Dictionary

Name: Integrated by Design
ISBN: 978-3-9828652-0-1

Short, precise definitions of IT terms and people referenced across this site. Hover any highlighted term in a blog article to see its definition. Click to jump here.

Terms

64K intro: A demoscene production whose entire compiled program must fit within 65,536 bytes (64 KB). Everything the viewer sees and hears is generated from that code at runtime, since there is no room to store textures, models or audio.

A

AB 316: A 2025 California statute, signed in October 2025 and in force from January 2026, barring a defendant who developed, modified or used an artificial-intelligence system from arguing that the system autonomously caused the harm. It removes the machine-did-it defence without creating strict liability.

ABI: Application Binary Interface. The low-level contract between a binary and the operating system: syscall numbers, calling conventions, data layout. Determines which binaries run on which kernel.

ACID: Atomicity, Consistency, Isolation, Durability. The four guarantees a database transaction must provide for reliability.

ACME: Automatic Certificate Management Environment. The protocol Let's Encrypt uses to issue and renew TLS certificates without manual intervention.

AGPL: Affero General Public Licence. A copyleft licence that closes the GPL's network gap: if users interact with the software over a network, they must be offered its source. Written for server-side software the GPL's distribution trigger never reached.

AI bill of materials: A proposed provenance record, an AI-SBOM, that tags each generated component with the model that produced it, along with the prompt and generation metadata, so a line can later be traced to its origin. An emerging practice rather than a settled standard.

Alpine: A small, security-oriented Linux distribution built on musl and BusyBox rather than glibc and GNU coreutils. Widely used as a minimal container base image. One of the userlands that share the Linux kernel and little else.

Alpine.js: A lightweight JavaScript framework, around ten kilobytes, for adding client-side behaviour directly in HTML attributes. A smaller, declarative alternative to the large single-page-application frameworks.

Andrew Tanenbaum: The computer scientist who wrote MINIX in 1987 as a teaching operating system, and Linus Torvalds' opponent in the well-known 1992 debate over microkernel versus monolithic kernel design.

Ansible: An agentless automation tool for configuration management, application deployment, and orchestration. Uses YAML playbooks over SSH.

Anthropic: American AI company. In June 2026 it complied with a US Commerce Department directive to suspend its two most capable models for all foreign nationals, three days after launch, withdrawing them from every customer. Cited as evidence that the institutional lever reaches proprietary, paid software as readily as open source.

Apache 2.0: A permissive open-source licence with a patent grant and no copyleft, granting broad rights to use, modify and distribute. Applied to a model's weights, as with Mistral's 2026 flagships, it removes licence restrictions but still grants only the numbers, not the training data or pipeline.

Arch: A rolling-release Linux distribution following a minimalist, do-it-yourself philosophy. Ships current packages continuously rather than in fixed versions, leaving system composition to the user. Like every distribution, an assembly of independently-governed projects rather than a single tree.

ARM: A processor instruction-set architecture designed in Cambridge and licensed, core by core, to chip makers worldwide; the most widely deployed ISA on Earth, owned since 2016 by Japan's SoftBank.

async runtime: A library that drives non-blocking, event-driven tasks and schedules them across all cores inside one process, giving a language the concurrency for which a container is often used as a substitute. Tokio is the common one for Rust.

AWS: Amazon Web Services. The dominant cloud computing platform offering IaaS, PaaS, and managed services.

AWS Amplify: Amazon Web Services' platform for building and deploying modern front-end and full-stack applications, alongside Vercel and Netlify in the deployment-economy tier whose business depends on the heavy stack.

B

Babel: A JavaScript compiler that transforms modern or non-standard syntax into widely-supported JavaScript. A near-universal part of the standard front-end toolchain, alongside Webpack, ESLint and Jest.

Base System: In FreeBSD and the other BSDs, the kernel, C library, userland utilities, documentation, toolchain and release-engineering process maintained together in one source tree by one project and shipped as one tested snapshot. Contrasts with a Linux distribution, which assembles several hundred independently-governed projects. Base means what is shipped together; system means integrated whole.

base image: The distribution layer a container is built on top of, such as Debian or Alpine, carrying a userland, package manager and its own attack surface into every image derived from it.

Berkeley: The University of California, Berkeley, and in particular its Computer Systems Research Group, where the Berkeley Software Distribution was developed from the late 1970s. The second wellspring of Unix after Bell Labs; the BSD family carries Berkeley's code to this day.

Berkeley Software Design: Berkeley Software Design Inc. (BSDi), the commercial spinoff that sold a Net/2-based product from 1992 and was sued by AT&T's Unix System Laboratories in USL v. BSDi.

Berkeley Software Distribution: The line of Unix begun in 1977 by Berkeley's Computer Systems Research Group as modifications to AT&T Unix; over fifteen years it became a fully alternative line, 1BSD through 4.4BSD, and the root of today's FreeBSD, NetBSD, OpenBSD and DragonFly.

Bionic: Android's C library and low-level runtime, used in place of glibc. One of several userlands that share the Linux kernel and little else, alongside GNU, musl and BusyBox.

BIOS: The traditional system firmware that initialised a PC at power-on before handing control to the operating system; today largely replaced by UEFI.

BPF: Berkeley Packet Filter. Originally a packet capture mechanism, extended in Linux as eBPF for programmable kernel-level filtering. Used by seccomp-bpf to inspect and decide on every syscall at runtime.

BSD: Berkeley Software Distribution. The line of Unix developed at the University of California, Berkeley from the late 1970s, and the family that descends from it today (FreeBSD, OpenBSD, NetBSD, DragonFly). Unix by inheritance, carrying the AT&T-and-Berkeley code in its source under a permissive licence.

BSDi: Berkeley Software Design Inc., the commercial spinoff that from 1992 sold a product based on Berkeley's Net/2; defendant in the USL v. BSDi lawsuit that ran 1992 to 1994.

build.rs: A Rust build script: arbitrary code a crate runs at build time, with full filesystem and network access under the developer's permissions. The reason Rust is not exempt from install-time code execution.

Bun: An all-in-one JavaScript runtime, bundler, transpiler, and package manager. Written in Zig, designed for speed.

BusyBox: A single small executable combining stripped-down versions of many standard Unix utilities, common on embedded Linux systems. Another userland that shares the Linux kernel with GNU, musl and Bionic.

blast radius: Everything an attacker reaches once a single component is compromised. In npm there is no privilege boundary between your code and its dependencies: a package's install script runs with your full user rights, so one compromised maintainer's blast radius is your shell, your environment, your SSH keys and your cloud tokens.

C

Caddy: A web server with automatic HTTPS via built-in ACME client. Written in Go. Often used as a reverse proxy.

Ambient Authority: The security property where a process inherits all the permissions of the user who launched it. The default Unix model since 1969. Capsicum eliminates it; seccomp restricts it.

backporting: Applying a fix from a newer upstream version to an older, frozen one, the maintenance model of enterprise Linux distributions. Done across dozens of independently maintained trees it is structurally hard, which is why a 2024 study counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel.

blocklistd: A FreeBSD daemon that blocks abusive network clients, the successor to blacklistd. Its integration into FreeBSD's OpenSSH introduced CVE-2024-7589, an unauthenticated root race: an integrated project planting a fault in the very act of integrating a component.

Capsicum: A capability-based security framework in FreeBSD. One syscall (cap_enter) permanently removes all access to global namespaces. The process keeps only its existing file descriptors, each restricted via cap_rights_limit(). Irreversible. Compiled into FreeBSD 10.0 by default since 2014.

cargo-vet: A Rust supply-chain tool from Mozilla that requires human-reviewed audits of a crate before it is allowed into a build, so a dependency cannot enter a project unreviewed.

CAST: The templating language used by CASTD. Five delimiter pairs for variables, conditions, slots, comments, and expressions.

CDDL: Common Development and Distribution Licence. Sun Microsystems' open-source licence, intentionally incompatible with the GPL. The licence under which ZFS was released.

certification mark: A trademark that certifies a product meets a defined standard rather than identifying its commercial source. UNIX is one: it may sit only on systems tested and approved against the Single UNIX Specification. Such a mark survives in law only by staying narrow, which is why The Open Group disowns loose use of the word.

Computer Systems Research Group: The group at the University of California, Berkeley (CSRG) that from 1977 produced the Berkeley Software Distribution and, before disbanding in the 1990s, the clean 4.4BSD-Lite release from which the modern BSDs descend.

CIQ: The company behind Rocky Linux and enterprise Linux support. Its engineers' 2024 white paper, Vendor Kernels, Bugs and Stability, counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel. A partisan source with a competing product, cited for its own primary finding.

Copyleft: A licensing strategy that grants the freedoms to use, study, modify and share on the condition that derivative works carry the same terms. The licence travels with every line into any fork and remains there in perpetuity. The GPL is the canonical example; permissive licences such as BSD impose no such condition.

coreboot: An open-source replacement for the proprietary system firmware (BIOS or UEFI) of a machine, available on some hardware classes; one of the few sub-OS layers that admits an open alternative.

coreutils: The GNU implementation of the basic file, shell and text utilities (ls, cp, cat and the rest) shipped by most Linux distributions. One component among the several hundred a distribution maintainer selects and integrates around the kernel.

CI/CD: Continuous Integration / Continuous Deployment. Automated pipelines that build, test, and deploy code on every commit.

cluster module: A Node.js core module that forks one worker process per CPU core and shares a listening socket between them; the first workaround for a single-threaded runtime that cannot, by itself, use more than one core.

CNCF: Cloud Native Computing Foundation. The Linux Foundation project hosting Kubernetes, Prometheus, Envoy, and other cloud-native infrastructure projects.

container: A packaged unit that bundles a process with a slice of userland (libraries, shell, tools) and runs it in an isolated view of a shared kernel; convenient for deployment, but often a small operating system shipped to run one process.

control groups: A Linux kernel feature, begun at Google in 2006 and merged into the mainline kernel in 2008, that limits and accounts for the CPU, memory and I/O a group of processes may use. With namespaces, one of the two primitives Linux containers are assembled from.

CQRS: Command Query Responsibility Segregation. Separates read models from write models, allowing independent optimisation of each path.

Cracktro: A signature animation attached to cracked software by pirate groups in the 1980s and 1990s. Scrolling text, chiptune music, and vector effects as calling cards. The art form that evolved into the demoscene.

Copy-on-Write: A storage strategy where data is never overwritten in place. New data is written to a new location, then the pointer is updated. Guarantees consistency after power failure.

crates.io: The package registry for the Rust language. A published version is immutable: it can never be overwritten, only yanked, which removes the republish-an-existing-name trick used against npm.

cron: The Unix job scheduler. Executes commands at specified times using a five-field time expression (minute, hour, day, month, weekday).

CrowdStrike Incident: On 19 July 2024, a rapid content update to CrowdStrike's Falcon Sensor bypassed quality control and crashed 8.5 million Windows machines globally. Airlines, hospitals, banks, and emergency services were affected. $5.4 billion in Fortune 500 damages.

CSR: Client-Side Rendering. Building the page DOM entirely in the browser via JavaScript after an initial empty HTML shell is delivered.

CSS Layers: The @layer rule in CSS, allowing authors to define explicit cascade priority between groups of styles, eliminating specificity wars.

CSS-in-JS: A pattern where CSS is authored inside JavaScript files, generating styles at runtime. Adds bundle weight and runtime overhead.

D

Cyber Resilience Act: An EU regulation imposing security-by-design, update and documentation duties on products with digital elements. Non-compliance can support a finding of defectiveness under the Product Liability Directive.

Datastar: A small hypermedia and reactivity framework taking a server-sent-events approach, combining ideas from HTMX and Alpine in one package in the same order of magnitude as HTMX. A modern entry in the lightweight front-end tier.

dayjs: A small, widely used JavaScript date library. Its name and metadata were impersonated by the typosquat easy-day-js in the June 2026 Mastra supply-chain attack.

Debian: A community-driven Linux distribution known for its stability-first release policy. Debian Stable freezes packages and releases when ready, not on a schedule. The reference for conservative, tested software deployment.

demoparty: A gathering where the demoscene meets to show new work and hold competitions, judged by the audience. Revision, held each Easter in Saarbrücken, is the largest.

Demoscene: A computer art subculture producing real-time audiovisual presentations (demos) within extreme size constraints, often 64 KB or less.

Deno: A secure JavaScript/TypeScript runtime by the creator of Node.js. Built-in TypeScript support, URL imports, and sandboxed permissions.

defect density: The rate of faults a system carries, as against its feature list. The argument of a dependable server OS: you do not choose your bugs, you choose your defect density, and it is decided by how the system was built, not by how clever its newest part contrives to be.

distinfo: The FreeBSD ports file that pins the SHA256 checksum and size of every distribution file a port downloads. A tampered upstream tarball fails the checksum and the port never builds.

DKMS: Dynamic Kernel Module Support. A framework for building kernel modules that automatically recompile when the kernel is updated. Used by ZFS on Linux.

Dependabot: A GitHub-integrated bot that automatically opens pull requests to update dependencies. On a monorepo, it can generate hundreds of PRs per week, each requiring review and testing.

dependency confusion: A supply-chain attack in which a package is published to a public registry under the name of a company's private internal package, so that a misconfigured build resolves the public impostor in preference to the intended private one.

devDependencies: The packages in an npm package.json needed only to develop or build a project, not to run it in production. A plain npm install pulls them in and runs them with the same permissions as everything else, which is when a post-install script fires; Snyk's default scan omits them.

Docker: A container runtime that packages applications with their dependencies into isolated filesystem images, sharing the host kernel.

DragonFly: DragonFly BSD. A fork of FreeBSD begun by Matthew Dillon in 2003, with its own approach to multiprocessing and the HAMMER filesystem. A member of the BSD family, Unix by descent.

DTrace: A dynamic tracing framework for real-time analysis of running systems. Originated in Solaris, ported to FreeBSD and macOS. Traces kernel and userspace with near-zero overhead when idle.

E

Ed25519: A modern public-key signature scheme, fast and compact, used by OpenSSH keys and by OpenBSD's signify for signing releases and packages.

Enshittification: The process by which platforms degrade their product to extract value. Coined by Cory Doctorow in 2022. Three phases: attract users, lock in businesses at users' expense, extract value for shareholders at everyone's expense. Word of the Year 2023 (American Dialect Society) and 2024 (Macquarie Dictionary).

ES Modules: The native JavaScript module system using import/export syntax, loaded by browsers without a bundler.

ESLint: A configurable linter for JavaScript and TypeScript that flags errors and enforces style rules. A standard fixture of the modern front-end toolchain.

EulerOS: Huawei's enterprise Linux distribution, once on The Open Group's register as conforming to UNIX and lapsed in 2022. One of the few Linux systems ever to hold the mark, a reminder that the certificate measures the interface, not the lineage.

European Processor Initiative: An EU-funded consortium (EPI) developing sovereign high-performance processors for European supercomputers, including the SiPearl Rhea line for the JUPITER exascale system.

Event Sourcing: A pattern that stores every state change as an immutable event rather than overwriting current state. The event log becomes the source of truth.

exascale: A class of supercomputer capable of a billion billion operations per second. Europe's first, JUPITER, is intended to run on SiPearl's Rhea processor.

F

fabrication: The manufacturing of chips from a design, carried out at a foundry. Leading-edge fabrication is dominated by TSMC, Samsung and Intel, with SMIC advancing in China.

faccessat2: A Linux system call added in kernel 5.8 (2020) to fix a flag-handling gap in faccessat. glibc 2.33 began preferring it in 2021; container seccomp allow-lists written earlier blocked it, so a correct kernel, a correct C library and a correct filter together broke ordinary file-access checks inside containers. A bug in the gap.

Fetch API: The modern browser interface for making HTTP requests, replacing XMLHttpRequest. Returns Promises and supports streaming.

FFmpeg: A universal multimedia framework handling over 100 audio and video codecs. 1.5 million lines of C. Powers YouTube, Netflix, VLC, Spotify, Chrome. Created by Fabrice Bellard in 2000.

firmware: Software stored in hardware that runs below the operating system, such as the system firmware that boots a machine or the firmware on a management processor. Often vendor-signed and not user-replaceable.

fixi: A minimalist implementation of generalised hypermedia controls by the HTMX team, built to be as small as possible: roughly 3.5 KB uncompressed, around 1.3 KB compressed. The smallest end of the hypermedia tier.

FOSDEM: Free and Open Source Developers' European Meeting. Annual two-day conference in Brussels, free to attend, no registration.

FreeBSD: An open-source Unix operating system descended from the Berkeley Software Distribution. Known for ZFS, Jails, and its licence model.

FreeBSD Foundation: The non-profit that supports FreeBSD development, infrastructure and release engineering. Registered in Colorado, United States. A single-tree architecture does not by itself relocate this institutional anchor, which is the distinction between the architectural layer and the jurisdictional one.

FSF: Free Software Foundation. Founded by Richard Stallman in 1985 to promote software freedom; author and steward of the GPL family of licences. In a sovereignty reading, the FSF remains a co-governor of any GPL fork through the licence it authored.

freemium: A business model in which the core product is given away to draw the largest possible audience while a minority pays for extra tiers. For the npm registry the free public registry is the funnel and private packages and enterprise are the revenue, so the size of the free tier, the package count, is the asset the paid tier is sold against.

G

genericide: The death of a trademark by becoming the generic name for its category, as befell aspirin, escalator and thermos. The risk that drives The Open Group to police the UNIX mark narrowly: allowed to mean any Unix-ish system, it would cease to be a mark at all.

glibc: The GNU C Library, the default C library on most Linux distributions. Implements the standard library and the syscall interface to the kernel. One userland among several (alongside musl, Bionic and BusyBox) that share the Linux kernel; its ABI contract with the kernel has occasionally broken in ways no single project owned.

GIL: Global Interpreter Lock. A mutex in CPython that allows only one thread to execute Python bytecode at a time, serialising CPU-bound work. Elegant until load disagrees.

GNU: GNU's Not Unix. The free-software project Richard Stallman began in 1983 to build a complete Unix-compatible system; its userland supplies the standard utilities, C library and toolchain on most Linux distributions. Unix-like by design, with no inherited Unix code.

git blame: A Git command that annotates each line of a file with the commit, author and date that last changed it. It was a rough but honest way to find who shaped a line; with generated code it names whoever pressed accept, not who actually wrote it.

GNU Hurd: The GNU project's microkernel operating system, a set of servers on the GNU Mach microkernel begun in 1990. It provides a POSIX interface but has never reached a 1.0 production release, the cautionary member of the discipline-without-descent class: the ambition intact, the delivery absent.

Go: A compiled language from Google (2009); its runtime scheduler multiplexes lightweight goroutines across every core of a single process, so one binary saturates a multi-core machine without a cluster of processes or a container per core.

GPAI: General-purpose AI, the EU AI Act's term for a model that can serve many downstream tasks. Article 53 obliges GPAI providers to publish a sufficiently detailed summary of their training content, to a template the AI Office issued in July 2025, binding open-licensed models as well as closed ones.

GPL: GNU General Public Licence. The canonical copyleft licence, authored by the Free Software Foundation. Requires derivative works to carry the same terms, so its conditions travel with every line into any fork and cannot be repealed by the forker. The Linux kernel is licensed under GPLv2. Deliberately designed not to let go.

Goroutine: A lightweight thread managed by the Go runtime. Multiplexed onto OS threads. Enables high concurrency but subject to garbage collection pauses.

Grafana: A visualisation platform for metrics, logs, and traces. Connects to Prometheus, Loki, InfluxDB, and dozens of other data sources.

Goodhart's Law: When a measure becomes a target, it ceases to be a good measure. Named after economist Charles Goodhart (1975). Explains why velocity tracking corrupts estimation.

GraphQL: A query language for APIs where the client specifies exactly which fields it needs. Developed by Facebook, alternative to REST.

gRPC: A high-performance RPC framework using Protocol Buffers and HTTP/2. Supports streaming, code generation, and strong typing.

GitHub: A web platform for hosting Git repositories and collaborative software development, founded in 2008 and acquired by Microsoft in 2018 for USD 7.5 billion. Owner of the npm registry since 2020.

H

HAMMER2: The native filesystem of DragonFly BSD, offering snapshots, clustering, deduplication and self-healing. Written for DragonFly and carried by no other BSD; the counterpart on that branch to ZFS on FreeBSD.

HAProxy: A high-performance TCP/HTTP load balancer and reverse proxy. Event-driven, widely used for traffic distribution.

htm/a: A four-kilobyte server-side reactivity framework with a type-safe Rust core and no dependencies, the author's own study built to see how low the front-end floor can go; it runs htma.run. Not a supported product, but a proof that the floor is lower than the industry assumes.

HTTP/2: The second major version of HTTP. Binary framing, multiplexed streams over a single TCP connection, header compression.

HTTP/3: HTTP over QUIC. Replaces TCP with UDP-based transport, eliminating head-of-line blocking. Built-in encryption.

I

ironies of automation: Lisanne Bainbridge's 1983 observation that automating a task deskills the operator: they stop practising the parts the machine now covers, yet must take over when it fails, exactly when unusual skill is needed and least available.

IaaS: Infrastructure as a Service. Virtual machines, storage, and networking rented from a cloud provider instead of running your own hardware.

IEEE 1003: The IEEE standard family better known as POSIX, first published as IEEE 1003.1 in 1988. The technical text the Single UNIX Specification incorporates, specifying the interface a program sees rather than the system that implements it.

information hiding: The module-decomposition principle David Parnas set out in 1972: a module should hide a design decision that is likely to change, so that when it changes, only that module changes. A boundary drawn where the volatility lives, the honest opposite of a layer that only postpones the look beneath it.

infostealer: Malware whose purpose is to harvest secrets from a machine, browser data, cryptocurrency wallets, SSH keys, cloud tokens and credential files, and exfiltrate them to attacker infrastructure.

Intel Management Engine: A small autonomous processor inside Intel chipsets, running its own MINIX-based firmware at a privilege below the kernel, with system access and a network path, active even while the machine is powered off. Built for remote fleet management; CVE-2017-5689 showed it could be taken over remotely.

io-pkt: The networking stack of the QNX operating system, built directly on NetBSD's networking code. Berkeley's code compiled into QNX's own address space, which is why a Unixoid by kernel carries a genuine piece of the BSD line inside it.

io_uring: A Linux asynchronous I/O interface (Jens Axboe, kernel 5.1, 2019) built on two shared-memory rings, a submission queue and a completion queue, letting an application hand the kernel batches of work with very few system calls. Fast, but a large and fast-growing attack surface: around six in ten Linux kernel exploits submitted to Google's 2022 bounty went through it.

IPsec: Internet Protocol Security. A suite of protocols for authenticating and encrypting IP packets. Complex configuration, largely replaced by WireGuard for VPNs.

IRIX: Silicon Graphics' Unix flavour for its workstations, one of the proprietary Unixes of the 1980s.

ISA: Instruction-set architecture: the contract between software and a processor, the set of instructions a CPU exposes. x86, ARM and RISC-V are the three main ISAs, and which a chip implements is a question of ownership as much as of engineering.

install script: A script a package declares to run automatically during npm install, such as a postinstall hook. It executes with the installing user's full permissions the moment installation finishes, before the installed code is deliberately run, which is what makes a malicious one so effective.

J

jails: FreeBSD's kernel-native operating-system virtualisation: an isolated environment that is a first-class kernel primitive rather than a daemon-mediated arrangement of namespaces. With VNET each jail holds an independent network stack.

Jest: A JavaScript testing framework, widely used in the React ecosystem. One of the tools, with React, Webpack, Babel and ESLint, that make a junior engineer a known quantity to the hiring market.

jq: A functional programming language for transforming JSON on the command line. Generators, backtracking, immutable values, compiled to a stack-based bytecode VM. 822 KB binary. Written in C by Stephen Dolan in 2012. MIT licence.

JSON-RPC: JSON Remote Procedure Call. A lightweight protocol that encodes function calls and responses as JSON objects, transported over HTTP or WebSockets.

K

K-UX: Inspur K-UX, a Linux-based operating system from the Chinese vendor Inspur, certified against UNIX in 2013 and later lapsed. One of the very few Linux distributions ever to hold the UNIX mark.

kintsugi: The Japanese art of repairing broken pottery with lacquer dusted with gold, so the mend is honoured as part of the object's history rather than disguised. Used here as an image for a system that shows its workarounds and their reasons on the surface, where the next maintainer can read them.

KISS: Keep It Simple, Stupid: a design principle holding that systems work best when kept as simple as the problem allows. With lean and minimal, one of the disciplines of removing everything that does not earn its place, so the result is proportioned to the problem and can be held whole in one mind.

KubeCon: The Cloud Native Computing Foundation's flagship conference for Kubernetes and cloud-native technologies.

Kubernetes: An orchestration platform for managing containerised workloads across clusters. Handles scheduling, scaling, and self-healing.

L

LibreSSL: A fork of OpenSSL begun by the OpenBSD project in 2014 after Heartbleed, stripping and auditing the codebase for correctness. One of several tools written for OpenBSD and now used far beyond it, alongside OpenSSH, doas and OpenNTPD.

Landlock: A Linux security module (merged in 5.13, 2021) that adds unprivileged filesystem sandboxing. Moves closer to Capsicum's capability model but does not yet match the simplicity of cap_enter().

light-dark(): A CSS function that returns one of two values depending on the computed color-scheme. Eliminates media-query duplication for dark mode.

LibreOffice: A free, open-source office suite forked from OpenOffice.org in 2010 and maintained by The Document Foundation. A common component of European public-sector migrations away from proprietary productivity software.

Linux: The kernel Linus Torvalds wrote from scratch in 1991, and the operating systems built around it with a GNU or other userland. Unix-like, not Unix: it inherited no Bell Labs or Berkeley code and has never been certified by The Open Group. A separate family that looks Unix-shaped by design.

Linux Foundation: A non-profit consortium that hosts the Linux kernel's infrastructure and many other projects (including the CNCF). Registered in the United States as a 501(c)(6) trade association and therefore bound by US legal reach. Its 2024/2025 report put 84.3 per cent of kernel commits with developers paid by their employers.

Linuxulator: FreeBSD's Linux binary compatibility layer. Translates Linux system calls to FreeBSD equivalents in the kernel, running Linux binaries natively without emulation. Active since 1995.

Lions' Commentary: John Lions' line-by-line reading of the Unix V6 kernel source, written at the University of New South Wales in 1976. Later restricted by AT&T and circulated in samizdat photocopies for two decades, one of the most-copied computer-science documents of its era.

Llama: Meta's family of open-weight language models. The weights are downloadable but the Llama Community Licence is not OSI-approved: it terminates for any company above 700 million monthly active users unless Meta expressly grants continued use, and carries an acceptable-use policy. The archetype of open weights that are not open source.

LoongArch: A domestic instruction-set architecture developed by China's Loongson in 2021, moving away from the MIPS lineage toward an ISA under its own control.

LTS: Long-Term Support. A release designated for extended maintenance, typically receiving only security patches and critical bug fixes. Node.js LTS lasts 30 months. PostgreSQL supports each major for 5 years.

Lua: A lightweight embeddable scripting language. 30 KB runtime, first-class functions, metatables for OOP. Used in game engines and web servers.

M

Matthew Dillon: A FreeBSD developer who, disagreeing with the fine-grained locking direction of FreeBSD 5, forked FreeBSD 4.8 in June 2003 to create DragonFly BSD, building a kernel organised around message-passing and the HAMMER and HAMMER2 filesystems.

Mach: A microkernel developed at Carnegie Mellon from the mid-1980s, part of the separate microkernel engineering tradition that grew up beside the monolithic Unix line and the basis of several later systems.

MAINTAINERS file: A file in the Linux kernel source tree listing who is responsible for each subsystem. In October 2024 it was edited to remove approximately eleven entries under stated compliance requirements, a change Linus Torvalds confirmed and declined to reverse. Illustrates that forking the source does not fork the governance.

make: A build automation tool written by Stuart Feldman at Bell Labs in 1976, driving compilation from a declarative file of targets and dependencies. Small enough to have been completed rather than continually replaced, and still in use half a century later.

Mastra: An open-source TypeScript framework for building AI applications, distributed as the @mastra npm scope. In June 2026 its publishing scope was hijacked through a dormant contributor account and 144 of its packages were backdoored.

MCP: Model Context Protocol, an open standard for connecting AI assistants to external tools and data sources. Packages aimed at MCP developers were a pointed target of the June 2026 PyPI supply-chain campaign.

Merkle tree: A hash tree where every leaf node is labelled with the hash of a data block and every non-leaf node is labelled with the hash of its children. Used by ZFS for end-to-end checksumming.

message passing: The way processes talk in a microkernel: instead of calling into shared kernel code, a process sends a message to another and waits for the reply. In QNX it is the core kernel mechanism, and it is what lets drivers, filesystems and the network stack run as separate, isolable programs.

Miasma: A June 2026 npm supply-chain attack that republished thirty-two packages under the @redhat-cloud-services scope through a hijacked continuous-integration pipeline identity. The packages carried valid signed provenance and stole credentials all the same, illustrating that an attestation certifies which pipeline built an artifact, not that the pipeline was still in the right hands.

microcode: The lowest layer of a CPU: the signed, encrypted program that translates architectural instructions into the processor's internal operations. It can be updated only with the manufacturer's signature; one cannot read it, write it, or fork it.

microkernel: An operating-system design that keeps drivers, filesystems and the network stack out of kernel space, communicating through a small message-passing core, so a failed driver restarts in milliseconds rather than taking the machine down. QNX is the long-standing production example.

Microservices: An architecture that decomposes an application into small, independently deployable services communicating over network protocols.

Minix: A small Unix-like operating system written by Andrew Tanenbaum in 1987 for teaching. Famously the system the young Linus Torvalds ran and outgrew, prompting him to write the Linux kernel.

Mistral: A Paris-based AI laboratory, Europe's most-cited example when digital sovereignty is discussed. It releases flagship 2026 models such as Mistral Large 3 under the permissive Apache 2.0 licence, a genuine good that is still not a fork, since the training data and pipeline are not published.

Monolith: A single deployable unit containing all application logic. Often contrasted with microservices but not inherently inferior.

monolithic kernel: A kernel design in which the scheduler, drivers, filesystems and network stack all run inside one privileged address space, as traditional Unix and Linux do. Fast, but a fault in any part can take the whole system down, the arrangement the microkernel was meant to avoid.

musl: A clean-room, lightweight implementation of the C standard library for Linux, emphasising POSIX correctness and small size. Used in place of glibc by Alpine and many container images. One userland among several (alongside glibc, Bionic and BusyBox) that share the Linux kernel and little else.

MVC: Model-View-Controller. An architectural pattern that separates data (Model), presentation (View), and input handling (Controller).

MVCC: Multi-Version Concurrency Control. A database technique where readers see a consistent snapshot without blocking writers. Used in PostgreSQL.

MVS: Multiple Virtual Storage, the IBM mainframe operating-system line whose design reaches back to the 1960s and the kernel beneath today's z/OS. It carries no Bell Labs or Berkeley code; the certified-Unix part of z/OS is a POSIX layer sitting on top of it.

N

Neoverse: ARM's line of licensed CPU cores for servers and high-performance computing; the cores on which Europe's SiPearl Rhea1 is built.

Net/2: Berkeley's 1991 release, an attempt to ship a Unix distribution containing only Berkeley-written code and no AT&T-licensed source; the basis of BSDi's product and the trigger for the USL lawsuit.

Netflix: The streaming company, cited here for a 2017 web-performance result: removing client-side React from its logged-out home page cut Time to Interactive by around half. In the Unix context, its Open Connect appliances also run FreeBSD.

Netlify: A deployment and hosting platform for modern front-end applications, in the same tier as Vercel. Its hosting model and integrations are coupled to the heavy modern stack, and pricing tends to scale with bundle size.

Network Effect: The phenomenon where a product becomes more valuable as more people use it. The mechanism that creates lock-in: leaving the network means losing the connections you built on it.

Nextcloud: An open-source, self-hostable file-sync and collaboration platform, often deployed as a sovereign alternative to proprietary cloud suites. A common component of European public-sector migrations.

nftables: The Linux packet classification framework replacing iptables. Uses a unified syntax for filtering, NAT, and mangling.

namespaces: The Linux kernel feature that gives a process its own isolated view of resources (mounts, network, PIDs), the primitive containers are built from. Isolation holds only while the kernel, the runtime and procfs all agree on the same picture; the seam between them is where the November 2025 runc break-outs escaped.

nginx: A high-performance HTTP server and reverse proxy using an event-driven, non-blocking architecture. Serves static files and proxies upstream applications.

Nintendo Switch: Nintendo's games console (2017). Its Horizon operating system carries FreeBSD's networking code without being a FreeBSD derivative outright, code from one family running inside another. Counted with Sony's consoles, it tilts the console world towards BSD.

node-ipc: A widely used Node.js inter-process-communication library, around 822,000 weekly downloads. In May 2026 its maintainer account was taken over after the domain behind its recovery email, atlantis-software.net, was allowed to lapse and re-registered by an attacker for the price of a registration; a credential stealer then shipped to every installer.

Novell: The software company that acquired AT&T's Unix System Laboratories, and with it the UNIX trademark, in 1993, before passing the mark to X/Open the same year. One link in the chain of custody that ends at The Open Group.

npm: Node Package Manager. The default registry and CLI for JavaScript packages. Manages dependency trees in node_modules.

non-blocking I/O: An I/O model in which one thread issues many operations and is notified as each completes, rather than waiting on each in turn, so a single process can hold thousands of idle connections. The model at the heart of Node.js, and of Go and Rust async runtimes alike.

Node.js: A JavaScript runtime built on Chrome's V8 engine, released by Ryan Dahl in 2009, that runs JavaScript outside the browser on a single-threaded event loop. npm shipped as its package manager, and the two grew together.

O

Open Software Foundation: An industry consortium founded in 1988 to develop an open Unix standard, which merged with X/Open in 1996 to form The Open Group. One of the two bodies whose union produced the present keeper of the UNIX mark.

Organic Reach: The percentage of a page's followers who see a post without paid promotion. Facebook organic reach for business pages fell from 16% in 2012 to 1.37% in 2024, the canonical example of platform enshittification.

OKLCH: A perceptually uniform colour space using Lightness, Chroma, and Hue. Produces consistent perceived brightness across all hues, unlike HSL.

OOCSS: Object-Oriented CSS. A methodology that separates structure from skin and container from content, promoting reusable CSS classes.

OmniOS: A minimalist, server-focused illumos distribution (OmniOS Community Edition) with a stable, predictable release cadence.

Open Source AI Definition: The Open Source Initiative's 2024 standard (OSAID 1.0, 28 October 2024) for what may be called open source AI: the system must provide the training and inference code, the parameters, and data information detailed enough that a skilled person could build a substantially equivalent system. A model that ships only its weights does not qualify.

open weights: A model released as its trained parameters plus a licence, downloadable and runnable on your own hardware, but without the training data, training code or compute needed to reconstruct it. Available and tunable, yet not reproducible; open weights are not the same as open source.

OpenBSD: A security-focused open-source Unix operating system. Produced OpenSSH, LibreSSL, OpenBGPD, and the pledge()/unveil() system calls. Known for code audits and minimal defaults.

openwashing: Presenting an AI system as open when it withholds what openness was meant to guarantee. Coined in a 2024 Nature paper by Widder, Whittaker and West, which argued that models offering little beyond downloadable weights under restrictive terms are better understood as closed, and that the rhetoric often concentrates power rather than loosening it.

orchestrator: A control system, such as Kubernetes, that schedules containers across cores and machines, health-checks them and restarts those that fail; the supervisor a single self-scheduling binary does not need.

OpenIndiana: A community-maintained illumos distribution, the continuation in spirit of OpenSolaris; ships rolling Hipster snapshots with x86 ISO images.

OpenVPN: An open-source VPN solution using SSL/TLS for key exchange. Flexible but verbose configuration compared to WireGuard.

ORM: Object-Relational Mapping. A layer that translates between programming-language objects and relational database rows, abstracting SQL behind method calls.

osv-scanner: An open-source vulnerability scanner that reads the OSV database of advisories rather than only CVE feeds. It flagged the malicious Mastra dependency that CVE-bound tools, finding no CVE, did not.

P

pkgsrc: NetBSD's portable package-building system, carrying roughly 29,000 recipes. It does not require NetBSD underneath it, building the same software the same way on illumos, macOS and Linux, a portability that mirrors NetBSD's own.

PaaS: Platform as a Service. A managed environment where developers deploy code without managing servers, containers, or operating systems.

permissive: A licence family (BSD, MIT, Apache 2.0) that lets the receiver build on, fork, ship and relicense the code freely, keeping only attribution. The counterpart to copyleft, which carries its conditions into everything built on it.

pf: Packet Filter. The firewall in FreeBSD (and OpenBSD). Stateful, with anchors, tables, and a concise rule syntax.

PHP-FPM: FastCGI Process Manager for PHP. Manages a pool of PHP worker processes, each handling one request at a time. Typical memory: 40-128 MB per worker.

PinTheft: A 2026 Linux local-privilege-escalation vulnerability (CVE-2026-43494) that chains a reference-counting bug in the kernel's RDS sockets with io_uring to overwrite a setuid-root binary in memory and obtain a root shell.

Platform Security Processor: AMD's equivalent of the Intel Management Engine: an embedded ARM core inside the SoC running signed proprietary firmware with full system access, but without the direct network path the Intel ME carries.

POSIX: Portable Operating System Interface. A family of IEEE standards defining Unix-compatible APIs, shell behaviour, and utility conventions.

POSIX AIO: The POSIX standard's asynchronous I/O interface, an older way for a program to ask the kernel to perform input and output without blocking. On Linux it is the fourth of five accreted I/O interfaces, after select, poll and epoll and before io_uring.

PostgreSQL: An advanced open-source relational database with MVCC, JSON support, full-text search, and extensibility via custom types and functions.

Pwn2Own: A recurring computer-security contest in which researchers demonstrate working exploits against fully-patched software for cash prizes; a public benchmark of what is currently exploitable. CVE-2020-8835, an eBPF verifier flaw, won there in 2020.

postinstall: An npm lifecycle hook: a script a package declares to run automatically the moment it is installed, with the full rights of whoever ran the install. Convenient for setup, and the standard foothold for supply-chain malware.

Poudriere: The FreeBSD tool for building binary packages from ports inside clean, isolated jails, so a build process cannot reach the host that drives it.

Privilege Separation: A security architecture that splits a process into a small privileged monitor and a larger unprivileged worker. Limits damage when the worker is compromised. Pioneered by OpenSSH in 2002.

Product Liability Directive: The European Union's revised product-liability regime, Directive 2024/2853, applying from December 2026. It writes software, firmware and AI systems into the definition of a product under no-fault liability and shifts the burden of proof toward the producer in technically complex cases.

Prometheus: A time-series monitoring system with a pull-based model, PromQL query language, and built-in alerting.

procfs: The Linux /proc filesystem, a kernel interface exposed as files: writing to /proc/sys/kernel/core_pattern or /proc/sysrq-trigger changes kernel behaviour. Its writable surface is the seam the November 2025 runc break-outs escaped through, redirecting a mount into procfs.

provenance: A signed attestation recording how a software artifact was built, for example which pipeline produced it and from which source. Useful but not a trust boundary: provenance certifies the build, not that the identity permitted to publish is still in the right hands, as the Miasma attack showed.

PSE52: The realtime-controller profile of the POSIX standard (IEEE 1003.13), against which QNX holds a formal certification. Issued by the same bodies that keep the UNIX register, only against a different standard, which is how QNX claims genuine POSIX certification without being certified UNIX.

PureDarwin: A community project that assembles Apple's open-source Darwin into a bootable operating system independent of macOS; current builds run as a virtual-machine image.

PyCon: The annual Python community conference. Held in multiple countries, featuring talks, sprints, and community gatherings.

Q

Quantum Software Systems: The Canadian company, founded near Ottawa, that began building QNX in 1982. The origin of one of the most widely deployed operating systems almost nobody can name.

R

RAII: Resource Acquisition Is Initialisation. A pattern where resources are tied to object lifetimes: acquired in the constructor, released in the destructor. Rust enforces this through ownership. No garbage collector needed.

Red Hat Enterprise Linux: A commercially supported Linux distribution from Red Hat (RHEL), aimed at enterprise deployments with long support cycles and certified hardware. Like every distribution, an assembly of independently-governed projects selected, patched and integrated by the vendor rather than a single tree.

Redis: An in-memory data structure store used as database, cache, and message broker. Single-threaded, sub-millisecond latency.

Redox: A Unix-like operating system written from scratch in Rust, begun by Jeremy Soller in 2015. A microkernel with drivers and filesystems in user space; being written in Rust, whole classes of memory-safety bug are designed out. The microkernel discipline carried into the present, with no Unix blood.

regreSSHion: A remote unauthenticated code-execution flaw in the OpenSSH server (CVE-2024-6387), disclosed by Qualys in July 2024; a regression that reintroduced a previously fixed signal-handler race. Cited as a reminder that an unmaintained old system is a liability, not an heirloom.

Ring 0: The most privileged execution level of an x86 processor, where the operating-system kernel runs with full control of the machine. Code here can do anything, so it is the level every other protection depends on; running foreign code in Ring 0 is what makes the eBPF verifier load-bearing.

remote-access trojan: Malware (a RAT) that opens a covert remote-control channel to an attacker, allowing arbitrary commands, file access and data exfiltration from the infected machine. The axios npm compromise of March 2026 shipped a cross-platform one through a post-install script.

Reproducible Builds: An effort to make a build produce a bit-for-bit identical artifact from the same source, so that an independent party can rebuild a release and confirm the binary on disk matches the published source. A pillar of the responsibility line that node_modules lacks.

REST: Representational State Transfer. An architectural style for APIs using standard HTTP methods (GET, POST, PUT, DELETE) on resource URLs.

RISC-V: An open instruction-set architecture, originally from UC Berkeley, that anyone may implement without a licence fee. Its specification is open; its governing body, RISC-V International, sits in Switzerland.

RISC-V International: The non-profit foundation that governs the RISC-V specification. It moved its incorporation from the United States to Switzerland in 2020 to insulate the open ISA from any single state's trade policy.

Rolling Checksum: A hash that can be updated incrementally as a window slides across data. Enables rsync to find matching blocks in O(n) instead of O(n²). Based on Adler-32.

Rolling Release: A software distribution model where updates ship continuously rather than in discrete versions. No fixed release date, no frozen state. The system is always current, never finished.

rsync: A fast, incremental file transfer utility. Transfers only the differences between source and destination using a rolling checksum algorithm.

RTOS: A real-time operating system, one whose response time can be bounded and proven, as safety-critical and embedded work demands. QNX is the best-known POSIX RTOS; LynxOS and VxWorks are others. Determinism tends to follow from a small kernel rather than from tuning a large one.

runc: The low-level Open Container Initiative runtime that actually creates Linux containers, used beneath Docker and Kubernetes. It sets up namespaces, cgroups and mounts as instructed; the November 2025 break-outs (CVE-2025-31133, -52565, -52881) turned its valid mount handling into a write into procfs.

Rust: A systems programming language emphasising memory safety without garbage collection, using ownership and borrowing rules enforced at compile time.

registry: A central index that stores and serves software packages for a package manager. The npm registry is the largest, free to publish to and free to install from; anyone can add a package, and that openness, with no responsibility line drawn between callers and what they pull in, is both its reach and its central security problem.

S

SaaS: Software as a Service. Renting access to software hosted by the vendor, paid via recurring subscription rather than a perpetual licence.

Sass: A CSS preprocessor adding variables, nesting, and mixins. Largely obsoleted by native CSS custom properties, nesting, and @layer.

Scrum: An agile framework using fixed-length Sprints, daily stand-ups, and defined roles (Product Owner, Scrum Master, Development Team).

seccomp: Secure Computing mode. A Linux kernel facility that restricts which system calls a process may invoke. Strict mode (2005) permits four calls. seccomp-bpf (2012) allows programmable filters via BPF programmes.

sed: A non-interactive stream editor from Bell Labs, written by Lee McMahon in 1974. One of the small Unix tools that composes through pipes rather than by stacking layers, and small enough to have been finished rather than merely versioned.

SemVer: Semantic Versioning. A versioning scheme using MAJOR.MINOR.PATCH where major means breaking changes, minor means new features, patch means bug fixes. The contract is voluntary and routinely violated.

server-side rendering: Generating a page's HTML on the server and sending it to the browser ready to display, rather than shipping JavaScript that builds the page on the client. The default of the web before the SPA era, and the model the lean alternatives return to.

Serverless: A cloud execution model where the provider allocates resources per request. You write functions, the vendor manages infrastructure.

SiFive: A US company that designs and licenses RISC-V processor cores, one of the earliest commercial RISC-V vendors.

signify: OpenBSD's signature tool, written by Ted Unangst in 2014, using Ed25519. It signs releases and packages; pkg_add verifies each file against its recorded checksum immediately after extraction, before doing anything with it.

Single UNIX Specification: The written standard a system must conform to in order to be certified UNIX, maintained by The Open Group and aligned with POSIX; its current edition, Issue 8, aligns with POSIX.1-2024. It certifies the interface (the C library, the shell, the standard utilities), not the kernel beneath.

SiPearl: A French company building high-performance server processors for the European Processor Initiative. Its Rhea1, taped out in 2025 as the most complex chip designed in Europe, is built on licensed ARM Neoverse cores and fabricated in Taiwan.

SLSA: Supply-chain Levels for Software Artifacts, a framework of provenance and integrity guarantees for build pipelines (pronounced salsa). It raises the bar for tampering, but, as Miasma showed, a valid SLSA attestation certifies the pipeline that built an artifact, not that its publishing identity is uncompromised.

SmartOS: An illumos distribution for cloud virtualisation, combining zones with a hypervisor, originally from Joyent.

SMIC: Semiconductor Manufacturing International Corporation, China's largest chip foundry. It has produced 5nm-class parts (the Huawei Kirin 9030) using deep-ultraviolet multi-patterning, without the extreme-ultraviolet tools restricted to it.

Socket: A behavioural supply-chain security tool that inspects package code for risky behaviour (network calls, file-system and shell access, install scripts) rather than waiting for a published advisory. It caught the node-ipc compromise, but is itself installed through npm into the environment it audits.

SoftBank: The Japanese holding company that has owned ARM since 2016. NVIDIA's attempt to buy ARM from SoftBank in 2020-2022 was blocked by regulators; ARM listed publicly in 2023 but remains majority SoftBank-owned.

SPA: Single-Page Application. A web app that loads one HTML document and rewrites it dynamically via JavaScript, avoiding full page reloads.

Specificity: The algorithm browsers use to determine which CSS rule wins when multiple rules target the same element. Based on selector weight: ID > class > element.

SQLite: A self-contained SQL database engine stored in a single file. No server process. Handles terabytes with zero configuration.

SSH: Secure Shell. A cryptographic protocol for secure remote login, command execution, and tunnelling over untrusted networks.

SSR: Server-Side Rendering. Generating the full HTML of a page on the server before sending it to the browser, as opposed to client-side rendering.

Steam Deck: Valve's handheld games console (2022), running the Linux-based SteamOS. The Linux counterweight in a console market otherwise dominated by FreeBSD-derived systems from Sony and Nintendo.

Stimulus: The small JavaScript framework in Hotwire (37signals) for the islands of a page that genuinely need client-side behaviour. Controllers attach to HTML via data attributes; deliberately modest, meant to complement server-rendered HTML, not replace it.

Stormshield: A French network-security vendor whose appliances run on FreeBSD. One of the security-appliance tier, alongside pfSense and OPNsense, that quietly runs BSD in the gap between the public internet and the office.

strict liability: Liability imposed without proof of fault or negligence: the claimant need only show the product was defective and caused harm. California's AB 316 pointedly does not create it; the EU Product Liability Directive applies a no-fault regime to products with digital elements.

supply chain: In software, the full chain of third-party code, registries, maintainer accounts and build steps a project depends on. A supply-chain attack compromises one of those links to reach everyone downstream.

SUSE: A German-founded Linux vendor and its enterprise distribution (SUSE Linux Enterprise, openSUSE). One of the long-established distributions that select, patch and integrate upstream components into a coherent system: an assembly process, not a single tree.

System V: The commercial Unix line developed by AT&T from 1983, ancestor of the certified commercial Unixes AIX and HP-UX. One of the two great branches of the Unix genealogy, alongside BSD.

systemd: The init system and service manager in most Linux distributions. Manages processes, logging, networking, and device events. Controversial for its scope.

single-threaded: Running on one thread, and therefore one core, at a time; the design Node.js chose in 2009 for safety, no shared-memory threads and no locks, at the cost of not using a multi-core machine on its own.

seed round: The earliest formal round of outside investment in a start-up, meant to get an idea off the ground before a Series A. npm, Inc. raised a 2.6-million-dollar seed round led by True Ventures in February 2014.

Series A: The first substantial priced round of venture funding a start-up raises after seed capital, usually to scale a model that is already working. npm, Inc. raised an eight-million-dollar Series A in April 2015.

T

tape-out: The point at which a finished chip design is sent to a foundry for manufacture; the milestone SiPearl's Rhea1 reached in 2025.

TCP/IP: The core networking protocols of the internet, whose reference implementation Berkeley shipped in 4.2BSD in 1983; every modern operating system on the internet uses what Berkeley wrote.

Terraform: An infrastructure-as-code tool by HashiCorp. Declares cloud resources in HCL files and manages their lifecycle.

Tokio: An asynchronous runtime for Rust that drives non-blocking I/O and schedules tasks across all cores from a single binary, without an external process supervisor.

Time to Interactive: A web-performance metric measuring how long until a page can reliably respond to user input. A page heavy with client-side JavaScript can render and yet stay unresponsive; reducing the script is the most direct way to improve it.

TLS: Transport Layer Security. The cryptographic protocol securing HTTPS, email, and other network traffic. Successor to SSL.

tmux: A terminal multiplexer. Runs multiple shell sessions in one terminal, supports detaching and reattaching, split panes, and session persistence.

TOP500: The twice-yearly ranking of the world's five hundred fastest supercomputers, published since 1993. Every machine on the list has run Linux since November 2017, when the last two non-Linux systems dropped off it; a plain measure of how far the kernel reaches at the largest scale.

transitive closure: The full set of dependencies a project pulls in: not only the packages you declared, but everything they depend on, recursively. A package.json of 30 to 50 entries routinely resolves to a transitive closure of well over a thousand packages.

TSMC: Taiwan Semiconductor Manufacturing Company, the world's largest contract chip foundry and the dominant maker of leading-edge silicon, including Europe's SiPearl Rhea1.

Turbo: The navigation half of Hotwire (37signals): it intercepts link clicks and form submissions, fetches the new HTML over the wire, and swaps it into the page without a full reload. No client-side router, no virtual DOM.

TypeScript: A typed superset of JavaScript that compiles to plain JS. Adds static type checking at build time.

typosquat: A malicious package given a name deliberately close to a popular one, so that a typo, an autocomplete or an injected dependency line pulls in the impostor instead of the real library. easy-day-js was a typosquat of dayjs.

transitive dependency: A package a project does not depend on directly, pulled in because something it depends on depends on it. A modern install resolves a whole tree of them, so most of what lands in node_modules was never chosen by name.

True Ventures: An early-stage venture capital firm based in San Francisco. Led npm, Inc.'s USD 2.6 million seed round in February 2014.

U

UEFI: Unified Extensible Firmware Interface, the modern replacement for the BIOS: the system firmware that initialises hardware and hands control to the operating-system bootloader. Some hardware admits open alternatives such as coreboot; much does not.

Ultrix: DEC's Unix flavour for its own hardware, one of the proprietary workstation Unixes of the 1980s Unix wars.

UNIX: The registered trademark, held by The Open Group, for operating systems certified against the Single UNIX Specification. Written in capitals it denotes the mark; written Unix it denotes the wider family. Not a roof over that family but a certification mark, kept deliberately narrow: it sits only on tested, fee-paying products, and the holder disowns loose use of the word.

Unix Philosophy: Design principles favouring small, composable programs that do one thing well, connected via text streams.

Unix System Laboratories: AT&T's subsidiary, spun out in 1991, that held the UNIX trademark and the System V source before both passed to Novell in 1993. The first owner in the trademark's chain of custody.

UNIX System Services: The certified-UNIX component of IBM's z/OS: a POSIX environment layered on top of the mainframe MVS kernel. The part of z/OS that holds the certificate, proof that a system can speak Unix at the surface while being a mainframe all the way down.

UNIX V7: The stricter brand level of the UNIX certification, corresponding to the Single UNIX Specification version 4 (POSIX.1-2008). IBM's AIX 7 is the only product on the register certified at this level; macOS sits one rung lower, at UNIX 03.

Unix wars: The 1980s period in which DEC, IBM, HP, Sun, SGI, NeXT and others each shipped an incompatible proprietary Unix flavour for their own hardware; the fragmentation POSIX was created to bridge.

unixoid: A Unix-like system: one that rebuilt the Unix design from resemblance without inheriting a line of Bell Labs or Berkeley code. Linux is the most widely deployed unixoid, QNX another. A unixoid resembles Unix without being Unix by descent.

userland: Everything that runs outside the kernel: the C library, the shell, the standard utilities and the applications. On Linux the userland is supplied separately from the kernel (GNU, musl, Bionic, BusyBox); in a BSD base system it is maintained in the same source tree as the kernel.

V

Version 6: Unix Version 6 (V6), released by Bell Labs in 1975, the first version to spread widely outside the Labs and the subject of Lions' line-by-line Commentary.

virtual DOM: An in-memory representation of the page that a framework such as React diffs against the real DOM to decide what to update. A core mechanism of single-page-application frameworks, and one that hypermedia approaches like HTMX deliberately do without.

verifier: In eBPF, the static analyser that inspects a loaded program's bytecode before it runs and tries to prove it cannot access kernel memory unsafely: the single gate between foreign code and Ring 0, and a recurring source of privilege-escalation bugs, since a flaw in the proof engine is a hole in the kernel.

Vite: A frontend build tool using native ES Modules for instant dev server startup and Rollup for production builds. Replaces Webpack.

VNET: Virtual Network Stack in FreeBSD. Gives each jail its own interfaces, routing table, and firewall rules. Kernel-native network isolation without overlay networks.

W

wabi-sabi: A Japanese aesthetic that finds beauty in the imperfect, the impermanent and the worn, described for Western readers by Leonard Koren in 1994. In engineering terms, the honoured wear of a coherent maintained thing, distinct from the unmanaged decay of one no one owns.

wavetable synthesis: A sound-synthesis technique that builds audio by reading through waveforms rather than replaying recorded samples. In size-constrained demos the waveforms are themselves produced in code, so no audio files are needed.

WebAssembly: A binary instruction format for a stack-based virtual machine. Runs near-native speed in browsers alongside JavaScript.

Webpack: A JavaScript module bundler that resolves dependency graphs and outputs optimised bundles. Largely replaced by Vite and native ES Modules.

WebSocket: A persistent, full-duplex communication channel over a single TCP connection, enabling real-time data exchange between browser and server.

WireGuard: A modern VPN protocol using state-of-the-art cryptography. One C file, ~4,000 lines, replaces IPsec and OpenVPN.

X

X/Open: The industry consortium that received the UNIX trademark from Novell in 1993 and merged with the Open Software Foundation in 1996 to form The Open Group. Custodian of the mark in the years between AT&T and the present.

XDP: eXpress Data Path: an eBPF hook that processes network packets at the earliest point in the Linux networking stack, close to the driver, for very high throughput. One of the capabilities that makes eBPF genuinely useful, alongside Cilium's networking.

x86: The dominant desktop and server processor architecture, designed by Intel and also built by AMD under licence, held behind a patent thicket dense enough that the practical number of vendors is two.

XuanTie: Alibaba's T-Head line of RISC-V processors; its C930, announced in 2025, is a RISC-V server CPU for AI and high-performance workloads.

Z

ZFS: Zettabyte File System. A combined filesystem and volume manager with checksumming, snapshots, clones, and built-in RAID.

Zscaler: A cloud-security company whose service edge has run on FreeBSD. Part of the FreeBSD security-appliance tier that handles a large share of corporate traffic between the public internet and the office.

buildworld: The make target that compiles the entire FreeBSD userland, the C library and the system tools from the single source tree, before make installworld puts them in place. With make buildkernel it rebuilds the base as one whole.

Fedora: A community Linux distribution sponsored by Red Hat, run as the upstream proving ground for Red Hat Enterprise Linux. One of the two best-known Red Hat-based systems.

man hier: A FreeBSD manual page documenting the layout of the filesystem: where the kernel and C library live, and where locally added software is kept apart from the base. It ships in the base system, so it describes the very tree it is part of.

NixOS: A Linux distribution built on the Nix package manager, in which the whole machine's configuration is written declaratively into one functional expression and built reproducibly. One of the newer distributions that rethink how a system is assembled.

ports: FreeBSD's collection of third-party software, kept deliberately apart from the base system. Each port is a recipe to build and install an application, so the line between the system and what you added to it stays clear; 37,958 as of the Q1 2026 status report.

Red Hat: An American open-source software company, now part of IBM, whose packaging and system conventions define one of the major Linux families. Red Hat-based systems include Fedora and Red Hat Enterprise Linux.

RHEL: Red Hat Enterprise Linux, the commercial, long-support Linux distribution from Red Hat. With Fedora, one of the two best-known members of the Red Hat family.

Silverblue: Fedora Silverblue, an immutable, image-based variant of Fedora in which the operating system is delivered as a versioned, read-only image and updated atomically. One of the newer takes on how a Linux system is shipped.

Ubuntu: A widely used Debian-based Linux distribution released by Canonical since 2004. The best known of Debian's many relations, and a common first encounter with the Debian way of arranging a system.

People

A

Jens Axboe: Linux kernel engineer, maintainer of the block layer and author of io_uring (merged in Linux 5.1, 2019) and the fio benchmark tool.

Jonathan Lemon: FreeBSD developer who designed and wrote kqueue, the unified event-notification interface shipped in FreeBSD 4.1 in 2000 and later adopted by macOS and the other BSDs.

Jonathan Anderson: Computer scientist, co-creator of Capsicum with Robert Watson. Their 2010 USENIX Security paper introduced capability-based sandboxing to FreeBSD. Now at Memorial University of Newfoundland.

Andrea Arcangeli: Linux kernel developer. Created the original seccomp strict mode in 2005 (Linux 2.6.12), permitting only four syscalls. Also known for work on KVM and Transparent Huge Pages.

B

Lisanne Bainbridge: British cognitive psychologist. Her 1983 paper “Ironies of Automation” showed that automating most of a task leaves the operator the parts that cannot be automated and the duty to take over when it fails, just when their skills have decayed for want of practice.

Kent Beck: Creator of Extreme Programming and co-inventor of story points with Ron Jeffries. Wrote the SUnit testing framework that became JUnit. Advocate of simplicity in software design.

Fabrice Bellard: French computer scientist. Created FFmpeg, QEMU, TinyCC, JSLinux, and Bellard's formula. Computed 2.7 trillion digits of pi on a desktop PC. Builds fundamental tools, then moves on.

Jeff Bonwick: Engineer at Sun Microsystems who designed the Slab Allocator and co-created ZFS with Matthew Ahrens. Built the filesystem that trusts mathematics over hardware.

D

Edsger Dijkstra: Dutch computer scientist (1930-2002). Described the THE multiprogramming system in 1968 as a strict hierarchy of levels, an early discipline of layering to contain complexity, and shaped structured programming, the shortest-path algorithm and much of the field's early rigour.

Cory Doctorow: Canadian-British author, journalist, and digital rights activist. Coined 'enshittification' in November 2022. Published on Pluralistic. Won Word of the Year 2023. Author of Little Brother, Walkaway, and the 2025 book Enshittification.

Stephen Dolan: Creator of jq (2012). PhD in Algebraic Subtyping at the University of Cambridge, supervised by Alan Mycroft. Now at Jane Street, working on the OCaml compiler. Wrote a functional language for JSON in 510 KB of C.

Will Drewry: Google engineer who introduced seccomp-bpf in Linux 3.5 (2012). Extended seccomp from a binary four-syscall mode to programmable BPF-based filtering, enabling practical process sandboxing on Linux.

Dubmood: Swedish chiptune musician and demoscene legend. Two decades of tracker music across Amiga, C64, and PC platforms. Composed the soundtrack for Razor 1911's 'The Scene Is Dead' (2012).

F

Rich Felker: Author of musl libc, a clean-room lightweight C standard library for Linux. Vocal advocate for POSIX correctness and minimal PID 1 design.

Michael Färber: Computer scientist. Published the first formal specification of the jq language in 2024 (arXiv:2403.20132), twelve years after Dolan wrote the implementation. Also wrote jaq, a Rust reimplementation of jq that is 5-10x faster.

Martin Fowler: Software author and Chief Scientist at ThoughtWorks. Coined 'Microservices' with James Lewis. Wrote Refactoring, Patterns of Enterprise Application Architecture, and the 'Monolith First' essay.

Nat Friedman: American technology executive who was GitHub's CEO from 2018 to 2021, following Microsoft's acquisition. Announced GitHub's purchase of the npm registry in March 2020, with the promise that the public registry would remain free.

H

David Heinemeier Hansson: Creator of Ruby on Rails. Co-founder of Basecamp and HEY. Now advocates software ownership over SaaS subscriptions with ONCE.

Rich Harris: Creator of Svelte and Rollup. Former graphics editor at The New York Times. Demonstrated that the Virtual DOM is 'pure overhead'.

J

Ron Jeffries: Co-creator of Extreme Programming. Agile Manifesto signatory. In 2018, wrote 'Developers Should Abandon Agile' — a rare recantation from an original author.

K

Poul-Henning Kamp: Danish FreeBSD developer. Created Jails (1999), the GEOM storage framework, and Varnish Cache. Known for phk's bikeshed argument and decades of kernel-level systems work.

Phil Karlton: Netscape and Silicon Graphics engineer (1947-1997), credited with the line that there are only two hard things in computer science: cache invalidation and naming things. The quip was first recorded publicly on Tim Bray's site.

Greg Kroah-Hartman: Senior Linux kernel maintainer responsible for stable releases. In 2024, removed Russian-affiliated maintainers from the MAINTAINERS file on compliance grounds.

L

James Lewis: Software architect at ThoughtWorks. Co-coined the term 'Microservices' with Martin Fowler in their 2014 article defining the architectural style.

M

Alan Mycroft: Professor of Computing at the University of Cambridge. Supervised Stephen Dolan's PhD in Algebraic Subtyping. Co-designed the Nanopass framework and contributed to static analysis research spanning four decades.

P

David Parnas: Canadian software engineer who, in a 1972 paper on decomposing systems into modules, coined the term information hiding: a module should hide a design decision that is likely to change. One of the foundational ideas of modular software design.

Lennart Poettering: Creator of systemd and PulseAudio. His replacement of SysVinit with a monolithic init system remains one of the most divisive decisions in Linux history.

R

Theo de Raadt: Founder and leader of the OpenBSD project. Forked OpenSSH in 1999. Three decades of security-first development, auditing every line, removing attack surface instead of adding features.

S

Salvatore Sanfilippo: Sicilian developer known as antirez. Created Redis in 2009, a single-threaded in-memory data structure server. Maintained it personally for fifteen years.

Isaac Schlueter: The American software engineer who created npm in 2010 and, in 2014, co-founded npm, Inc. with Laurie Voss to run the registry. An early and prominent contributor to the Node.js project.

Ken Schwaber: Co-creator of Scrum with Jeff Sutherland. Founded the Scrum Alliance, later Scrum.org. Admitted that 75 per cent of organisations using Scrum will not succeed.

T

Dave Thomas: Agile Manifesto signatory. Co-author of The Pragmatic Programmer. Declared 'Agile is Dead' in 2014, arguing the word had been hijacked by consultancies.

Ken Thompson: Co-creator of Unix (1969), the B programming language, and the first cron (1975) at Bell Labs. Co-designed UTF-8 and Plan 9. Turing Award winner (1983) with Dennis Ritchie.

Linus Torvalds: Creator and principal developer of the Linux kernel. Also wrote Git. Maintains kernel development from Portland, Oregon.

Andrew Tridgell: Australian computer scientist. Created rsync (1996), Samba (Windows file sharing on Unix), ccache, and co-developed Git's delta compression with Linus Torvalds.

V

Paul Vixie: Author of Vixie cron (1987), BIND (the DNS server running a third of the internet), and numerous RFCs. Internet Hall of Fame inductee (2014). The five-field crontab syntax is his.

Laurie Voss: Co-founder of npm, Inc. with Isaac Schlueter in 2014, and long the company's data and operations lead, building a business around the npm registry.

W

RLHF: Reinforcement learning from human feedback, the training stage that shapes a raw predictive model into one that answers helpfully and refuses sensibly. It is much of a model's character, and one of the layers most often withheld even when the weights are released.

Robert Watson: Computer scientist at the University of Cambridge. Co-created Capsicum with Jonathan Anderson (2010, Best Student Paper at USENIX Security). Also contributed to FreeBSD's MAC framework and TrustedBSD.

Y

Greg Young: Popularised Event Sourcing and CQRS as architectural patterns. Author of Versioning in an Event Sourced System.