty held at Blaker Samfunnshus, the community hall in Blaker near Lillestrøm, east of Oslo. Its fifth edition ran from 10 to 12 July 2026, organised by Menace with a team of fourteen.

Blink: The browser engine of Chrome, Edge and Chromium-based browsers, forked from WebKit in 2013. Through WebKit it descends from KDE's KHTML, which makes the major system web views relatives rather than unrelated implementations.

boot environment: A bootable snapshot of an entire operating system. On FreeBSD bectl creates one before an upgrade, so a failed upgrade is undone by selecting the previous entry at the boot menu.

BPF: Berkeley Packet Filter. Originally a packet capture mechanism, extended in Linux as eBPF for programmable kernel-level filtering. Used by seccomp-bpf to inspect and decide on every syscall at runtime.

branch coverage: A test-coverage measure asking whether each conditional in the code has taken both its outcomes at least once during testing. It is stricter than line coverage, which only asks whether a line ran at all, and considerably weaker than MC/DC, which additionally asks whether each individual condition inside a compound decision could be shown to matter on its own.

branch protection: The per-branch rule set governing what a pull request must satisfy before it may be merged: required status checks, required approvals, linear history. It holds the switches that decide whether an approval means anything.

Branch Target Reuse: A Spectre-v2 variant published by VUSec and Scuola Superiore Sant'Anna on 29 September 2026 (CVE-2026-64507, CVE-2026-64508). It exploits stale branch-predictor state left behind when a just-in-time compiler reuses memory for new code, and recovered a root password hash from a fully patched Intel Linux machine in minutes through the classic BPF JIT. The reason a kernel that assumes the worst about its predictor is not being silly.

Breakpoint: The Easter demoparty held in Bingen am Rhein from 2003 to 2010, successor to Mekka and Symposium and in its day the largest pure demoscene event in the world. The Scene.org Awards were handed out there each year for the productions of the year before.

BSD Daemon: The mascot of BSD, a small red daemon with horns, a tail, sneakers and a trident, often called Beastie. Copyright 1988 Marshall Kirk McKusick.

Bureau of Labor Statistics: The United States government's statistics agency for employment and wages. Its Employee Tenure Summary of September 2024 put the median time an American worker had been with the current employer at 3.9 years.

Business Source License: A source-available licence, not an open-source one: the code is readable and usable except in competition with the licensor, and each release converts to a true open licence after a set period, typically four years. HashiCorp moved Terraform to it in August 2023, which produced the OpenTofu fork within days.

bus factor: The number of people a project can lose before nobody left understands it. Named on 29 June 1994, when Michael McLay asked the Python mailing list what would happen if Guido van Rossum were hit by a bus; also called the truck factor. A 2016 study of 133 popular GitHub projects put it at two or fewer for 65 per cent of them.

cryptokey routing: WireGuard's arrangement in which one line, AllowedIPs, serves as routing table outbound and access rule inbound. Identity and route become the same statement, so a peer cannot be authorised and misrouted at once.

Brotli: A lossless compression format published by Google in 2013 and supported by every current browser over HTTPS. It typically beats gzip by ten to twenty per cent on JavaScript and HTML, which is why library sizes are quoted after Brotli rather than raw.

Brute Force: An attack that tries credentials one after another until something works, usually automated and usually against a service reachable from the open internet. Against SSH it is less a threat than a constant background condition, which is why every hardening guide addresses it and why the cost of the chosen answer is worth measuring.

BSD: Berkeley Software Distribution. The line of Unix developed at the University of California, Berkeley from the late 1970s, and the family that descends from it today (FreeBSD, OpenBSD, NetBSD, DragonFly). Unix by inheritance, carrying the AT&T-and-Berkeley code in its source under a permissive licence.

BSDi: Berkeley Software Design Inc., the commercial spinoff that from 1992 sold a product based on Berkeley's Net/2; defendant in the USL v. BSDi lawsuit that ran 1992 to 1994.

bsdinstall: The FreeBSD system installer. Its hardening menu offers nine security switches at install time, none of them enabled by default, each landing in a readable configuration file.

build.rs: A Rust build script: arbitrary code a crate runs at build time, with full filesystem and network access under the developer's permissions. The reason Rust is not exempt from install-time code execution.

Bun: An all-in-one JavaScript runtime, bundler, transpiler, and package manager. Written in Zig, designed for speed.

Business Source Licence: A source-available licence that permits use for purposes the licensor names and forbids the rest, typically competing commercial hosting, with a clause converting the work to an open licence after a set period. Not approved by the Open Source Initiative.

BusyBox: A single small executable combining stripped-down versions of many standard Unix utilities, common on embedded Linux systems. Another userland that shares the Linux kernel with GNU, musl and Bionic.

blacklistd: A daemon in the FreeBSD base system that receives reports of failed authentication attempts directly from a service over a socket, counts them per source address, and adds offenders to a packet filter table once a threshold is reached. No log file is written or parsed at any point in that chain, because the reporting service passes the verdict it already holds rather than formatting it into text. Its entire configuration lives in blacklistd.conf, typically one line of seven fields per service. Originally written by Christos Zoulas for NetBSD and imported into FreeBSD in version 11.

blast radius: Everything an attacker reaches once a single component is compromised. In npm there is no privilege boundary between your code and its dependencies: a package's install script runs with your full user rights, so one compromised maintainer's blast radius is your shell, your environment, your SSH keys and your cloud tokens.

build step: The compile-and-bundle stage between source code and the artefact a web server ships: transpiling, bundling, minification, sourcemaps. No longer required by the platform itself, since browsers run ES modules natively; kept alive by tooling defaults and metered CI minutes.

bundler: A tool that combines many JavaScript source files, and often CSS and assets, into fewer optimised files for delivery. Rational under HTTP/1.1 and before native modules; the lineage runs Grunt, Gulp, webpack, Rollup, Parcel, esbuild, Vite, Turbopack, Rolldown.

build runner: The machine or container that executes a continuous integration job. Its memory holds the credentials the job needs, which is what the spring 2026 campaign lifted through an abused pull-request trigger.

Bitbendaz: A Swedish demogroup whose members include Stalvik, java, Comatron, Mygg, Dyrgrip, Optic and Leinonen. Their demo Laevitas won Best Soundtrack at the Meteoriks 2021.

breakbeat: An electronic music style built on syncopated, chopped drum loops rather than a straight four-to-the-floor beat. One of the tags Demozoo applies to Laevitas.

Berkeley Packet Filter: A small virtual machine in the kernel, published in 1992 by Steven McCanne and Van Jacobson, that decides which network packets are passed upward. Extended in 2014 into eBPF, which generalised it into a programmable runtime for the whole kernel.

C

cat: The utility that concatenates files to standard output; on FreeBSD it enters Capsicum capability mode after opening its inputs.

chmod: The utility and system call that change a file's permission bits; called on a path after creation it opens the gap of a TOCTOU race, which is why permissions are better set at creation.

cp: The utility that copies files and, with -R, directory trees; FreeBSD's cp.c carries a Berkeley copyright from 1988 and, in recursive mode, opens every destination beneath a handle on the target directory with O_RESOLVE_BENEATH.

capability mode: The state a FreeBSD process enters with cap_enter(), after which it cannot open files or sockets by name and can use only the descriptors it already holds, with rights it may narrow further; 46 programs in bin and usr.bin of FreeBSD 15.1 enter it, cat, echo, tee and uniq among them.

coreutils-from-gnu: The Ubuntu package that reinstates the GNU coreutils in place of the Rust-based default, installed with apt install --allow-remove-essential coreutils-from-gnu coreutils-from-uutils-, the flag being needed because the Rust package is the essential one.

Commodore PET: Commodore's first personal computer of 1977, with a built-in monitor and keyboard, and a demo target to this day.

Crionics: An Amiga demogroup of the early 1990s, co-author with The Silents of Hardwired.

crossover cable: A network cable that connects two machines directly, without a switch; pfsync(4) recommends one for the state traffic between two firewalls.

conntrackd: The daemon of the netfilter project that copies the Linux connection-tracking table to a second firewall, so that a failover keeps established connections. Usually wired to keepalived through a notify script; the counterpart of pfsync on FreeBSD.

command injection: A flaw in which input reaches a shell or an interpreter as part of a command, so that an attacker's text runs as code.

CARP: Common Address Redundancy Protocol. Lets several machines on one network segment share IP addresses, with the heartbeat in the kernel and no daemon. Written for OpenBSD 3.5 in 2004 after Cisco claimed patents on VRRP, imported into FreeBSD 5.4 and rewritten for 10.0; on FreeBSD the same interface also speaks VRRPv3. Works with pfsync for stateful firewall pairs.

container image: A packaged file system with an application and the user-space libraries it needs, run in isolation on a shared kernel. Each image carries its own copies of those libraries and has to be rebuilt to receive their fixes.

cloud-init: The de facto standard agent for configuring a cloud virtual machine from user data, begun at Canonical for Ubuntu on Amazon EC2 and written in Python. Version 25.1.4 has 69,102 lines of Python, 31 datasources and 59 modules, and runs at every boot to check whether the machine is still the same instance.

Chef: A configuration management tool written in Ruby, first released in 2009, which describes the desired state of a machine in recipes and applies them through an agent.

Canonical: The company behind Ubuntu, founded by Mark Shuttleworth in 2004. It has shipped a prebuilt ZFS module with Ubuntu since 16.04, on its reading that the licences permit it.

CentOS: Community Enterprise Operating System, a free rebuild of Red Hat Enterprise Linux first released in 2004. CentOS Linux 7 reached its end of life on 30 June 2024; its successor, CentOS Stream, tracks RHEL from upstream.

Certificate Transparency: Public, append-only logs into which certificate authorities record every TLS certificate they issue. They make mis-issuance visible and also announce every new hostname within minutes.

Chrome: Google's web browser, built on the Blink engine and shipped on a roughly four-weekly release train. Version 123 in March 2024 was the first to advertise zstd in its Accept-Encoding header, and only over HTTPS.

compatibility profile: The kind of OpenGL context, introduced with version 3.2 in 2009, that keeps the deprecated fixed-function features available beside the modern core profile.

conffile: A file that a Debian package marks as configuration. dpkg records an MD5 digest of it and, when both the administrator and a new package version have changed it, asks on upgrade which version to keep instead of merging the two.

Content-Encoding: The HTTP header that names the compression applied to a response body. A client lists what it can read in Accept-Encoding; gzip and br have been the common answers for years, with zstd joining them in 2024.

context switch: The act of saving one execution context and restoring another so a different thread or process can run. A message between two processes costs at least two of them, which is the price a microkernel pays on every call.

contrib: The section of the Debian archive for free software that cannot go into main, usually because it depends on something outside it. Debian carries ZFS there as source, to be compiled on the user's own machine.

Ctrl-Alt-Test: French demoscene group known for procedurally generated landscapes in size-limited productions. Their 64k intro H - Immersion placed fifth at Revision 2017 and is still cited as a reference for terrain generation inside the limit.

cache invalidation: The problem of ensuring that a client stops using a stored copy once the original has changed. Named by Phil Karlton as one of the two hard things in computer science, it does not disappear when a build step does; it moves to whoever owns the names of the files being served.

Caddy: A web server with automatic HTTPS via built-in ACME client. Written in Go. Often used as a reverse proxy.

Ambient Authority: The security property where a process inherits all the permissions of the user who launched it. The default Unix model since 1969. Capsicum eliminates it; seccomp restricts it.

backporting: Applying a fix from a newer upstream version to an older, frozen one, the maintenance model of enterprise Linux distributions. Done across dozens of independently maintained trees it is structurally hard, which is why a 2024 study counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel.

blocklistd: A FreeBSD daemon that blocks abusive network clients, the successor to blacklistd. Its integration into FreeBSD's OpenSSH introduced CVE-2024-7589, an unauthenticated root race: an integrated project planting a fault in the very act of integrating a component.

cap_enter: The FreeBSD system call that puts a process into capability mode. After it returns, the filesystem, the network namespace and the process table no longer exist for that process; only the file descriptors it already holds remain usable, restricted to the rights granted before the call. The transition is irreversible by design, which is what makes it trustworthy in a program whose input may be hostile.

Capsicum: A capability-based security framework in FreeBSD. One syscall (cap_enter) permanently removes all access to global namespaces. The process keeps only its existing file descriptors, each restricted via cap_rights_limit(). Irreversible. Compiled into FreeBSD 10.0 by default since 2014.

cargo-vet: A Rust supply-chain tool from Mozilla that requires human-reviewed audits of a crate before it is allowed into a build, so a dependency cannot enter a project unreviewed.

Casper: A FreeBSD daemon that supplies services to processes already running in capability mode, which by definition can no longer reach global namespaces themselves. Name resolution is the usual case: a sandboxed program hands the request to Casper through a capability rather than opening a socket. Casper's own services run sandboxed in turn.

CAST: The templating language used by CASTD. Five delimiter pairs for variables, conditions, slots, comments, and expressions.

CDDL: Common Development and Distribution Licence. Sun Microsystems' open-source licence, intentionally incompatible with the GPL. The licence under which ZFS was released.

certification mark: A trademark that certifies a product meets a defined standard rather than identifying its commercial source. UNIX is one: it may sit only on systems tested and approved against the Single UNIX Specification. Such a mark survives in law only by staying narrow, which is why The Open Group disowns loose use of the word.

cgroups: Control groups. A Linux kernel feature for limiting, accounting for and isolating the resource usage (CPU, memory, disk I/O, network) of a collection of processes. Originally contributed by Google engineers as 'process containers' in 2006, merged in 2007 and renamed cgroups, with cgroups v2 stabilised in 2016. The other half of the Linux containerisation stack alongside namespaces.

Cg: NVIDIA's C for graphics, a shading language of the early 2000s that compiles to both OpenGL and Direct3D. Rupture ships its 333 Cg shaders as plain text and translates them at startup, which is why the visual language of the production can be read without any source release.

ChaCha20-Poly1305: An authenticated stream cipher construction by Daniel J. Bernstein, standardised in RFC 8439 and used by WireGuard for transport. It is fast in software without dedicated hardware support, which matters on machines lacking AES acceleration.

check digit: A redundant digit computed from the other digits of an identifier and appended to it, as in an IBAN or an ISBN. A single mistyped or transposed digit breaks the computation and is rejected, which gives a class of silent error a visible shape.

Chromium: The open source browser project underlying Chrome, Edge and Electron. It ships a major version roughly every four weeks; applications that bundle it inherit the obligation to follow that cadence themselves.

Cisco: American networking company, whose engineering organisation supplied the code-review dataset behind the widely cited 200-to-400-lines-per-sitting review limit.

CNCD: Long-running demogroup, frequently releasing jointly with Fairlight; the pairing has won or placed in major competitions for two decades.

code review: The practice of a second engineer reading a change before it is merged. Its traditional value is forensic: a human mistake sits where the author's attention ran out, and the shape of it tells the reviewer where to look next.

code style: The formatting and naming conventions of a codebase. Where a language defines no canonical form, style must be enforced by a separate checker, and a project written in several notations needs one pass per notation.

Codeception: A PHP testing framework covering unit, functional and acceptance tests through one interface. The final stage of Spryker's documented pipeline.

Colima: A free, MIT-licensed container runtime for macOS and Linux that provisions a Lima virtual machine and exposes a Docker-compatible socket. One of the tool-for-tool replacements for Docker Desktop.

ColorQube: Xerox solid-ink multifunction device range, affected alongside the WorkCentre models by the 2013 JBIG2 character-substitution fault.

Commodore 64: The 8-bit home computer of 1982 that carried the first generation of the demoscene. Its fixed character set, three-voice sound chip and tight memory shaped a house style that outlived the hardware by decades.

compo: Short for competition: the judged category at a demoparty in which productions are shown to the audience and ranked, such as the combined demo compo or the 64k intro compo.

Composer: The dependency manager for PHP. Reads composer.json for declared requirements and writes composer.lock with the fully resolved set, which is usually several times larger.

Computer Systems Research Group: The group at the University of California, Berkeley (CSRG) that from 1977 produced the Berkeley Software Distribution and, before disbanding in the 1990s, the clean 4.4BSD-Lite release from which the modern BSDs descend.

CIQ: The company behind Rocky Linux and enterprise Linux support. Its engineers' 2024 white paper, Vendor Kernels, Bugs and Stability, counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel. A partisan source with a competing product, cited for its own primary finding.

containerd: The container runtime daemon that Docker's engine delegates to: dockerd talks to containerd, and containerd manages the container lifecycles. The pair resides in memory as root whether or not any container is running.

context rot: The measurable degradation of a language model's output quality as the input grows, beginning well before the context window is full. Named in a 2025 Chroma technical report covering eighteen models.

coordination rent: The charge that appears once a program has been split into parts that cannot see each other: shared cache handlers, matching encryption keys across a fleet, and rollout protection between old clients and new servers. The features themselves run without any of it; the agreement between the parts does not, and that agreement is what the hosting platform sells.

Copyleft: A licensing strategy that grants the freedoms to use, study, modify and share on the condition that derivative works carry the same terms. The licence travels with every line into any fork and remains there in perpetuity. The GPL is the canonical example; permissive licences such as BSD impose no such condition.

coreboot: An open-source replacement for the proprietary system firmware (BIOS or UEFI) of a machine, available on some hardware classes; one of the few sub-OS layers that admits an open alternative.

coreutils: The GNU implementation of the basic file, shell and text utilities (ls, cp, cat and the rest) shipped by most Linux distributions. One component among the several hundred a distribution maintainer selects and integrates around the kernel.

CI/CD: Continuous Integration / Continuous Deployment. Automated pipelines that build, test, and deploy code on every commit.

cipher agility: The ability to negotiate cryptographic algorithms at connection time. It permits gradual migration and, as the TLS record shows, downgrade attacks; WireGuard refuses it and replaces the whole protocol instead.

cluster module: A Node.js core module that forks one worker process per CPU core and shares a listening socket between them; the first workaround for a single-threaded runtime that cannot, by itself, use more than one core.

CNCF: Cloud Native Computing Foundation. The Linux Foundation project hosting Kubernetes, Prometheus, Envoy, and other cloud-native infrastructure projects.

colocation: Housing your own hardware in somebody else's datacentre, paying for rack space, power and connectivity while retaining ownership of the machines.

container: A packaged unit that bundles a process with a slice of userland (libraries, shell, tools) and runs it in an isolated view of a shared kernel; convenient for deployment, but often a small operating system shipped to run one process.

control groups: A Linux kernel feature, begun at Google in 2006 and merged into the mainline kernel in 2008, that limits and accounts for the CPU, memory and I/O a group of processes may use. With namespaces, one of the two primitives Linux containers are assembled from.

CQRS: Command Query Responsibility Segregation. Separates read models from write models, allowing independent optimisation of each path.

Cracktro: A signature animation attached to cracked software by pirate groups in the 1980s and 1990s. Scrolling text, chiptune music, and vector effects as calling cards. The art form that evolved into the demoscene.

Copy-on-Write: A storage strategy where data is never overwritten in place. New data is written to a new location, then the pointer is updated. Guarantees consistency after power failure.

crates.io: The package registry for the Rust language. A published version is immutable: it can never be overwritten, only yanked, which removes the republish-an-existing-name trick used against npm.

cron: The Unix job scheduler. Executes commands at specified times using a five-field time expression (minute, hour, day, month, weekday).

Crossref: The not-for-profit organisation that registers DOIs for scholarly publications and runs the resolution infrastructure behind them. Its outage of 24 March 2022 lasted seventeen hours and was fielded by one sysadmin, because two positions in the infrastructure group were unfilled.

CrowdStrike Incident: On 19 July 2024, a rapid content update to CrowdStrike's Falcon Sensor bypassed quality control and crashed 8.5 million Windows machines globally. Airlines, hospitals, banks, and emergency services were affected. $5.4 billion in Fortune 500 damages.

CSR: Client-Side Rendering. Building the page DOM entirely in the browser via JavaScript after an initial empty HTML shell is delivered.

CSS Layers: The @layer rule in CSS, allowing authors to define explicit cascade priority between groups of styles, eliminating specificity wars.

CSS-in-JS: A pattern where CSS is authored inside JavaScript files, generating styles at runtime. Adds bundle weight and runtime overhead.

Create React App: The React project's official scaffold from 2016, retired on 14 February 2025; the farewell notice pointed newcomers to frameworks and to build tools such as Vite, keeping the compiler in the default path.

CVE: Common Vulnerabilities and Exposures, the identifier scheme run by MITRE under which publicly known security flaws receive a number of the form CVE-YEAR-NUMBER. A CVE identifier records that a claim was made and catalogued; it is not by itself evidence that the flaw exists, and SQLite's own vulnerability page marks six identifiers issued in 2026 as unreproducible and attributes them to AI hallucinations.

Cyberhaven: A data-security company whose research arm, Cyberhaven Labs, measures corporate data flows into AI tools across millions of monitored workers; publisher of the annual AI Adoption and Risk Report.

chalk: A widely used npm package for colouring terminal output. Taken over in September 2025 along with debug and sixteen others through a phishing attack, with a combined 2.6 billion weekly downloads behind them.

CVE-2026-45321: The identifier for the Mini Shai-Hulud campaign of April and May 2026, which took 172 packages across 404 malicious versions on npm and PyPI, including packages carrying forged SLSA provenance.

Cast AI: A vendor of Kubernetes optimisation software whose annual report measures resource utilisation across tens of thousands of production clusters before any optimisation is applied, and therefore reads as an upper bound on waste.

D

demotion: In carp, a system-wide counter added to the skew of every advertisement a machine sends, so that it loses elections. The kernel and pfsync raise it when something is amiss, and any script may add to it through net.inet.carp.demotion.

Darklite: Norwegian demogroup based around the small township of Dokka in eastern Norway, with over a hundred productions on Demozoo. Its demo Blackout State, written with the fixed-function pipeline of OpenGL and no shaders, won the newschool demo competition at Black Valley 2026.

Darth Shader: Demoscene coder, credited alongside ferris on the code of Engage by Logicoma.

Cyber Resilience Act: An EU regulation imposing security-by-design, update and documentation duties on products with digital elements. Non-compliance can support a finding of defectiveness under the Product Liability Directive.

daemon: A process that runs continuously in the background rather than being started for a task. Docker's engine relies on a central daemon running as root, which is why its failure takes every container with it and its compromise hands over the host; jails and Podman need no such process.

Dash: The Debian Almquist shell, a fast, strictly POSIX shell that Debian and Ubuntu install as /bin/sh. Bash-specific syntax fails on it, usually silently.

dataset: A ZFS filesystem within a pool, with its own properties, quotas and snapshots. Datasets share the pool's free space rather than being sized in advance.

Datastar: A small hypermedia and reactivity framework taking a server-sent-events approach, combining ideas from HTMX and Alpine in one package in the same order of magnitude as HTMX. A modern entry in the lightweight front-end tier.

Datenschutzkonferenz: The conference of Germany's federal and state data-protection authorities (DSK). Its November 2022 assessment: proof of GDPR-compliant operation of Microsoft 365 could not be provided.

dayjs: A small, widely used JavaScript date library. Its name and metadata were impersonated by the typosquat easy-day-js in the June 2026 Mastra supply-chain attack.

dbsqlfuzz: SQLite's own fuzz-testing harness, which mutates both SQL text and database files and runs continuously against the library. It produces on the order of a billion mutations a day from a corpus of 336 seed files, and cases that once proved interesting are kept afterwards as regression tests.

Debian: A community-driven Linux distribution known for its stability-first release policy. Debian Stable freezes packages and releases when ready, not on a schedule. The reference for conservative, tested software deployment.

Debian Policy: The Debian Policy Manual, which sets out what Debian packages must do, including how configuration files are handled on upgrade.

deduplication: Storing identical blocks once. In ZFS the dedup table holds an entry per unique block at a little over 320 bytes and must stay resident, which is the actual source of the gigabyte-per-terabyte rule so often quoted about ZFS generally. It is off by default.

definition of done: The written agreement in a team about when a piece of work counts as finished. Cheaper to change than any tool, which makes it the natural home for rules about authorship and the origin of a change.

demoparty: A gathering where the demoscene meets to show new work and hold competitions, judged by the audience. Revision, held each Easter in Saarbrücken, is the largest.

Demoscene: A computer art subculture producing real-time audiovisual presentations (demos) within extreme size constraints, often 64 KB or less.

Demozoo: A community-maintained database of demoscene productions, groups, parties and competition results, used as the scene's reference record.

demotool: The editor a demo group builds before the demos: a timeline, curve editors and a preview window, so that a designer can place cameras and time effects without recompiling. Farbrausch had werkkzeug, Conspiracy apEx. A few groups, Andromeda Software Development among them, have never built one and hardcode each production instead.

Deno: A secure JavaScript/TypeScript runtime by the creator of Node.js. Built-in TypeScript support, URL imports, and sandboxed permissions.

defect density: The rate of faults a system carries, as against its feature list. The argument of a dependable server OS: you do not choose your bugs, you choose your defect density, and it is decided by how the system was built, not by how clever its newest part contrives to be.

dependency hell: The failure mode in which package requirements cannot be satisfied together, through circular requirements or irreconcilable version constraints. The reason given for Slackware's refusal to resolve dependencies automatically.

DirectX: Microsoft's family of multimedia programming interfaces for Windows, of which Direct3D is the graphics part. Version 9 dates from 2002 and was still the common target for demos in 2010, which is why productions of that period run into its limits on memory management and driver overhead.

distinfo: The FreeBSD ports file that pins the SHA256 checksum and size of every distribution file a port downloads. A tampered upstream tarball fails the checksum and the port never builds.

DKMS: Dynamic Kernel Module Support. A framework for building kernel modules that automatically recompile when the kernel is updated. Used by ZFS on Linux.

Dependabot: A GitHub-integrated bot that automatically opens pull requests to update dependencies. On a monorepo, it can generate hundreds of PRs per week, each requiring review and testing.

dependency confusion: A supply-chain attack in which a package is published to a public registry under the name of a company's private internal package, so that a misconfigured build resolves the public impostor in preference to the intended private one.

devDependencies: The packages in an npm package.json needed only to develop or build a project, not to run it in production. A plain npm install pulls them in and runs them with the same permissions as everything else, which is when a post-install script fires; Snyk's default scan omits them.

dnf: The package manager of Red Hat Enterprise Linux and Fedora, resolving dependencies above the rpm package format; the counterpart to Debian's apt.

Docker: A container runtime that packages applications with their dependencies into isolated filesystem images, sharing the host kernel.

Docker Desktop: The graphical Docker distribution for macOS and Windows. Because containers are Linux kernel constructs, it runs a Linux virtual machine underneath and manages the mount and lifecycle around it. Free for individuals; since 31 August 2021 a paid seat is required in companies above 250 employees or $10 million in revenue.

DOI: Digital Object Identifier: a persistent identifier for a document, usually a scholarly article, that resolves to its current location through a registry rather than through a fixed address. Much of academic publishing depends on the resolver staying up.

Doom: First-person shooter released by id Software in December 1993. The wish to play it on FreeBSD is the motive the FreeBSD Foundation gives for the Linux binary compatibility that first appeared in FreeBSD 2.1 in 1995.

double-entry bookkeeping: Accounting method described by Luca Pacioli in 1494 in which every figure is recorded twice, on both sides of the book. Its purpose is not tidiness but detection: a transposed digit makes the two sides disagree, so the error announces itself without anyone having to look for it.

dpkg: Debian's package manager and its on-disk ledger. /var/lib/dpkg/status lists every installed package, which makes it the honest inventory of what a Debian-based container image actually carries.

dpkg-buildflags: The Debian tool that supplies compiler and linker flags when a package is built. It is a mechanism for the package maintainer, not for the operator of an installed system.

DragonFly: DragonFly BSD. A fork of FreeBSD begun by Matthew Dillon in 2003, with its own approach to multiprocessing and the HAMMER filesystem. A member of the BSD family, Unix by descent.

DTrace: A dynamic tracing framework for real-time analysis of running systems. Originated in Solaris, ported to FreeBSD and macOS. Traces kernel and userspace with near-zero overhead when idle.

Docker Hub: The default public registry for container images. A 2026 study of its 52,895 highest-exposure repositories, accounting for 84.7 per cent of all recorded pulls, found 96.3 per cent carrying a known package vulnerability.

demo: In the demoscene, a production with no size limit, distinguished from an intro, which is capped at 64 kilobytes or less. The absence of a limit does not remove the discipline; it moves it to whatever the group chooses to constrain instead.

dynamic instrumentation: Attaching measurement to a program while it is running, without recompiling it, restarting it or having anticipated the question in advance. The subject of the 2004 DTrace paper and the capability behind both DTrace and eBPF.

Dynatrace: A commercial observability platform that instruments applications and infrastructure and traces requests across services. Like every monitoring tool it reports where a symptom surfaces, which is not always where the cause sits.

devfs: FreeBSD's device filesystem, in the base system since 2.0 and the only method of populating /dev since 6.0. The kernel creates each device node and applies the ruleset attached to the mount in the same operation, so a node arrives already carrying its owner and mode. Its rule language has two conditions and six actions, none of which can execute a program.

devd: FreeBSD daemon that reacts to device events and runs configured commands, written by M. Warner Losh and first appearing in 5.0. It hooks into devctl and multiplexes events to clients over a Unix domain socket. It executes actions but never touches device node permissions, which is the division of labour udev does not make.

devtmpfs: The Linux kernel filesystem that populates /dev. It creates each device node with default ownership and default permissions and then emits a uevent; the real ownership, mode and symlinks are applied afterwards by systemd-udevd in user space.

devctl: The FreeBSD kernel device through which devd receives notifications about the device tree. It allows a single active reader, which devd multiplexes to any number of clients, and it is not a socket any unprivileged process can write to.

device node: The file in /dev through which a program addresses a device. Who creates it and who decides its ownership and mode is the question that separates devfs from devtmpfs plus udev.

E

essential package: A Debian and Ubuntu package marked Essential: yes, which apt and dpkg refuse to remove without --allow-remove-essential; the coreutils are among them.

ELF: Executable and Linkable Format, the standard file format for executables, shared libraries and object files on FreeBSD, Linux and most other Unix-like systems. Tools such as ldd read its dynamic section to show which libraries a program links against.

ENOSYS: The POSIX error number for a function that is not implemented, returned among other cases when a program calls a system call the kernel does not provide.

entropy coding: The stage of a compressor that assigns short codes to frequent symbols and long ones to rare symbols. zstd uses finite state entropy alongside Huffman coding; the decoder reads the tables the encoder wrote, which is why decoding cost barely moves between compression levels.

etckeeper: A set of tools that keep /etc in a version control repository such as git and commit before and after each package manager run. It records changes; it does not merge them.

etcupdate: FreeBSD's tool for updating the files in /etc that installworld does not touch, by a three-way merge against stored copies of the previous and the current release. Written by John Baldwin at Hudson River Trading between 2010 and 2013, it first appeared in FreeBSD 10.0.

exit status: The integer a Unix program returns when it finishes: zero conventionally means success. FreeBSD’s periodic(8) turns it into a reporting vocabulary of four values, where 0 means nothing notable happened, 1 is information, 2 is a warning and anything above 2 is something the operator should see now.

EBS: Elastic Block Store, the network-attached block storage service behind most EC2 instances. Billed per provisioned gigabyte-month rather than per gigabyte used.

ebuild: A Gentoo build script describing where a package's source comes from, how to unpack, patch, compile and install it, and what it depends on. The Portage equivalent of a port's Makefile.

Ed25519: A modern public-key signature scheme, fast and compact, used by OpenSSH keys and by OpenBSD's signify for signing releases and packages.

EDPS: The European Data Protection Supervisor, the EU's independent authority for data protection within its own institutions. In March 2024 it found the European Commission's Microsoft 365 use in breach of Regulation (EU) 2018/1725 and ordered the data flows suspended; the case closed in July 2025 after remediation.

egress: Outbound data transfer from a provider's network to the internet, billed per gigabyte by the major clouds and typically not billed at all by dedicated server hosts. The line most cost comparisons omit.

Elasticsearch: A distributed search and analytics engine, released under the Apache licence until 2021, then moved to the SSPL and the Elastic Licence, with the AGPL offered again from August 2024.

Enshittification: The process by which platforms degrade their product to extract value. Coined by Cory Doctorow in 2022. Three phases: attract users, lock in businesses at users' expense, extract value for shareholders at everyone's expense. Word of the Year 2023 (American Dialect Society) and 2024 (Macquarie Dictionary).

environment maps: A prepared image wrapped around a surface so that it appears to reflect its surroundings. It produces convincing metal and glass without calculating where any light actually is, which makes it both old and fast.

EPYC: AMD's server processor line, offering high core counts per socket. A 48-core EPYC appears in this measurement as the machine an egress bill can exceed.

ESLint: A configurable linter for JavaScript and TypeScript that flags errors and enforces style rules. A standard fixture of the modern front-end toolchain.

EULA: End-User Licence Agreement: the contract under which commercial software is delivered. On the warranty question it descends from the AS IS clause of the early permissive licences, usually with more pages.

EulerOS: Huawei's enterprise Linux distribution, once on The Open Group's register as conforming to UNIX and lapsed in 2022. One of the few Linux systems ever to hold the mark, a reminder that the certificate measures the interface, not the lineage.

EuroBSDCon: The annual European conference of the BSD community, running since 2001 and held in a different European city each year. The 2026 edition takes place in Brussels from 9 to 13 September.

European Processor Initiative: An EU-funded consortium (EPI) developing sovereign high-performance processors for European supercomputers, including the SiPearl Rhea line for the JUPITER exascale system.

evaluation penalty: The measured social cost of admitting AI use: in four PNAS experiments (Duke, 2025), people disclosing AI use were judged lazier and less competent for identical output, and hiring evaluators marked them down. The penalty largely disappears when the evaluator uses AI too.

event loop: Node.js's single-threaded concurrency model. Processes I/O callbacks on one thread without blocking. Efficient for I/O-bound workloads (waiting for data). Blocks entirely on CPU-bound work (processing data).

Event Sourcing: A pattern that stores every state change as an immutable event rather than overwriting current state. The event log becomes the source of truth.

exascale: A class of supercomputer capable of a billion billion operations per second. Europe's first, JUPITER, is intended to run on SiPearl's Rhea processor.

ES modules: JavaScript's native module system (import and export), standardised with ES2015. Every major browser has executed ES modules natively since May 2018, Firefox 60 completing the set, which removed the module gap that bundlers were built to bridge.

ENISA: The European Union Agency for Cybersecurity. Co-publishes the guideline on state of the art in IT security with the German association TeleTrusT.

Evoke: A German demoparty normally held in Cologne. Its cancellation in 2020 prompted the online replacement event Novoque.

F

fchmodat2: A Linux system call, added in kernel 6.6, that changes a file's mode relative to a directory descriptor and honours AT_SYMLINK_NOFOLLOW, so that a planted symbolic link is not followed.

fts: The BSD library for walking file hierarchies, fts(3), used by rm, cp, ls, find and du on FreeBSD; it changes directory as it descends, so the path handed to the kernel never exceeds the name in front of it, and a tree of any depth can be removed.

Fulcrum: A Belgian demogroup; its 4K intro Fractus by Seven took third place at Revision 2012.

fractalforums: The forum where the three-dimensional fractal community of the late 2000s and 2010s, knighty, Rrrola and Theli-at among them, developed formulas such as the Mandelbox and the Pseudo-Kleinian; thanked in the Hartverdrahtet readme.

fractal: A shape whose detail repeats at every scale, produced by a formula applied over and over. In the demoscene a fractal replaces models and textures, because the formula fits in a few bytes.

failover: The move of a service or an address from a failed machine to a standby, ideally before any client notices.

flua: The Lua interpreter in the FreeBSD base system, intended for the system's own tools, among them nuageinit.

firstboot: An rc(8) keyword on FreeBSD. Scripts that carry it run only while the sentinel file /firstboot exists, and rc removes that file at the end of the first start, so their work is done exactly once.

Facebook: The company, now Meta, that employed Yann Collet while he wrote zstd and released it under a permissive licence in 2016. The format was later standardised at the IETF, which is what keeps it available regardless of the company's interest.

ferris: Handle of Jake Taylor, coder and musician active in the demoscene since the mid-2000s, founder of Logicoma and co-author of the WaveSabre synthesiser. Credited on Engage for code, graphics and direction, and the author of a four-hour public breakdown of how it was built.

ext4: The default filesystem of most Linux distributions. It checksums its own metadata but not file contents, and it cannot reach the second copy held one layer below in the storage stack.

fabrication: The manufacturing of chips from a design, carried out at a foundry. Leading-edge fabrication is dominated by TSMC, Samsung and Intel, with SMIC advancing in China.

faccessat2: A Linux system call added in kernel 5.8 (2020) to fix a flag-handling gap in faccessat. glibc 2.33 began preferring it in 2021; container seccomp allow-lists written earlier blocked it, so a correct kernel, a correct C library and a correct filter together broke ordinary file-access checks inside containers. A bug in the gap.

fail2ban: A log-watching daemon, written in Python, that reads service log files, matches lines against regular expressions to identify failed authentication attempts, counts them per source address, and calls a firewall to block offenders. It has been the standard answer to SSH brute force for two decades and is genuinely portable, because a log file is the one interface every service offers. The cost is the route it has to take: the reporting service formats a fact it already holds into English prose, and fail2ban loads an interpreter and a set of patterns to recover that fact from the prose.

failregex: A regular expression in a fail2ban filter definition that matches a line indicating a failed attempt and extracts the source address from it. The filter for OpenSSH carries 27 of them, one for each phrasing the daemon might use, which is the concrete price of treating a log file as an interface.

Fairlight: One of the oldest names in the scene, active since the mid-1980s, still releasing demos and intros; its 64k intro dead ringer took first place at Assembly 2006.

FEMP: FreeBSD, nginx, MySQL or MariaDB, and PHP: the FreeBSD equivalent of the LEMP stack, installed from ports or packages. Four components, one configuration file each, and the same versions available on the development machine.

Fetch API: The modern browser interface for making HTTP requests, replacing XMLHttpRequest. Returns Promises and supports streaming.

FFmpeg: A universal multimedia framework handling over 100 audio and video codecs. 1.5 million lines of C. Powers YouTube, Netflix, VLC, Spotify, Chrome. Created by Fabrice Bellard in 2000.

fill rate: The number of pixels a graphics card can render and write to memory per second. It limits how much of the screen an effect can cover, and how often, in each frame.

find: A Unix command-line tool that walks a directory tree and evaluates an expression against each file, performing actions where the expression is true. Unlike most Unix tools, which take flags, find takes an expression: a small query language of primaries (tests and actions) and operators (implicit AND, -o for OR, ! for NOT, parentheses for grouping). Written by Dick Haight for Version 7 Unix in 1979. BSD find ships in the FreeBSD base system, BSD-licensed; GNU find is part of the GPL-licensed findutils.

Fingerprinting: Putting a hash of a file's contents into its filename, so that any cache treats a changed file as a different file. It is what makes a long max-age with immutable safe to serve, and it is the mechanism that causes cascading invalidation when the hashed name is written into importing files.

firewalld: Red Hat's firewall abstraction, layered over nftables and before that iptables. Introduces zones, named service definitions and a split between runtime and permanent configuration, with rich rules for anything the predefined services do not cover.

firmware: Software stored in hardware that runs below the operating system, such as the system firmware that boots a machine or the firmware on a management processor. Often vendor-signed and not user-replaceable.

fixed-function pipeline: The rendering model of early 3D graphics hardware and of OpenGL before shaders: vertices pass through fixed stages for transformation, lighting, texturing and blending, which the programmer configures with switches instead of writing programs for them. OpenGL 3.0 declared it deprecated in 2008.

fixi: A minimalist implementation of generalised hypermedia controls by the HTMX team, built to be as small as possible: roughly 3.5 KB uncompressed, around 1.3 KB compressed. The smallest end of the hypermedia tier.

Flatpak: A cross-distribution packaging system for Linux desktop applications. Applications are built against a runtime that supplies their basic dependencies; the runtime is installed once on the host, so patching it patches every application built on it.

Fletcher-4: The checksum ZFS uses by default on data blocks: a fast running sum over 32-bit words with four accumulators, computed with SIMD instructions wherever the processor offers them.

FOSDEM: Free and Open Source Developers' European Meeting. Annual two-day conference in Brussels, free to attend, no registration.

Fossil: A distributed version control system by D. Richard Hipp, the author of SQLite. pkg took its three-way merge code for configuration files from Fossil in 2014.

frame format: The byte layout a compressed stream declares at its start: magic number, window size, checksum flags and the blocks that follow. zstd froze its frame format with version 1.0, so every later 1.x release still reads it.

Free Software Foundation: The organisation Richard Stallman founded in 1985 to promote free software. It publishes the GNU General Public License and lists the CDDL as incompatible with it.

FreeBSD: An open-source Unix operating system descended from the Berkeley Software Distribution. Known for ZFS, Jails, and its licence model.

FreeBSD Foundation: The non-profit that supports FreeBSD development, infrastructure and release engineering. Registered in Colorado, United States. A single-tree architecture does not by itself relocate this institutional anchor, which is the distinction between the architectural layer and the jurisdictional one.

FreeBSD Handbook: The project's official, continuously maintained manual for installing and administering the whole system. Editions from two decades ago still describe today's rc.conf and pf accurately.

freebsd-update: FreeBSD's tool for binary updates of the base system, kernel included. Since 12.3 and 13.1 it takes a boot environment before installing, so the previous state can be booted again with bectl.

FSF: Free Software Foundation. Founded by Richard Stallman in 1985 to promote software freedom; author and steward of the GPL family of licences. In a sovereignty reading, the FSF remains a co-governor of any GPL fork through the licence it authored.

freemium: A business model in which the core product is given away to draw the largest possible audience while a minority pays for extra tiers. For the npm registry the free public registry is the funnel and private packages and enterprise are the revenue, so the size of the free tier, the package count, is the asset the paid tier is sold against.

flatmap-stream: The package added one level below event-stream in 2018, carrying obfuscated code that activated only when a particular Bitcoin wallet library was present in the same dependency tree.

framebuffer: A block of memory holding a rendered image before it is displayed. Graphics code allocates them constantly, and failing to release one produces visible garbage without any error being raised.

FUSE: Filesystem in Userspace, the mechanism by which a kernel hands filesystem operations to an ordinary user-space daemon and copies the answer back. FreeBSD ships it as fusefs in the base system; it is the microkernel pattern assembled by hand on a monolithic kernel.

fwknop: Michael Rash's implementation of Single Packet Authorization, available in the FreeBSD ports tree. The server daemon opens a port for one address after a valid encrypted packet.

G

GNU/Linux: The name the GNU project asks for a Linux system, on the ground that the kernel is Linux and the commands and libraries around it are GNU; the slash marks the two projects.

GNU coreutils: The GNU package that collects the basic file, shell and text utilities of a Unix system, ls, cp, mv, rm, cat, chmod, sort and about a hundred others, formed in 2003 from fileutils, textutils and sh-utils; written in C under the GPL and the default on most Linux distributions, on Ubuntu until the switch to uutils.

gratuitous ARP: An ARP announcement that a host sends for its own address without being asked, so that switches and neighbours update their tables. carp sends one the moment a machine becomes master.

fuzzing: A testing technique that feeds a program large volumes of malformed, random or mutated input in the hope of provoking a crash or a wrong answer. It is very effective against parsers and file formats and very poor at reaching faults that require a specific semantic setup, which is why 150 CPU-hours of fuzzing against SQLite missed the underflow that a reasoning agent later found by reading the code.

Gargaj: Hungarian coder and musician, a member of Conspiracy, credited on f07 for code and on Chaos Theory for the soundtrack.

gawk: GNU awk, the awk implementation shipped by Fedora and Arch; extends POSIX awk with features such as length() on arrays.

generative AI: The class of AI systems that produce text, images or code from prompts rather than classifying existing data. Per the 2024 Work Trend Index, three quarters of knowledge workers use it at work.

genericide: The death of a trademark by becoming the generic name for its category, as befell aspirin, escalator and thermos. The risk that drives The Open Group to police the UNIX mark narrowly: allowed to mean any Unix-ish system, it would cease to be a mark at all.

Gentoo: A source-based Linux distribution built around Portage, in which packages are compiled on the target machine with user-selected USE flags rather than installed as prebuilt binaries.

glibc: The GNU C Library, the default C library on most Linux distributions. Implements the standard library and the syscall interface to the kernel. One userland among several (alongside musl, Bionic and BusyBox) that share the Linux kernel; its ABI contract with the kernel has occasionally broken in ways no single project owned.

GIL: Global Interpreter Lock. A mutex in CPython that allows only one thread to execute Python bytecode at a time, serialising CPU-bound work. Elegant until load disagrees.

GNU: GNU's Not Unix. The free-software project Richard Stallman began in 1983 to build a complete Unix-compatible system; its userland supplies the standard utilities, C library and toolchain on most Linux distributions. Unix-like by design, with no inherited Unix code.

git blame: A Git command that annotates each line of a file with the commit, author and date that last changed it. It was a rough but honest way to find who shaped a line; with generated code it names whoever pressed accept, not who actually wrote it.

GNU Hurd: The GNU project's microkernel operating system, a set of servers on the GNU Mach microkernel begun in 1990. It provides a POSIX interface but has never reached a 1.0 production release, the cautionary member of the discipline-without-descent class: the ambition intact, the delivery absent.

Go: A compiled language from Google (2009); its runtime scheduler multiplexes lightweight goroutines across every core of a single process, so one binary saturates a multi-core machine without a cluster of processes or a container per core.

Google Summer of Code: Google's annual programme that pays newcomers to work on open-source projects under a mentor. FreeBSD's libbe and bectl came out of it in 2017.

GPAI: General-purpose AI, the EU AI Act's term for a model that can serve many downstream tasks. Article 53 obliges GPAI providers to publish a sufficiently detailed summary of their training content, to a template the AI Office issued in July 2025, binding open-licensed models as well as closed ones.

GPL: GNU General Public Licence. The canonical copyleft licence, authored by the Free Software Foundation. Requires derivative works to carry the same terms, so its conditions travel with every line into any fork and cannot be repealed by the forker. The Linux kernel is licensed under GPLv2. Deliberately designed not to let go.

Goroutine: A lightweight thread managed by the Go runtime. Multiplexed onto OS threads. Enables high concurrency but subject to garbage collection pauses.

GPU: Graphics processing unit. Built to draw pixels in parallel and now the main hardware on which language models are trained and run, which is why the cost of an AI system is so often quoted in GPU hours.

Grafana: A visualisation platform for metrics, logs, and traces. Connects to Prometheus, Loki, InfluxDB, and dozens of other data sources.

Goodhart's Law: When a measure becomes a target, it ceases to be a good measure. Named after economist Charles Goodhart (1975). Explains why velocity tracking corrupts estimation.

GraphQL: A query language for APIs where the client specifies exactly which fields it needs. Developed by Facebook, alternative to REST.

greetings: The list of other groups a demoscene production thanks, traditionally scrolling past at the end. It is the scene's oldest social convention and normally detachable from the work itself; Conspiracy's Offscreen Colonies is the counter-example, where the greeted names are the places the viewer flies through.

gRPC: A high-performance RPC framework using Protocol Buffers and HTTP/2. Supports streaming, code generation, and strong typing.

GitHub: A web platform for hosting Git repositories and collaborative software development, founded in 2008 and acquired by Microsoft in 2018 for USD 7.5 billion. Owner of the npm registry since 2020.

GRUB: GNU GRUB, the boot loader that Debian, Ubuntu and Red Hat Enterprise Linux install by default. It lists the installed kernels at start-up and can boot an older one.

Grunt: An early JavaScript task runner, from 2012, that automated build chores through configured plugins. The first link in the bundler lineage that runs, so far, to Rolldown.

Gulp: A JavaScript task runner from 2013 built on streams, the code-over-configuration answer to Grunt; the second link in the build-tooling lineage.

generally accepted rules of technology: The lowest of the three technology levels in the Kalkar three-stage theory: the proven, the widespread, the thing everybody does. Measures descend to this level with increasing distribution and market recognition, where they may have weaknesses because attackers have found ways to bypass them.

GNU Rocket: A sync tracker by Erik Faye-Lund, used across the demoscene to tie visuals to music. You scrub a timeline, set values against it, and the running demo reads them back. Effectively a spreadsheet for time, and the reason demos can hit a beat at all.

gzip: The compression program and format built on DEFLATE, released in 1992 for the GNU project and present in every Unix base system since. Its dial runs from -1 to -9, and the top of that range costs a great deal of time for very little size.

H

Hardwired: An Amiga demo by Crionics and The Silents, second at The Party 1991 and near the top of the Pouët all-time chart ever since; retold as the 4K intro Hartverdrahtet in 2012.

HSRP: Hot Standby Router Protocol. Cisco's router-redundancy protocol and the forerunner of VRRP; the patent on it led the OpenBSD developers to design CARP as a protocol of their own.

heartbeat: In high availability, the regular signal one machine sends so that its partner knows it is alive; silence beyond a set time triggers the failover.

h0ffman: Demoscene musician and co-author of WaveSabre, credited with wobble on the soundtrack of Engage by Logicoma.

HAMMER2: The native filesystem of DragonFly BSD, offering snapshots, clustering, deduplication and self-healing. Written for DragonFly and carried by no other BSD; the counterpart on that branch to ZFS on FreeBSD.

HAProxy: A high-performance TCP/HTTP load balancer and reverse proxy. Event-driven, widely used for traffic distribution.

honeypot: A deliberately exposed system that records the attacks made against it, used to measure what attackers actually do.

htm/a: A four-kilobyte server-side reactivity framework with a type-safe Rust core and no dependencies, the author's own study built to see how low the front-end floor can go; it runs htma.run. Not a supported product, but a proof that the floor is lower than the industry assumes.

HTTP caching: The set of response headers by which a server tells clients and proxies how long a resource may be reused without asking again. Its failure mode is silent: a stale asset served from a browser cache is a production fault nobody can recall.

HTTP/2: The second major version of HTTP. Binary framing, multiplexed streams over a single TCP connection, header compression.

HTTP/3: HTTP over QUIC. Replaces TCP with UDP-based transport, eliminating head-of-line blocking. Built-in encryption.

Hudson River Trading: A trading firm at which John Baldwin wrote FreeBSD's etcupdate between 2010 and 2013, for upgrading many machines without user intervention.

I

IPVS: IP Virtual Server. The layer 4 load balancer in the Linux kernel, from the Linux Virtual Server project; keepalived configures it and checks the servers behind it.

IPv6: Internet Protocol version 6, with 128-bit addresses. It replaces ARP with Neighbor Discovery, which is why carp announces a moved address there with an unsolicited neighbour advertisement.

IETF: Internet Engineering Task Force. The open standards body that publishes the protocols of the internet as RFCs, VRRP among them.

IANA: Internet Assigned Numbers Authority. Keeps the internet's registries of numbers, among them the protocol and port numbers; it assigned IP protocol 112 to VRRP and refused the OpenBSD developers a number for CARP.

Husky: A tool that installs Git hooks from a project's repository, so that checks run automatically on commit or push. The generated pre-commit hook calls npx lint-staged.

hyperscaler: One of the very large cloud operators running datacentres at global scale, principally Amazon Web Services, Microsoft Azure and Google Cloud.

ICSME: IEEE International Conference on Software Maintenance and Evolution. Venue of the 2024 study that measured comment-free code reviews and the LGTM smell across five large-scale projects.

ifconfig: The classic Unix tool for configuring network interfaces; deprecated on Linux in favour of ip, still the standard tool on FreeBSD and macOS.

illusion of explanatory depth: Rozenblit and Keil's 2002 finding that people rate their understanding of how things work far above what they can produce when asked to write the mechanism down. Fernbach and colleagues showed in 2013 that asking for the mechanism moderates political views, while asking for reasons leaves them where they were.

image mode: Red Hat's image-based way of running RHEL, generally available since 2025 for RHEL 9.6 and 10: the system is built as a container image and booted with bootc, which keeps the previous image for a rollback. Existing package-mode systems cannot be converted.

Incremental Static Regeneration: A caching strategy in which a statically generated page is rebuilt in the background after a defined interval or on demand, while stale content continues to be served. It behaves as advertised on a single instance; across several instances each one keeps its own record of what is fresh unless a shared cache handler is configured.

init system: The first userland process the kernel starts (PID 1), responsible for bringing up and supervising services; systemd, OpenRC, launchd and FreeBSD's rc.d fill this role.

installpkg: Slackware's package installer: it unpacks an archive, records every file it placed and where, and stops. It resolves no dependencies, by design; a missing library announces itself when the program is run.

inter-agent misalignment: A failure category in the Berkeley taxonomy of multi-agent LLM systems presented at NeurIPS 2025: agents misreading or talking past one another's output. In the annotated traces it accounted for 32.3 per cent of failures.

Interop: An annual cross-vendor programme in which browser makers agree on a set of web platform areas to bring into alignment, measured publicly against the web platform test suite. It exists to reduce the rendering differences that once justified bundling an engine.

intro: A demoscene production bound by a size limit, usually 4 or 64 kilobytes, as opposed to a demo, which carries no limit at all.

invitation demo: A demoscene production made to advertise an upcoming party. It competes in the same competitions as everything else and has to earn its screen time on the same terms.

IPC: Inter-process communication, the machinery by which separate processes exchange data. On a microkernel it is the central operation of the whole system, which is why its cost per message decides whether the design is usable.

IPv4: Version 4 of the Internet Protocol, with 32-bit addresses, about 4.3 billion of them, few enough for a single machine to scan in minutes.

ironies of automation: Lisanne Bainbridge's 1983 observation that automating a task deskills the operator: they stop practising the parts the machine now covers, yet must take over when it fails, exactly when unusual skill is needed and least available.

IaaS: Infrastructure as a Service. Virtual machines, storage, and networking rented from a cloud provider instead of running your own hardware.

IEEE 1003: The IEEE standard family better known as POSIX, first published as IEEE 1003.1 in 1988. The technical text the Single UNIX Specification incorporates, specifying the interface a program sees rather than the system that implements it.

information hiding: The module-decomposition principle David Parnas set out in 1972: a module should hide a design decision that is likely to change, so that when it changes, only that module changes. A boundary drawn where the volatility lives, the honest opposite of a layer that only postpones the look beneath it.

infostealer: Malware whose purpose is to harvest secrets from a machine, browser data, cryptocurrency wallets, SSH keys, cloud tokens and credential files, and exfiltrate them to attacker infrastructure.

Intel Management Engine: A small autonomous processor inside Intel chipsets, running its own MINIX-based firmware at a privilege below the kernel, with system access and a network path, active even while the machine is powered off. Built for remote fleet management; CVE-2017-5689 showed it could be taken over remotely.

io-pkt: The networking stack of the QNX operating system, built directly on NetBSD's networking code. Berkeley's code compiled into QNX's own address space, which is why a Unixoid by kernel carries a genuine piece of the BSD line inside it.

io_uring: A Linux asynchronous I/O interface (Jens Axboe, kernel 5.1, 2019) built on two shared-memory rings, a submission queue and a completion queue, letting an application hand the kernel batches of work with very few system calls. Fast, but a large and fast-growing attack surface: around six in ten Linux kernel exploits submitted to Google's 2022 bounty went through it.

IPsec: Internet Protocol Security. A suite of protocols for authenticating and encrypting IP packets. Complex configuration, largely replaced by WireGuard for VPNs.

IRIX: Silicon Graphics' Unix flavour for its workstations, one of the proprietary Unixes of the 1980s.

ISA: Instruction-set architecture: the contract between software and a processor, the set of instructions a CPU exposes. x86, ARM and RISC-V are the three main ISAs, and which a chip implements is a question of ownership as much as of engineering.

install script: A script a package declares to run automatically during npm install, such as a postinstall hook. It executes with the installing user's full permissions the moment installation finishes, before the installed code is deliberately run, which is what makes a malicious one so effective.

import maps: A browser feature that maps bare import specifiers such as 'lodash' onto URLs, letting native ES modules resolve dependencies without a bundler. Native in every major browser since Safari 16.4 in March 2023.

J

jail.conf: The FreeBSD configuration file describing jails: one block per jail, in the same declarative style as the rest of the base system. Together with rc.conf it holds the authoritative state of a host, which is why a management layer built on top of it can be removed without consequence.

Jail Ferry: A local development workflow built from base-system parts instead of Docker Desktop, described in chapter 20 of Integrated by Design: QEMU for the virtual machine, NFS for the shared directory, zfs send for moving filesystems, and about 190 lines of POSIX shell to orchestrate them. The name is deliberate, since a docker loads ships and a ferry carries cargo across a channel.

jails: FreeBSD's kernel-native operating-system virtualisation: an isolated environment that is a first-class kernel primitive rather than a daemon-mediated arrangement of namespaces. With VNET each jail holds an independent network stack.

jc: A command-line tool by Kelly Brazil, written in Python, that converts the output of common Unix commands into JSON after the fact. It ships a separate parser for each command it understands, 220 of them in version 1.25.2.

Jest: A JavaScript testing framework, widely used in the React ecosystem. One of the tools, with React, Webpack, Babel and ESLint, that make a junior engineer a known quantity to the hiring market.

journald: systemd's logging service, which stores system logs in a binary journal queried with journalctl; it replaced plain-text syslog on most Linux distributions.

jq: A functional programming language for transforming JSON on the command line. Generators, backtracking, immutable values, compiled to a stack-based bytecode VM. 822 KB binary. Written in C by Stephen Dolan in 2012. MIT licence.

JSON: JavaScript Object Notation, a plain text data format of objects, arrays, strings and numbers. Douglas Crockford specified it in 2001 and it became the default interchange format of the web, and the format an import map is written in.

JSON-RPC: JSON Remote Procedure Call. A lightweight protocol that encodes function calls and responses as JSON objects, transported over HTTP or WebSockets.

JIT: Just-in-time compilation. Translating bytecode into native machine instructions at the moment of execution rather than ahead of time. Part of what turned BPF from a packet filter into a general kernel runtime.

Juniper: American network equipment manufacturer, founded 1996, whose routers and switches run the company's own operating system on a FreeBSD foundation.

Junos: Juniper Networks' operating system for routers, switches and security appliances, built on FreeBSD since the late nineties. The permissive licence allowed proprietary extensions without a negotiation, which the company has named as part of the appeal.

K

keepalived: A Linux daemon that provides VRRP failover and, together with IPVS, load balancing with health checks for the servers behind it. Maintained by Alexandre Cassen since 2001 and configured in a language of its own in keepalived.conf.

kernel module: Code loaded into a running kernel to extend it, typically a driver or a filesystem. On Linux, a module maintained outside the kernel tree has to be compiled against the headers of every kernel it is meant to run on.

kevent: The structure a programme fills in to talk to a BSD kqueue, and also the name of the system call that carries it. Six fields since July 2000: an identifier, a filter, action flags, filter flags, a data value and an opaque user pointer, with a fixed-width data field and four spare words appended since. One kevent call passes a changelist of registrations in and receives an eventlist of what has happened back, which is why the whole interface needs only two system calls.

kkrunchy: Executable packer written by Farbrausch for size-limited Windows productions. It compresses a finished binary so that it fits inside a category limit such as the 65,536 bytes of a 64k intro, and it is named in the Engage readme as the last step of the build.

K-UX: Inspur K-UX, a Linux-based operating system from the Chinese vendor Inspur, certified against UNIX in 2013 and later lapsed. One of the very few Linux distributions ever to hold the UNIX mark.

kernel: The core of an operating system: it manages memory, processes, devices and filesystems. Nearly everything an administrator touches day to day sits in the layers above it.

kernel TLS: A FreeBSD subsystem that performs Transport Layer Security encryption inside the kernel rather than in the application, so that video data never crosses the user-kernel boundary twice. Designed at Netflix by Drew Gallatin and upstreamed over roughly five years.

Kewlers: Finnish demogroup formed in the early 1990s, known for a provocative style, a logo of a stylised raised middle finger and the motto “Kewlers suck”. Their 2002 demo Variform took several Scene.org Awards; they announced the 2006 demo 1995, made together with mfx, as their farewell and returned to competition some years later.

KHTML: The HTML rendering engine written for KDE's Konqueror from 1998. Apple forked it in 2001 to create WebKit, which Google forked in 2013 to create Blink, so nearly every engine in use on the desktop shares this ancestor.

kintsugi: The Japanese art of repairing broken pottery with lacquer dusted with gold, so the mend is honoured as part of the object's history rather than disguised. Used here as an image for a system that shows its workarounds and their reasons on the surface, where the next maintainer can read them.

KISS: Keep It Simple, Stupid: a design principle holding that systems work best when kept as simple as the problem allows. With lean and minimal, one of the disciplines of removing everything that does not earn its place, so the result is proportioned to the problem and can be held whole in one mind.

Klara Systems: A company offering commercial FreeBSD and OpenZFS development and support. Its infrastructure support is sold in monthly blocks of hours with a seventy-two-hour response commitment and an emergency line: an address for blame that exists for the base system, and rarely sits at the budget table.

knockd: A small daemon that watches for a configured port-knocking sequence and runs a command, typically adding the knocking address to a firewall table.

Koji: The Fedora build system, against which packages are produced with rpmbuild, mock and fedpkg.

kqueue: The BSD kernel event notification interface, introduced by Jonathan Lemon in FreeBSD 4.1 in July 2000. A single queue a process owns, against which it registers anything it wants watched: sockets, files, timers, signals, processes, jails. Fourteen filters today against six at release, added without a new system call. Present in FreeBSD, NetBSD, OpenBSD, DragonFly and macOS.

KubeCon: The Cloud Native Computing Foundation's flagship conference for Kubernetes and cloud-native technologies.

Kubernetes: An orchestration platform for managing containerised workloads across clusters. Handles scheduling, scaling, and self-healing.

Kalkar decision: A 1978 ruling of the German Federal Constitutional Court (BVerfGE 49, 89) that introduced the three-stage theory distinguishing generally accepted rules of technology, state of the art, and existing scientific knowledge and research. Still the basis for reading the term state of the art in IT security law.

L

Launchpad: Canonical's bug tracker and build platform for Ubuntu, where packages are built, bugs filed against them and changelogs published.

Loonies: A Danish demogroup; Blueberry of Loonies co-wrote Crinkler.

lyaml: A Lua binding to libyaml. FreeBSD carries it in the base system for flua, where nuageinit uses it to parse cloud-config files.

LXD: A manager for system containers and virtual machines, built by Canonical on top of LXC.

libyaml: A YAML parser and emitter written in C, used through bindings in many languages, among them PyYAML in Python and lyaml in Lua.

L4: The second-generation microkernel family begun by Jochen Liedtke in 1993, built on the finding that first-generation IPC was slow by implementation rather than by design. Its descendants include seL4 and the kernels used in billions of mobile basebands.

libev: A small, fast C event loop library in the same family as libevent, using kqueue where it exists and epoll on Linux. Deliberately narrower in scope than libevent.

libevent: A portable C event-notification library that wraps whichever mechanism the host kernel provides: kqueue on the BSDs and macOS, epoll on Linux, and older interfaces elsewhere. The reason a great deal of software reaches kqueue without its author ever typing the name.

libuv: The cross-platform asynchronous I/O library written for Node.js and used well beyond it. Sits on kqueue on the BSDs and macOS, epoll on Linux and IOCP on Windows, presenting one event loop over all of them.

libxo: A FreeBSD library that lets base system utilities emit their output as plain text, JSON, XML or HTML from the same code path. It is why netstat --libxo json returns a routing table a program can read, and it is uneven in coverage: some utilities support it, others do not.

Linux kernel mailing list: The main public mailing list of Linux kernel development, often abbreviated LKML, on which patches are posted, reviewed and argued over before they are merged.

Linux Standard Base: A Linux Foundation specification meant to give Linux distributions a common binary interface for applications. Version 5.0 of June 2015 was the last, and Debian gave up its LSB support the same year.

LLVM: Compiler infrastructure begun by Chris Lattner at the University of Illinois in 2000, home of the Clang compiler and the default toolchain of FreeBSD since version 10.

lmbench: A suite of operating-system microbenchmarks written by Larry McVoy and Carl Staelin in 1996 and maintained today in Intel's fork. lat_syscall null times getppid, lat_pipe times a token passed between two processes and back; both take a warm-up period and report the median of a number of batches, which is what makes them a reference instrument.

loader.conf: FreeBSD's boot loader configuration, /boot/loader.conf, which sets kernel tunables before the kernel starts; sysctl -T lists the settings it can take.

Logicoma: Demoscene group founded by ferris, known for 64k intros on modern hardware and for publishing its own tooling. Engage took third place at Revision 2017 and Best High-End 64k Intro at the Meteoriks a year later; the group also released the WaveSabre synthesiser under an MIT licence.

lockf: A FreeBSD base system utility that runs a command while holding an exclusive lock on a file. With -t 0 it gives up immediately if the lock is taken, which is how periodic(8) prevents two runs of the same set from overlapping without any scheduler of its own.

locate: A Unix utility that finds files by name in a database rebuilt periodically rather than by walking the filesystem. On FreeBSD that rebuild is one of the five weekly periodic scripts and accounts for most of the weekly run time.

logd: The logging daemon of modern macOS, which collects and manages system log data. Apple cited it and its siblings when removing the inherited periodic(8) utility in macOS 15, on the grounds that the maintenance work had moved into managed services.

launchd: The init system and service manager of macOS, starting daemons and agents from property-list files; Apple's counterpart to systemd.

LEMP: Linux, nginx, MySQL or MariaDB, and PHP. The successor to the LAMP stack with nginx in place of Apache, and still the smallest arrangement that serves a database-backed site from one machine.

LESS: A stylesheet language that compiles to CSS, adding variables, mixins and nesting. One of several notations that can share a single commerce project, each requiring its own style pass.

Library of Congress: The research library of the United States Congress, which among other duties publishes recommended formats for the long-term preservation of digital content. The SQLite file format appears on that list, which is an unusual endorsement for a piece of engineering: it says that an institution planning in centuries expects the format to remain readable.

LibreSSL: A fork of OpenSSL begun by the OpenBSD project in 2014 after Heartbleed, stripping and auditing the codebase for correctness. One of several tools written for OpenBSD and now used far beyond it, alongside OpenSSH, doas and OpenNTPD.

Landlock: A Linux security module (merged in 5.13, 2021) that adds unprivileged filesystem sandboxing. Moves closer to Capsicum's capability model but does not yet match the simplicity of cap_enter().

LGTM smell: A review anti-pattern named after the phrase Looks Good To Me: an approval given without substantive examination. Measured at roughly three and a half times the rate in comment-free reviews (ICSME 2024).

Libsystem: The C library of macOS, carrying BSD ancestry; the macOS counterpart to glibc or FreeBSD's libc.

light-dark(): A CSS function that returns one of two values depending on the computed color-scheme. Eliminates media-query duplication for dark mode.

LibreOffice: A free, open-source office suite forked from OpenOffice.org in 2010 and maintained by The Document Foundation. A common component of European public-sector migrations away from proprietary productivity software.

LinearB: Engineering-analytics vendor whose 2026 benchmark report covers some 8.1 million pull requests from 4,800 organisations and reports that teams leaning heavily on AI merge around 98 per cent more changes.

lint-staged: A tool that runs linters against the files staged for a Git commit rather than the whole repository. It appends every staged path to a single command invocation instead of spawning one process per file.

Linux: The kernel Linus Torvalds wrote from scratch in 1991, and the operating systems built around it with a GNU or other userland. Unix-like, not Unix: it inherited no Bell Labs or Berkeley code and has never been certified by The Open Group. A separate family that looks Unix-shaped by design.

Linux Foundation: A non-profit consortium that hosts the Linux kernel's infrastructure and many other projects (including the CNCF). Registered in the United States as a 501(c)(6) trade association and therefore bound by US legal reach. Its 2024/2025 report put 84.3 per cent of kernel commits with developers paid by their employers.

Linuxulator: FreeBSD's Linux binary compatibility layer. Translates Linux system calls to FreeBSD equivalents in the kernel, running Linux binaries natively without emulation. Active since 1995.

Lions' Commentary: John Lions' line-by-line reading of the Unix V6 kernel source, written at the University of New South Wales in 1976. Later restricted by AT&T and circulated in samizdat photocopies for two decades, one of the most-copied computer-science documents of its era.

live-restore: A Docker daemon option that lets running containers survive a daemon restart. It ships switched off, so by default restarting dockerd takes every running container down with it.

Llama: Meta's family of open-weight language models. The weights are downloadable but the Llama Community Licence is not OSI-approved: it terminates for any company above 700 million monthly active users unless Meta expressly grants continued use, and carries an acceptable-use policy. The archetype of open weights that are not open source.

load balancer: A component that distributes incoming requests across several instances of an application. It makes horizontal scaling possible and, in doing so, makes any state held inside a single instance divergent by default.

Loghub: A public collection of real system log datasets maintained by the LogPAI group, used for research and benchmarking. The SSH dataset carries 655,146 lines of authentication log, which makes measurements over it reproducible by anyone.

LoongArch: A domestic instruction-set architecture developed by China's Loongson in 2021, moving away from the MIPS lineage toward an ISA under its own control.

LTS: Long-Term Support. A release designated for extended maintenance, typically receiving only security patches and critical bug fixes. Node.js LTS lasts 30 months. PostgreSQL supports each major for 5 years.

Lua: A lightweight embeddable scripting language. 30 KB runtime, first-class functions, metatables for OOP. Used in game engines and web servers.

linter: A tool that reads source code without running it and reports style violations, suspect constructs and likely errors. ESLint is the common choice in JavaScript projects.

LSB: Linux Standard Base, a specification of filesystem layout and interfaces intended to make software portable between distributions. Its device naming rules were one of the four reasons given for removing devfs from the Linux kernel in 2.6.18.

M

mv: The utility that renames or moves files; FreeBSD's mv.c carries a Berkeley copyright from 1989.

memory safety: The property of a language or program that it cannot read or write memory outside what it owns; Rust guarantees it at compile time for safe code, which removes one class of bug and says nothing about races on paths, permissions or logic.

mknodat: The system call that creates a special file such as a fifo relative to a directory descriptor, taking the mode at creation; GNU mkfifo calls it with the requested mode, uutils 0.8.0 with 0666 followed by chmod.

mkfifo: The utility that creates a named pipe; the uutils version created the pipe with mode 0666 and tightened it afterwards with chmod on the path, the race recorded as CVE-2026-35352, whereas GNU's passes the requested mode to mknodat at creation.

multicast: Sending one packet to a group of receivers at once through a group address such as 224.0.0.18, which carries CARP and VRRP advertisements on the local segment.

metadata service: A service inside a cloud, reached by a new virtual machine at a fixed local address, that hands the machine its configuration and user data.

Macau Exports: Demoscene group whose 64k intro Guberniya placed sixth at Revision 2017 and went on to win Best Direction at the Meteoriks 2018, which says a good deal about the strength of that competition.

lz4: A fast compression algorithm, the ZFS default since OpenZFS 2.2.0. It reduces I/O rather than adding to it, because fewer bytes cross the bus.

MAC framework: The FreeBSD mandatory access control framework, which carries security policies as loadable kernel modules rather than as a single fixed model.

macOS: Apple's desktop and laptop operating system, the successor to Mac OS X. Built on the Darwin foundation (XNU kernel plus FreeBSD-derived userland). Every version from 10.5 Leopard (2007) through macOS 15 Sequoia (2024) has been certified by The Open Group against the Single UNIX Specification version 3 and carries the UNIX 03 brand. The single largest carrier of certified Unix on the planet.

Magento: An open-source PHP commerce platform, now Adobe Commerce, organised as a monorepo that replaces 241 modules of its own. Its published quality gate runs a separate code-style pass for PHP, XML and XSD, HTML, GraphQL and LESS.

mainline: The Linux kernel tree maintained by Linus Torvalds, from which the numbered releases come; stable and distribution kernels are derived from it.

maintainer: The person who carries an open-source project: reviewing patches, cutting releases, answering the list. The role concentrates trust that the wider chain rarely verifies, which made it the target of the xz attack.

masscan: A fast Internet-scale port scanner by Robert Graham. Its README states that it can scan the entire IPv4 Internet on one port in under five minutes at ten million packets a second.

Matthew Dillon: A FreeBSD developer who, disagreeing with the fine-grained locking direction of FreeBSD 5, forked FreeBSD 4.8 in June 2003 to create DragonFly BSD, building a kernel organised around message-passing and the HAMMER and HAMMER2 filesystems.

MD5: A 128-bit hash function from 1992, cryptographically broken since collisions were demonstrated in 2004, but still used for integrity bookkeeping, among others by dpkg for configuration files.

mdo: A FreeBSD command, new in 14.2, that changes process credentials through the mac_do kernel policy and needs no setuid program to do it.

Meltdown: A 2018 vulnerability in speculative execution that let a user process read kernel memory across the privilege boundary. The countermeasure, page table isolation, costs time on every entry into the kernel, which is why processors that are immune to it announce the fact in a feature register.

Mesa: The open-source implementation of OpenGL, Vulkan and other graphics interfaces used by most free Unix-like systems, FreeBSD among them. It runs the old fixed-function pipeline on modern hardware by generating vertex programs that do the same work.

microarchitectural data sampling: A family of side-channel vulnerabilities in which stale data left in internal processor buffers leaks to a process that should not see it. The mitigation clears those buffers on every return to user space, adding cost to the kernel exit path.

motivated numeracy: Dan Kahan's term for the finding that skill with numbers is spent selectively when a number touches a reader's identity. In the 2017 study, 1,111 adults read the same two-by-two table correctly more often with rising numeracy when it described a skin cream, and more divergently with rising numeracy when it described a gun control measure.

page table isolation: The Meltdown countermeasure: kernel and user space are given separate page tables, swapped on every entry into the kernel and every return. Effective, and one of the most expensive things a kernel can do on its own hot path.

Mach ports: The message-passing endpoints of the Mach kernel, still the basis of inter-process communication under macOS. Measured on an Apple M1 Max in 2026, a round trip costs 2,750 nanoseconds, against the roughly 115 microseconds that Mach charged in 1993.

VM exit: A trap from a virtual machine guest into the hypervisor, taken when the guest attempts something the hypervisor must handle. Ordinary system calls raise no VM exit at all, which is why they cost the guest no hypervisor time.

Unix domain socket: A socket for communication between processes on the same machine, addressed by a path in the filesystem rather than by a network address. It carries no network stack overhead and is a common way to measure the cost of a process boundary.

Binder: The inter-process communication driver at the centre of Android, through which almost every system service call travels. A Rust implementation was merged into the Linux kernel and is in production use, which is the type-system answer to the problem that microkernels answered with address spaces.

Asahi: The project porting Linux to Apple silicon, notable for a GPU driver written in Rust that runs inside the kernel rather than in a separate address space.

jail: The FreeBSD operating-system-level virtualisation mechanism, in the base system since March 2000. A jail shares the host kernel, so measurements taken inside one are measurements of the host kernel.

M1 Max: A 2021 Apple silicon processor. Used here as the macOS measurement platform, where a Mach port round trip costs 2,750 nanoseconds and a system call 149.

GNU Coding Standards: The document that governs how GNU programs are written. On compatibility it says that POSIX prohibits many kinds of extension and that contributors should feel free to make the extensions anyway, and that additional useful features are welcome regardless of precedent. The sixty switches on GNU ls are what those sentences asked for.

ls: The Unix command that lists what is in a directory, present since the First Edition of 1971. POSIX.1-2024 defines 26 switches for it; the FreeBSD base system documents 44, GNU coreutils 60. Run with no switches at all, it is the version nearly everybody uses nearly all the time.

SYNOPSIS: The section of a Unix manual page that shows the command line in compressed form, with optional switches in square brackets. Counting the letters in those brackets is a conservative and reproducible way of counting a program's documented options.

Mach: A microkernel developed at Carnegie Mellon from the mid-1980s, part of the separate microkernel engineering tradition that grew up beside the monolithic Unix line and the basis of several later systems.

MAINTAINERS file: A file in the Linux kernel source tree listing who is responsible for each subsystem. In October 2024 it was edited to remove approximately eleven entries under stated compliance requirements, a change Linus Torvalds confirmed and declined to reverse. Illustrates that forking the source does not fork the governance.

make: A build automation tool written by Stuart Feldman at Bell Labs in 1976, driving compilation from a declarative file of targets and dependencies. Small enough to have been completed rather than continually replaced, and still in use half a century later.

make.conf: The FreeBSD configuration file that governs how third-party software is built from ports, including the hardening switches WITH_PIE, WITH_RELRO, WITH_BIND_NOW and WITH_FORTIFY.

Mastra: An open-source TypeScript framework for building AI applications, distributed as the @mastra npm scope. In June 2026 its publishing scope was hijacked through a dormant contributor account and 144 of its packages were backdoored.

mawk: A small, fast awk implementation that Debian and Ubuntu ship as their default awk. It stays close to POSIX and answers some gawk extensions differently, returning zero where gawk counts array elements.

MC/DC: Modified condition/decision coverage, a test-coverage criterion that goes well past branch coverage. It requires that every individual condition inside a compound decision has been shown to change the outcome on its own, with all other conditions held constant, so an if statement with four clauses needs at least five test cases before it counts as covered. The standard is written into DO-178B Level A, the assurance level a certification authority demands of airborne software whose failure would be catastrophic. SQLite has maintained one hundred per cent MC/DC coverage of its core library since version 3.6.17, released on 10 August 2009.

Model Context Protocol: An open protocol introduced by Anthropic in November 2024 that describes how AI applications connect to tools and data sources through structured, JSON-based messages. Usually shortened to MCP.

multi-vendor case ownership: Red Hat's term for the promise that its support organisation owns a problem even when the fault lies in another vendor's product. The phrase names precisely what an enterprise subscription sells: someone who will own the case.

National Vulnerability Database: NIST's register of record for CVEs. It enriched a record 42,000 entries in 2025, still carried a backlog of 25,000 that spring, and in 2026 began labelling entries below certain criteria as lowest priority rather than analysing them.

OpenSSL: The dominant open-source TLS and cryptography library. Most of the internet's encrypted traffic passes through it, and its 2006 Debian patching incident put 32,768 possible keys where billions should have been.

pcre2: The Perl Compatible Regular Expressions library, second series. On FreeBSD it is the single dependency nginx pulls in: 8.4 megabytes beside the web server's 1.7.

ports tree: FreeBSD's collection of build recipes for third-party software, held in one versioned tree alongside the base system. Each port records the upstream source and its checksums in a distinfo file, so a package has one origin that can be named and verified, rather than a dependency graph assembled at install time from whatever a registry serves.

Project Zero: Google's security research team, formed in 2014 to find previously unknown vulnerabilities in widely used software and to publish them under a fixed disclosure deadline. It is one of the two teams behind the Big Sleep agent.

public domain: The status of a work to which no copyright applies, so that no licence is needed and no condition can be attached. SQLite is placed in the public domain rather than published under a permissive licence, which was done because some early users had legal departments that could not approve any licence at all; the only terms their lawyers could accept were no terms.

sentinel value: A value chosen to mean not a value, carried in the same field as ordinary data. Minus one in a field that is otherwise always positive is the classic case. The technique costs nothing in storage and everything in discipline, because every piece of code touching that field must recognise the special case, and the one that forgets is the bug.

SQL Logic Tests: A test corpus of 7.2 million SQL queries over roughly 1.12 GB of data, run against SQLite and against other database engines so that the answers can be compared. Where the engines disagree, one of them is wrong; the point is to find that out without a human having to state the expected result for every query.

stack buffer underflow: A memory-safety fault in which a program writes or reads before the beginning of a stack buffer, rather than past its end as in the more familiar overflow. Both corrupt memory the program does not own; an underflow tends to be rarer and harder to provoke, which is part of why fuzzing can miss one.

STRICT tables: A table option added to SQLite in version 3.37 which makes declared column types binding, so that a value of the wrong type is rejected instead of converted. It arrived seventeen years after the file format froze, and its existence is a quiet admission that type affinity, however deliberate, left a soft edge that some applications needed closed.

syslogd: The system logging daemon. It receives messages from the kernel and from programs, writes them to files under /var/log with timestamps, and can forward the lot to a central collector with a single configuration line.

sysstat: A Linux package collecting system activity at intervals and storing it for later reading with sar, holding twenty-eight days by default. The closest thing to a built-in metrics history on that platform, and it weighs a couple of megabytes.

systat: A FreeBSD utility showing live system statistics in a full-screen terminal display, with views for virtual memory, network interfaces, disk activity and more. The moment rather than the history.

Tailwind CSS: A utility-first CSS framework in which styling is written as many small classes directly in the markup, with a build step that removes the classes a project does not use.

TanStack: A suite of headless JavaScript libraries for state management, routing, querying and table rendering, maintained by Tanner Linsley since 2017. Includes React Query (now TanStack Query), TanStack Router, TanStack Table and TanStack Form. The flagship @tanstack/react-router ships roughly 12 million weekly downloads. The 11 May 2026 Mini Shai-Hulud wave compromised 84 versions across 42 @tanstack/* packages between 19:20 and 19:26 UTC.

TH3: The Test Harness 3, a proprietary test suite for SQLite written in C and maintained by the SQLite developers. It holds 50,362 distinct test cases which expand across parameter combinations into roughly 2.4 million test instances, and it exists deliberately as a second and unconnected body of tests alongside the open TCL suite, so that a blind spot in one cannot be a blind spot in both. TH3 is what carries SQLite's one hundred per cent branch and MC/DC coverage.

The Ultimate Meeting: A German demoparty, usually abbreviated tUM, held in Karlsruhe between Christmas and New Year. Ran from 2001 and carries a reputation as a relaxed end-of-year gathering rather than a large competitive event.

thin jail: A FreeBSD jail whose root filesystem is a ZFS clone of a base-system snapshot rather than a full copy. The clone is created in milliseconds regardless of the size of the base system and occupies roughly five megabytes until its contents diverge from the snapshot, against about ninety-one megabytes for a thick jail carrying its own userland.

threat model: A written statement of what an attacker must already be able to do before a system can be attacked at all. SQLite publishes one: every historical vulnerability against the library requires either an attacker who can run arbitrary SQL, or one who can supply a maliciously crafted database file. The value of writing it down is that it can be pointed at, which a project assembled from several hundred transitive dependencies cannot do.

time series database: A store built for values stamped with a time, optimised for writing many samples and querying ranges of them. Prometheus carries one; the base system of a Unix does not, which is the honest gap in the comparison.

triage tax: The asymmetry between reporting a defect and examining one. A plausible advisory can now be drafted in seconds and at negligible cost, while reading it, building a reproduction case, watching it fail and writing down why still takes a person an afternoon. The cost falls entirely on the maintainer, is paid in the attention that would otherwise go into the next release, and scales with the volume of reports rather than with the number of real faults among them.

troff: The typesetting engine at the heart of roff, originally written at Bell Labs for the Graphic Systems phototypesetter. It reads a document marked up with macros and produces device-independent output for a driver to render.

tron: Demoscene handle of a farbrausch coder, credited alongside chaos on fr-063: Magellan and named in the source files of the production.

type affinity: SQLite's approach to column types, under which a declared type expresses a preference rather than a constraint: a value of another type is converted where it can be and stored as it is where it cannot. It makes the engine forgiving of loosely typed input and makes it possible to store text in a column declared as an integer. STRICT tables, added in version 3.37, provide the alternative for anyone who wants the declaration enforced.

ufw: The Uncomplicated Firewall, developed by Canonical for Ubuntu. Reduces common cases to single commands over iptables or nftables. Requirements beyond its vocabulary, such as rate limiting or interface-specific matching, push the administrator back into the layer underneath.

umask: The three-digit octal mask deciding which permission bits are withheld from newly created files. At the common default of 022 a new file arrives as -rw-r--r--, readable by every account on the machine; on FreeBSD the value is set at line 49 of /etc/login.conf. Almost nobody chooses it, almost everybody inherits it, and it is a fair example of a decision made for you by someone you will never meet.

unmapped mbufs: The memory buffer structure that BSD kernels use to hold network packets. Unmapped mbufs let the kernel carry data that has no virtual address mapping, which spares the mapping work on a machine pushing hundreds of gigabits.

MCP: Model Context Protocol, an open standard for connecting AI assistants to external tools and data sources. Packages aimed at MCP developers were a pointed target of the June 2026 PyPI supply-chain campaign.

mdadm: The Linux tool that manages software RAID arrays. It holds the redundancy and no checksum of file contents, so when two mirrored copies disagree it cannot determine which one is correct.

merge queue: A facility that batches approved pull requests, re-tests each against the current target branch and merges them in order. It does not waive a required approval; it moves the merge away from the person who gave it.

Merkle tree: A hash tree where every leaf node is labelled with the hash of a data block and every non-leaf node is labelled with the hash of its children. Used by ZFS for end-to-end checksumming.

message passing: The way processes talk in a microkernel: instead of calling into shared kernel code, a process sends a message to another and waits for the reply. In QNX it is the core kernel mechanism, and it is what lets drivers, filesystems and the network stack run as separate, isolable programs.

meta-framework: A framework built on top of a client-side rendering library that adds server rendering, routing, data loading and a build pipeline. Next.js, Nuxt and SvelteKit are the common examples; each answers problems introduced by the layer beneath it.

mfx: Finnish demogroup, collaborators with Kewlers on the 2006 demo 1995, which came third in the combined demo competition at Assembly 2006 and afterwards took Best Soundtrack and Public Choice at the Scene.org Awards.

Miasma: A June 2026 npm supply-chain attack that republished thirty-two packages under the @redhat-cloud-services scope through a hijacked continuous-integration pipeline identity. The packages carried valid signed provenance and stole credentials all the same, illustrating that an attestation certifies which pipeline built an artifact, not that the pipeline was still in the right hands.

microcode: The lowest layer of a CPU: the signed, encrypted program that translates architectural instructions into the processor's internal operations. It can be updated only with the manufacturer's signature; one cannot read it, write it, or fork it.

microkernel: An operating-system design that keeps drivers, filesystems and the network stack out of kernel space, communicating through a small message-passing core, so a failed driver restarts in milliseconds rather than taking the machine down. QNX is the long-standing production example.

Microservices: An architecture that decomposes an application into small, independently deployable services communicating over network protocols.

Microsoft 365: Microsoft's cloud office and collaboration suite. The German Datenschutzkonferenz found in November 2022 that GDPR-compliant operation could not be demonstrated; the EDPS ordered the European Commission to suspend its data flows in 2024, remedied only in 2025.

middleware: Code that runs between the arrival of a request and its handling by the application, typically for authentication, redirects or rewrites. In edge-deployed frameworks it runs on separate infrastructure from the application itself, which is why self-hosting has to reproduce it as its own component.

Minix: A small Unix-like operating system written by Andrew Tanenbaum in 1987 for teaching. Famously the system the young Linus Torvalds ran and outgrew, prompting him to write the Linux kernel.

Mistral: A Paris-based AI laboratory, Europe's most-cited example when digital sovereignty is discussed. It releases flagship 2026 models such as Mistral Large 3 under the permissive Apache 2.0 licence, a genuine good that is still not a fork, since the training data and pipeline are not published.

module graph: The complete set of modules an application loads and the import relationships between them. Browsers discover it by executing modules rather than by scanning the HTML, which is why a preload scanner cannot find imports for you.

Monolith: A single deployable unit containing all application logic. Often contrasted with microservices but not inherently inferior.

monolithic kernel: A kernel design in which the scheduler, drivers, filesystems and network stack all run inside one privileged address space, as traditional Unix and Linux do. Fast, but a fault in any part can take the whole system down, the arrangement the microkernel was meant to avoid.

monorepo: A single repository holding several packages or services that are versioned and built together. Convenient for shared code; it also multiplies every pipeline stage by the number of packages.

musl: A clean-room, lightweight implementation of the C standard library for Linux, emphasising POSIX correctness and small size. Used in place of glibc by Alpine and many container images. One userland among several (alongside glibc, Bionic and BusyBox) that share the Linux kernel and little else.

MVC: Model-View-Controller. An architectural pattern that separates data (Model), presentation (View), and input handling (Controller).

MVCC: Multi-Version Concurrency Control. A database technique where readers see a consistent snapshot without blocking writers. Used in PostgreSQL.

MVS: Multiple Virtual Storage, the IBM mainframe operating-system line whose design reaches back to the 1960s and the kernel beneath today's z/OS. It carries no Bell Labs or Berkeley code; the certified-Unix part of z/OS is a POSIX layer sitting on top of it.

minified build: The compressed, whitespace-stripped form of a JavaScript package that ships to production. Because it is not the form anybody reads, it is where the event-stream payload of 2018 was hidden.

Mistral AI: French artificial intelligence company. Its npm packages were among those taken in the Mini Shai-Hulud campaign of spring 2026.

Meteoriks: Annual demoscene awards presented since 2017, successor in spirit to the Scene.org Awards, with categories including Best Soundtrack, Best Visuals, Best Direction and Best High-End Demo.

N

Netgate: The company behind pfSense, the FreeBSD-based firewall distribution, whose high-availability pairs run on CARP and pfsync.

netfilter: The packet-filtering framework of the Linux kernel, behind iptables and nftables, and the project that also maintains conntrack and conntrackd.

nuageinit: FreeBSD's reader for cloud-init user data, in the base system since FreeBSD 14.1. Written in Lua and run by flua, with YAML parsed by lyaml; three rc scripts with the firstboot keyword apply hostname, users, keys, files, network settings and packages at the first boot only. Nuage is French for cloud.

netcat: A small Unix tool that reads and writes data across network connections and sockets. The OpenBSD rewrite, packaged as netcat-openbsd, has been a dependency of cloud-init since version 24.3.

NeurIPS: The Conference on Neural Information Processing Systems, one of the largest annual research conferences in machine learning, held since 1987.

Neutrino: The microkernel at the centre of QNX since 2001, successor to the QNX 4 kernel. In version 6.3.2 it came to roughly 23,000 lines, because filesystems, drivers, the network stack and the graphics all run outside it as ordinary processes.

newaliases: The command that rebuilds the mail aliases database after /etc/aliases has been edited. On a FreeBSD machine it is what makes the nightly periodic report reach a person rather than a mailbox nobody opens.

Neoverse: ARM's line of licensed CPU cores for servers and high-performance computing; the cores on which Europe's SiPearl Rhea1 is built.

Net/2: Berkeley's 1991 release, an attempt to ship a Unix distribution containing only Berkeley-written code and no AT&T-licensed source; the basis of BSDi's product and the trigger for the USL lawsuit.

Netflix: The streaming company, cited here for a 2017 web-performance result: removing client-side React from its logged-out home page cut Time to Interactive by around half. In the Unix context, its Open Connect appliances also run FreeBSD.

Netlify: A deployment and hosting platform for modern front-end applications, in the same tier as Vercel. Its hosting model and integrations are coupled to the heavy modern stack, and pricing tends to scale with bundle size.

Network Effect: The phenomenon where a product becomes more valuable as more people use it. The mechanism that creates lock-in: leaving the network means losing the connections you built on it.

Next.js: A React-based full-stack web framework, originally released by Vercel (then ZEIT) in October 2016. Bundles server-side rendering, static generation, file-based routing, edge functions, image optimisation and a build pipeline. A typical fresh install in 2026 lands at 700 MB to a full gigabyte on disk, the majority devDependencies; the de facto starting template for React projects after create-react-app was retired.

Nextcloud: An open-source, self-hostable file-sync and collaboration platform, often deployed as a sovereign alternative to proprietary cloud suites. A common component of European public-sector migrations.

NFO: The plain text file shipped with a demoscene release, named after its .nfo extension, listing credits, technical notes and greetings, often under a logo drawn in characters.

NFS: Network File System, a protocol from Sun Microsystems for mounting a remote directory as if it were local. Older than containers by decades and sufficient, on its own, for sharing a project directory between a host and a development virtual machine.

nftables: The Linux packet classification framework replacing iptables. Uses a unified syntax for filtering, NAT, and mangling.

namespaces: The Linux kernel feature that gives a process its own isolated view of resources (mounts, network, PIDs), the primitive containers are built from. Isolation holds only while the kernel, the runtime and procfs all agree on the same picture; the seam between them is where the November 2025 runc break-outs escaped.

nginx: A high-performance HTTP server and reverse proxy using an event-driven, non-blocking architecture. Serves static files and proxies upstream applications.

Nintendo Switch: Nintendo's games console (2017). Its Horizon operating system carries FreeBSD's networking code without being a FreeBSD derivative outright, code from one family running inside another. Counted with Sony's consoles, it tilts the console world towards BSD.

Nix: A functional package manager that stores every build under a hash of its complete dependency tree, allowing incompatible versions to coexist on one machine and making upgrades and rollbacks atomic. The basis of NixOS.

node-ipc: A widely used Node.js inter-process-communication library, around 822,000 weekly downloads. In May 2026 its maintainer account was taken over after the domain behind its recovery email, atlantis-software.net, was allowed to lapse and re-registered by an attacker for the price of a registration; a credential stealer then shipped to every installer.

NOTICE file: A text file carried alongside Apache-licensed software that records attribution required by contributors. Section four of the licence requires any derivative distribution to reproduce it.

Novell: The software company that acquired AT&T's Unix System Laboratories, and with it the UNIX trademark, in 1993, before passing the mark to X/Open the same year. One link in the chain of custody that ends at The Open Group.

npm: Node Package Manager. The default registry and CLI for JavaScript packages. Manages dependency trees in node_modules.

non-blocking I/O: An I/O model in which one thread issues many operations and is notified as each completes, rather than waiting on each in turn, so a single process can hold thousands of idle connections. The model at the heart of Node.js, and of Go and Rust async runtimes alike.

Node.js: A JavaScript runtime built on Chrome's V8 engine, released by Ryan Dahl in 2009, that runs JavaScript outside the browser on a single-threaded event loop. npm shipped as its package manager, and the two grew together.

Noise Protocol Framework: A construction kit for cryptographic handshakes by Trevor Perrin, from which WireGuard uses the IKpsk2 pattern. The chosen pattern is hashed into every handshake, which is why a future version would be a different protocol rather than a negotiated option.

npm audit: The built-in dependency scanner of the npm CLI. It compares the version strings of installed packages against a database of published advisories and reports matches. It does not read the code, test the combination of packages, or notice a compromise that has not yet been published as an advisory.

NIS2: The European directive on measures for a high common level of cybersecurity across the Union. Article 21 requires risk management measures taking into account the state-of-the-art and relevant European and international standards.

NIST: The United States National Institute of Standards and Technology. Its technical investigation of The Station nightclub fire recorded that about two-thirds of the occupants attempted to leave through the main entrance.

Novoque: An online demoparty held on 15 and 16 August 2020, assembled because Evoke could not take place that summer. Nine competitions from demos and intros to ANSI art; six entries in the demo compo.

NVD: The National Vulnerability Database of the US National Institute of Standards and Technology, which records CVE entries with scores and references.

O

out-of-bounds read: A memory error in which a program reads past the end of a buffer; GNU sort and uniq each received a CVE for one, patched in Ubuntu in August 2026.

oss-security: The public mailing list at openwall.com on which security issues in open-source software are disclosed and discussed.

O_RESOLVE_BENEATH: A FreeBSD open(2) flag, with AT_RESOLVE_BENEATH for the *at calls, that makes the kernel refuse a path resolving outside the starting directory, symbolic links included; FreeBSD's cp uses it for every destination of a recursive copy.

openat: The system call that opens a path relative to an already open directory descriptor rather than the current directory; with O_RESOLVE_BENEATH on FreeBSD the kernel refuses any path that would escape that directory, which closes the symlink race between a check and the action.

OpenStack: An open-source platform for running private and public clouds, begun in 2010 by Rackspace and NASA. Its metadata service and its config drive hand configuration data to new virtual machines.

npx: A wrapper shipped with npm that locates and runs a package binary. It starts a Node process of its own before starting the intended one, which measured 262 milliseconds of pure overhead per invocation.

null pointer dereference: Reading or writing through a pointer that holds no valid address. In userland it usually ends the programme; in the kernel it can panic the machine or, where the null page can be mapped by an unprivileged process, be steered into privilege escalation. FreeBSD 6.1 carried one in kqueue.

NVMe: Non-Volatile Memory Express, the interface that connects solid-state storage directly to the PCIe bus, removing the queueing limits inherited from disk-era protocols.

open design: Saltzer and Schroeder's principle that the design of a protection mechanism should not be secret and should rest on keys or passwords; the computing form of Kerckhoffs's second requirement.

OpenAI: The American AI company behind the GPT models and ChatGPT, founded in 2015. In August 2024 it introduced structured outputs, which make a model's reply conform to a supplied JSON schema.

OpenMP: A standard for shared-memory parallel programming in C, C++ and Fortran, in which compiler directives divide loops and tasks among the cores of a processor. Compilers ship it as a runtime library.

OpenSearch: An open-source search and analytics suite, forked from Elasticsearch 7.10 in 2021 by Amazon Web Services after Elastic relicensed Elasticsearch under SSPL. Maintained by the OpenSearch Foundation since 2024. The npm packages of the OpenSearch JavaScript client were among the components touched by the 11 May 2026 Mini Shai-Hulud wave.

OpenSSH: The open-source implementation of the SSH protocol suite, maintained by the OpenBSD project. First released in 1999 by Theo de Raadt. Ships with virtually every Unix-like operating system.

openSUSE: The community Linux distribution sponsored by SUSE. Since 13.2 in November 2014 it has installed btrfs with snapper by default, taking a snapshot before and after every zypper transaction.

OpenTofu: Open-source fork of Terraform maintained by the Linux Foundation, created after HashiCorp relicensed Terraform under the BSL in August 2023. Drop-in compatible with existing configurations.

Open Software Foundation: An industry consortium founded in 1988 to develop an open Unix standard, which merged with X/Open in 1996 to form The Open Group. One of the two bodies whose union produced the present keeper of the UNIX mark.

Open Source Initiative: The body that has maintained the Open Source Definition since 1998 and decides which licences meet it. Approval by the OSI is what separates open source from source available, and both BSD and the GPL carry it.

OpenGL: A cross-platform graphics API for rendering two- and three-dimensional content on the GPU, long the standard alternative to Direct3D and widely used in demoscene productions.

OpenRC: A dependency-based init and service manager used by Alpine Linux and Gentoo; a lighter alternative to systemd.

Organic Reach: The percentage of a page's followers who see a post without paid promotion. Facebook organic reach for business pages fell from 16% in 2012 to 1.37% in 2024, the canonical example of platform enshittification.

OKLCH: A perceptually uniform colour space using Lightness, Chroma, and Hue. Produces consistent perceived brightness across all hues, unlike HSL.

OOCSS: Object-Oriented CSS. A methodology that separates structure from skin and container from content, promoting reusable CSS classes.

OmniOS: A minimalist, server-focused illumos distribution (OmniOS Community Edition) with a stable, predictable release cadence.

on-demand: Cloud pricing without commitment, charged by the hour or second. The most expensive tier, and the one most published comparisons quote.

Open Source AI Definition: The Open Source Initiative's 2024 standard (OSAID 1.0, 28 October 2024) for what may be called open source AI: the system must provide the training and inference code, the parameters, and data information detailed enough that a skilled person could build a substantially equivalent system. A model that ships only its weights does not qualify.

open weights: A model released as its trained parameters plus a licence, downloadable and runnable on your own hardware, but without the training data, training code or compute needed to reconstruct it. Available and tunable, yet not reproducible; open weights are not the same as open source.

OpenBSD: A security-focused open-source Unix operating system. Produced OpenSSH, LibreSSL, OpenBGPD, and the pledge()/unveil() system calls. Known for code audits and minimal defaults.

openwashing: Presenting an AI system as open when it withholds what openness was meant to guarantee. Coined in a 2024 Nature paper by Widder, Whittaker and West, which argued that models offering little beyond downloadable weights under restrictive terms are better understood as closed, and that the rhetoric often concentrates power rather than loosening it.

orchestrator: A control system, such as Kubernetes, that schedules containers across cores and machines, health-checks them and restarts those that fail; the supervisor a single self-scheduling binary does not need.

OpenIndiana: A community-maintained illumos distribution, the continuation in spirit of OpenSolaris; ships rolling Hipster snapshots with x86 ISO images.

OpenVPN: An open-source VPN solution using SSL/TLS for key exchange. Flexible but verbose configuration compared to WireGuard.

ORM: Object-Relational Mapping. A layer that translates between programming-language objects and relational database rows, abstracting SQL behind method calls.

osv-scanner: An open-source vulnerability scanner that reads the OSV database of advisories rather than only CVE feeds. It flagged the malicious Mastra dependency that CVE-bound tools, finding no CVE, did not.

over-provisioning: Allocating more compute or memory to a workload than it will ever use, usually as a hedge against unknown demand. Measured across production Kubernetes clusters, it affects sixty-nine per cent of them on CPU, up from forty per cent the year before.

orchestration: The layer that schedules, places and restarts containers across a fleet of machines. Introduced to make containers manageable, it becomes an operational system in its own right, with its own staff and its own failure modes.

observability: The practice of being able to answer questions about a running system from the outside. In the kernel it means dynamic instrumentation; as a purchased product it means agents, a collector and a dashboard, charged per host and per gigabyte.

P

PE header: The header of a Windows executable, which follows the DOS stub that begins with the letters MZ. Crinkler places it twelve bytes into the file, overlapping the stub, to save space.

Pseudo-Kleinian fractal: A family of three-dimensional fractals developed on fractalforums around 2010 from a few folding operations, named after the Kleinian limit sets they resemble. Hartverdrahtet draws one.

promiscuous mode: A setting in which a network interface or a virtual switch port accepts frames addressed to any MAC address on the segment. Virtual switches often need it before a guest may use a virtual MAC.

preemption: The rule that a better-placed backup takes the address from a master that advertises worse, without waiting for the master to fail. Off by default in carp and switched on with net.inet.carp.preempt.

point releases: Updates within one release of an operating system, such as Debian 13.1 or RHEL 10.2. Debian's bring fixes; Red Hat's can also bring new Application Streams.

Ports Collection: FreeBSD's collection of build recipes for third-party software, from which the official binary packages are built. It appeared in FreeBSD 1.0 and runs on its own calendar, separate from the release of the base system.

PHP: A scripting language for the web, first released by Rasmus Lerdorf in 1995. Each minor release, such as 8.4 or 8.5, is a branch of its own with its own support period, which is why a server often needs a particular one.

port knocking: Opening a firewall port only after a secret sequence of connection attempts on other ports, described by Martin Krzywinski in 2003. A sniffed sequence can be replayed, which Single Packet Authorization addresses.

procps: The collection of process and kernel utilities that supplies ps, top, free and sysctl on most Linux distributions. Its sysctl documents -d as an alias of -h.

Puppet: Configuration management system that keeps machines in a declared state, reconciling drift on each run. Together with Ansible it is the class of tool a shell loop deliberately is not, and the reason both exist is that state reconciliation, inventory and reporting matter once a fleet outgrows what one person can hold in their head.

Poo-Brain: Demoscene group whose 64k intro Eidolon won the PC 64k competition at Revision 2017. A year later Poo-Brain and Logicoma released Bros Before Foes together, which took Best Soundtrack at the Meteoriks 2019.

periodic: FreeBSD’s maintenance framework, first shipped in FreeBSD 3.0 in October 1998. A driver of 123 lines of POSIX shell runs the scripts in /etc/periodic/{daily,weekly,monthly,security}, filters their output by exit status through the switches in periodic.conf, and posts what remains to root. Adding a task means dropping a script into a directory.

patent grant: A clause in which contributors license the patents that their contribution necessarily infringes, so recipients cannot be sued over the code they were given. Apache 2.0 contains one in section three, and it terminates if the recipient begins patent litigation over the work.

PHPMD: PHP Mess Detector. Scans PHP source for likely bugs, over-complicated expressions and unused parameters, driven by rulesets. Spryker runs it against an architecture sniffer ruleset.

PHPStan: A static analysis tool for PHP that infers and checks types the language does not require. Configured in levels from 0 to 10; commerce projects commonly run level 4.

PIE: Position Independent Executable. A binary that can be loaded at an arbitrary address, which is what allows address space layout randomisation to apply to the program itself.

pkg: FreeBSD's binary package manager, installing prebuilt software produced from the curated ports tree.

pkgsrc: NetBSD's portable package-building system, carrying roughly 29,000 recipes. It does not require NetBSD underneath it, building the same software the same way on illumos, macOS and Linux, a portability that mirrors NetBSD's own.

Overload Table: A pf construct in which a rule that exceeds a connection rate limit places the offending source address into a named table, which a separate block rule then drops. It gives the packet filter its own rate-limiting defence without any external daemon. The equivalent on Linux is an nftables dynamic set updated by a rule when a rate is crossed.

PaaS: Platform as a Service. A managed environment where developers deploy code without managing servers, containers, or operating systems.

permissive: A licence family (BSD, MIT, Apache 2.0) that lets the receiver build on, fork, ship and relicense the code freely, keeping only attribution. The counterpart to copyleft, which carries its conditions into everything built on it.

PerSourcePenalties: An OpenSSH feature introduced in version 9.8 in 2024 that makes sshd refuse connections from sources which have recently misbehaved, without any external tool. Each class of failure carries its own penalty in seconds, penalties accumulate per source address, and a source is refused once its total crosses a threshold. Enabled by default on current FreeBSD and on Debian 13, which means many machines are already doing part of this work with no configuration at all.

PETSCII: The character set and block-graphics repertoire of the Commodore 64, used as an art form in its own right. Drawing in PETSCII means composing a picture out of the machine's fixed glyphs rather than free pixels.

pf: Packet Filter. The firewall in FreeBSD (and OpenBSD). Stateful, with anchors, tables, and a concise rule syntax.

PHP-FPM: FastCGI Process Manager for PHP. Manages a pool of PHP worker processes, each handling one request at a time. Typical memory: 40-128 MB per worker.

PinTheft: A 2026 Linux local-privilege-escalation vulnerability (CVE-2026-43494) that chains a reference-counting bug in the kernel's RDS sockets with io_uring to overwrite a setuid-root binary in memory and obtain a root shell.

Platform Security Processor: AMD's equivalent of the Intel Management Engine: an embedded ARM core inside the SoC running signed proprietary firmware with full system access, but without the direct network path the Intel ME carries.

pluralistic ignorance: Social psychology's name, going back to Katz and Allport (1931), for the stable arrangement in which each person privately does or believes a thing, assumes the others do not, and so everyone keeps the silence together. The engine of the AI disclosure gap.

PNAS: Proceedings of the National Academy of Sciences, one of the most-cited multidisciplinary scientific journals, established in 1914. Venue of the 2025 Duke study that measured the social evaluation penalty for AI use.

Podman: An open-source container engine maintained by Red Hat, first released in 2018. Container-compatible with Docker at the CLI level (podman run, podman build) but daemonless and rootless by default; each container is a direct child of the invoking shell rather than of a long-running daemon. Demonstrated that the Docker model does not structurally require a daemon.

Podman Desktop: Red Hat's graphical container tool, Apache-licensed and free. Daemonless by design: each container runs as a child of the process that started it, supervised by conmon, so there is no central root daemon to crash or to compromise.

Portage: Gentoo's package management system, which builds software from source according to ebuild scripts and lets the user select optional features through USE flags before anything is compiled.

POSIX: Portable Operating System Interface. A family of IEEE standards defining Unix-compatible APIs, shell behaviour, and utility conventions.

POSIX AIO: The POSIX standard's asynchronous I/O interface, an older way for a program to ask the kernel to perform input and output without blocking. On Linux it is the fourth of five accreted I/O interfaces, after select, poll and epoll and before io_uring.

PostgreSQL: An advanced open-source relational database with MVCC, JSON support, full-text search, and extensibility via custom types and functions.

Pouët: The demoscene's long-running community database and discussion site for productions, where releases are catalogued, rated and argued over at length.

preload scanner: A browser component that reads ahead through raw HTML while the main parser is blocked, starting downloads for resources it recognises. It works on markup, so resources reached only by executing JavaScript modules stay invisible to it.

Prettier: An opinionated code formatter for JavaScript, TypeScript, CSS and more. It exists because the language never fixed a canonical form, so the form has to be imposed afterwards by a tool.

Prix Ars Electronica: Annual award of the Ars Electronica festival in Linz, Austria, given across categories including computer animation and digital art. Conspiracy's Chaos Theory was nominated in 2007.

procedural generation: Producing content from code and mathematics at runtime instead of loading it from files. It is what makes a 64k intro possible, since a formula costs a few bytes where a texture costs megabytes.

Propel: An object-relational mapper for PHP that generates model classes from an XML schema. Because the classes are generated rather than written, the schema and the generated transfer objects need their own validation stages.

Public Choice: An award category decided by an open community vote rather than a jury. At the Scene.org Awards it went to 1995 by Kewlers and mfx for the year 2006.

Pwn2Own: A recurring computer-security contest in which researchers demonstrate working exploits against fully-patched software for cash prizes; a public benchmark of what is currently exploitable. CVE-2020-8835, an eBPF verifier flaw, won there in 2020.

postinstall: An npm lifecycle hook: a script a package declares to run automatically the moment it is installed, with the full rights of whoever ran the install. Convenient for setup, and the standard foothold for supply-chain malware.

Poudriere: The FreeBSD tool for building binary packages from ports inside clean, isolated jails, so a build process cannot reach the host that drives it.

Privilege Separation: A security architecture that splits a process into a small privileged monitor and a larger unprivileged worker. Limits damage when the worker is compromised. Pioneered by OpenSSH in 2002.

Product Liability Directive: The European Union's revised product-liability regime, Directive 2024/2853, applying from December 2026. It writes software, firmware and AI systems into the definition of a product under no-fault liability and shifts the burden of proof toward the producer in technically complex cases.

Prometheus: A time-series monitoring system with a pull-based model, PromQL query language, and built-in alerting.

procfs: The Linux /proc filesystem, a kernel interface exposed as files: writing to /proc/sys/kernel/core_pattern or /proc/sysrq-trigger changes kernel behaviour. Its writable surface is the seam the November 2025 runc break-outs escaped through, redirecting a mount into procfs.

provenance: A signed attestation recording how a software artifact was built, for example which pipeline produced it and from which source. Useful but not a trust boundary: provenance certifies the build, not that the identity permitted to publish is still in the right hands, as the Miasma attack showed.

PSE52: The realtime-controller profile of the POSIX standard (IEEE 1003.13), against which QNX holds a formal certification. Issued by the same bodies that keep the UNIX register, only against a different standard, which is how QNX claims genuine POSIX certification without being certified UNIX.

PureDarwin: A community project that assembles Apple's open-source Darwin into a bootable operating system independent of macOS; current builds run as a virtual-machine image.

PyCon: The annual Python community conference. Held in multiple countries, featuring talks, sprints, and community gatherings.

Parcel: A zero-configuration JavaScript bundler from 2017 that sold convenience where webpack sold configurability.

package-lock.json: The file npm writes to record the exact resolved version of every package in an installation, direct and transitive. Counting its entries is the honest way to learn how many packages a project actually brought in.

phishing: An attack that obtains credentials by imitating a trusted sender. The September 2025 npm compromise began with a message imitating a two-factor authentication reset, sent from a lookalike domain.

probe: A single point of instrumentation in a running system, which can be enabled to fire when execution reaches it. DTrace exposes tens of thousands of them; the 2004 paper puts even the smallest system at around thirty thousand in the kernel alone.

production system: A system carrying real users and real consequences, as distinct from a laboratory or test machine. The distinction matters because most measurement tools are acceptable on the latter and not on the former.

Python: A general-purpose, dynamically typed programming language created by Guido van Rossum and first released in 1991. fail2ban and jc are both written in it, which on FreeBSD means installing an interpreter alongside the tool.

Q

quarterly branch: The branch of the FreeBSD ports tree that is cut at the start of every January, April, July and October and afterwards receives fixes only, security updates included. It is the default package source for FreeBSD releases since 10.2.

pull request: A proposed change offered for review and merging. The unit that carries the approval field, and therefore the unit whose recorded history everyone downstream interprets.

QEMU: Quick Emulator. An open-source machine emulator and virtualiser, created by Fabrice Bellard in 2003. Provides device emulation and, with KVM, near-native virtual-machine performance. The userland half of the KVM/QEMU pairing used by Proxmox VE and many other platforms.

Quantum Software Systems: The Canadian company, founded near Ottawa, that began building QNX in 1982. The origin of one of the most widely deployed operating systems almost nobody can name.

R

rm: The utility that removes files and, with -r, directory trees; POSIX requires it to descend to arbitrary depths. FreeBSD's rm.c carries a Berkeley copyright from 1990 and walks with fts(3).

Regents of the University of California: The copyright holder named in the BSD licence headers of the Berkeley code, including cp.c, ls.c, mv.c and rm.c in FreeBSD, with years from 1988 to 1994.

rust-coreutils: The Debian and Ubuntu source package for the uutils coreutils; on Ubuntu the binaries are provided through coreutils-from-uutils, with coreutils-from-gnu as the way back.

RFC 5798: The IETF specification of VRRP version 3 for IPv4 and IPv6, published in March 2010. Its security section states that it defines no authentication.

RAID-Z: ZFS's own form of parity RAID, with one to three parity disks per group and a variable stripe width, which avoids the write hole of classic RAID 5.

rc.subr: The shell library behind FreeBSD service management, 2,870 lines of it, contributed originally by NetBSD. Together with /etc/rc it starts the network, the firewall, the storage layer and the jails, and every line is readable by whoever operates the machine.

Real World Technologies: A long-running website and discussion forum on processor and system architecture, where Linus Torvalds has posted for many years.

regular expression: A pattern language for matching text, found in grep, sed, most programming languages and every log-scanning tool. It matches what it was written for, and a sentence worded differently simply fails to match, with no error to say so.

RFC 8878: The IETF document that specifies the Zstandard compression format and the application/zstd media type, published in February 2021. It describes exactly one decoder; compression levels do not appear in it at all.

RFC 9659: The IETF document that fixes the window size for zstd used as an HTTP content encoding, published in 2024. Browsers cap the window to bound memory, and the document turns that cap from a recommendation into a requirement.

Rocky Linux: Community rebuild of Red Hat Enterprise Linux, founded in 2020 after CentOS Linux gave way to CentOS Stream. FreeBSD's default Linux userland, the package linux_base-rl9, is derived from Rocky Linux 9.

rpmconf: A Fedora tool that finds the .rpmnew, .rpmsave and .rpmorig files RPM leaves behind and offers a two-way diff for each. It is not installed by default.

run-parts: The Debian-derived helper that runs every executable in a directory, used on Linux to drive /etc/cron.daily and its siblings. It schedules in the same way FreeBSD’s periodic(8) does and has no equivalent of its configuration layer or of the collected report.

RACK: Recent ACKnowledgement, a TCP loss-detection method that infers loss from the order and timing of acknowledgements rather than counting duplicates. Contributed to FreeBSD from Netflix's traffic work.

RAID: Redundant Array of Independent Disks: several drives combined so that the failure of one does not lose data. It was designed against a drive dying, and it has no instrument for a drive that returns wrong data while reporting success.

RAIDZ: ZFS's parity redundancy scheme. Unlike classic RAID 5 it writes every block as a complete stripe of variable width inside a transaction, which is why the write hole cannot occur.

RAII: Resource Acquisition Is Initialisation. A pattern where resources are tied to object lifetimes: acquired in the constructor, released in the destructor. Rust enforces this through ownership. No garbage collector needed.

rc.d: The BSD-style init layout: services are plain shell scripts in /etc/rc.d, enabled through rc.conf on FreeBSD or the execute bit on Slackware.

Red Hat Enterprise Linux: A commercially supported Linux distribution from Red Hat (RHEL), aimed at enterprise deployments with long support cycles and certified hardware. Like every distribution, an assembly of independently-governed projects selected, patched and integrated by the vendor rather than a single tree.

Redis: An in-memory data structure store used as database, cache, and message broker. Single-threaded, sub-millisecond latency.

Redox: A Unix-like operating system written from scratch in Rust, begun by Jeremy Soller in 2015. A microkernel with drivers and filesystems in user space; being written in Rust, whole classes of memory-safety bug are designed out. The microkernel discipline carried into the present, with no Unix blood.

regreSSHion: A remote unauthenticated code-execution flaw in the OpenSSH server (CVE-2024-6387), disclosed by Qualys in July 2024; a regression that reintroduced a previously fixed signal-handler race. Cited as a reminder that an unmaintained old system is a liability, not an heirloom.

RELRO: Relocation Read-Only. A linker option that marks parts of a binary's relocation data read-only after loading, closing a class of attacks that overwrite it.

replacement scanning: Scanning a paper document and then destroying the original, so that the scan becomes the legally binding record. Germany's federal security office ruled in March 2015 that image compression working by symbol coding, JBIG2 above all, is unsuitable for this workflow, because a substitution error leaves no second copy to check against.

reserved instance: A commitment to use a given cloud instance type for one or three years in exchange for a substantially lower rate. It cuts compute cost and leaves storage and traffic charges untouched.

resume-driven development: The habit of choosing technologies for what they do to a CV rather than for what they do to the problem, on both sides of the hiring table. Defined and measured in a 2021 ICSE study of 591 software professionals: 82 per cent believed fashionable technology makes them more attractive to employers, and 60 per cent of hiring staff said trends shape their job adverts.

Ring 0: The most privileged execution level of an x86 processor, where the operating-system kernel runs with full control of the machine. Code here can do anything, so it is the level every other protection depends on; running foreign code in Ring 0 is what makes the eBPF verifier load-bearing.

remote-access trojan: Malware (a RAT) that opens a covert remote-control channel to an attacker, allowing arbitrary commands, file access and data exfiltration from the infected machine. The axios npm compromise of March 2026 shipped a cross-platform one through a post-install script.

Reproducible Builds: An effort to make a build produce a bit-for-bit identical artifact from the same source, so that an independent party can rebuild a release and confirm the binary on disk matches the published source. A pillar of the responsibility line that node_modules lacks.

RESP: Redis Serialisation Protocol, the wire format spoken between a Redis client and server, in versions 2 and 3. Because it is narrow, documented and stable, a fork that keeps it can be adopted without touching a line of client code, which is the single technical reason the Valkey migration was cheap.

REST: Representational State Transfer. An architectural style for APIs using standard HTTP methods (GET, POST, PUT, DELETE) on resource URLs.

RISC-V: An open instruction-set architecture, originally from UC Berkeley, that anyone may implement without a licence fee. Its specification is open; its governing body, RISC-V International, sits in Switzerland.

RISC-V International: The non-profit foundation that governs the RISC-V specification. It moved its incorporation from the United States to Switzerland in 2020 to insulate the open ISA from any single state's trade policy.

Rolling Checksum: A hash that can be updated incrementally as a window slides across data. Enables rsync to find matching blocks in O(n) instead of O(n²). Based on Adler-32.

Rolling Release: A software distribution model where updates ship continuously rather than in discrete versions. No fixed release date, no frozen state. The system is always current, never finished.

rpm: The package format and low-level tool of the Red Hat family, comparable in role to Debian's dpkg: it installs and removes individual packages while dnf handles repositories and dependency resolution.

rsync: A fast, incremental file transfer utility. Transfers only the differences between source and destination using a rolling checksum algorithm.

RTOS: A real-time operating system, one whose response time can be bounded and proven, as safety-critical and embedded work demands. QNX is the best-known POSIX RTOS; LynxOS and VxWorks are others. Determinism tends to follow from a small kernel rather than from tuning a large one.

runc: The low-level Open Container Initiative runtime that actually creates Linux containers, used beneath Docker and Kubernetes. It sets up namespaces, cgroups and mounts as instructed; the November 2025 break-outs (CVE-2025-31133, -52565, -52881) turned its valid mount handling into a write into procfs.

Rust: A systems programming language emphasising memory safety without garbage collection, using ownership and borrowing rules enforced at compile time.

recordsize: The ZFS property setting the maximum logical block size of a dataset, 128 KiB by default. It governs how much data one checksum and one copy-on-write operation cover, so it belongs in any published measurement: the same benchmark at 8 KiB and at 1 MiB is not the same benchmark.

registry: A central index that stores and serves software packages for a package manager. The npm registry is the largest, free to publish to and free to install from; anyone can add a package, and that openness, with no responsibility line drawn between callers and what they pull in, is both its reach and its central security problem.

Rolldown: A Rust rewrite of Rollup, begun for Vite; the latest generation of the bundler lineage. The industry's newest answer to slow builds is, once again, a faster bundler.

Rollup: A JavaScript bundler from 2015 focused on ES modules and tree-shaking; its engine long underpinned Vite's production builds.

React DOM: The renderer that attaches a React component tree to the browser DOM, shipped as a package separate from React itself.

registry token: The credential that authorises publishing to a package registry. Shai-Hulud spread by harvesting these from build environments and publishing poisoned versions of whatever else the credential could reach.

reachability analysis: A filter applied to scanner output that asks whether a vulnerable code path can actually be reached from the application, in order to separate advisories that matter from those that do not.

RenderDoc: A frame debugger for graphics work. It captures a single frame of a running application and lets you step through every draw call and inspect the buffers, which is the only practical way to find out why a picture is wrong.

ruleset: A named, numbered set of devfs rules in /etc/devfs.rules, attached to a mount and applied to every node appearing under it. The shipped jail ruleset begins by hiding everything and grants individual devices back, which is why a jail sees a fraction of the host's devices without anybody writing a rule.

rootkit: Software that maintains privileged access to a compromised machine while hiding its own presence. The REPTILE rootkit is listed by MITRE as a real-world user of udev rules for persistence.

REPTILE: A Linux rootkit documented by MITRE as using udev rules for persistence, attaching a command to a device event so that it re-executes with root privileges whenever an application touches a pseudo-device.

S

segmentation fault: The failure a Unix process reports when it touches memory it may not; on Ubuntu 26.10 in September 2026 the uutils rm produced one on 32,768 nested directories because its recursion ran out of stack.

symlink: Short for symbolic link, a file holding a path that the kernel follows when the name is resolved.

symbolic link: A file that holds a path to another file and is followed by the kernel when the path is resolved; the usual instrument of a TOCTOU race, planted between a tool's check and its action.

supersampling: Rendering an image at a multiple of the screen resolution and scaling it down, so that edges and fine detail are averaged. Costly in proportion, which is why Hartverdrahtet's HQ builds come with a note about buying a new GPU.

sphere tracing: A way of drawing a shape that is defined by a distance formula. For every pixel a ray steps forward by the distance the formula reports to the nearest surface, asks again and stops when the distance is nearly zero; depth and shading fall out of the steps taken. Also called ray marching with distance fields, and the method behind most 4K intros.

split brain: The state of a redundant pair in which both machines believe they are in charge, usually because the link between them has failed whilst both stay up. Every heartbeat protocol is exposed to it; the defence is a second path between the partners.

SNMP: Simple Network Management Protocol. Reads and sets management values on network devices; keepalived's SNMP support brings the net-snmp libraries and, on Debian, Perl with them.

SHA-1: A cryptographic hash function from 1995 with a 160-bit digest, broken for collisions in 2017 and retired for signatures. As the core of an HMAC it is still in use, carp's among them.

signing key: A cryptographic key with which a repository signs its package lists, so that a package manager can verify where packages came from. Every additional repository adds one more key an administrator has to trust.

sentinel file: A file whose mere existence signals a state, such as /firstboot on FreeBSD, which marks a system that has not yet completed its first start.

Saltzer and Schroeder: Jerome H. Saltzer and Michael D. Schroeder, authors of The Protection of Information in Computer Systems (1975), the paper that set out the design principles of computer protection, among them economy of mechanism, open design, least privilege and the work factor.

security through obscurity: Relying on the secrecy of a design or of a location for protection. Rejected as the basis of a mechanism since Kerckhoffs; still useful as a cost imposed on untargeted attackers.

seL4: A member of the L4 family and the first operating-system kernel with a machine-checked proof of functional correctness. It publishes its own performance figures: a cross-address-space call takes 279 cycles on a 1 GHz Cortex-A9.

Shader Model: The versioned feature set a graphics card exposes to Direct3D, from Shader Model 1.0 in 2001 through 2.0 in 2002 to the unified models of later cards. A demo written against Shader Model 2.0 in 2007 states its minimum hardware more precisely than a year number could.

shellcode: The payload of an exploit, named after its classic purpose of starting a command shell for the attacker.

SIMD: Single instruction, multiple data: processor instructions that apply one operation to several values at once, such as AVX on x86 and NEON on ARM. Checksums and parity calculations gain most from them.

Single Packet Authorization: An authentication scheme in which one encrypted, authenticated and non-replayable packet asks the firewall to open a port for a short while; until it arrives, the port gives nothing away. Implemented by fwknop.

Software Freedom Conservancy: A US charity that gives free software projects a legal and administrative home and enforces the GPL on behalf of copyright holders. In 2016 it described Canonical's shipping of a binary ZFS module with Ubuntu as an ongoing violation.

structured outputs: A feature introduced by OpenAI in August 2024 that constrains a model's reply to a supplied JSON schema. In OpenAI's own evaluation, schema compliance rose from less than 40 per cent when merely asked to 100 per cent when enforced.

su: The traditional Unix command to switch user identity. On FreeBSD it lets only members of the wheel group become root, and then only with root's own password.

sysctl.conf: The file of kernel settings applied at boot. On FreeBSD /etc/rc.d/sysctl loads it with sysctl -i, so names the kernel no longer knows are skipped.

sysrc: A FreeBSD utility that reads, writes and removes variables in rc.conf from the command line without a text editor, introduced in FreeBSD 9.2 by Devin Teske. It exists because a shell file that a machine has to edit deserves a tool that will not corrupt it; notably it validates variable names on read but not on write.

setuid: A file permission bit that makes a program run with the privileges of its owner rather than of the user invoking it. Because a new setuid binary is a classic sign of compromise, FreeBSD’s nightly security run reports any that appeared since the previous check.

SaaS: Software as a Service. Renting access to software hosted by the vendor, paid via recurring subscription rather than a perpetual licence.

sales and marketing: The line in a company's income statement for the cost of being seen and being sold: sales staff, advertising, events, partner programmes. At Splunk it took 44 cents of every dollar of revenue in fiscal 2023, more than research and development.

Sass: A CSS preprocessor adding variables, nesting, and mixins. Largely obsoleted by native CSS custom properties, nesting, and @layer.

Scene.org: The demoscene's central file archive and the body behind the annual Scene.org Awards, which recognise the year's outstanding productions by category and by public vote.

Scene.org Awards: The demoscene's own annual awards, voted on productions of the preceding year, including a Public Choice category decided by the community rather than by a jury.

scrub: A background pass that reads every block in a pool or array and verifies it. On ZFS a scrub can repair what it finds, because the same program holds both the checksum and the redundant copy.

Scrum: An agile framework using fixed-length Sprints, daily stand-ups, and defined roles (Product Owner, Scrum Master, Development Team).

seccomp: Secure Computing mode. A Linux kernel facility that restricts which system calls a process may invoke. Strict mode (2005) permits four calls. seccomp-bpf (2012) allows programmable filters via BPF programmes.

secret cyborgs: Ethan Mollick's name for employees who have automated real parts of their jobs with AI and tell nobody, because their organisation's rules taught them that disclosure is the risky option.

securelevel: A FreeBSD kernel setting that removes capabilities from the superuser itself once the system has started, so that certain operations become impossible rather than merely restricted.

sed: A non-interactive stream editor from Bell Labs, written by Lee McMahon in 1974. One of the small Unix tools that composes through pipes rather than by stacking layers, and small enough to have been finished rather than merely versioned.

SELinux: Security-Enhanced Linux, a mandatory access control implementation for the Linux kernel, originating at the NSA and now maintained as part of the kernel.

SemVer: Semantic Versioning. A versioning scheme using MAJOR.MINOR.PATCH where major means breaking changes, minor means new features, patch means bug fixes. The contract is voluntary and routinely violated.

sendfile: A system call that copies a file to a socket entirely inside the kernel, sparing the application the round trip through user space. The asynchronous variant contributed by Netflix allows the call to return before the data has been read from disk.

server-side rendering: Generating a page's HTML on the server and sending it to the browser ready to display, rather than shipping JavaScript that builds the page on the client. The default of the web before the SPA era, and the model the lean alternatives return to.

service worker: A script the browser runs in the background, between a page and the network, able to intercept requests and serve responses from its own cache. It is one of the ways a first visit can be given the assets a preload scanner never found.

Shadow AI: Employees' use of AI tools outside the channels their organisation sanctions or can audit, typically through private accounts. Cyberhaven measured roughly three quarters of workplace AI use running through such accounts in 2025, with about a third of the pasted data being sensitive company data.

Serverless: A cloud execution model where the provider allocates resources per request. You write functions, the vendor manages infrastructure.

shared responsibility model: The published division of duties between a cloud provider and its customer. The provider secures what sits beneath the instance; the guest operating system, packages, configuration and applications remain the customer's responsibility.

Shopware: A German open-source commerce platform built on Symfony, declaring 165 direct dependencies. Its repository carries 55 GitHub workflow files, one of which exists solely to warm the static-analysis cache.

SiFive: A US company that designs and licenses RISC-V processor cores, one of the earliest commercial RISC-V vendors.

signify: OpenBSD's signature tool, written by Ted Unangst in 2014, using Ed25519. It signs releases and packages; pkg_add verifies each file against its recorded checksum immediately after extraction, before doing anything with it.

silent data corruption: A stored block that comes back changed while every component reports success. NetApp recorded over 400,000 such checksum mismatches across 1.53 million drives, eight per cent of them discovered only during a RAID rebuild.

single sign-on: One authentication against a central identity provider that then grants access to many services, typically via SAML or OIDC. In business software it is frequently confined to the most expensive tier, which is why organisations end up there for reasons unrelated to the tool itself.

Single UNIX Specification: The written standard a system must conform to in order to be certified UNIX, maintained by The Open Group and aligned with POSIX; its current edition, Issue 8, aligns with POSIX.1-2024. It certifies the interface (the C library, the shell, the standard utilities), not the kernel beneath.

single-page application: A web application that loads once and then rewrites the page in the browser instead of requesting new documents from the server. It suits software people live in for hours and suits a product catalogue rather badly.

SiPearl: A French company building high-performance server processors for the European Processor Initiative. Its Rhea1, taped out in 2025 as the most complex chip designed in Europe, is built on licensed ARM Neoverse cores and fabricated in Taiwan.

Slackware: The oldest surviving Linux distribution, first released as version 1.00 on 17 July 1993 on twenty-four floppy disks and still maintained. Its package tools deliberately make no attempt to resolve dependencies, while keeping a complete plain-text record of every installed package.

SLSA: Supply-chain Levels for Software Artifacts, a framework of provenance and integrity guarantees for build pipelines (pronounced salsa). It raises the bar for tampering, but, as Miasma showed, a valid SLSA attestation certifies the pipeline that built an artifact, not that its publishing identity is uncompromised.

SmartBear: Software-tooling company whose study of 2,500 code reviews across 3.2 million lines at Cisco established the practical limits of human review: 200 to 400 lines in one sitting, with defect detection falling away beyond roughly 500 lines an hour.

SmartOS: An illumos distribution for cloud virtualisation, combining zones with a hypervisor, originally from Joyent.

SMIC: Semiconductor Manufacturing International Corporation, China's largest chip foundry. It has produced 5nm-class parts (the Huawei Kirin 9030) using deep-ultraviolet multi-patterning, without the extreme-ultraviolet tools restricted to it.

Snap: Canonical's cross-distribution package format, which bundles more per application than Flatpak's shared runtime model and installs through the snapd daemon.

snapshot: A read-only record of a filesystem at one moment. Under copy-on-write it costs almost nothing, because it merely declines to free blocks that already exist.

Socket: A behavioural supply-chain security tool that inspects package code for risky behaviour (network calls, file-system and shell access, install scripts) rather than waiting for a published advisory. It caught the node-ipc compromise, but is itself installed through npm into the environment it audits.

SoftBank: The Japanese holding company that has owned ARM since 2016. NVIDIA's attempt to buy ARM from SoftBank in 2020-2022 was blocked by regulators; ARM listed publicly in 2023 but remains majority SoftBank-owned.

Sonar: The company behind the SonarQube and SonarCloud static analysis tools, and publisher of the State of Code Developer Survey. Its 2026 edition found 96 per cent of professional developers do not fully trust generated code to be functionally correct.

SPA: Single-Page Application. A web app that loads one HTML document and rewrites it dynamically via JavaScript, avoiding full page reloads.

SPDX: The Software Package Data Exchange, a Linux Foundation project that maintains a canonical list of licence identifiers and their exact texts. Quoting a licence as SPDX-License-Identifier: BSD-2-Clause removes the ambiguity that plain-language references leave behind.

Specificity: The algorithm browsers use to determine which CSS rule wins when multiple rules target the same element. Based on selector weight: ID > class > element.

Spryker: A modular PHP commerce framework built from several hundred small packages, split into a shop front called Yves and a back office called Zed. Its B2C reference shop declares 266 direct dependencies and resolves to 1,202 packages, 899 of them Spryker's own modules.

SQLite: A self-contained SQL database engine stored in a single file. No server process. Handles terabytes with zero configuration.

src.conf: The FreeBSD configuration file governing the build of the base system and kernel. Its WITHOUT_ switches remove whole components before they are compiled, so the code is never present to be patched.

ss: The socket statistics tool from Linux's iproute2 suite, the designated successor to netstat.

SSH: Secure Shell. A cryptographic protocol for secure remote login, command execution, and tunnelling over untrusted networks.

sshd: The OpenSSH server daemon, the program that accepts incoming SSH connections and authenticates them. It is the component that knows, at the moment an attempt fails, both the source address and the fact of the failure; what it does with that knowledge afterwards is what separates the approaches to brute force defence.

SSR: Server-Side Rendering. Generating the full HTML of a page on the server before sending it to the browser, as opposed to client-side rendering.

Stack Overflow: The question-and-answer site for programmers, and publisher of the annual Developer Survey, the largest recurring census of the profession.

static analysis: Examining source code without running it, to find type errors, unreachable branches or rule violations. In languages with a strong compiler this work happens during compilation; elsewhere it needs a separate tool and a separate pipeline stage.

Steam Deck: Valve's handheld games console (2022), running the Linux-based SteamOS. The Linux counterweight in a console market otherwise dominated by FreeBSD-derived systems from Sony and Nintendo.

Stimulus: The small JavaScript framework in Hotwire (37signals) for the islands of a page that genuinely need client-side behaviour. Controllers attach to HTML via data attributes; deliberately modest, meant to complement server-rendered HTML, not replace it.

Stormshield: A French network-security vendor whose appliances run on FreeBSD. One of the security-appliance tier, alongside pfSense and OPNsense, that quietly runs BSD in the gap between the public internet and the office.

strict liability: Liability imposed without proof of fault or negligence: the claimant need only show the product was defective and caused harm. California's AB 316 pointedly does not create it; the EU Product Liability Directive applies a no-fault regime to products with digital elements.

subresource integrity: A mechanism by which a page states the expected hash of a script or stylesheet, so the browser refuses to execute a file that has been altered. Since 2025 an import map can carry this metadata alongside the names it resolves.

subvolume: Btrfs's equivalent of a dataset: an independently mountable filesystem tree inside the same pool, which can be snapshotted and, unlike a ZFS snapshot, may be writable.

supply chain: In software, the full chain of third-party code, registries, maintainer accounts and build steps a project depends on. A supply-chain attack compromises one of those links to reach everyone downstream.

SUSE: A German-founded Linux vendor and its enterprise distribution (SUSE Linux Enterprise, openSUSE). One of the long-established distributions that select, patch and integrate upstream components into a coherent system: an assembly process, not a single tree.

Swift: A compiled, statically typed language from Apple, used here only as a reference point: a compiled binary that does nothing starts in 4.2 milliseconds, against 64.7 for an empty Node process.

system call: The boundary between a programme and the kernel: a request for the kernel to do something the programme cannot do itself, such as opening a file or waiting for an event. The number of them an interface needs is a rough measure of its surface, which is why two is a notable figure for a facility as broad as kqueue.

System V: The commercial Unix line developed by AT&T from 1983, ancestor of the certified commercial Unixes AIX and HP-UX. One of the two great branches of the Unix genealogy, alongside BSD.

systemd: The init system and service manager in most Linux distributions. Manages processes, logging, networking, and device events. Controversial for its scope.

single-threaded: Running on one thread, and therefore one core, at a time; the design Node.js chose in 2009 for safety, no shared-memory threads and no locks, at the cost of not using a multi-core machine on its own.

seed round: The earliest formal round of outside investment in a start-up, meant to get an idea off the ground before a Series A. npm, Inc. raised a 2.6-million-dollar seed round led by True Ventures in February 2014.

Series A: The first substantial priced round of venture funding a start-up raises after seed capital, usually to scale a model that is already working. npm, Inc. raised an eight-million-dollar Series A in April 2015.

sourcemap: A file that maps compiled, bundled or minified code back to the source a human wrote, so that debugging production means translating through the build step's output.

supply chain attack: An attack that compromises a dependency, a build system or a distribution channel rather than the target itself, so that malicious code arrives through a route the target already trusts.

SLSA Build Level 3: The tier of the Supply-chain Levels for Software Artifacts framework at which a build runs on hardened, isolated infrastructure and produces signed provenance that the build itself cannot forge. In spring 2026 a worm minted valid attestations at this level for its own malicious packages.

state of the art: A legal test rather than a compliment. It appears in Article 32 GDPR and Article 21 NIS2, and is defined on a three-stage ladder from the 1978 Kalkar decision as the best-performing measure available on the market that achieves the legal protection objective. It sits above the generally accepted rules of technology and below existing scientific knowledge and research.

Sysdig: A cloud security vendor whose annual usage report measures container vulnerabilities in the field, distinguishing what sits in a registry from what is actually reachable at runtime.

sync tracker: A tool that stores curves of values against a musical timeline, so that a running production knows where the music is at any instant and can cut, move or colour accordingly.

shader: A small program that runs on the graphics processor to decide the colour of pixels or the position of vertices. The building block of nearly every modern demo effect.

Solaris 10: The 2005 release of Sun's Unix in which DTrace first shipped, alongside ZFS and Zones. The release that established dynamic instrumentation as part of a base system rather than a product to procure.

systemd-udevd: The udev daemon as it exists after the 2012 merge into systemd. It runs as root, reads rules from four directories, applies ownership, mode and symlinks to nodes the kernel has already created, and executes any RUN key after processing all rules for the event.

T

time-of-check-to-time-of-use: The long form of TOCTOU, the race between checking a path and acting on it; the class behind eight open issues that kept cp, mv and rm from GNU in Ubuntu 26.04 LTS.

TOCTOU: Time-of-check-to-time-of-use: a race in which a program checks a path and then acts on the same path, and between the two steps another process swaps a directory or file on the way for a symbolic link, so that the action lands elsewhere. Memory safety does not address it; the remedy is to act on an open descriptor and the *at system calls, or to set permissions at creation.

Traction: A Finnish demogroup; Shoal, with Brainstorm, took second place in PC 4K at Revision 2012.

TBC: A Danish demogroup, The Black Company; Mentor of TBC co-wrote Crinkler.

tracker: A music program of the Amiga era that arranges samples in patterns and rows; where most demoscene musicians learnt their craft, and the reason a readme greets the Trackers with AMIGAAAA.

The Silents: An Amiga demogroup of the early 1990s, co-author with Crionics of Hardwired.

The Party: The Danish demoparty held every December from 1991 to 2002, among the largest of its era. Hardwired took second place at the first one.

TTL: Time to live. A counter in every IP packet that each router lowers by one; carp and VRRP send their advertisements with 255 and drop any that arrive lower, which keeps forged ones from beyond the segment out.

tape-out: The point at which a finished chip design is sent to a foundry for manufacture; the milestone SiPearl's Rhea1 reached in 2025.

TCP/IP: The core networking protocols of the internet, whose reference implementation Berkeley shipped in 4.2BSD in 1983; every modern operating system on the internet uses what Berkeley wrote.

Terraform: An infrastructure-as-code tool by HashiCorp. Declares cloud resources in HCL files and manages their lifecycle.

The Gathering: A Norwegian computer party running since 1992, historically one of the major demoscene events in Scandinavia alongside its competitions for demos and intros.

three-way merge: Combining two sets of changes to a file by comparing both with their common ancestor. Changes on different lines are merged automatically; changes to the same lines produce a conflict.

Tokio: An asynchronous runtime for Rust that drives non-blocking I/O and schedules tasks across all cores from a single binary, without an external process supervisor.

Time to Interactive: A web-performance metric measuring how long until a page can reliably respond to user input. A page heavy with client-side JavaScript can render and yet stay unresponsive; reducing the script is the most direct way to improve it.

TLS: Transport Layer Security. The cryptographic protocol securing HTTPS, email, and other network traffic. Successor to SSL.

tmux: A terminal multiplexer. Runs multiple shell sessions in one terminal, supports detaching and reattaching, split panes, and session persistence.

TOP500: The twice-yearly ranking of the world's five hundred fastest supercomputers, published since 1993. Every machine on the list has run Linux since November 2017, when the last two non-Linux systems dropped off it; a plain measure of how far the kernel reaches at the largest scale.

touchless rate: The share of documents an accounts-payable process handles without any human contact. Best-in-class finance operations report eighty to ninety-five per cent, which removes the last point at which a wrong figure would have been read by a person.

transitive closure: The full set of dependencies a project pulls in: not only the packages you declared, but everything they depend on, recursively. A package.json of 30 to 50 entries routinely resolves to a transitive closure of well over a thousand packages.

transpiling: Translating source code into different source code of comparable level, typically a newer language dialect into an older one. It is the line that separates bookkeeping from building: a process that hashes files writes a catalogue, a process that transpiles ships something you did not write.

TrueNAS: Storage operating system built on ZFS. Its FreeBSD edition, formerly FreeNAS, went into sustaining engineering in 2024, and the unified product has run on Linux since release 25.04 in April 2025.

TSMC: Taiwan Semiconductor Manufacturing Company, the world's largest contract chip foundry and the dominant maker of leading-edge silicon, including Europe's SiPearl Rhea1.

Turbo: The navigation half of Hotwire (37signals): it intercepts link clicks and form submissions, fetches the new HTML over the wire, and swaps it into the page without a full reload. No client-side router, no virtual DOM.

TypeScript: A typed superset of JavaScript that compiles to plain JS. Adds static type checking at build time.

typosquat: A malicious package given a name deliberately close to a popular one, so that a typo, an autocomplete or an injected dependency line pulls in the impostor instead of the real library. easy-day-js was a typosquat of dayjs.

transitive dependency: A package a project does not depend on directly, pulled in because something it depends on depends on it. A modern install resolves a whole tree of them, so most of what lands in node_modules was never chosen by name.

transitive trust: The assumption that trust carries across intermediaries: I trust my vendor, the vendor trusts the image, the image trusts the distribution. Convenient, universal, and exactly the assumption that supply-chain attacks exploit.

True Ventures: An early-stage venture capital firm based in San Francisco. Led npm, Inc.'s USD 2.6 million seed round in February 2014.

type stripping: Running TypeScript by deleting its type annotations instead of compiling: the types are replaced with whitespace and the remaining JavaScript runs directly. Node.js has shipped it unflagged since version 23.6, January 2025.

TeleTrusT: IT Security Association Germany. Publishes, together with ENISA, the reference guideline on what state of the art means in IT security law, last revised in September 2025.

The T.J. Hooper: A 1932 decision of the US Court of Appeals for the Second Circuit, 60 F.2d 737, in which Judge Learned Hand held that industry custom is no defence: a whole calling may have unduly lagged in the adoption of new and available devices, and courts must in the end say what is required.

tracing: Recording what a program actually does as it runs, at chosen points, rather than sampling it statistically or reasoning about it from the outside.

U

uniq: The utility that reports or filters repeated adjacent lines; GNU's received CVE-2026-56391 for an out-of-bounds read with -w, and FreeBSD's enters Capsicum capability mode.

uutils: A rewrite of the GNU coreutils in Rust under the MIT licence that treats any divergence from GNU as a bug and runs the GNU test suite against itself, 653 of 692 passing in version 0.12.0; Ubuntu made it the default coreutils in 25.10 and completed the switch in 26.10 after two audit rounds by Zellic found 113 issues and 44 CVEs.

ucarp: A userland implementation of CARP that runs as a daemon on Linux and other systems; version 1.5.2 in Debian 13.

upstream: The project that writes a piece of software, seen from the distribution or ports tree that packages it. Upstream decides release dates and support periods; the packager decides which of those releases reach the system.

Unix socket: A socket for communication between processes on the same machine, addressed by a path in the filesystem; also called a Unix domain socket.

UCL: Universal Configuration Language, a configuration format by Vsevolod Stakhov used by pkg on FreeBSD; the base system carries a parser for it.

ucf: Update Configuration File, a Debian helper that maintainer scripts use for configuration files outside dpkg's conffile mechanism. It can offer a three-way merge with diff3, as one choice in a menu whose default keeps the current file.

UEFI: Unified Extensible Firmware Interface, the modern replacement for the BIOS: the system firmware that initialises hardware and hands control to the operating-system bootloader. Some hardware admits open alternatives such as coreboot; much does not.

Ultrix: DEC's Unix flavour for its own hardware, one of the proprietary workstation Unixes of the 1980s Unix wars.

unattended-upgrades: The Debian and Ubuntu tool that installs updates, usually security updates, without an administrator present. It holds back any package whose upgrade would raise a conffile prompt, security updates included, and logs a warning.

universal interface: The role Unix gives to text streams: because programs read and write plain text, any program can feed any other, including ones not yet written. The phrase comes from Peter Salus's 1994 summary of Doug McIlroy's rules.

UNIX: The registered trademark, held by The Open Group, for operating systems certified against the Single UNIX Specification. Written in capitals it denotes the mark; written Unix it denotes the wider family. Not a roof over that family but a certification mark, kept deliberately narrow: it sits only on tested, fee-paying products, and the holder disowns loose use of the word.

Unix Philosophy: Design principles favouring small, composable programs that do one thing well, connected via text streams.

Unix sockets: Communication endpoints that live in the filesystem rather than on the network. Between jails they can be shared through nullfs mounts, so a service needs no network address to be reached.

Unix System Laboratories: AT&T's subsidiary, spun out in 1991, that held the UNIX trademark and the System V source before both passed to Novell in 1993. The first owner in the trademark's chain of custody.

UNIX System Services: The certified-UNIX component of IBM's z/OS: a POSIX environment layered on top of the mainframe MVS kernel. The part of z/OS that holds the certificate, proof that a system can speak Unix at the surface while being a mainframe all the way down.

UNIX V7: The stricter brand level of the UNIX certification, corresponding to the Single UNIX Specification version 4 (POSIX.1-2008). IBM's AIX 7 is the only product on the register certified at this level; macOS sits one rung lower, at UNIX 03.

Unix wars: The 1980s period in which DEC, IBM, HP, Sun, SGI, NeXT and others each shipped an incompatible proprietary Unix flavour for their own hardware; the fragmentation POSIX was created to bridge.

unixoid: A Unix-like system: one that rebuilt the Unix design from resemblance without inheriting a line of Bell Labs or Berkeley code. Linux is the most widely deployed unixoid, QNX another. A unixoid resembles Unix without being Unix by descent.

upstreaming: Contributing a local modification back into the project it came from, so that future releases carry it. The alternative is a private patch set that has to be reapplied and retested against every new version, which is why upstreaming is usually the cheaper path.

USE flag: Gentoo's mechanism for selecting which optional features a package is compiled with, set globally or per package. The FreeBSD Ports Collection calls the equivalent mechanism options.

Use it or lose it: The budget rule under which money not spent by the end of the fiscal year is forfeited, and next year's allocation shrinks to match. Liebman and Mahoney measured its effect in federal procurement: spending in the final week runs 4.9 times the weekly average, and the IT projects bought then are markedly worse.

use-after-free: A memory-safety fault in which code keeps using a pointer to memory that has already been released. In kernel code it is among the more serious classes, because the freed memory can be reallocated for something else in the meantime and the stale pointer then writes into it. CVE-2026-58083 in FreeBSD kqueue is one of these, in the copy performed during fork.

user namespaces: A Linux namespace that maps user and group IDs, so that a process can be root inside it without being root outside. Unprivileged user namespaces are a frequent step in privilege escalation exploits, and Ubuntu has restricted them by default since 24.04.

userfaultfd: A Linux system call that lets a process handle page faults in user space. Because it can stall the kernel in the middle of an operation, exploits have used it to hold race windows open; since Linux 5.11 unprivileged users may only handle faults from user mode.

userland: Everything that runs outside the kernel: the C library, the shell, the standard utilities and the applications. On Linux the userland is supplied separately from the kernel (GNU, musl, Bionic, BusyBox); in a BSD base system it is maintained in the same source tree as the kernel.

UiPath: Robotic process automation vendor. Its packages were among the 172 taken across npm and PyPI in the supply chain campaign of April and May 2026.

USENIX: The Advanced Computing Systems Association. Its Annual Technical Conference is where the DTrace paper, Dynamic Instrumentation of Production Systems, was presented in 2004.

udev: The Linux device manager, begun in 2003 by Greg Kroah-Hartman and others as a user space replacement for the kernel devfs, absorbed into systemd in 2012. Its rules carry around twenty match keys and fifteen assignment keys, three of which start a process, in the same syntax that assigns device names and permissions.

udevadm: The udev administration tool. Its settle subcommand blocks until queued device events have been processed, which exists because a node created by devtmpfs is visible before udev has applied the rules that govern it.

uevent: The notification the Linux kernel sends over netlink when a device appears, changes or is removed. Until udev 1.4.1 the daemon did not verify that such a message had originated in the kernel, which is CVE-2009-1185.

V

VRRP: Virtual Router Redundancy Protocol. The IETF standard for letting several routers share one IP address, first published as RFC 2338 in 1998 and as version 3 in RFC 5798 in 2010. It runs over IP protocol 112; on Linux keepalived provides it, and FreeBSD's carp speaks version 3 alongside its own protocol.

virtual MAC: A MAC address that belongs to a redundancy group and moves with the shared IP address from one machine to the other. For CARP and VRRP it is 00:00:5e:00:01 followed by the group number, so the neighbours' ARP caches stay correct during a failover.

vhid: Virtual host ID. The number from 1 to 255 that identifies a carp group on a network segment, and the last byte of the group's virtual MAC.

V2 synthesiser: The software synthesiser Tammo Hinrichs wrote for Farbrausch, used in their demos and intros since around 2000 and released with the group's tools in 2012. It stores instruments as parameters and generates the audio at runtime, which is how a four-minute soundtrack fits into a few kilobytes.

Valkey: Open-source fork of Redis maintained by the Linux Foundation, created after Redis Ltd. relicensed Redis under the SSPL in March 2024. Supported by AWS, Google Cloud, and Oracle.

Variform: Kewlers' breakthrough demo, shown at Assembly 2002, which took several Scene.org Awards and established the group's reputation years before their 2006 farewell.

vCPU: A virtual CPU as counted by cloud providers, which on current x86 instances corresponds to one hardware thread rather than one physical core. Two vCPU therefore match one core with simultaneous multithreading.

vdev: A virtual device in a ZFS pool: a mirror, a RAIDZ group or a single disk. Pools are built from vdevs, and redundancy is a property of the vdev rather than the pool.

veriexec: A file signing and verification scheme, present in FreeBSD as mac_veriexec. A list of paths and hashes is loaded into the kernel, which then verifies contents at exec and open, at four levels of strictness up to refusing anything unsigned.

Version 6: Unix Version 6 (V6), released by Bell Labs in 1975, the first version to spread widely outside the Labs and the subject of Lions' line-by-line Commentary.

vigilance decrement: The measured decline in detection performance during sustained monitoring. Norman Mackworth demonstrated it in 1948 with observers watching a clock hand for two hours: accuracy fell by ten to fifteen per cent within the first half hour and continued to decline. No training regime has been found that removes it.

virtual DOM: An in-memory representation of the page that a framework such as React diffs against the real DOM to decide what to update. A core mechanism of single-page-application frameworks, and one that hypermedia approaches like HTMX deliberately do without.

verifier: In eBPF, the static analyser that inspects a loaded program's bytecode before it runs and tries to prove it cannot access kernel memory unsafely: the single gate between foreign code and Ring 0, and a recurring source of privilege-escalation bugs, since a flaw in the proof engine is a hole in the kernel.

Vite: A frontend build tool using native ES Modules for instant dev server startup and Rollup for production builds. Replaces Webpack.

VNET: Virtual Network Stack in FreeBSD. Gives each jail its own interfaces, routing table, and firewall rules. Kernel-native network isolation without overlay networks.

voxel: A volume element, the three-dimensional counterpart of a pixel. Voxel landscapes draw terrain from a height map and were a fixture of 1990s games and demos; demosceners still fit them into intros of 256 bytes.

W

WaveSabre: A software synthesiser and toolchain for music in 64k intros, written by ferris and h0ffman of Logicoma with contributions from revival, kusma, cpdt, Wertstahl and others, and published on GitHub under an MIT licence. It renders a full soundtrack at runtime inside the same size budget as the visuals.

wayfinder: Demoscene handle of a farbrausch member credited with graphics and music, including both on fr-063: Magellan.

werkkzeug: The tool chain farbrausch built for making demos: a node-based editor in which meshes, textures and animation are generated by operators rather than stored as data, which is how productions of a few kilobytes contain hours of visual material. Version 4, used for Magellan, is in the group's public repository.

wheel: The traditional BSD group whose members may become root; FreeBSD's su admits only members of wheel, enforced by pam_group in /etc/pam.d/su.

wobble: Demoscene musician, credited with h0ffman on the soundtrack of Engage by Logicoma and additionally on its direction.

whatis: A Unix utility that looks up the one-line description of a manual page in a database. On FreeBSD that database is rebuilt by the weekly periodic run.

wabi-sabi: A Japanese aesthetic that finds beauty in the imperfect, the impermanent and the worn, described for Western readers by Leonard Koren in 1994. In engineering terms, the honoured wear of a coherent maintained thing, distinct from the unmanaged decay of one no one owns.

wavetable synthesis: A sound-synthesis technique that builds audio by reading through waveforms rather than replaying recorded samples. In size-constrained demos the waveforms are themselves produced in code, so no audio files are needed.

WebAssembly: A binary instruction format for a stack-based virtual machine. Runs near-native speed in browsers alongside JavaScript.

WebKit: The browser engine Apple forked from KHTML in 2001. It powers Safari, the WKWebView system web view on Apple platforms and WebKitGTK on Linux, and it is the ancestor of Blink.

WebKitGTK: The WebKit port used as the system web view on Linux desktops. Its version is whatever the distribution shipped, which is the practical reason cross-platform frameworks end up bundling an engine anyway.

WebSocket: A persistent, full-duplex communication channel over a single TCP connection, enabling real-time data exchange between browser and server.

WebView2: Microsoft's system web view on Windows, based on Blink and distributed on an evergreen channel, so that applications using it receive engine updates from Microsoft rather than shipping their own.

WireGuard: A modern VPN protocol using state-of-the-art cryptography. One C file, ~4,000 lines, replaces IPsec and OpenVPN.

webpack: The bundler that defined the build-step era. Begun by Tobias Koppers in March 2012 as a side project of a master's thesis, version 1.0 in February 2014; it faked modules before browsers had them and became the default toolchain of a decade.

WKWebView: The system web view on Apple platforms, based on WebKit. It arrives with the operating system and is updated with it, which means an application using it does not carry or patch its own engine.

WordPress: The most widely used content management system for websites, written in PHP. A fresh installation can be taken over through its setup page until the owner completes it.

work factor: Saltzer and Schroeder's design principle of 1975: compare the cost of circumventing a protection mechanism with the resources of a potential attacker.

Work Trend Index: Microsoft and LinkedIn's annual survey of the working world. The 2024 edition measured 75 per cent of knowledge workers using generative AI at work, 78 per cent bringing their own tools, and half declining to admit use on their most important tasks.

X

WorkCentre: Xerox multifunction printer and scanner range, standard office equipment in administrations, practices and engineering firms. Several model lines carried the 2013 JBIG2 character-substitution fault.

write hole: The failure mode of classic RAID 5: if power is lost partway through writing a stripe, the data and its parity no longer agree, and nothing reports it. It surfaces later during a rebuild, when the parity reconstructs rubbish with complete confidence.

X/Open: The industry consortium that received the UNIX trademark from Novell in 1993 and merged with the Open Software Foundation in 1996 to form The Open Group. Custodian of the mark in the years between AT&T and the present.

Xbox 360: Microsoft's games console, released in 2005. Through XNA it briefly became the most accessible closed platform of its generation for developers without a publishing deal.

XDP: eXpress Data Path: an eBPF hook that processes network packets at the earliest point in the Linux networking stack, close to the driver, for very high throughput. One of the capabilities that makes eBPF genuinely useful, alongside Cilium's networking.

x86: The dominant desktop and server processor architecture, designed by Intel and also built by AMD under licence, held behind a patent thicket dense enough that the practical number of vendors is two.

Xerox: American document-technology company. In 2013 its WorkCentre and ColorQube scanners were found to silently alter digits in scanned documents through faulty JBIG2 pattern matching, across four product families and dozens of model lines.

XFS: A high-performance journalling filesystem, the default on Red Hat systems; like ext4 it sits above the volume manager rather than incorporating it.

XNA: Microsoft's managed framework and toolkit for game development in C#, published from 2006. XNA Game Studio Express was free and aimed at students and hobbyists, and for a few years it allowed code written at home to run on a retail Xbox 360.

XuanTie: Alibaba's T-Head line of RISC-V processors; its C930, announced in 2025, is a RISC-V server CPU for AI and high-performance workloads.

xz: A compression library and format in the lzma family, present in the build chain of most Linux distributions. In March 2024 versions 5.6.0 and 5.6.1 shipped a backdoor aimed at sshd, planted by a co-maintainer who had spent three years earning the role (CVE-2024-3094).

Z

Zellic: A security auditing firm engaged by Canonical for two rounds on the uutils coreutils between December 2025 and March 2026, which reported 113 issues, 44 of them assigned CVEs.

yum: The former package manager of Red Hat systems, since replaced by dnf.

zectl: A command-line tool for managing ZFS boot environments on Linux, developed by John Ramsden as an independent project.

zero-day: A vulnerability exploited in the wild before a fix is available. Google shipped fixes for five actively exploited Chrome zero-days in the first half of 2026 alone, which is the record any application bundling that engine takes on.

ZFS on Linux: The port of ZFS to the Linux kernel, begun at Lawrence Livermore National Laboratory, which became the shared OpenZFS code base with release 2.0 in 2020. Its CDDL licence keeps it out of the mainline kernel, so it is built as a separate kernel module.

zfs receive: The counterpart to 'zfs send': reads a replication stream and writes it back into a pool as a dataset. With -s it keeps a resumable checkpoint, so an interrupted transfer of eighteen datasets does not start again from the beginning. The receiving side recompresses and writes into the pool, which makes it the more expensive half of the pair.

ZFS: Zettabyte File System. A combined filesystem and volume manager with checksumming, snapshots, clones, and built-in RAID.

zlib: The compression library implementing DEFLATE, written by Jean-loup Gailly and Mark Adler in 1995 and probably the most widely deployed piece of C in the world. At 22,732 lines it is a third of the size of the zstd library and considerably slower at the same ratio.

Zod: A TypeScript-first schema validation library. 93 million weekly npm downloads (March 2026). Used for runtime type checking and form validation in React applications. Solves a problem the browser's Constraint Validation API already handles for 95% of forms.

zstd: A compression algorithm by Yann Collet, in the FreeBSD base system and available as a ZFS pool property. At level 3 across all cores it compresses a replication stream by roughly 2.9 to 1 while running at about 1.2 GB/s in, which puts the network rather than the compressor in the way.

Zscaler: A cloud-security company whose service edge has run on FreeBSD. Part of the FreeBSD security-appliance tier that handles a large share of corporate traffic between the public internet and the office.

buildworld: The make target that compiles the entire FreeBSD userland, the C library and the system tools from the single source tree, before make installworld puts them in place. With make buildkernel it rebuilds the base as one whole.

CUE: A configuration language with types, constraints and composition, built to replace templated text with a checked description.

Dhall: A typed, total configuration language with imports and functions, designed so that a configuration cannot loop or fail in surprising ways.

DKIM: DomainKeys Identified Mail. A cryptographic signature added by the sending domain with the public key published in DNS, so a receiver can verify that a message was authorised and arrived unaltered.

dma: The Dragonfly Mail Agent, a small mail transport agent written for DragonFly BSD by Matthias Schmidt and Simon Schubert. It accepts mail from programs on the local machine and either delivers it locally or hands it to a smarthost, and it does not listen on port 25. FreeBSD made it the default MTA in 14.0; the binary measures 67,792 bytes on FreeBSD 15.1.

Fedora: A community Linux distribution sponsored by Red Hat, run as the upstream proving ground for Red Hat Enterprise Linux. One of the two best-known Red Hat-based systems.

FORTRAN: The first widely used high-level language, built by John Backus and released in 1957. The name is short for formula translation, which says what its designers had in mind.

Gmail: Google's mail service and, with roughly 1.8 billion users, the largest mailbox operator. Its sender guidelines set the entry rules that anybody sending five thousand messages a day has to meet.

Go templates: The text templating package of the Go standard library, whose directives sit inside double braces. Helm renders Kubernetes manifests by running it over YAML held as strings, which is why a chart file carries two notations at once.

inflection: In linguistics, the change of a word's form to carry a change in role or meaning: run, runs, running. Programming languages never adopted it, and configuration systems imitate it with templating.

Jsonnet: A data templating language that extends JSON with variables, functions and inheritance, used to generate configuration without string substitution.

KYAML: A stricter subset of YAML for Kubernetes in which every string is quoted and every type is explicit. Alpha in Kubernetes 1.34, beta in 1.35 and stable in 1.37, which is the platform conceding that plain YAML could not say what it meant.

lambda calculus: Alonzo Church's formal system from the nineteen thirties for expressing computation through functions and their application. Lisp and every functional language descend from it.

Lisp: The language John McCarthy built on Church's lambda calculus in 1958, in which code and data share one representation.

mail exchanger: The server named in a domain's MX records as the recipient of mail for that domain. Delivery between servers goes to it on port 25.

Mailgun: An email API provider. The entry plan is fifteen dollars for ten thousand messages with overage from a dollar eighty per thousand, and the pay-as-you-go tier doubled to two dollars per thousand on 1 December 2025.

man hier: A FreeBSD manual page documenting the layout of the filesystem: where the kernel and C library live, and where locally added software is kept apart from the base. It ships in the base system, so it describes the very tree it is part of.

manifest: The declarative description of a Kubernetes object, normally written in YAML, which the API server validates against its schema before storing it.

MTA: Mail transport agent. The program that takes a message from a local program or another server and moves it onwards over SMTP. sendmail, Postfix and dma are all MTAs and differ mostly in how much else they do.

NixOS: A Linux distribution built on the Nix package manager, in which the whole machine's configuration is written declaratively into one functional expression and built reproducibly. One of the newer distributions that rethink how a system is assembled.

null reference: The value Tony Hoare introduced in ALGOL W and later called his billion-dollar mistake: a reference that points at nothing and type-checks as though it points at something.

opendkim: A DKIM signing and verification service for mail servers. Installing it on FreeBSD 15.1 pulls nine packages and 80 MiB, a Perl interpreter and a DNS resolver among them.

ports: FreeBSD's collection of third-party software, kept deliberately apart from the base system. Each port is a recipe to build and install an application, so the line between the system and what you added to it stays clear; 37,958 as of the Q1 2026 status report.

Postmark: An email API provider known for transactional delivery. Fifteen dollars for ten thousand messages, with a dollar eighty per thousand above the allowance.

Red Hat: An American open-source software company, now part of IBM, whose packaging and system conventions define one of the major Linux families. Red Hat-based systems include Fedora and Red Hat Enterprise Linux.

Resend: An email API provider. Twenty dollars for fifty thousand messages on the Pro plan, which works out at forty cents per thousand, with ninety cents per thousand above the allowance.

reverse lookup: Resolving an IP address back to a name through a PTR record. Mail receivers check that a sending address has one and that it matches the name the server announces for itself.

RFC 5321: The current specification of the Simple Mail Transfer Protocol, the 2008 revision of RFC 2821 and of RFC 821 from 1982. It governs how mail moves between servers and says nothing about reputation.

RFC 8058: The specification for one-click unsubscribe in email, using the List-Unsubscribe and List-Unsubscribe-Post headers. Google and Yahoo have required it of bulk senders of marketing mail since February 2024.

RHEL: Red Hat Enterprise Linux, the commercial, long-support Linux distribution from Red Hat. With Fedora, one of the two best-known members of the Red Hat family.

Ruby: The language Yukihiro Matsumoto released in 1995, designed around the comfort of the reader and around minimising his own surprise, and later the foundation of a generation of web applications.

sendmail: The mail transport agent Eric Allman wrote in 1983, for decades the standard on Unix systems and long a byword for configuration complexity. It remains in the FreeBSD base system at 802,856 bytes, no longer the default since 14.0.

Silverblue: Fedora Silverblue, an immutable, image-based variant of Fedora in which the operating system is delivered as a versioned, read-only image and updated atomically. One of the newer takes on how a Linux system is shipped.

smarthost: A mail server that accepts outgoing messages from a machine and relays them onwards on its behalf, usually after authentication. Small agents such as dma exist to hand mail to one.

spam complaint rate: The share of delivered messages that recipients mark as spam. Google asks bulk senders to stay below 0.10 per cent and treats 0.30 per cent as the line that must never be reached.

SPF: Sender Policy Framework. A DNS record listing the addresses permitted to send mail for a domain, so a receiver can check whether the connecting server is one of them.

Sprig: A library of template functions for Go templates. Helm's documentation groups the functions it exposes into 18 categories, most of them coming from this library.

submission port: TCP port 587, defined for mail submission from a client to its own server, as distinct from port 25 between servers. Hosting companies commonly block 25 outbound and leave 587 open.

template engine: A program that produces text by substituting values into a template before anything parses the result. In configuration work it writes the indentation as well, which is how a key moves under the wrong parent without an error.

Ubuntu: A widely used Debian-based Linux distribution released by Canonical since 2004. The best known of Debian's many relations, and a common first encounter with the Debian way of arranging a system.

values file: The YAML file that supplies the variables a Helm chart substitutes into its templates. Defaults ship with the chart, an environment file overrides them, and the command line overrides everything.

kTLS: Kernel TLS. The TLS record layer moved into the operating system kernel, so that a file can be encrypted and framed on its way out without ever being copied into the application. The handshake stays in the SSL library with the private key. First appeared in FreeBSD 13.0 and in Linux 4.13.

NUMA: Non-Uniform Memory Access. A machine layout in which each processor socket owns part of the memory and reaches the rest across an interconnect, so that where a page lives decides how fast it can be read. On a server at high throughput the interconnect, rather than the processor, becomes the ceiling.

setsockopt: The system call that sets an option on an open socket. Kernel TLS uses it as its entire interface: one call hands the kernel the keys and the cipher, and everything written afterwards is encrypted on the way through.

lagg: The FreeBSD link aggregation interface, which joins several network ports into one. Since 2019 it can be told to pick an egress port on the same NUMA domain as the data being sent.

page cache: The part of main memory in which the kernel keeps file contents it has read, so that a second read costs nothing. A system call that can lend those pages straight to a socket avoids copying them into the application at all.

record layer: The part of TLS that cuts a byte stream into records, each with a short header, a sealed body and an authentication tag. It is the half of TLS that kernel TLS moves into the kernel, the handshake being the other.

socket buffer: The queue in which the kernel holds data that belongs to a socket but has not yet gone out on the wire. Marking an entry as not ready lets a file be queued before the disk has delivered it.

AES-CBC: An older block cipher mode for TLS, without built-in authentication, which needs a separate MAC. FreeBSD accepts it in the kernel record layer only while a sysctl allows it, which is how one 2026 advisory was defused without a reboot.

cpuset: The FreeBSD command that pins a process or thread to named processors. Measurements that compare processor time need it, because an unpinned worker wanders between cores and takes the numbers with it.

Chelsio: Network adapter manufacturer. Its cxgbe driver was the first in FreeBSD able to seal TLS records on the card itself, so that the payload never passes through the host processor.

Mellanox: Network adapter manufacturer, now part of NVIDIA. Its mlx5en driver carries inline TLS offload, the second such backend behind the single FreeBSD socket option.

Varnish: An HTTP cache server. Used with Intel in a 2021 laboratory test that reached 509 gigabits a second from a dual-socket Linux machine, with TLS done in userland rather than in the kernel.

netdev: The annual conference of the Linux networking community, where kernel TLS was first presented in 2016 and where several of the measurements comparing it to the userland path were published.

livepatch: A service that applies kernel security fixes to a running system without a reboot. On Ubuntu it is a paid subscription and covers selected flaws rather than all of them.

Pouet: Demoscene database and discussion board, running since 2000. Every production can collect thumbs up or down from registered users, and the resulting all-time toplist is the nearest thing the scene has to a canon.

diskmag: A magazine distributed as a program on a floppy disk, with its own interface, music and artwork. Scene groups published them for years, and they carried party reports, interviews and results long before the web did.

software rendering: Drawing a three-dimensional image with the general-purpose processor alone, without handing the work to a graphics card. The default until the late nineties, and since then a deliberate restriction rather than a necessity.

MS-DOS: The single-tasking operating system that ran on IBM-compatible personal computers from 1981 into the late nineties. A demo written for it addressed the hardware directly, with no driver layer in between.

thick jail: A FreeBSD jail that carries a complete copy of the base system of its own, independent of the host and of every other jail. It can run its own release and patch schedule, at the cost of the disk space and the maintenance of a full userland.

OCI: Open Container Initiative, the Linux Foundation project that standardises container image and runtime formats. FreeBSD has published official OCI images since 14.3, and Podman runs them on FreeBSD jails.

NAT: Network address translation: rewriting the addresses of packets as they pass a router or bridge. Docker's default bridge networking uses it, and IBM Research measured it doubling round-trip latency in 2014.

Linpack: A benchmark that measures floating-point performance by solving a dense system of linear equations, reported in GFLOPS. It is the yardstick behind the TOP500 list of supercomputers.

GFLOPS: Billions of floating-point operations per second, the unit in which Linpack and similar compute benchmarks report their results.

microVM: A virtual machine stripped to the minimum a guest kernel needs, with a small device model and a fast boot. Firecracker, built by AWS for its serverless services, is the best-known implementation.

live migration: Moving a running virtual machine from one host to another without stopping it, by copying its memory while it keeps running. KVM supports it; bhyve does not yet.

virtual machine: A complete computer provided in software with hardware assistance, running its own kernel on virtual hardware. It isolates more strongly than a container or a jail, because only the hypervisor is shared.

write-ahead log: A log in which a database records every change before applying it to its data files, so that after a crash it can replay the log and return to a consistent state. PostgreSQL calls it WAL.

crun: A container runtime written in C, an alternative to runc that implements the same OCI runtime specification. Podman uses it by default on several distributions.

NSDI: The USENIX Symposium on Networked Systems Design and Implementation, an academic conference on distributed and networked systems. AWS published the Firecracker paper there in 2020.

39C3: The 39th Chaos Communication Congress, held in Hamburg in December 2025. Its programme included a security analysis of FreeBSD jails that reported roughly fifty kernel issues reachable from inside a jail.

Linux security module: The hook framework in the Linux kernel through which mandatory access control systems such as SELinux and AppArmor enforce their policies. Container runtimes apply a profile from one of them on top of the namespaces and seccomp filters.

GPU passthrough: Handing a physical graphics card directly to a virtual machine, so that the guest drives it with its own drivers. KVM supports it widely; in bhyve it is partial.

Containerfiles: Build recipes for container images in the format Docker introduced as the Dockerfile. Podman and Buildah use the neutral name Containerfile for the same thing.

NullFS: FreeBSD's null filesystem, which mounts an existing directory a second time at another place, optionally read-only. Thin jails built on it share one read-only copy of the base system, so updating the template updates every jail that mounts it.

zero probe effect: The property that an instrumentation facility costs nothing at all while disabled, so that the system behaves exactly as if the facility were not present. Stated in the 2004 DTrace paper as a precondition for anything that is to be switched on in production.

People

zypper: The command-line package manager of openSUSE and SUSE Linux Enterprise. On a btrfs root with snapper it triggers a pair of snapshots around every change.

A

Guilherme Avelino: A software engineering researcher in Brazil and lead author of the 2016 study that computed truck factors for 133 popular GitHub projects and found that 65 per cent of them would be dead after losing two people.

Norman Mackworth: British psychologist who investigated sustained attention for the Royal Air Force during the Second World War. His 1948 clock test established the vigilance decrement and remains the founding paradigm of vigilance research.

Chris Mason: The engineer who started Btrfs in 2007 after moving from SUSE to Oracle. He has said the motivation was less about ZFS than about Linux keeping up with the storage devices of the following decade.

Jens Axboe: Linux kernel engineer, maintainer of the block layer and author of io_uring (merged in Linux 5.1, 2019) and the fio benchmark tool.

Jonathan Lemon: FreeBSD developer who designed and wrote kqueue, the unified event-notification interface shipped in FreeBSD 4.1 in 2000 and later adopted by macOS and the other BSDs.

Jonathan Anderson: Computer scientist, co-creator of Capsicum with Robert Watson. Their 2010 USENIX Security paper introduced capability-based sandboxing to FreeBSD. Now at Memorial University of Newfoundland.

Andrea Arcangeli: Linux kernel developer. Created the original seccomp strict mode in 2005 (Linux 2.6.12), permitting only four syscalls. Also known for work on KVM and Transparent Huge Pages.

B

John Baldwin: FreeBSD developer at Netflix. Wrote the kernel TLS framing and encryption layer with Drew Gallatin, presented it at vBSDCon in 2019 and in the FreeBSD Journal in 2020, and is credited in the OpenSSL 3.0 changelog for the FreeBSD path.

Lisanne Bainbridge: British cognitive psychologist. Her 1983 paper “Ironies of Automation” showed that automating most of a task leaves the operator the parts that cannot be automated and the duty to take over when it fails, just when their skills have decayed for want of practice.

Kent Beck: Creator of Extreme Programming and co-inventor of story points with Ron Jeffries. Wrote the SUnit testing framework that became JUnit. Advocate of simplicity in software design.

Fabrice Bellard: French computer scientist. Created FFmpeg, QEMU, TinyCC, JSLinux, and Bellard's formula. Computed 2.7 trillion digits of pi on a desktop PC. Builds fundamental tools, then moves on.

Geoffrey Bilder: Director of Technology and Research at Crossref and author of its post-mortem for the outage of 24 March 2022, which admitted that one long-suffering sysadmin had to field the whole thing alone.

Jeff Bonwick: Engineer at Sun Microsystems who designed the Slab Allocator and co-created ZFS with Matthew Ahrens. Built the filesystem that trusts mathematics over hardware.

Kelly Brazil: Engineer and author of jc, the tool that turns the output of command-line programs into JSON. In a 2019 essay, Brazil argued that tools should offer JSON output themselves, so that nobody has to parse text written for people.

C

Alan Coopersmith: Oracle engineer and long-standing X.Org developer who summarised the Zellic audit of rust-coreutils on oss-security in May 2026, 73 findings in the first round, seven of them critical.

Neal Cardwell: Network engineer at Google. Principal author of the BBR congestion control algorithm, which landed in Linux 4.9 in December 2016 and was later implemented for FreeBSD as a selectable TCP stack.

Yann Collet: French engineer, author of LZ4 in 2011 and of Zstandard in 2015, the latter written at Facebook and released under a permissive licence. Both programs answer the same question from opposite ends: LZ4 takes whatever ratio falls out of going as fast as possible, zstd asks how much time is on offer.

D

Kristaps Dzonsons: Developer who began mandoc in November 2008, after grohtml would not let him change the colour of section headings in HTML manual pages. His implementation replaced groff as the manual formatter across the BSD systems.

Edsger Dijkstra: Dutch computer scientist (1930-2002). Described the THE multiprogramming system in 1968 as a strict hierarchy of levels, an early discipline of layering to contain complexity, and shaped structured programming, the shortest-path algorithm and much of the field's early rigour.

Cory Doctorow: Canadian-British author, journalist, and digital rights activist. Coined 'enshittification' in November 2022. Published on Pluralistic. Won Word of the Year 2023. Author of Little Brother, Walkaway, and the 2025 book Enshittification.

Stephen Dolan: Creator of jq (2012). PhD in Algebraic Subtyping at the University of Cambridge, supervised by Alan Mycroft. Now at Jane Street, working on the OCaml compiler. Wrote a functional language for JSON in 510 KB of C.

Will Drewry: Google engineer who introduced seccomp-bpf in Linux 3.5 (2012). Extended seccomp from a binary four-syscall mode to programmable BPF-based filtering, enabling practical process sandboxing on Linux.

Dubmood: Swedish chiptune musician and demoscene legend. Two decades of tracker music across Amiga, C64, and PC platforms. Composed the soundtrack for Razor 1911's 'The Scene Is Dead' (2012).

E

F

Collin Funk: GNU coreutils committer who in May 2026 traced three uutils CVEs with strace on oss-security and in September 2026 filed the Launchpad bug on the uutils rm segfault at 32,768 nested directories.

Ullrich Ecker: Cognitive psychologist at the University of Western Australia. Showed in 2014, with Lewandowsky, Chang and Pillai, that a misleading headline shapes memory and inference even after the body of the article corrects it.

Jochen Feldkoetter: German demoscene musician known as Virgill, writing since 1990 and a member of Alcatraz and Haujobb among others. He built AmigaKlang, a modular synthesiser for the Amiga and the Atari ST, after seeing what 4klang did on the PC.

Rich Felker: Author of musl libc, a clean-room lightweight C standard library for Linux. Vocal advocate for POSIX correctness and minimal PID 1 design.

Michael Färber: Computer scientist. Published the first formal specification of the jq language in 2024 (arXiv:2403.20132), twelve years after Dolan wrote the implementation. Also wrote jaq, a Rust reimplementation of jq that is 5-10x faster.

Philip Fernbach: Cognitive scientist at the University of Colorado. Showed in 2013, with Rogers, Fox and Sloman, that asking people to explain a policy's mechanism moderates extreme views, while asking for reasons does not.

Leon Festinger: American social psychologist (1919 to 1989). A Theory of Cognitive Dissonance (1957): a belief that meets a contradicting fact produces discomfort, and the cheap ways out are to doubt the fact, doubt the person who brought it, or find others who doubt it with you.

Martin Fowler: Software author and Chief Scientist at ThoughtWorks. Coined 'Microservices' with James Lewis. Wrote Refactoring, Patterns of Enterprise Application Architecture, and the 'Monolith First' essay.

Nat Friedman: American technology executive who was GitHub's CEO from 2018 to 2021, following Microsoft's acquisition. Announced GitHub's purchase of the npm registry in March 2020, with the promise that the public registry would remain free.

G

Fabian Giesen: Coder in Farbrausch under the handle ryg, author of the executable compressor kkrunchy and of much of the code behind debris. He has written about graphics and compression for two decades and works on real-time rendering professionally.

Colin S. Gordon: Computer scientist at Drexel University and author of The Linguistics of Programming, presented at ACM Onward! in 2024, which argues that programming language research and linguistics study the same questions.

Robert Graham: Security researcher and author of the masscan port scanner.

H

David Heinemeier Hansson: Creator of Ruby on Rails. Co-founder of Basecamp and HEY. Now advocates software ownership over SaaS subscriptions with ONCE.

Rich Harris: Creator of Svelte and Rollup. Former graphics editor at The New York Times. Demonstrated that the Virtual DOM is 'pure overhead'.

Christoph Hellwig: Long-standing Linux kernel developer, known for his work on the block layer, XFS and the DMA mapping code. In January 2019 he told a ZFS user on the Linux kernel mailing list to switch to FreeBSD.

Tammo Hinrichs: Coder and musician in Farbrausch under the handle kb, author of the V2 software synthesiser that produced the soundtracks of the group's demos and intros without storing a single sample.

Alfred Hobbs: American locksmith who in 1851, during the Great Exhibition, picked the Bramah lock in London after fifty-one hours over sixteen days and won its two-hundred-guinea challenge.

Orion Hodson: FreeBSD developer who suggested exporting sysctl descriptions, which Luigi Rizzo implemented in December 2001.

William Hoskins: Director of the Office of Technology Licensing at the University of California, Berkeley, who signed the letter of 22 July 1999 that struck the advertising clause from the BSD licence.

I

iq of rgba: Inigo Quilez, demoscener of rgba and author of the articles on ray marching with distance fields and cheap ambient occlusion that most 4K intros follow; thanked in the Hartverdrahtet readme.

ilja: Security researcher who presented Escaping Containment: A Security Analysis of FreeBSD Jails with Michael Smith at 39C3 in December 2025, reporting roughly fifty distinct kernel issues reachable from inside a jail.

J

Ron Jeffries: Co-creator of Extreme Programming. Agile Manifesto signatory. In 2018, wrote 'Developers Should Abandon Agile' — a rare recantation from an original author.

Allan Jude: FreeBSD and OpenZFS developer, co-author of two books on ZFS with Michael W. Lucas, and mentor of the 2017 Summer of Code project that produced bectl.

K

Dan Kahan: Yale law professor and cultural cognition researcher. Showed in 2012 that scientific literacy and numeracy widen, rather than close, the split between cultural camps on climate risk, and in 2017 that numerate readers read an identity-charged table more selectively than innumerate ones.

Poul-Henning Kamp: Danish FreeBSD developer. Created Jails (1999), the GEOM storage framework, and Varnish Cache. Known for phk's bikeshed argument and decades of kernel-level systems work.

Mike Karels: Berkeley CSRG developer and later of Berkeley Software Design, from whose work the sysctl interface of 4.4BSD derives.

Phil Karlton: Netscape and Silicon Graphics engineer (1947-1997), credited with the line that there are only two hard things in computer science: cache invalidation and naming things. The quip was first recorded publicly on Tim Bray's site.

Frank Keil: Yale cognitive scientist, co-author with Leonid Rozenblit of the 2002 paper that named the illusion of explanatory depth.

Auguste Kerckhoffs: Dutch linguist and cryptographer whose La cryptographie militaire (1883) required that a cipher must not depend on secrecy and may fall into enemy hands without harm.

Kyle Kneitinger: Wrote libbe and bectl for FreeBSD as a Google Summer of Code project in 2017, mentored by Allan Jude; bectl has been in the base system since FreeBSD 12.0.

Greg Kroah-Hartman: Senior Linux kernel maintainer responsible for stable releases. In 2024, removed Russian-affiliated maintainers from the MAINTAINERS file on compliance grounds.

Martin Krzywinski: Scientist who described port knocking in Sys Admin magazine in June 2003.

L

Stephan Lewandowsky: Cognitive scientist at the University of Bristol, co-author of the 2014 study on misleading headlines and of the continued-influence literature on misinformation.

James Lewis: Software architect at ThoughtWorks. Co-coined the term 'Microservices' with Martin Fowler in their 2014 article defining the architectural style.

Little Bitchard: Finnish demoscene musician, credited with the main part of the soundtrack to 1995 by Kewlers and mfx, which won Best Soundtrack at the Scene.org Awards; the closing part of that soundtrack is by 1in10.

Jeffrey Liebman: Economist at Harvard's Kennedy School and co-author, with Neale Mahoney, of the study showing that expiring federal budgets drive a spending spike of 4.9 times the weekly average in the last week of the fiscal year, and markedly worse IT projects.

Jochen Liedtke: German computer scientist, 1953 to 2001, author of the L3 and L4 microkernels. His 1993 paper showed an eight-byte message costing 5.2 microseconds where Mach charged about 115, which moved the microkernel argument from architecture to implementation.

M

Marshall Kirk McKusick: Computer scientist and BSD developer, author of the Berkeley Fast File System and co-author of The Design and Implementation of the FreeBSD Operating System. He holds the copyright to the BSD Daemon.

Yukihiro Matsumoto: The creator of Ruby, who has said that he designed the language to minimise his own surprise and to make programmers happy, which puts the reader at the centre of the design.

Doug McIlroy: Head of Bell Labs Computing Sciences Research Centre. Inventor of the Unix pipe (1973). Wrote the four foundational principles of Unix philosophy in 1978: do one thing well, expect output to become input, try early, use tools.

Luke Mewburn: NetBSD developer who designed and implemented the rc.d framework in the late nineties and presented the reasoning at USENIX in 2001. FreeBSD adopted the framework, and the copyright header in rc.subr still carries the NetBSD Foundation attribution three decades later.

Neale Mahoney: Economist at Stanford and co-author, with Jeffrey Liebman, of Do Expiring Budgets Lead to Wasteful Year-End Spending?, published as NBER Working Paper 19481 in 2013 and in the American Economic Review in 2017.

Michael McLay: The developer who asked the Python mailing list on 29 June 1994 what would happen to the language if Guido van Rossum were hit by a bus, and thereby gave the bus factor its name.

John Stuart Mill: English philosopher (1806 to 1873). On Liberty (1859), chapter II, carries the rule that he who knows only his own side of the case knows little of that: an argument is not understood until its strongest opposing case has been heard.

Alan Mycroft: Professor of Computing at the University of Cambridge. Supervised Stephen Dolan's PhD in Algebraic Subtyping. Co-designed the Nanopass framework and contributed to static analysis research spanning four decades.

Ethan Mollick: Professor at the Wharton School studying AI and work, author of Co-Intelligence and the One Useful Thing newsletter. Coined the term secret cyborgs for employees who automate their work with AI and stay silent about it.

Sebastian McKenzie: Creator of Babel: released in September 2014 as 6to5, the compiler that translated tomorrow's JavaScript for yesterday's browsers and became standard equipment of the build-step era. Later the initial author of Rome.

N

O

Jakob Nielsen: Danish web usability researcher, co-founder of the Nielsen Norman Group. His 2008 analysis of instrumented browsing found that a visitor has time to read at most 28 per cent of the words on an average page, and more usually about a fifth.

Dierk Ohlerich: Coder in Farbrausch under the handle chaos and principal author of werkkzeug, the editor in which the group built its demos, including the 96-kilobyte first-person shooter kkrieger.

P

Demoscene Passivist: Coder and musician of Akronyme Analogiker, author of Hartverdrahtet, the 4K intro that won PC 4K at Revision 2012; on Pouët as ScenePassivist.

Boris Pismenny: Engineer at NVIDIA and co-author of the Linux kernel TLS data path, credited in the OpenSSL 3.0 changelog beside the FreeBSD authors.

Pacioli: Luca Pacioli, Italian mathematician who published the first printed description of double-entry bookkeeping in 1494. The method is the earliest widely adopted instrument that gives a numerical error a detectable shape.

David Parnas: Canadian software engineer who, in a 1972 paper on decomposing systems into modules, coined the term information hiding: a module should hide a design decision that is likely to change. One of the foundational ideas of modular software design.

Bruce Perens: American software engineer, co-founder of the Open Source Initiative and author of the Open Source Definition. Posted the getpid loop in the comments under What FreeBSD Charges at the Boundary that the bare-metal rerun in The Review That Stopped at the Cover used unchanged.

Lennart Poettering: Creator of systemd and PulseAudio. His replacement of SysVinit with a monolithic init system remains one of the most divisive decisions in Linux history.

R

Rudi: Norwegian demoscene coder from Kristiansand, member of Darklite and RasterDream, with ninety-nine productions since 1998, lately MS-DOS intros of 256 bytes, among them a voxel engine. He wrote the code of Blackout State, which used no shaders and won at Black Valley 2026.

Theo de Raadt: Founder and leader of the OpenBSD project. Forked OpenSSH in 1999. Three decades of security-first development, auditing every line, removing attack surface instead of adding features.

Michael Rash: Security researcher and author of fwknop, who described the replay weakness of port knocking and proposed Single Packet Authorization.

Luigi Rizzo: FreeBSD developer and professor at the University of Pisa, author of dummynet and netmap, who on 16 December 2001 made sysctl descriptions readable with sysctl -d.

Leonid Rozenblit: Cognitive scientist, co-author with Frank Keil of the 2002 paper that named the illusion of explanatory depth.

S

Jon Seager: Engineering lead for Ubuntu at Canonical who announced in March 2025, under the title Carefully But Purposefully Oxidising Ubuntu, the plan to make the Rust-based uutils coreutils and sudo-rs the Ubuntu defaults.

Seven of Fulcrum: Coder of Fulcrum, whose 4K intro Fractus took third place at Revision 2012 and who posted the twenty-byte fix for the winner's busy-cursor fault in the comments the same afternoon.

Claude Shannon: American mathematician and founder of information theory, whose Communication Theory of Secrecy Systems (1949) assumed that the enemy knows the system being used.

Gleb Smirnoff: FreeBSD network stack developer. Rewrote sendfile in 2016 with Netflix sponsorship so that it no longer waits for the disk, introducing the not-ready flag in the socket buffer that kernel TLS reused five years later.

Randall Stewart: FreeBSD developer and co-author of SCTP. Wrote the RACK and BBR TCP stacks for FreeBSD with Netflix sponsorship, shipping in 13.0 as loadable modules selectable per connection.

Simon Schubert: DragonFly BSD developer and co-author of the Dragonfly Mail Agent.

Matthias Schmidt: One of the two authors of the Dragonfly Mail Agent, the small MTA that DragonFly BSD produced and FreeBSD adopted as its default in 14.0.

Jan Scheurer: German demoscene coder known as LJ, member of Alcatraz. Nordic Cathedral, his first production shown at a party, won the newschool competition at Nordlicht 2016.

Ingo Schwarze: OpenBSD developer and the maintainer of mandoc since the early 2010s. Development continues in the OpenBSD source tree; the last portable release, version 1.14.6, appeared on 23 September 2021.

Peter Salus: Author of A Quarter Century of Unix (1994). Summarised McIlroy's Unix philosophy in three lines: write programs that do one thing well, work together, and handle text streams as the universal interface.

Phil Shafer: Engineer at Juniper Networks and author of libxo, the library that lets a program emit text, JSON, XML or HTML from one code path. It was adopted into the FreeBSD base system and first appeared in FreeBSD 11.0.

Brian Somers: FreeBSD developer, credited with Paul Traina as an author of periodic(8), the maintenance framework that first shipped in FreeBSD 3.0 in October 1998 and has carried both names on its manual page ever since.

Salvatore Sanfilippo: Sicilian developer known as antirez. Created Redis in 2009, a single-threaded in-memory data structure server. Maintained it personally for fifteen years.

Isaac Schlueter: The American software engineer who created npm in 2010 and, in 2014, co-founded npm, Inc. with Laurie Voss to run the registry. An early and prominent contributor to the Node.js project.

Ken Schwaber: Co-creator of Scrum with Jeff Sutherland. Founded the Scrum Alliance, later Scrum.org. Admitted that 75 per cent of organisations using Scrum will not succeed.

Michael Smith: Security researcher and co-presenter, with ilja, of Escaping Containment: A Security Analysis of FreeBSD Jails at 39C3 in December 2025.

Søren Schmidt: FreeBSD developer whose copyright lines from 1994 to 1996 stand on the original files of FreeBSD's Linux binary compatibility layer, which first appeared in FreeBSD 2.1.

T

Henri Tajfel: British social psychologist (1919 to 1982). His minimal group experiments of 1971 showed that people favour their own side over a group assigned by coin toss, with nothing at stake and nobody to impress; the root of social identity theory.

Devin Teske: FreeBSD developer, author of sysrc(8) and bsdconfig, both introduced in FreeBSD 9.2. His work made rc.conf editable from a script without risking the file.

Paul Traina: FreeBSD developer, credited with Brian Somers as an author of periodic(8), the framework that replaced the older three-script arrangement with a directory of small scripts and a configuration layer.

Dave Thomas: Agile Manifesto signatory. Co-author of The Pragmatic Programmer. Declared 'Agile is Dead' in 2014, arguing the word had been hijacked by consultancies.

Ken Thompson: Co-creator of Unix (1969), the B programming language, and the first cron (1975) at Bell Labs. Co-designed UTF-8 and Plan 9. Turing Award winner (1983) with Dennis Ritchie.

Linus Torvalds: Creator and principal developer of the Linux kernel. Also wrote Git. Maintains kernel development from Portland, Oregon.

Andrew Tridgell: Australian computer scientist. Created rsync (1996), Samba (Windows file sharing on Unix), ccache, and co-developed Git's delta compression with Linus Torvalds.

Dominic Tarr: British developer and prolific author of small Node.js modules. Maintained event-stream unpaid from 2012 and handed it to a volunteer in 2018, which became the textbook case of a maintainer handover used as an attack route.

Learned Hand: American appellate judge (1872-1961), among the most cited jurists never to sit on the Supreme Court. Wrote The T.J. Hooper in 1932, establishing that conformity with industry practice does not by itself discharge a duty of care.

V

Guido van Rossum: Creator of the Python programming language, its Benevolent Dictator for Life until 2018, and the hypothetical bus victim in the 1994 mailing-list question that named the bus factor.

Paul Vixie: Author of Vixie cron (1987), BIND (the DNS server running a third of the internet), and numerous RFCs. Internet Hall of Fame inductee (2014). The five-field crontab syntax is his.

Laurie Voss: Co-founder of npm, Inc. with Isaac Schlueter in 2014, and long the company's data and operations lead, building a business around the npm registry.

Patrick Volkerding: Creator and maintainer of Slackware, which he released in July 1993 after improving the Softlanding Linux System for his own use. He has kept the distribution's package tools free of automatic dependency resolution for more than three decades.

W

Dave Watson: Engineer at Facebook. Presented kernel TLS for Linux at netdev in 2016, together with the measurement that a tenth of the company's processor time was going on encryption and decryption.

RLHF: Reinforcement learning from human feedback, the training stage that shapes a raw predictive model into one that answers helpfully and refuses sensibly. It is much of a model's character, and one of the layers most often withheld even when the weights are released.

Philip Walton: Engineer at Google working on web performance and the author of the reference account of cascading cache invalidation, which documents why fingerprinted filenames written into importing files multiply a single change across a dependency chain. His own recommended remedy is an indirection layer, of which he calls import maps the simplest to implement.

Robert Watson: Computer scientist at the University of Cambridge. Co-created Capsicum with Jonathan Anderson (2010, Best Student Paper at USENIX Security). Also contributed to FreeBSD's MAC framework and TrustedBSD.

Y

Jeremy Wolfe: American visual-attention researcher at Harvard. His 2005 Nature paper showed that rare targets are missed far more often than common ones, with miss rates of thirty per cent and above at low prevalence against seven per cent at high prevalence.

Greg Young: Popularised Event Sourcing and CQRS as architectural patterns. Author of Versioning in an Event Sourced System.

Dima Dorfman: FreeBSD developer, author of devfs(8), the tool that applies device filesystem rulesets. It first appeared in FreeBSD 5.0.

Richard Gooch: Author of the Linux devfs, merged into kernel 2.3.46 in February 2000. He stopped maintaining it a few years later, and it was removed in 2.6.18.

Jon Oberheide: Security researcher who published a working exploit for CVE-2009-1185, the udev flaw that let an unprivileged user forge a netlink message and have it acted upon as root.