Dictionary

Name: Integrated by Design
ISBN: 978-3-9828652-0-1

Short, precise definitions of IT terms and people referenced across this site. Hover any highlighted term in a blog article to see its definition. Click to jump here.

Terms

64K intro: A demoscene production whose entire compiled program must fit within 65,536 bytes (64 KB). Everything the viewer sees and hears is generated from that code at runtime, since there is no room to store textures, models or audio.

4K intro: A demoscene production limited to 4,096 bytes in total. Everything visible and audible is computed by the program itself.

A

AB 316: A 2025 California statute, signed in October 2025 and in force from January 2026, barring a defendant who developed, modified or used an artificial-intelligence system from arguing that the system autonomously caused the harm. It removes the machine-did-it defence without creating strict liability.

ABI: Application Binary Interface. The low-level contract between a binary and the operating system: syscall numbers, calling conventions, data layout. Determines which binaries run on which kernel.

ACID: Atomicity, Consistency, Isolation, Durability. The four guarantees a database transaction must provide for reliability.

ACME: Automatic Certificate Management Environment. The protocol Let's Encrypt uses to issue and renew TLS certificates without manual intervention.

advertising clause: The third condition of the original four-clause BSD licence, requiring that advertising materials acknowledge the University of California. Berkeley struck it on 22 July 1999 because the acknowledgements had become unmanageable as BSD code spread.

AGPL: Affero General Public Licence. A copyleft licence that closes the GPL's network gap: if users interact with the software over a network, they must be offered its source. Written for server-side software the GPL's distribution trigger never reached.

AI bill of materials: A proposed provenance record, an AI-SBOM, that tags each generated component with the model that produced it, along with the prompt and generation metadata, so a line can later be traced to its origin. An emerging practice rather than a settled standard.

Alpine: A small, security-oriented Linux distribution built on musl and BusyBox rather than glibc and GNU coreutils. Widely used as a minimal container base image. One of the userlands that share the Linux kernel and little else.

Alpine.js: A lightweight JavaScript framework, around ten kilobytes, for adding client-side behaviour directly in HTML attributes. A smaller, declarative alternative to the large single-page-application frameworks.

amalgamation: The single C source file, together with one header, into which the whole of SQLite is concatenated for distribution. It compiles as one translation unit, which lets the compiler optimise across what would otherwise be file boundaries, and it means the library arrives as one artefact with one provenance rather than as a tree of sources to be assembled by whoever builds it.

Amiga: Commodore's 16-bit machine of 1985, with custom chips for graphics and sound that made smooth scrolling and multi-channel music routine. The platform on which the demoscene came of age.

Andrew Tanenbaum: The computer scientist who wrote MINIX in 1987 as a teaching operating system, and Linus Torvalds' opponent in the well-known 1992 debate over microkernel versus monolithic kernel design.

Andromeda Software Development: Greek demogroup, founded in the early 1990s, whose demo LifeForce won the combined demo competition at Assembly 2007.

Ansible: An agentless automation tool for configuration management, application deployment, and orchestration. Uses YAML playbooks over SSH.

Anthropic: American AI company. In June 2026 it complied with a US Commerce Department directive to suspend its two most capable models for all foreign nationals, three days after launch, withdrawing them from every customer. Cited as evidence that the institutional lever reaches proprietary, paid software as readily as open source.

Apache 2.0: A permissive open-source licence with a patent grant and no copyleft, granting broad rights to use, modify and distribute. Applied to a model's weights, as with Mistral's 2026 flagships, it removes licence restrictions but still grants only the numbers, not the training data or pipeline.

apEx: The demotool built by the Hungarian group Conspiracy, developed between the summer of 2010 and the spring of 2021 and used for eight of their productions between 2014 and 2023. Its source was published in November 2023 under a Creative Commons non-commercial licence, with the stated intent that others could learn from it.

apk: The package manager of Alpine Linux: small, fast and built for the distribution's musl and BusyBox userland.

AppArmor: A mandatory access control system for Linux that confines programs by path-based profiles, generally regarded as simpler to configure than SELinux and correspondingly less granular.

AppImage: A Linux application format that bundles a program and its dependencies into a single executable file, which is why it runs on any distribution and why its bundled libraries are only ever updated when the author rebuilds it.

ARC: The Adaptive Replacement Cache, ZFS's page cache. It replaces the least-recently-used algorithm most filesystems use with one weighing both recency and frequency, and it returns memory to applications on demand.

Arch: A rolling-release Linux distribution following a minimalist, do-it-yourself philosophy. Ships current packages continuously rather than in fixed versions, leaving system composition to the user. Like every distribution, an assembly of independently-governed projects rather than a single tree.

architecture sniffer: A rule engine that checks whether code respects the intended layering and module boundaries of a framework. Necessary wherever the architecture is a convention that the framework itself cannot enforce.

ARM: A processor instruction-set architecture designed in Cambridge and licensed, core by core, to chip makers worldwide; the most widely deployed ISA on Earth, owned since 2016 by Japan's SoftBank.

ash: The Almquist shell, a compact POSIX shell of BSD origin; BusyBox ships a variant of it as /bin/sh on Alpine and most minimal container images.

Assembly: One of the oldest and largest demoparties in the world, held in Finland since 1992 and traditionally in Helsinki, with competitions for demos, intros, music and graphics.

async runtime: A library that drives non-blocking, event-driven tasks and schedules them across all cores inside one process, giving a language the concurrency for which a container is often used as a substitute. Tokio is the common one for Rust.

automerge: A configuration option in dependency bots such as Renovate and Dependabot that merges a pull request automatically once the required checks pass, with no human interaction at the moment of merging.

awk: A pattern-matching and text-processing language created by Alfred Aho, Peter Weinberger and Brian Kernighan at Bell Labs in 1977. The name is an acronym of the authors' surnames. The language has remained substantially unchanged for nearly fifty years and ships in every Unix-like operating system.

AWS: Amazon Web Services. The dominant cloud computing platform offering IaaS, PaaS, and managed services.

AWS Amplify: Amazon Web Services' platform for building and deploying modern front-end and full-stack applications, alongside Vercel and Netlify in the deployment-economy tier whose business depends on the heavy stack.

APM: Application performance monitoring. The layer of an observability platform that traces requests through an application, listed by Datadog at thirty-one dollars per host per month.

AsiaBSDCon: An annual conference on BSD-based operating systems, held in Tokyo. The venue for the 2024 paper benchmarking DTrace on FreeBSD against eBPF on Linux.

B

Babel: A JavaScript compiler that transforms modern or non-standard syntax into widely-supported JavaScript. A near-universal part of the standard front-end toolchain, alongside Webpack, ESLint and Jest.

Banno: A digital banking platform, part of Jack Henry, whose engineering team published a production account of using import maps for cache management, reporting that unchanged parent files keep their hashes and their cached copies while the map points them at new children.

Base System: In FreeBSD and the other BSDs, the kernel, C library, userland utilities, documentation, toolchain and release-engineering process maintained together in one source tree by one project and shipped as one tested snapshot. Contrasts with a Linux distribution, which assembles several hundred independently-governed projects. Base means what is shipped together; system means integrated whole.

base image: The distribution layer a container is built on top of, such as Debian or Alpine, carrying a userland, package manager and its own attack surface into every image derived from it.

Bash: The GNU Bourne-again shell, the default interactive shell on most Linux distributions. Its conveniences, arrays, process substitution, double brackets, go beyond POSIX sh and fail on stricter shells.

BBR: Bottleneck Bandwidth and Round-trip propagation time, a congestion control algorithm that models the path rather than reacting to packet loss. Developed at Google and available in FreeBSD alongside RACK.

Berkeley: The University of California, Berkeley, and in particular its Computer Systems Research Group, where the Berkeley Software Distribution was developed from the late 1970s. The second wellspring of Unix after Bell Labs; the BSD family carries Berkeley's code to this day.

Berkeley Software Design: Berkeley Software Design Inc. (BSDi), the commercial spinoff that sold a Net/2-based product from 1992 and was sued by AT&T's Unix System Laboratories in USL v. BSDi.

Berkeley Software Distribution: The line of Unix begun in 1977 by Berkeley's Computer Systems Research Group as modifications to AT&T Unix; over fifteen years it became a fully alternative line, 1BSD through 4.4BSD, and the root of today's FreeBSD, NetBSD, OpenBSD and DragonFly.

Big Sleep: A vulnerability-research agent built jointly by Google Project Zero and Google DeepMind, which reads source code and reasons about it rather than mutating inputs. In October 2024 it found a stack buffer underflow in a development build of SQLite, in a function where a sentinel value of minus one reaches a field the surrounding code assumes will be positive. Google's own team had already spent 150 CPU-hours fuzzing the same code without result; SQLite fixed the fault the same day and no release ever carried it.

Bionic: Android's C library and low-level runtime, used in place of glibc. One of several userlands that share the Linux kernel and little else, alongside GNU, musl and BusyBox.

BIOS: The traditional system firmware that initialised a PC at power-on before handing control to the operating system; today largely replaced by UEFI.

Blink: The browser engine of Chrome, Edge and Chromium-based browsers, forked from WebKit in 2013. Through WebKit it descends from KDE's KHTML, which makes the major system web views relatives rather than unrelated implementations.

boot environment: A bootable snapshot of an entire operating system. On FreeBSD bectl creates one before an upgrade, so a failed upgrade is undone by selecting the previous entry at the boot menu.

BPF: Berkeley Packet Filter. Originally a packet capture mechanism, extended in Linux as eBPF for programmable kernel-level filtering. Used by seccomp-bpf to inspect and decide on every syscall at runtime.

branch coverage: A test-coverage measure asking whether each conditional in the code has taken both its outcomes at least once during testing. It is stricter than line coverage, which only asks whether a line ran at all, and considerably weaker than MC/DC, which additionally asks whether each individual condition inside a compound decision could be shown to matter on its own.

branch protection: The per-branch rule set governing what a pull request must satisfy before it may be merged: required status checks, required approvals, linear history. It holds the switches that decide whether an approval means anything.

Brotli: A lossless compression format published by Google in 2013 and supported by every current browser over HTTPS. It typically beats gzip by ten to twenty per cent on JavaScript and HTML, which is why library sizes are quoted after Brotli rather than raw.

BSD: Berkeley Software Distribution. The line of Unix developed at the University of California, Berkeley from the late 1970s, and the family that descends from it today (FreeBSD, OpenBSD, NetBSD, DragonFly). Unix by inheritance, carrying the AT&T-and-Berkeley code in its source under a permissive licence.

BSDi: Berkeley Software Design Inc., the commercial spinoff that from 1992 sold a product based on Berkeley's Net/2; defendant in the USL v. BSDi lawsuit that ran 1992 to 1994.

bsdinstall: The FreeBSD system installer. Its hardening menu offers nine security switches at install time, none of them enabled by default, each landing in a readable configuration file.

build.rs: A Rust build script: arbitrary code a crate runs at build time, with full filesystem and network access under the developer's permissions. The reason Rust is not exempt from install-time code execution.

Bun: An all-in-one JavaScript runtime, bundler, transpiler, and package manager. Written in Zig, designed for speed.

Business Source Licence: A source-available licence that permits use for purposes the licensor names and forbids the rest, typically competing commercial hosting, with a clause converting the work to an open licence after a set period. Not approved by the Open Source Initiative.

BusyBox: A single small executable combining stripped-down versions of many standard Unix utilities, common on embedded Linux systems. Another userland that shares the Linux kernel with GNU, musl and Bionic.

blast radius: Everything an attacker reaches once a single component is compromised. In npm there is no privilege boundary between your code and its dependencies: a package's install script runs with your full user rights, so one compromised maintainer's blast radius is your shell, your environment, your SSH keys and your cloud tokens.

build step: The compile-and-bundle stage between source code and the artefact a web server ships: transpiling, bundling, minification, sourcemaps. No longer required by the platform itself, since browsers run ES modules natively; kept alive by tooling defaults and metered CI minutes.

bundler: A tool that combines many JavaScript source files, and often CSS and assets, into fewer optimised files for delivery. Rational under HTTP/1.1 and before native modules; the lineage runs Grunt, Gulp, webpack, Rollup, Parcel, esbuild, Vite, Turbopack, Rolldown.

build runner: The machine or container that executes a continuous integration job. Its memory holds the credentials the job needs, which is what the spring 2026 campaign lifted through an abused pull-request trigger.

Bitbendaz: A Swedish demogroup whose members include Stalvik, java, Comatron, Mygg, Dyrgrip, Optic and Leinonen. Their demo Laevitas won Best Soundtrack at the Meteoriks 2021.

breakbeat: An electronic music style built on syncopated, chopped drum loops rather than a straight four-to-the-floor beat. One of the tags Demozoo applies to Laevitas.

Berkeley Packet Filter: A small virtual machine in the kernel, published in 1992 by Steven McCanne and Van Jacobson, that decides which network packets are passed upward. Extended in 2014 into eBPF, which generalised it into a programmable runtime for the whole kernel.

C

cache invalidation: The problem of ensuring that a client stops using a stored copy once the original has changed. Named by Phil Karlton as one of the two hard things in computer science, it does not disappear when a build step does; it moves to whoever owns the names of the files being served.

Caddy: A web server with automatic HTTPS via built-in ACME client. Written in Go. Often used as a reverse proxy.

Ambient Authority: The security property where a process inherits all the permissions of the user who launched it. The default Unix model since 1969. Capsicum eliminates it; seccomp restricts it.

backporting: Applying a fix from a newer upstream version to an older, frozen one, the maintenance model of enterprise Linux distributions. Done across dozens of independently maintained trees it is structurally hard, which is why a 2024 study counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel.

blocklistd: A FreeBSD daemon that blocks abusive network clients, the successor to blacklistd. Its integration into FreeBSD's OpenSSH introduced CVE-2024-7589, an unauthenticated root race: an integrated project planting a fault in the very act of integrating a component.

Capsicum: A capability-based security framework in FreeBSD. One syscall (cap_enter) permanently removes all access to global namespaces. The process keeps only its existing file descriptors, each restricted via cap_rights_limit(). Irreversible. Compiled into FreeBSD 10.0 by default since 2014.

cargo-vet: A Rust supply-chain tool from Mozilla that requires human-reviewed audits of a crate before it is allowed into a build, so a dependency cannot enter a project unreviewed.

CAST: The templating language used by CASTD. Five delimiter pairs for variables, conditions, slots, comments, and expressions.

CDDL: Common Development and Distribution Licence. Sun Microsystems' open-source licence, intentionally incompatible with the GPL. The licence under which ZFS was released.

certification mark: A trademark that certifies a product meets a defined standard rather than identifying its commercial source. UNIX is one: it may sit only on systems tested and approved against the Single UNIX Specification. Such a mark survives in law only by staying narrow, which is why The Open Group disowns loose use of the word.

cgroups: Control groups. A Linux kernel feature for limiting, accounting for and isolating the resource usage (CPU, memory, disk I/O, network) of a collection of processes. Originally contributed by Google engineers as 'process containers' in 2006, merged in 2007 and renamed cgroups, with cgroups v2 stabilised in 2016. The other half of the Linux containerisation stack alongside namespaces.

check digit: A redundant digit computed from the other digits of an identifier and appended to it, as in an IBAN or an ISBN. A single mistyped or transposed digit breaks the computation and is rejected, which gives a class of silent error a visible shape.

Chromium: The open source browser project underlying Chrome, Edge and Electron. It ships a major version roughly every four weeks; applications that bundle it inherit the obligation to follow that cadence themselves.

Cisco: American networking company, whose engineering organisation supplied the code-review dataset behind the widely cited 200-to-400-lines-per-sitting review limit.

CNCD: Long-running demogroup, frequently releasing jointly with Fairlight; the pairing has won or placed in major competitions for two decades.

code review: The practice of a second engineer reading a change before it is merged. Its traditional value is forensic: a human mistake sits where the author's attention ran out, and the shape of it tells the reviewer where to look next.

code style: The formatting and naming conventions of a codebase. Where a language defines no canonical form, style must be enforced by a separate checker, and a project written in several notations needs one pass per notation.

Codeception: A PHP testing framework covering unit, functional and acceptance tests through one interface. The final stage of Spryker's documented pipeline.

Colima: A free, MIT-licensed container runtime for macOS and Linux that provisions a Lima virtual machine and exposes a Docker-compatible socket. One of the tool-for-tool replacements for Docker Desktop.

ColorQube: Xerox solid-ink multifunction device range, affected alongside the WorkCentre models by the 2013 JBIG2 character-substitution fault.

Commodore 64: The 8-bit home computer of 1982 that carried the first generation of the demoscene. Its fixed character set, three-voice sound chip and tight memory shaped a house style that outlived the hardware by decades.

compo: Short for competition: the judged category at a demoparty in which productions are shown to the audience and ranked, such as the combined demo compo or the 64k intro compo.

Composer: The dependency manager for PHP. Reads composer.json for declared requirements and writes composer.lock with the fully resolved set, which is usually several times larger.

Computer Systems Research Group: The group at the University of California, Berkeley (CSRG) that from 1977 produced the Berkeley Software Distribution and, before disbanding in the 1990s, the clean 4.4BSD-Lite release from which the modern BSDs descend.

CIQ: The company behind Rocky Linux and enterprise Linux support. Its engineers' 2024 white paper, Vendor Kernels, Bugs and Stability, counted 4,594 upstream-fixed bugs never back-ported into the RHEL 8.8 kernel. A partisan source with a competing product, cited for its own primary finding.

context rot: The measurable degradation of a language model's output quality as the input grows, beginning well before the context window is full. Named in a 2025 Chroma technical report covering eighteen models.

coordination rent: The charge that appears once a program has been split into parts that cannot see each other: shared cache handlers, matching encryption keys across a fleet, and rollout protection between old clients and new servers. The features themselves run without any of it; the agreement between the parts does not, and that agreement is what the hosting platform sells.

Copyleft: A licensing strategy that grants the freedoms to use, study, modify and share on the condition that derivative works carry the same terms. The licence travels with every line into any fork and remains there in perpetuity. The GPL is the canonical example; permissive licences such as BSD impose no such condition.

coreboot: An open-source replacement for the proprietary system firmware (BIOS or UEFI) of a machine, available on some hardware classes; one of the few sub-OS layers that admits an open alternative.

coreutils: The GNU implementation of the basic file, shell and text utilities (ls, cp, cat and the rest) shipped by most Linux distributions. One component among the several hundred a distribution maintainer selects and integrates around the kernel.

CI/CD: Continuous Integration / Continuous Deployment. Automated pipelines that build, test, and deploy code on every commit.

cluster module: A Node.js core module that forks one worker process per CPU core and shares a listening socket between them; the first workaround for a single-threaded runtime that cannot, by itself, use more than one core.

CNCF: Cloud Native Computing Foundation. The Linux Foundation project hosting Kubernetes, Prometheus, Envoy, and other cloud-native infrastructure projects.

colocation: Housing your own hardware in somebody else's datacentre, paying for rack space, power and connectivity while retaining ownership of the machines.

container: A packaged unit that bundles a process with a slice of userland (libraries, shell, tools) and runs it in an isolated view of a shared kernel; convenient for deployment, but often a small operating system shipped to run one process.

control groups: A Linux kernel feature, begun at Google in 2006 and merged into the mainline kernel in 2008, that limits and accounts for the CPU, memory and I/O a group of processes may use. With namespaces, one of the two primitives Linux containers are assembled from.

CQRS: Command Query Responsibility Segregation. Separates read models from write models, allowing independent optimisation of each path.

Cracktro: A signature animation attached to cracked software by pirate groups in the 1980s and 1990s. Scrolling text, chiptune music, and vector effects as calling cards. The art form that evolved into the demoscene.

Copy-on-Write: A storage strategy where data is never overwritten in place. New data is written to a new location, then the pointer is updated. Guarantees consistency after power failure.

crates.io: The package registry for the Rust language. A published version is immutable: it can never be overwritten, only yanked, which removes the republish-an-existing-name trick used against npm.

cron: The Unix job scheduler. Executes commands at specified times using a five-field time expression (minute, hour, day, month, weekday).

CrowdStrike Incident: On 19 July 2024, a rapid content update to CrowdStrike's Falcon Sensor bypassed quality control and crashed 8.5 million Windows machines globally. Airlines, hospitals, banks, and emergency services were affected. $5.4 billion in Fortune 500 damages.

CSR: Client-Side Rendering. Building the page DOM entirely in the browser via JavaScript after an initial empty HTML shell is delivered.

CSS Layers: The @layer rule in CSS, allowing authors to define explicit cascade priority between groups of styles, eliminating specificity wars.

CSS-in-JS: A pattern where CSS is authored inside JavaScript files, generating styles at runtime. Adds bundle weight and runtime overhead.

Create React App: The React project's official scaffold from 2016, retired on 14 February 2025; the farewell notice pointed newcomers to frameworks and to build tools such as Vite, keeping the compiler in the default path.

CVE: Common Vulnerabilities and Exposures, the identifier scheme run by MITRE under which publicly known security flaws receive a number of the form CVE-YEAR-NUMBER. A CVE identifier records that a claim was made and catalogued; it is not by itself evidence that the flaw exists, and SQLite's own vulnerability page marks six identifiers issued in 2026 as unreproducible and attributes them to AI hallucinations.

Cyberhaven: A data-security company whose research arm, Cyberhaven Labs, measures corporate data flows into AI tools across millions of monitored workers; publisher of the annual AI Adoption and Risk Report.

chalk: A widely used npm package for colouring terminal output. Taken over in September 2025 along with debug and sixteen others through a phishing attack, with a combined 2.6 billion weekly downloads behind them.

CVE-2026-45321: The identifier for the Mini Shai-Hulud campaign of April and May 2026, which took 172 packages across 404 malicious versions on npm and PyPI, including packages carrying forged SLSA provenance.

Cast AI: A vendor of Kubernetes optimisation software whose annual report measures resource utilisation across tens of thousands of production clusters before any optimisation is applied, and therefore reads as an upper bound on waste.

D

Cyber Resilience Act: An EU regulation imposing security-by-design, update and documentation duties on products with digital elements. Non-compliance can support a finding of defectiveness under the Product Liability Directive.

daemon: A process that runs continuously in the background rather than being started for a task. Docker's engine relies on a central daemon running as root, which is why its failure takes every container with it and its compromise hands over the host; jails and Podman need no such process.

Dash: The Debian Almquist shell, a fast, strictly POSIX shell that Debian and Ubuntu install as /bin/sh. Bash-specific syntax fails on it, usually silently.

dataset: A ZFS filesystem within a pool, with its own properties, quotas and snapshots. Datasets share the pool's free space rather than being sized in advance.

Datastar: A small hypermedia and reactivity framework taking a server-sent-events approach, combining ideas from HTMX and Alpine in one package in the same order of magnitude as HTMX. A modern entry in the lightweight front-end tier.

Datenschutzkonferenz: The conference of Germany's federal and state data-protection authorities (DSK). Its November 2022 assessment: proof of GDPR-compliant operation of Microsoft 365 could not be provided.

dayjs: A small, widely used JavaScript date library. Its name and metadata were impersonated by the typosquat easy-day-js in the June 2026 Mastra supply-chain attack.

dbsqlfuzz: SQLite's own fuzz-testing harness, which mutates both SQL text and database files and runs continuously against the library. It produces on the order of a billion mutations a day from a corpus of 336 seed files, and cases that once proved interesting are kept afterwards as regression tests.

Debian: A community-driven Linux distribution known for its stability-first release policy. Debian Stable freezes packages and releases when ready, not on a schedule. The reference for conservative, tested software deployment.

deduplication: Storing identical blocks once. In ZFS the dedup table holds an entry per unique block at a little over 320 bytes and must stay resident, which is the actual source of the gigabyte-per-terabyte rule so often quoted about ZFS generally. It is off by default.

definition of done: The written agreement in a team about when a piece of work counts as finished. Cheaper to change than any tool, which makes it the natural home for rules about authorship and the origin of a change.

demoparty: A gathering where the demoscene meets to show new work and hold competitions, judged by the audience. Revision, held each Easter in Saarbrücken, is the largest.

Demoscene: A computer art subculture producing real-time audiovisual presentations (demos) within extreme size constraints, often 64 KB or less.

Demozoo: A community-maintained database of demoscene productions, groups, parties and competition results, used as the scene's reference record.

Deno: A secure JavaScript/TypeScript runtime by the creator of Node.js. Built-in TypeScript support, URL imports, and sandboxed permissions.

defect density: The rate of faults a system carries, as against its feature list. The argument of a dependable server OS: you do not choose your bugs, you choose your defect density, and it is decided by how the system was built, not by how clever its newest part contrives to be.

dependency hell: The failure mode in which package requirements cannot be satisfied together, through circular requirements or irreconcilable version constraints. The reason given for Slackware's refusal to resolve dependencies automatically.

distinfo: The FreeBSD ports file that pins the SHA256 checksum and size of every distribution file a port downloads. A tampered upstream tarball fails the checksum and the port never builds.

DKMS: Dynamic Kernel Module Support. A framework for building kernel modules that automatically recompile when the kernel is updated. Used by ZFS on Linux.

Dependabot: A GitHub-integrated bot that automatically opens pull requests to update dependencies. On a monorepo, it can generate hundreds of PRs per week, each requiring review and testing.

dependency confusion: A supply-chain attack in which a package is published to a public registry under the name of a company's private internal package, so that a misconfigured build resolves the public impostor in preference to the intended private one.

devDependencies: The packages in an npm package.json needed only to develop or build a project, not to run it in production. A plain npm install pulls them in and runs them with the same permissions as everything else, which is when a post-install script fires; Snyk's default scan omits them.

dnf: The package manager of Red Hat Enterprise Linux and Fedora, resolving dependencies above the rpm package format; the counterpart to Debian's apt.

Docker: A container runtime that packages applications with their dependencies into isolated filesystem images, sharing the host kernel.

Docker Desktop: The graphical Docker distribution for macOS and Windows. Because containers are Linux kernel constructs, it runs a Linux virtual machine underneath and manages the mount and lifecycle around it. Free for individuals; since 31 August 2021 a paid seat is required in companies above 250 employees or $10 million in revenue.

double-entry bookkeeping: Accounting method described by Luca Pacioli in 1494 in which every figure is recorded twice, on both sides of the book. Its purpose is not tidiness but detection: a transposed digit makes the two sides disagree, so the error announces itself without anyone having to look for it.

dpkg-buildflags: The Debian tool that supplies compiler and linker flags when a package is built. It is a mechanism for the package maintainer, not for the operator of an installed system.

DragonFly: DragonFly BSD. A fork of FreeBSD begun by Matthew Dillon in 2003, with its own approach to multiprocessing and the HAMMER filesystem. A member of the BSD family, Unix by descent.

DTrace: A dynamic tracing framework for real-time analysis of running systems. Originated in Solaris, ported to FreeBSD and macOS. Traces kernel and userspace with near-zero overhead when idle.

Docker Hub: The default public registry for container images. A 2026 study of its 52,895 highest-exposure repositories, accounting for 84.7 per cent of all recorded pulls, found 96.3 per cent carrying a known package vulnerability.

demo: In the demoscene, a production with no size limit, distinguished from an intro, which is capped at 64 kilobytes or less. The absence of a limit does not remove the discipline; it moves it to whatever the group chooses to constrain instead.

dynamic instrumentation: Attaching measurement to a program while it is running, without recompiling it, restarting it or having anticipated the question in advance. The subject of the 2004 DTrace paper and the capability behind both DTrace and eBPF.

Dynatrace: A commercial observability platform that instruments applications and infrastructure and traces requests across services. Like every monitoring tool it reports where a symptom surfaces, which is not always where the cause sits.

E

EBS: Elastic Block Store, the network-attached block storage service behind most EC2 instances. Billed per provisioned gigabyte-month rather than per gigabyte used.

ebuild: A Gentoo build script describing where a package's source comes from, how to unpack, patch, compile and install it, and what it depends on. The Portage equivalent of a port's Makefile.

Ed25519: A modern public-key signature scheme, fast and compact, used by OpenSSH keys and by OpenBSD's signify for signing releases and packages.

EDPS: The European Data Protection Supervisor, the EU's independent authority for data protection within its own institutions. In March 2024 it found the European Commission's Microsoft 365 use in breach of Regulation (EU) 2018/1725 and ordered the data flows suspended; the case closed in July 2025 after remediation.

egress: Outbound data transfer from a provider's network to the internet, billed per gigabyte by the major clouds and typically not billed at all by dedicated server hosts. The line most cost comparisons omit.

Elasticsearch: A distributed search and analytics engine, released under the Apache licence until 2021, then moved to the SSPL and the Elastic Licence, with the AGPL offered again from August 2024.

Enshittification: The process by which platforms degrade their product to extract value. Coined by Cory Doctorow in 2022. Three phases: attract users, lock in businesses at users' expense, extract value for shareholders at everyone's expense. Word of the Year 2023 (American Dialect Society) and 2024 (Macquarie Dictionary).

environment maps: A prepared image wrapped around a surface so that it appears to reflect its surroundings. It produces convincing metal and glass without calculating where any light actually is, which makes it both old and fast.

EPYC: AMD's server processor line, offering high core counts per socket. A 48-core EPYC appears in this measurement as the machine an egress bill can exceed.

ES Modules: The native JavaScript module system using import/export syntax, loaded by browsers without a bundler.

ESLint: A configurable linter for JavaScript and TypeScript that flags errors and enforces style rules. A standard fixture of the modern front-end toolchain.

EulerOS: Huawei's enterprise Linux distribution, once on The Open Group's register as conforming to UNIX and lapsed in 2022. One of the few Linux systems ever to hold the mark, a reminder that the certificate measures the interface, not the lineage.

EuroBSDCon: The annual European conference of the BSD community, running since 2001 and held in a different European city each year. The 2026 edition takes place in Brussels from 9 to 13 September.

European Processor Initiative: An EU-funded consortium (EPI) developing sovereign high-performance processors for European supercomputers, including the SiPearl Rhea line for the JUPITER exascale system.

evaluation penalty: The measured social cost of admitting AI use: in four PNAS experiments (Duke, 2025), people disclosing AI use were judged lazier and less competent for identical output, and hiring evaluators marked them down. The penalty largely disappears when the evaluator uses AI too.

event loop: Node.js's single-threaded concurrency model. Processes I/O callbacks on one thread without blocking. Efficient for I/O-bound workloads (waiting for data). Blocks entirely on CPU-bound work (processing data).

Event Sourcing: A pattern that stores every state change as an immutable event rather than overwriting current state. The event log becomes the source of truth.

exascale: A class of supercomputer capable of a billion billion operations per second. Europe's first, JUPITER, is intended to run on SiPearl's Rhea processor.

ES modules: JavaScript's native module system (import and export), standardised with ES2015. Every major browser has executed ES modules natively since May 2018, Firefox 60 completing the set, which removed the module gap that bundlers were built to bridge.

ENISA: The European Union Agency for Cybersecurity. Co-publishes the guideline on state of the art in IT security with the German association TeleTrusT.

Evoke: A German demoparty normally held in Cologne. Its cancellation in 2020 prompted the online replacement event Novoque.

F

ext4: The default filesystem of most Linux distributions. It checksums its own metadata but not file contents, and it cannot reach the second copy held one layer below in the storage stack.

fabrication: The manufacturing of chips from a design, carried out at a foundry. Leading-edge fabrication is dominated by TSMC, Samsung and Intel, with SMIC advancing in China.

faccessat2: A Linux system call added in kernel 5.8 (2020) to fix a flag-handling gap in faccessat. glibc 2.33 began preferring it in 2021; container seccomp allow-lists written earlier blocked it, so a correct kernel, a correct C library and a correct filter together broke ordinary file-access checks inside containers. A bug in the gap.

Fairlight: One of the oldest names in the scene, active since the mid-1980s, still releasing demos and intros; its 64k intro dead ringer took first place at Assembly 2006.

FEMP: FreeBSD, nginx, MySQL or MariaDB, and PHP: the FreeBSD equivalent of the LEMP stack, installed from ports or packages. Four components, one configuration file each, and the same versions available on the development machine.

Fetch API: The modern browser interface for making HTTP requests, replacing XMLHttpRequest. Returns Promises and supports streaming.

FFmpeg: A universal multimedia framework handling over 100 audio and video codecs. 1.5 million lines of C. Powers YouTube, Netflix, VLC, Spotify, Chrome. Created by Fabrice Bellard in 2000.

find: A Unix command-line tool that walks a directory tree and evaluates an expression against each file, performing actions where the expression is true. Unlike most Unix tools, which take flags, find takes an expression: a small query language of primaries (tests and actions) and operators (implicit AND, -o for OR, ! for NOT, parentheses for grouping). Written by Dick Haight for Version 7 Unix in 1979. BSD find ships in the FreeBSD base system, BSD-licensed; GNU find is part of the GPL-licensed findutils.

Fingerprinting: Putting a hash of a file's contents into its filename, so that any cache treats a changed file as a different file. It is what makes a long max-age with immutable safe to serve, and it is the mechanism that causes cascading invalidation when the hashed name is written into importing files.

firmware: Software stored in hardware that runs below the operating system, such as the system firmware that boots a machine or the firmware on a management processor. Often vendor-signed and not user-replaceable.

fixi: A minimalist implementation of generalised hypermedia controls by the HTMX team, built to be as small as possible: roughly 3.5 KB uncompressed, around 1.3 KB compressed. The smallest end of the hypermedia tier.

Flatpak: A cross-distribution packaging system for Linux desktop applications. Applications are built against a runtime that supplies their basic dependencies; the runtime is installed once on the host, so patching it patches every application built on it.

FOSDEM: Free and Open Source Developers' European Meeting. Annual two-day conference in Brussels, free to attend, no registration.

FreeBSD: An open-source Unix operating system descended from the Berkeley Software Distribution. Known for ZFS, Jails, and its licence model.

FreeBSD Foundation: The non-profit that supports FreeBSD development, infrastructure and release engineering. Registered in Colorado, United States. A single-tree architecture does not by itself relocate this institutional anchor, which is the distinction between the architectural layer and the jurisdictional one.

FreeBSD Handbook: The project's official, continuously maintained manual for installing and administering the whole system. Editions from two decades ago still describe today's rc.conf and pf accurately.

FSF: Free Software Foundation. Founded by Richard Stallman in 1985 to promote software freedom; author and steward of the GPL family of licences. In a sovereignty reading, the FSF remains a co-governor of any GPL fork through the licence it authored.

freemium: A business model in which the core product is given away to draw the largest possible audience while a minority pays for extra tiers. For the npm registry the free public registry is the funnel and private packages and enterprise are the revenue, so the size of the free tier, the package count, is the asset the paid tier is sold against.

flatmap-stream: The package added one level below event-stream in 2018, carrying obfuscated code that activated only when a particular Bitcoin wallet library was present in the same dependency tree.

framebuffer: A block of memory holding a rendered image before it is displayed. Graphics code allocates them constantly, and failing to release one produces visible garbage without any error being raised.

G

fuzzing: A testing technique that feeds a program large volumes of malformed, random or mutated input in the hope of provoking a crash or a wrong answer. It is very effective against parsers and file formats and very poor at reaching faults that require a specific semantic setup, which is why 150 CPU-hours of fuzzing against SQLite missed the underflow that a reasoning agent later found by reading the code.

Gargaj: Hungarian coder and musician, a member of Conspiracy, credited on f07 for code and on Chaos Theory for the soundtrack.

gawk: GNU awk, the awk implementation shipped by Fedora and Arch; extends POSIX awk with features such as length() on arrays.

generative AI: The class of AI systems that produce text, images or code from prompts rather than classifying existing data. Per the 2024 Work Trend Index, three quarters of knowledge workers use it at work.

genericide: The death of a trademark by becoming the generic name for its category, as befell aspirin, escalator and thermos. The risk that drives The Open Group to police the UNIX mark narrowly: allowed to mean any Unix-ish system, it would cease to be a mark at all.

Gentoo: A source-based Linux distribution built around Portage, in which packages are compiled on the target machine with user-selected USE flags rather than installed as prebuilt binaries.

glibc: The GNU C Library, the default C library on most Linux distributions. Implements the standard library and the syscall interface to the kernel. One userland among several (alongside musl, Bionic and BusyBox) that share the Linux kernel; its ABI contract with the kernel has occasionally broken in ways no single project owned.

GIL: Global Interpreter Lock. A mutex in CPython that allows only one thread to execute Python bytecode at a time, serialising CPU-bound work. Elegant until load disagrees.

GNU: GNU's Not Unix. The free-software project Richard Stallman began in 1983 to build a complete Unix-compatible system; its userland supplies the standard utilities, C library and toolchain on most Linux distributions. Unix-like by design, with no inherited Unix code.

git blame: A Git command that annotates each line of a file with the commit, author and date that last changed it. It was a rough but honest way to find who shaped a line; with generated code it names whoever pressed accept, not who actually wrote it.

GNU Hurd: The GNU project's microkernel operating system, a set of servers on the GNU Mach microkernel begun in 1990. It provides a POSIX interface but has never reached a 1.0 production release, the cautionary member of the discipline-without-descent class: the ambition intact, the delivery absent.

Go: A compiled language from Google (2009); its runtime scheduler multiplexes lightweight goroutines across every core of a single process, so one binary saturates a multi-core machine without a cluster of processes or a container per core.

GPAI: General-purpose AI, the EU AI Act's term for a model that can serve many downstream tasks. Article 53 obliges GPAI providers to publish a sufficiently detailed summary of their training content, to a template the AI Office issued in July 2025, binding open-licensed models as well as closed ones.

GPL: GNU General Public Licence. The canonical copyleft licence, authored by the Free Software Foundation. Requires derivative works to carry the same terms, so its conditions travel with every line into any fork and cannot be repealed by the forker. The Linux kernel is licensed under GPLv2. Deliberately designed not to let go.

Goroutine: A lightweight thread managed by the Go runtime. Multiplexed onto OS threads. Enables high concurrency but subject to garbage collection pauses.

Grafana: A visualisation platform for metrics, logs, and traces. Connects to Prometheus, Loki, InfluxDB, and dozens of other data sources.

Goodhart's Law: When a measure becomes a target, it ceases to be a good measure. Named after economist Charles Goodhart (1975). Explains why velocity tracking corrupts estimation.

GraphQL: A query language for APIs where the client specifies exactly which fields it needs. Developed by Facebook, alternative to REST.

greetings: The list of other groups a demoscene production thanks, traditionally scrolling past at the end. It is the scene's oldest social convention and normally detachable from the work itself; Conspiracy's Offscreen Colonies is the counter-example, where the greeted names are the places the viewer flies through.

gRPC: A high-performance RPC framework using Protocol Buffers and HTTP/2. Supports streaming, code generation, and strong typing.

GitHub: A web platform for hosting Git repositories and collaborative software development, founded in 2008 and acquired by Microsoft in 2018 for USD 7.5 billion. Owner of the npm registry since 2020.

Grunt: An early JavaScript task runner, from 2012, that automated build chores through configured plugins. The first link in the bundler lineage that runs, so far, to Rolldown.

Gulp: A JavaScript task runner from 2013 built on streams, the code-over-configuration answer to Grunt; the second link in the build-tooling lineage.

generally accepted rules of technology: The lowest of the three technology levels in the Kalkar three-stage theory: the proven, the widespread, the thing everybody does. Measures descend to this level with increasing distribution and market recognition, where they may have weaknesses because attackers have found ways to bypass them.

GNU Rocket: A sync tracker by Erik Faye-Lund, used across the demoscene to tie visuals to music. You scrub a timeline, set values against it, and the running demo reads them back. Effectively a spreadsheet for time, and the reason demos can hit a beat at all.

H

HAMMER2: The native filesystem of DragonFly BSD, offering snapshots, clustering, deduplication and self-healing. Written for DragonFly and carried by no other BSD; the counterpart on that branch to ZFS on FreeBSD.

HAProxy: A high-performance TCP/HTTP load balancer and reverse proxy. Event-driven, widely used for traffic distribution.

htm/a: A four-kilobyte server-side reactivity framework with a type-safe Rust core and no dependencies, the author's own study built to see how low the front-end floor can go; it runs htma.run. Not a supported product, but a proof that the floor is lower than the industry assumes.

HTTP caching: The set of response headers by which a server tells clients and proxies how long a resource may be reused without asking again. Its failure mode is silent: a stale asset served from a browser cache is a production fault nobody can recall.

HTTP/2: The second major version of HTTP. Binary framing, multiplexed streams over a single TCP connection, header compression.

HTTP/3: HTTP over QUIC. Replaces TCP with UDP-based transport, eliminating head-of-line blocking. Built-in encryption.

I

Husky: A tool that installs Git hooks from a project's repository, so that checks run automatically on commit or push. The generated pre-commit hook calls npx lint-staged.

hyperscaler: One of the very large cloud operators running datacentres at global scale, principally Amazon Web Services, Microsoft Azure and Google Cloud.

ICSME: IEEE International Conference on Software Maintenance and Evolution. Venue of the 2024 study that measured comment-free code reviews and the LGTM smell across five large-scale projects.

ifconfig: The classic Unix tool for configuring network interfaces; deprecated on Linux in favour of ip, still the standard tool on FreeBSD and macOS.

Incremental Static Regeneration: A caching strategy in which a statically generated page is rebuilt in the background after a defined interval or on demand, while stale content continues to be served. It behaves as advertised on a single instance; across several instances each one keeps its own record of what is fresh unless a shared cache handler is configured.

init system: The first userland process the kernel starts (PID 1), responsible for bringing up and supervising services; systemd, OpenRC, launchd and FreeBSD's rc.d fill this role.

installpkg: Slackware's package installer: it unpacks an archive, records every file it placed and where, and stops. It resolves no dependencies, by design; a missing library announces itself when the program is run.

Interop: An annual cross-vendor programme in which browser makers agree on a set of web platform areas to bring into alignment, measured publicly against the web platform test suite. It exists to reduce the rendering differences that once justified bundling an engine.

intro: A demoscene production bound by a size limit, usually 4 or 64 kilobytes, as opposed to a demo, which carries no limit at all.

invitation demo: A demoscene production made to advertise an upcoming party. It competes in the same competitions as everything else and has to earn its screen time on the same terms.

ironies of automation: Lisanne Bainbridge's 1983 observation that automating a task deskills the operator: they stop practising the parts the machine now covers, yet must take over when it fails, exactly when unusual skill is needed and least available.

IaaS: Infrastructure as a Service. Virtual machines, storage, and networking rented from a cloud provider instead of running your own hardware.

IEEE 1003: The IEEE standard family better known as POSIX, first published as IEEE 1003.1 in 1988. The technical text the Single UNIX Specification incorporates, specifying the interface a program sees rather than the system that implements it.

information hiding: The module-decomposition principle David Parnas set out in 1972: a module should hide a design decision that is likely to change, so that when it changes, only that module changes. A boundary drawn where the volatility lives, the honest opposite of a layer that only postpones the look beneath it.

infostealer: Malware whose purpose is to harvest secrets from a machine, browser data, cryptocurrency wallets, SSH keys, cloud tokens and credential files, and exfiltrate them to attacker infrastructure.

Intel Management Engine: A small autonomous processor inside Intel chipsets, running its own MINIX-based firmware at a privilege below the kernel, with system access and a network path, active even while the machine is powered off. Built for remote fleet management; CVE-2017-5689 showed it could be taken over remotely.

io-pkt: The networking stack of the QNX operating system, built directly on NetBSD's networking code. Berkeley's code compiled into QNX's own address space, which is why a Unixoid by kernel carries a genuine piece of the BSD line inside it.

io_uring: A Linux asynchronous I/O interface (Jens Axboe, kernel 5.1, 2019) built on two shared-memory rings, a submission queue and a completion queue, letting an application hand the kernel batches of work with very few system calls. Fast, but a large and fast-growing attack surface: around six in ten Linux kernel exploits submitted to Google's 2022 bounty went through it.

IPsec: Internet Protocol Security. A suite of protocols for authenticating and encrypting IP packets. Complex configuration, largely replaced by WireGuard for VPNs.

IRIX: Silicon Graphics' Unix flavour for its workstations, one of the proprietary Unixes of the 1980s.

ISA: Instruction-set architecture: the contract between software and a processor, the set of instructions a CPU exposes. x86, ARM and RISC-V are the three main ISAs, and which a chip implements is a question of ownership as much as of engineering.

install script: A script a package declares to run automatically during npm install, such as a postinstall hook. It executes with the installing user's full permissions the moment installation finishes, before the installed code is deliberately run, which is what makes a malicious one so effective.

import maps: A browser feature that maps bare import specifiers such as 'lodash' onto URLs, letting native ES modules resolve dependencies without a bundler. Native in every major browser since Safari 16.4 in March 2023.

J

Jail Ferry: A local development workflow built from base-system parts instead of Docker Desktop, described in chapter 20 of Integrated by Design: QEMU for the virtual machine, NFS for the shared directory, zfs send for moving filesystems, and about 190 lines of POSIX shell to orchestrate them. The name is deliberate, since a docker loads ships and a ferry carries cargo across a channel.

jails: FreeBSD's kernel-native operating-system virtualisation: an isolated environment that is a first-class kernel primitive rather than a daemon-mediated arrangement of namespaces. With VNET each jail holds an independent network stack.

Jest: A JavaScript testing framework, widely used in the React ecosystem. One of the tools, with React, Webpack, Babel and ESLint, that make a junior engineer a known quantity to the hiring market.

journald: systemd's logging service, which stores system logs in a binary journal queried with journalctl; it replaced plain-text syslog on most Linux distributions.

jq: A functional programming language for transforming JSON on the command line. Generators, backtracking, immutable values, compiled to a stack-based bytecode VM. 822 KB binary. Written in C by Stephen Dolan in 2012. MIT licence.

JSON: JavaScript Object Notation, a plain text data format of objects, arrays, strings and numbers. Douglas Crockford specified it in 2001 and it became the default interchange format of the web, and the format an import map is written in.

JSON-RPC: JSON Remote Procedure Call. A lightweight protocol that encodes function calls and responses as JSON objects, transported over HTTP or WebSockets.

JIT: Just-in-time compilation. Translating bytecode into native machine instructions at the moment of execution rather than ahead of time. Part of what turned BPF from a packet filter into a general kernel runtime.

Juniper: American network equipment manufacturer, founded 1996, whose routers and switches run the company's own operating system on a FreeBSD foundation.

Junos: Juniper Networks' operating system for routers, switches and security appliances, built on FreeBSD since the late nineties. The permissive licence allowed proprietary extensions without a negotiation, which the company has named as part of the appeal.

K

K-UX: Inspur K-UX, a Linux-based operating system from the Chinese vendor Inspur, certified against UNIX in 2013 and later lapsed. One of the very few Linux distributions ever to hold the UNIX mark.

kernel: The core of an operating system: it manages memory, processes, devices and filesystems. Nearly everything an administrator touches day to day sits in the layers above it.

kernel TLS: A FreeBSD subsystem that performs Transport Layer Security encryption inside the kernel rather than in the application, so that video data never crosses the user-kernel boundary twice. Designed at Netflix by Drew Gallatin and upstreamed over roughly five years.

Kewlers: Finnish demogroup formed in the early 1990s, known for a provocative style, a logo of a stylised raised middle finger and the motto “Kewlers suck”. Their 2002 demo Variform took several Scene.org Awards; they announced the 2006 demo 1995, made together with mfx, as their farewell and returned to competition some years later.

KHTML: The HTML rendering engine written for KDE's Konqueror from 1998. Apple forked it in 2001 to create WebKit, which Google forked in 2013 to create Blink, so nearly every engine in use on the desktop shares this ancestor.

kintsugi: The Japanese art of repairing broken pottery with lacquer dusted with gold, so the mend is honoured as part of the object's history rather than disguised. Used here as an image for a system that shows its workarounds and their reasons on the surface, where the next maintainer can read them.

KISS: Keep It Simple, Stupid: a design principle holding that systems work best when kept as simple as the problem allows. With lean and minimal, one of the disciplines of removing everything that does not earn its place, so the result is proportioned to the problem and can be held whole in one mind.

Koji: The Fedora build system, against which packages are produced with rpmbuild, mock and fedpkg.

KubeCon: The Cloud Native Computing Foundation's flagship conference for Kubernetes and cloud-native technologies.

Kubernetes: An orchestration platform for managing containerised workloads across clusters. Handles scheduling, scaling, and self-healing.

Kalkar decision: A 1978 ruling of the German Federal Constitutional Court (BVerfGE 49, 89) that introduced the three-stage theory distinguishing generally accepted rules of technology, state of the art, and existing scientific knowledge and research. Still the basis for reading the term state of the art in IT security law.

L

launchd: The init system and service manager of macOS, starting daemons and agents from property-list files; Apple's counterpart to systemd.

LEMP: Linux, nginx, MySQL or MariaDB, and PHP. The successor to the LAMP stack with nginx in place of Apache, and still the smallest arrangement that serves a database-backed site from one machine.

LESS: A stylesheet language that compiles to CSS, adding variables, mixins and nesting. One of several notations that can share a single commerce project, each requiring its own style pass.

Library of Congress: The research library of the United States Congress, which among other duties publishes recommended formats for the long-term preservation of digital content. The SQLite file format appears on that list, which is an unusual endorsement for a piece of engineering: it says that an institution planning in centuries expects the format to remain readable.

LibreSSL: A fork of OpenSSL begun by the OpenBSD project in 2014 after Heartbleed, stripping and auditing the codebase for correctness. One of several tools written for OpenBSD and now used far beyond it, alongside OpenSSH, doas and OpenNTPD.

Landlock: A Linux security module (merged in 5.13, 2021) that adds unprivileged filesystem sandboxing. Moves closer to Capsicum's capability model but does not yet match the simplicity of cap_enter().

LGTM smell: A review anti-pattern named after the phrase Looks Good To Me: an approval given without substantive examination. Measured at roughly three and a half times the rate in comment-free reviews (ICSME 2024).

Libsystem: The C library of macOS, carrying BSD ancestry; the macOS counterpart to glibc or FreeBSD's libc.

light-dark(): A CSS function that returns one of two values depending on the computed color-scheme. Eliminates media-query duplication for dark mode.

LibreOffice: A free, open-source office suite forked from OpenOffice.org in 2010 and maintained by The Document Foundation. A common component of European public-sector migrations away from proprietary productivity software.

LinearB: Engineering-analytics vendor whose 2026 benchmark report covers some 8.1 million pull requests from 4,800 organisations and reports that teams leaning heavily on AI merge around 98 per cent more changes.

lint-staged: A tool that runs linters against the files staged for a Git commit rather than the whole repository. It appends every staged path to a single command invocation instead of spawning one process per file.

Linux: The kernel Linus Torvalds wrote from scratch in 1991, and the operating systems built around it with a GNU or other userland. Unix-like, not Unix: it inherited no Bell Labs or Berkeley code and has never been certified by The Open Group. A separate family that looks Unix-shaped by design.

Linux Foundation: A non-profit consortium that hosts the Linux kernel's infrastructure and many other projects (including the CNCF). Registered in the United States as a 501(c)(6) trade association and therefore bound by US legal reach. Its 2024/2025 report put 84.3 per cent of kernel commits with developers paid by their employers.

Linuxulator: FreeBSD's Linux binary compatibility layer. Translates Linux system calls to FreeBSD equivalents in the kernel, running Linux binaries natively without emulation. Active since 1995.

Lions' Commentary: John Lions' line-by-line reading of the Unix V6 kernel source, written at the University of New South Wales in 1976. Later restricted by AT&T and circulated in samizdat photocopies for two decades, one of the most-copied computer-science documents of its era.

Llama: Meta's family of open-weight language models. The weights are downloadable but the Llama Community Licence is not OSI-approved: it terminates for any company above 700 million monthly active users unless Meta expressly grants continued use, and carries an acceptable-use policy. The archetype of open weights that are not open source.

load balancer: A component that distributes incoming requests across several instances of an application. It makes horizontal scaling possible and, in doing so, makes any state held inside a single instance divergent by default.

Loghub: A public collection of real system log datasets maintained by the LogPAI group, used for research and benchmarking. The SSH dataset carries 655,146 lines of authentication log, which makes measurements over it reproducible by anyone.

LoongArch: A domestic instruction-set architecture developed by China's Loongson in 2021, moving away from the MIPS lineage toward an ISA under its own control.

LTS: Long-Term Support. A release designated for extended maintenance, typically receiving only security patches and critical bug fixes. Node.js LTS lasts 30 months. PostgreSQL supports each major for 5 years.

Lua: A lightweight embeddable scripting language. 30 KB runtime, first-class functions, metatables for OOP. Used in game engines and web servers.

linter: A tool that reads source code without running it and reports style violations, suspect constructs and likely errors. ESLint is the common choice in JavaScript projects.

M

lz4: A fast compression algorithm, the ZFS default since OpenZFS 2.2.0. It reduces I/O rather than adding to it, because fewer bytes cross the bus.

MAC framework: The FreeBSD mandatory access control framework, which carries security policies as loadable kernel modules rather than as a single fixed model.

macOS: Apple's desktop and laptop operating system, the successor to Mac OS X. Built on the Darwin foundation (XNU kernel plus FreeBSD-derived userland). Every version from 10.5 Leopard (2007) through macOS 15 Sequoia (2024) has been certified by The Open Group against the Single UNIX Specification version 3 and carries the UNIX 03 brand. The single largest carrier of certified Unix on the planet.

Magento: An open-source PHP commerce platform, now Adobe Commerce, organised as a monorepo that replaces 241 modules of its own. Its published quality gate runs a separate code-style pass for PHP, XML and XSD, HTML, GraphQL and LESS.

Matthew Dillon: A FreeBSD developer who, disagreeing with the fine-grained locking direction of FreeBSD 5, forked FreeBSD 4.8 in June 2003 to create DragonFly BSD, building a kernel organised around message-passing and the HAMMER and HAMMER2 filesystems.

Mach: A microkernel developed at Carnegie Mellon from the mid-1980s, part of the separate microkernel engineering tradition that grew up beside the monolithic Unix line and the basis of several later systems.

MAINTAINERS file: A file in the Linux kernel source tree listing who is responsible for each subsystem. In October 2024 it was edited to remove approximately eleven entries under stated compliance requirements, a change Linus Torvalds confirmed and declined to reverse. Illustrates that forking the source does not fork the governance.

make: A build automation tool written by Stuart Feldman at Bell Labs in 1976, driving compilation from a declarative file of targets and dependencies. Small enough to have been completed rather than continually replaced, and still in use half a century later.

make.conf: The FreeBSD configuration file that governs how third-party software is built from ports, including the hardening switches WITH_PIE, WITH_RELRO, WITH_BIND_NOW and WITH_FORTIFY.

Mastra: An open-source TypeScript framework for building AI applications, distributed as the @mastra npm scope. In June 2026 its publishing scope was hijacked through a dormant contributor account and 144 of its packages were backdoored.

mawk: A small, fast awk implementation that Debian and Ubuntu ship as their default awk. It stays close to POSIX and answers some gawk extensions differently, returning zero where gawk counts array elements.

MC/DC: Modified condition/decision coverage, a test-coverage criterion that goes well past branch coverage. It requires that every individual condition inside a compound decision has been shown to change the outcome on its own, with all other conditions held constant, so an if statement with four clauses needs at least five test cases before it counts as covered. The standard is written into DO-178B Level A, the assurance level a certification authority demands of airborne software whose failure would be catastrophic. SQLite has maintained one hundred per cent MC/DC coverage of its core library since version 3.6.17, released on 10 August 2009.

ports tree: FreeBSD's collection of build recipes for third-party software, held in one versioned tree alongside the base system. Each port records the upstream source and its checksums in a distinfo file, so a package has one origin that can be named and verified, rather than a dependency graph assembled at install time from whatever a registry serves.

Project Zero: Google's security research team, formed in 2014 to find previously unknown vulnerabilities in widely used software and to publish them under a fixed disclosure deadline. It is one of the two teams behind the Big Sleep agent.

public domain: The status of a work to which no copyright applies, so that no licence is needed and no condition can be attached. SQLite is placed in the public domain rather than published under a permissive licence, which was done because some early users had legal departments that could not approve any licence at all; the only terms their lawyers could accept were no terms.

sentinel value: A value chosen to mean not a value, carried in the same field as ordinary data. Minus one in a field that is otherwise always positive is the classic case. The technique costs nothing in storage and everything in discipline, because every piece of code touching that field must recognise the special case, and the one that forgets is the bug.

SQL Logic Tests: A test corpus of 7.2 million SQL queries over roughly 1.12 GB of data, run against SQLite and against other database engines so that the answers can be compared. Where the engines disagree, one of them is wrong; the point is to find that out without a human having to state the expected result for every query.

stack buffer underflow: A memory-safety fault in which a program writes or reads before the beginning of a stack buffer, rather than past its end as in the more familiar overflow. Both corrupt memory the program does not own; an underflow tends to be rarer and harder to provoke, which is part of why fuzzing can miss one.

STRICT tables: A table option added to SQLite in version 3.37 which makes declared column types binding, so that a value of the wrong type is rejected instead of converted. It arrived seventeen years after the file format froze, and its existence is a quiet admission that type affinity, however deliberate, left a soft edge that some applications needed closed.

TH3: The Test Harness 3, a proprietary test suite for SQLite written in C and maintained by the SQLite developers. It holds 50,362 distinct test cases which expand across parameter combinations into roughly 2.4 million test instances, and it exists deliberately as a second and unconnected body of tests alongside the open TCL suite, so that a blind spot in one cannot be a blind spot in both. TH3 is what carries SQLite's one hundred per cent branch and MC/DC coverage.

threat model: A written statement of what an attacker must already be able to do before a system can be attacked at all. SQLite publishes one: every historical vulnerability against the library requires either an attacker who can run arbitrary SQL, or one who can supply a maliciously crafted database file. The value of writing it down is that it can be pointed at, which a project assembled from several hundred transitive dependencies cannot do.

triage tax: The asymmetry between reporting a defect and examining one. A plausible advisory can now be drafted in seconds and at negligible cost, while reading it, building a reproduction case, watching it fail and writing down why still takes a person an afternoon. The cost falls entirely on the maintainer, is paid in the attention that would otherwise go into the next release, and scales with the volume of reports rather than with the number of real faults among them.

type affinity: SQLite's approach to column types, under which a declared type expresses a preference rather than a constraint: a value of another type is converted where it can be and stored as it is where it cannot. It makes the engine forgiving of loosely typed input and makes it possible to store text in a column declared as an integer. STRICT tables, added in version 3.37, provide the alternative for anyone who wants the declaration enforced.

unmapped mbufs: The memory buffer structure that BSD kernels use to hold network packets. Unmapped mbufs let the kernel carry data that has no virtual address mapping, which spares the mapping work on a machine pushing hundreds of gigabits.

MCP: Model Context Protocol, an open standard for connecting AI assistants to external tools and data sources. Packages aimed at MCP developers were a pointed target of the June 2026 PyPI supply-chain campaign.

mdadm: The Linux tool that manages software RAID arrays. It holds the redundancy and no checksum of file contents, so when two mirrored copies disagree it cannot determine which one is correct.

merge queue: A facility that batches approved pull requests, re-tests each against the current target branch and merges them in order. It does not waive a required approval; it moves the merge away from the person who gave it.

Merkle tree: A hash tree where every leaf node is labelled with the hash of a data block and every non-leaf node is labelled with the hash of its children. Used by ZFS for end-to-end checksumming.

message passing: The way processes talk in a microkernel: instead of calling into shared kernel code, a process sends a message to another and waits for the reply. In QNX it is the core kernel mechanism, and it is what lets drivers, filesystems and the network stack run as separate, isolable programs.

meta-framework: A framework built on top of a client-side rendering library that adds server rendering, routing, data loading and a build pipeline. Next.js, Nuxt and SvelteKit are the common examples; each answers problems introduced by the layer beneath it.

mfx: Finnish demogroup, collaborators with Kewlers on the 2006 demo 1995, which came third in the combined demo competition at Assembly 2006 and afterwards took Best Soundtrack and Public Choice at the Scene.org Awards.

Miasma: A June 2026 npm supply-chain attack that republished thirty-two packages under the @redhat-cloud-services scope through a hijacked continuous-integration pipeline identity. The packages carried valid signed provenance and stole credentials all the same, illustrating that an attestation certifies which pipeline built an artifact, not that the pipeline was still in the right hands.

microcode: The lowest layer of a CPU: the signed, encrypted program that translates architectural instructions into the processor's internal operations. It can be updated only with the manufacturer's signature; one cannot read it, write it, or fork it.

microkernel: An operating-system design that keeps drivers, filesystems and the network stack out of kernel space, communicating through a small message-passing core, so a failed driver restarts in milliseconds rather than taking the machine down. QNX is the long-standing production example.

Microservices: An architecture that decomposes an application into small, independently deployable services communicating over network protocols.

Microsoft 365: Microsoft's cloud office and collaboration suite. The German Datenschutzkonferenz found in November 2022 that GDPR-compliant operation could not be demonstrated; the EDPS ordered the European Commission to suspend its data flows in 2024, remedied only in 2025.

middleware: Code that runs between the arrival of a request and its handling by the application, typically for authentication, redirects or rewrites. In edge-deployed frameworks it runs on separate infrastructure from the application itself, which is why self-hosting has to reproduce it as its own component.

Minix: A small Unix-like operating system written by Andrew Tanenbaum in 1987 for teaching. Famously the system the young Linus Torvalds ran and outgrew, prompting him to write the Linux kernel.

Mistral: A Paris-based AI laboratory, Europe's most-cited example when digital sovereignty is discussed. It releases flagship 2026 models such as Mistral Large 3 under the permissive Apache 2.0 licence, a genuine good that is still not a fork, since the training data and pipeline are not published.

module graph: The complete set of modules an application loads and the import relationships between them. Browsers discover it by executing modules rather than by scanning the HTML, which is why a preload scanner cannot find imports for you.

Monolith: A single deployable unit containing all application logic. Often contrasted with microservices but not inherently inferior.

monolithic kernel: A kernel design in which the scheduler, drivers, filesystems and network stack all run inside one privileged address space, as traditional Unix and Linux do. Fast, but a fault in any part can take the whole system down, the arrangement the microkernel was meant to avoid.

monorepo: A single repository holding several packages or services that are versioned and built together. Convenient for shared code; it also multiplies every pipeline stage by the number of packages.

musl: A clean-room, lightweight implementation of the C standard library for Linux, emphasising POSIX correctness and small size. Used in place of glibc by Alpine and many container images. One userland among several (alongside glibc, Bionic and BusyBox) that share the Linux kernel and little else.

MVC: Model-View-Controller. An architectural pattern that separates data (Model), presentation (View), and input handling (Controller).

MVCC: Multi-Version Concurrency Control. A database technique where readers see a consistent snapshot without blocking writers. Used in PostgreSQL.

MVS: Multiple Virtual Storage, the IBM mainframe operating-system line whose design reaches back to the 1960s and the kernel beneath today's z/OS. It carries no Bell Labs or Berkeley code; the certified-Unix part of z/OS is a POSIX layer sitting on top of it.

minified build: The compressed, whitespace-stripped form of a JavaScript package that ships to production. Because it is not the form anybody reads, it is where the event-stream payload of 2018 was hidden.

Mistral AI: French artificial intelligence company. Its npm packages were among those taken in the Mini Shai-Hulud campaign of spring 2026.

Meteoriks: Annual demoscene awards presented since 2017, successor in spirit to the Scene.org Awards, with categories including Best Soundtrack, Best Visuals, Best Direction and Best High-End Demo.

N

Neoverse: ARM's line of licensed CPU cores for servers and high-performance computing; the cores on which Europe's SiPearl Rhea1 is built.

Net/2: Berkeley's 1991 release, an attempt to ship a Unix distribution containing only Berkeley-written code and no AT&T-licensed source; the basis of BSDi's product and the trigger for the USL lawsuit.

Netflix: The streaming company, cited here for a 2017 web-performance result: removing client-side React from its logged-out home page cut Time to Interactive by around half. In the Unix context, its Open Connect appliances also run FreeBSD.

Netlify: A deployment and hosting platform for modern front-end applications, in the same tier as Vercel. Its hosting model and integrations are coupled to the heavy modern stack, and pricing tends to scale with bundle size.

Network Effect: The phenomenon where a product becomes more valuable as more people use it. The mechanism that creates lock-in: leaving the network means losing the connections you built on it.

Next.js: A React-based full-stack web framework, originally released by Vercel (then ZEIT) in October 2016. Bundles server-side rendering, static generation, file-based routing, edge functions, image optimisation and a build pipeline. A typical fresh install in 2026 lands at 700 MB to a full gigabyte on disk, the majority devDependencies; the de facto starting template for React projects after create-react-app was retired.

Nextcloud: An open-source, self-hostable file-sync and collaboration platform, often deployed as a sovereign alternative to proprietary cloud suites. A common component of European public-sector migrations.

NFS: Network File System, a protocol from Sun Microsystems for mounting a remote directory as if it were local. Older than containers by decades and sufficient, on its own, for sharing a project directory between a host and a development virtual machine.

nftables: The Linux packet classification framework replacing iptables. Uses a unified syntax for filtering, NAT, and mangling.

namespaces: The Linux kernel feature that gives a process its own isolated view of resources (mounts, network, PIDs), the primitive containers are built from. Isolation holds only while the kernel, the runtime and procfs all agree on the same picture; the seam between them is where the November 2025 runc break-outs escaped.

nginx: A high-performance HTTP server and reverse proxy using an event-driven, non-blocking architecture. Serves static files and proxies upstream applications.

Nintendo Switch: Nintendo's games console (2017). Its Horizon operating system carries FreeBSD's networking code without being a FreeBSD derivative outright, code from one family running inside another. Counted with Sony's consoles, it tilts the console world towards BSD.

Nix: A functional package manager that stores every build under a hash of its complete dependency tree, allowing incompatible versions to coexist on one machine and making upgrades and rollbacks atomic. The basis of NixOS.

node-ipc: A widely used Node.js inter-process-communication library, around 822,000 weekly downloads. In May 2026 its maintainer account was taken over after the domain behind its recovery email, atlantis-software.net, was allowed to lapse and re-registered by an attacker for the price of a registration; a credential stealer then shipped to every installer.

NOTICE file: A text file carried alongside Apache-licensed software that records attribution required by contributors. Section four of the licence requires any derivative distribution to reproduce it.

Novell: The software company that acquired AT&T's Unix System Laboratories, and with it the UNIX trademark, in 1993, before passing the mark to X/Open the same year. One link in the chain of custody that ends at The Open Group.

npm: Node Package Manager. The default registry and CLI for JavaScript packages. Manages dependency trees in node_modules.

non-blocking I/O: An I/O model in which one thread issues many operations and is notified as each completes, rather than waiting on each in turn, so a single process can hold thousands of idle connections. The model at the heart of Node.js, and of Go and Rust async runtimes alike.

Node.js: A JavaScript runtime built on Chrome's V8 engine, released by Ryan Dahl in 2009, that runs JavaScript outside the browser on a single-threaded event loop. npm shipped as its package manager, and the two grew together.

npm audit: The built-in dependency scanner of the npm CLI. It compares the version strings of installed packages against a database of published advisories and reports matches. It does not read the code, test the combination of packages, or notice a compromise that has not yet been published as an advisory.

NIS2: The European directive on measures for a high common level of cybersecurity across the Union. Article 21 requires risk management measures taking into account the state-of-the-art and relevant European and international standards.

NIST: The United States National Institute of Standards and Technology. Its technical investigation of The Station nightclub fire recorded that about two-thirds of the occupants attempted to leave through the main entrance.

Novoque: An online demoparty held on 15 and 16 August 2020, assembled because Evoke could not take place that summer. Nine competitions from demos and intros to ANSI art; six entries in the demo compo.

O

npx: A wrapper shipped with npm that locates and runs a package binary. It starts a Node process of its own before starting the intended one, which measured 262 milliseconds of pure overhead per invocation.

NVMe: Non-Volatile Memory Express, the interface that connects solid-state storage directly to the PCIe bus, removing the queueing limits inherited from disk-era protocols.

Open Software Foundation: An industry consortium founded in 1988 to develop an open Unix standard, which merged with X/Open in 1996 to form The Open Group. One of the two bodies whose union produced the present keeper of the UNIX mark.

Open Source Initiative: The body that has maintained the Open Source Definition since 1998 and decides which licences meet it. Approval by the OSI is what separates open source from source available, and both BSD and the GPL carry it.

OpenGL: A cross-platform graphics API for rendering two- and three-dimensional content on the GPU, long the standard alternative to Direct3D and widely used in demoscene productions.

OpenRC: A dependency-based init and service manager used by Alpine Linux and Gentoo; a lighter alternative to systemd.

Organic Reach: The percentage of a page's followers who see a post without paid promotion. Facebook organic reach for business pages fell from 16% in 2012 to 1.37% in 2024, the canonical example of platform enshittification.

OKLCH: A perceptually uniform colour space using Lightness, Chroma, and Hue. Produces consistent perceived brightness across all hues, unlike HSL.

OOCSS: Object-Oriented CSS. A methodology that separates structure from skin and container from content, promoting reusable CSS classes.

OmniOS: A minimalist, server-focused illumos distribution (OmniOS Community Edition) with a stable, predictable release cadence.

on-demand: Cloud pricing without commitment, charged by the hour or second. The most expensive tier, and the one most published comparisons quote.

Open Source AI Definition: The Open Source Initiative's 2024 standard (OSAID 1.0, 28 October 2024) for what may be called open source AI: the system must provide the training and inference code, the parameters, and data information detailed enough that a skilled person could build a substantially equivalent system. A model that ships only its weights does not qualify.

open weights: A model released as its trained parameters plus a licence, downloadable and runnable on your own hardware, but without the training data, training code or compute needed to reconstruct it. Available and tunable, yet not reproducible; open weights are not the same as open source.

OpenBSD: A security-focused open-source Unix operating system. Produced OpenSSH, LibreSSL, OpenBGPD, and the pledge()/unveil() system calls. Known for code audits and minimal defaults.

openwashing: Presenting an AI system as open when it withholds what openness was meant to guarantee. Coined in a 2024 Nature paper by Widder, Whittaker and West, which argued that models offering little beyond downloadable weights under restrictive terms are better understood as closed, and that the rhetoric often concentrates power rather than loosening it.

orchestrator: A control system, such as Kubernetes, that schedules containers across cores and machines, health-checks them and restarts those that fail; the supervisor a single self-scheduling binary does not need.

OpenIndiana: A community-maintained illumos distribution, the continuation in spirit of OpenSolaris; ships rolling Hipster snapshots with x86 ISO images.

OpenVPN: An open-source VPN solution using SSL/TLS for key exchange. Flexible but verbose configuration compared to WireGuard.

ORM: Object-Relational Mapping. A layer that translates between programming-language objects and relational database rows, abstracting SQL behind method calls.

osv-scanner: An open-source vulnerability scanner that reads the OSV database of advisories rather than only CVE feeds. It flagged the malicious Mastra dependency that CVE-bound tools, finding no CVE, did not.

over-provisioning: Allocating more compute or memory to a workload than it will ever use, usually as a hedge against unknown demand. Measured across production Kubernetes clusters, it affects sixty-nine per cent of them on CPU, up from forty per cent the year before.

orchestration: The layer that schedules, places and restarts containers across a fleet of machines. Introduced to make containers manageable, it becomes an operational system in its own right, with its own staff and its own failure modes.

observability: The practice of being able to answer questions about a running system from the outside. In the kernel it means dynamic instrumentation; as a purchased product it means agents, a collector and a dashboard, charged per host and per gigabyte.

P

patent grant: A clause in which contributors license the patents that their contribution necessarily infringes, so recipients cannot be sued over the code they were given. Apache 2.0 contains one in section three, and it terminates if the recipient begins patent litigation over the work.

PHPMD: PHP Mess Detector. Scans PHP source for likely bugs, over-complicated expressions and unused parameters, driven by rulesets. Spryker runs it against an architecture sniffer ruleset.

PHPStan: A static analysis tool for PHP that infers and checks types the language does not require. Configured in levels from 0 to 10; commerce projects commonly run level 4.

PIE: Position Independent Executable. A binary that can be loaded at an arbitrary address, which is what allows address space layout randomisation to apply to the program itself.

pkg: FreeBSD's binary package manager, installing prebuilt software produced from the curated ports tree.

pkgsrc: NetBSD's portable package-building system, carrying roughly 29,000 recipes. It does not require NetBSD underneath it, building the same software the same way on illumos, macOS and Linux, a portability that mirrors NetBSD's own.

PaaS: Platform as a Service. A managed environment where developers deploy code without managing servers, containers, or operating systems.

permissive: A licence family (BSD, MIT, Apache 2.0) that lets the receiver build on, fork, ship and relicense the code freely, keeping only attribution. The counterpart to copyleft, which carries its conditions into everything built on it.

PETSCII: The character set and block-graphics repertoire of the Commodore 64, used as an art form in its own right. Drawing in PETSCII means composing a picture out of the machine's fixed glyphs rather than free pixels.

pf: Packet Filter. The firewall in FreeBSD (and OpenBSD). Stateful, with anchors, tables, and a concise rule syntax.

PHP-FPM: FastCGI Process Manager for PHP. Manages a pool of PHP worker processes, each handling one request at a time. Typical memory: 40-128 MB per worker.

PinTheft: A 2026 Linux local-privilege-escalation vulnerability (CVE-2026-43494) that chains a reference-counting bug in the kernel's RDS sockets with io_uring to overwrite a setuid-root binary in memory and obtain a root shell.

Platform Security Processor: AMD's equivalent of the Intel Management Engine: an embedded ARM core inside the SoC running signed proprietary firmware with full system access, but without the direct network path the Intel ME carries.

pluralistic ignorance: Social psychology's name, going back to Katz and Allport (1931), for the stable arrangement in which each person privately does or believes a thing, assumes the others do not, and so everyone keeps the silence together. The engine of the AI disclosure gap.

PNAS: Proceedings of the National Academy of Sciences, one of the most-cited multidisciplinary scientific journals, established in 1914. Venue of the 2025 Duke study that measured the social evaluation penalty for AI use.

Podman: An open-source container engine maintained by Red Hat, first released in 2018. Container-compatible with Docker at the CLI level (podman run, podman build) but daemonless and rootless by default; each container is a direct child of the invoking shell rather than of a long-running daemon. Demonstrated that the Docker model does not structurally require a daemon.

Podman Desktop: Red Hat's graphical container tool, Apache-licensed and free. Daemonless by design: each container runs as a child of the process that started it, supervised by conmon, so there is no central root daemon to crash or to compromise.

Portage: Gentoo's package management system, which builds software from source according to ebuild scripts and lets the user select optional features through USE flags before anything is compiled.

POSIX: Portable Operating System Interface. A family of IEEE standards defining Unix-compatible APIs, shell behaviour, and utility conventions.

POSIX AIO: The POSIX standard's asynchronous I/O interface, an older way for a program to ask the kernel to perform input and output without blocking. On Linux it is the fourth of five accreted I/O interfaces, after select, poll and epoll and before io_uring.

PostgreSQL: An advanced open-source relational database with MVCC, JSON support, full-text search, and extensibility via custom types and functions.

Pouët: The demoscene's long-running community database and discussion site for productions, where releases are catalogued, rated and argued over at length.

preload scanner: A browser component that reads ahead through raw HTML while the main parser is blocked, starting downloads for resources it recognises. It works on markup, so resources reached only by executing JavaScript modules stay invisible to it.

Prettier: An opinionated code formatter for JavaScript, TypeScript, CSS and more. It exists because the language never fixed a canonical form, so the form has to be imposed afterwards by a tool.

Prix Ars Electronica: Annual award of the Ars Electronica festival in Linz, Austria, given across categories including computer animation and digital art. Conspiracy's Chaos Theory was nominated in 2007.

procedural generation: Producing content from code and mathematics at runtime instead of loading it from files. It is what makes a 64k intro possible, since a formula costs a few bytes where a texture costs megabytes.

Propel: An object-relational mapper for PHP that generates model classes from an XML schema. Because the classes are generated rather than written, the schema and the generated transfer objects need their own validation stages.

Public Choice: An award category decided by an open community vote rather than a jury. At the Scene.org Awards it went to 1995 by Kewlers and mfx for the year 2006.

Pwn2Own: A recurring computer-security contest in which researchers demonstrate working exploits against fully-patched software for cash prizes; a public benchmark of what is currently exploitable. CVE-2020-8835, an eBPF verifier flaw, won there in 2020.

postinstall: An npm lifecycle hook: a script a package declares to run automatically the moment it is installed, with the full rights of whoever ran the install. Convenient for setup, and the standard foothold for supply-chain malware.

Poudriere: The FreeBSD tool for building binary packages from ports inside clean, isolated jails, so a build process cannot reach the host that drives it.

Privilege Separation: A security architecture that splits a process into a small privileged monitor and a larger unprivileged worker. Limits damage when the worker is compromised. Pioneered by OpenSSH in 2002.

Product Liability Directive: The European Union's revised product-liability regime, Directive 2024/2853, applying from December 2026. It writes software, firmware and AI systems into the definition of a product under no-fault liability and shifts the burden of proof toward the producer in technically complex cases.

Prometheus: A time-series monitoring system with a pull-based model, PromQL query language, and built-in alerting.

procfs: The Linux /proc filesystem, a kernel interface exposed as files: writing to /proc/sys/kernel/core_pattern or /proc/sysrq-trigger changes kernel behaviour. Its writable surface is the seam the November 2025 runc break-outs escaped through, redirecting a mount into procfs.

provenance: A signed attestation recording how a software artifact was built, for example which pipeline produced it and from which source. Useful but not a trust boundary: provenance certifies the build, not that the identity permitted to publish is still in the right hands, as the Miasma attack showed.

PSE52: The realtime-controller profile of the POSIX standard (IEEE 1003.13), against which QNX holds a formal certification. Issued by the same bodies that keep the UNIX register, only against a different standard, which is how QNX claims genuine POSIX certification without being certified UNIX.

PureDarwin: A community project that assembles Apple's open-source Darwin into a bootable operating system independent of macOS; current builds run as a virtual-machine image.

PyCon: The annual Python community conference. Held in multiple countries, featuring talks, sprints, and community gatherings.

Parcel: A zero-configuration JavaScript bundler from 2017 that sold convenience where webpack sold configurability.

package-lock.json: The file npm writes to record the exact resolved version of every package in an installation, direct and transitive. Counting its entries is the honest way to learn how many packages a project actually brought in.

phishing: An attack that obtains credentials by imitating a trusted sender. The September 2025 npm compromise began with a message imitating a two-factor authentication reset, sent from a lookalike domain.

probe: A single point of instrumentation in a running system, which can be enabled to fire when execution reaches it. DTrace exposes tens of thousands of them; the 2004 paper puts even the smallest system at around thirty thousand in the kernel alone.

production system: A system carrying real users and real consequences, as distinct from a laboratory or test machine. The distinction matters because most measurement tools are acceptable on the latter and not on the former.

Q

pull request: A proposed change offered for review and merging. The unit that carries the approval field, and therefore the unit whose recorded history everyone downstream interprets.

QEMU: Quick Emulator. An open-source machine emulator and virtualiser, created by Fabrice Bellard in 2003. Provides device emulation and, with KVM, near-native virtual-machine performance. The userland half of the KVM/QEMU pairing used by Proxmox VE and many other platforms.

Quantum Software Systems: The Canadian company, founded near Ottawa, that began building QNX in 1982. The origin of one of the most widely deployed operating systems almost nobody can name.

R

RACK: Recent ACKnowledgement, a TCP loss-detection method that infers loss from the order and timing of acknowledgements rather than counting duplicates. Contributed to FreeBSD from Netflix's traffic work.

RAID: Redundant Array of Independent Disks: several drives combined so that the failure of one does not lose data. It was designed against a drive dying, and it has no instrument for a drive that returns wrong data while reporting success.

RAIDZ: ZFS's parity redundancy scheme. Unlike classic RAID 5 it writes every block as a complete stripe of variable width inside a transaction, which is why the write hole cannot occur.

RAII: Resource Acquisition Is Initialisation. A pattern where resources are tied to object lifetimes: acquired in the constructor, released in the destructor. Rust enforces this through ownership. No garbage collector needed.

rc.d: The BSD-style init layout: services are plain shell scripts in /etc/rc.d, enabled through rc.conf on FreeBSD or the execute bit on Slackware.

Red Hat Enterprise Linux: A commercially supported Linux distribution from Red Hat (RHEL), aimed at enterprise deployments with long support cycles and certified hardware. Like every distribution, an assembly of independently-governed projects selected, patched and integrated by the vendor rather than a single tree.

Redis: An in-memory data structure store used as database, cache, and message broker. Single-threaded, sub-millisecond latency.

Redox: A Unix-like operating system written from scratch in Rust, begun by Jeremy Soller in 2015. A microkernel with drivers and filesystems in user space; being written in Rust, whole classes of memory-safety bug are designed out. The microkernel discipline carried into the present, with no Unix blood.

regreSSHion: A remote unauthenticated code-execution flaw in the OpenSSH server (CVE-2024-6387), disclosed by Qualys in July 2024; a regression that reintroduced a previously fixed signal-handler race. Cited as a reminder that an unmaintained old system is a liability, not an heirloom.

RELRO: Relocation Read-Only. A linker option that marks parts of a binary's relocation data read-only after loading, closing a class of attacks that overwrite it.

replacement scanning: Scanning a paper document and then destroying the original, so that the scan becomes the legally binding record. Germany's federal security office ruled in March 2015 that image compression working by symbol coding, JBIG2 above all, is unsuitable for this workflow, because a substitution error leaves no second copy to check against.

reserved instance: A commitment to use a given cloud instance type for one or three years in exchange for a substantially lower rate. It cuts compute cost and leaves storage and traffic charges untouched.

Ring 0: The most privileged execution level of an x86 processor, where the operating-system kernel runs with full control of the machine. Code here can do anything, so it is the level every other protection depends on; running foreign code in Ring 0 is what makes the eBPF verifier load-bearing.

remote-access trojan: Malware (a RAT) that opens a covert remote-control channel to an attacker, allowing arbitrary commands, file access and data exfiltration from the infected machine. The axios npm compromise of March 2026 shipped a cross-platform one through a post-install script.

Reproducible Builds: An effort to make a build produce a bit-for-bit identical artifact from the same source, so that an independent party can rebuild a release and confirm the binary on disk matches the published source. A pillar of the responsibility line that node_modules lacks.

REST: Representational State Transfer. An architectural style for APIs using standard HTTP methods (GET, POST, PUT, DELETE) on resource URLs.

RISC-V: An open instruction-set architecture, originally from UC Berkeley, that anyone may implement without a licence fee. Its specification is open; its governing body, RISC-V International, sits in Switzerland.

RISC-V International: The non-profit foundation that governs the RISC-V specification. It moved its incorporation from the United States to Switzerland in 2020 to insulate the open ISA from any single state's trade policy.

Rolling Checksum: A hash that can be updated incrementally as a window slides across data. Enables rsync to find matching blocks in O(n) instead of O(n²). Based on Adler-32.

Rolling Release: A software distribution model where updates ship continuously rather than in discrete versions. No fixed release date, no frozen state. The system is always current, never finished.

rpm: The package format and low-level tool of the Red Hat family, comparable in role to Debian's dpkg: it installs and removes individual packages while dnf handles repositories and dependency resolution.

rsync: A fast, incremental file transfer utility. Transfers only the differences between source and destination using a rolling checksum algorithm.

RTOS: A real-time operating system, one whose response time can be bounded and proven, as safety-critical and embedded work demands. QNX is the best-known POSIX RTOS; LynxOS and VxWorks are others. Determinism tends to follow from a small kernel rather than from tuning a large one.

runc: The low-level Open Container Initiative runtime that actually creates Linux containers, used beneath Docker and Kubernetes. It sets up namespaces, cgroups and mounts as instructed; the November 2025 break-outs (CVE-2025-31133, -52565, -52881) turned its valid mount handling into a write into procfs.

Rust: A systems programming language emphasising memory safety without garbage collection, using ownership and borrowing rules enforced at compile time.

registry: A central index that stores and serves software packages for a package manager. The npm registry is the largest, free to publish to and free to install from; anyone can add a package, and that openness, with no responsibility line drawn between callers and what they pull in, is both its reach and its central security problem.

Rolldown: A Rust rewrite of Rollup, begun for Vite; the latest generation of the bundler lineage. The industry's newest answer to slow builds is, once again, a faster bundler.

Rollup: A JavaScript bundler from 2015 focused on ES modules and tree-shaking; its engine long underpinned Vite's production builds.

React DOM: The renderer that attaches a React component tree to the browser DOM, shipped as a package separate from React itself.

registry token: The credential that authorises publishing to a package registry. Shai-Hulud spread by harvesting these from build environments and publishing poisoned versions of whatever else the credential could reach.

reachability analysis: A filter applied to scanner output that asks whether a vulnerable code path can actually be reached from the application, in order to separate advisories that matter from those that do not.

RenderDoc: A frame debugger for graphics work. It captures a single frame of a running application and lets you step through every draw call and inspect the buffers, which is the only practical way to find out why a picture is wrong.

S

SaaS: Software as a Service. Renting access to software hosted by the vendor, paid via recurring subscription rather than a perpetual licence.

Sass: A CSS preprocessor adding variables, nesting, and mixins. Largely obsoleted by native CSS custom properties, nesting, and @layer.

Scene.org: The demoscene's central file archive and the body behind the annual Scene.org Awards, which recognise the year's outstanding productions by category and by public vote.

Scene.org Awards: The demoscene's own annual awards, voted on productions of the preceding year, including a Public Choice category decided by the community rather than by a jury.

scrub: A background pass that reads every block in a pool or array and verifies it. On ZFS a scrub can repair what it finds, because the same program holds both the checksum and the redundant copy.

Scrum: An agile framework using fixed-length Sprints, daily stand-ups, and defined roles (Product Owner, Scrum Master, Development Team).

seccomp: Secure Computing mode. A Linux kernel facility that restricts which system calls a process may invoke. Strict mode (2005) permits four calls. seccomp-bpf (2012) allows programmable filters via BPF programmes.

secret cyborgs: Ethan Mollick's name for employees who have automated real parts of their jobs with AI and tell nobody, because their organisation's rules taught them that disclosure is the risky option.

securelevel: A FreeBSD kernel setting that removes capabilities from the superuser itself once the system has started, so that certain operations become impossible rather than merely restricted.

sed: A non-interactive stream editor from Bell Labs, written by Lee McMahon in 1974. One of the small Unix tools that composes through pipes rather than by stacking layers, and small enough to have been finished rather than merely versioned.

SELinux: Security-Enhanced Linux, a mandatory access control implementation for the Linux kernel, originating at the NSA and now maintained as part of the kernel.

SemVer: Semantic Versioning. A versioning scheme using MAJOR.MINOR.PATCH where major means breaking changes, minor means new features, patch means bug fixes. The contract is voluntary and routinely violated.

sendfile: A system call that copies a file to a socket entirely inside the kernel, sparing the application the round trip through user space. The asynchronous variant contributed by Netflix allows the call to return before the data has been read from disk.

server-side rendering: Generating a page's HTML on the server and sending it to the browser ready to display, rather than shipping JavaScript that builds the page on the client. The default of the web before the SPA era, and the model the lean alternatives return to.

service worker: A script the browser runs in the background, between a page and the network, able to intercept requests and serve responses from its own cache. It is one of the ways a first visit can be given the assets a preload scanner never found.

Shadow AI: Employees' use of AI tools outside the channels their organisation sanctions or can audit, typically through private accounts. Cyberhaven measured roughly three quarters of workplace AI use running through such accounts in 2025, with about a third of the pasted data being sensitive company data.

Serverless: A cloud execution model where the provider allocates resources per request. You write functions, the vendor manages infrastructure.

shared responsibility model: The published division of duties between a cloud provider and its customer. The provider secures what sits beneath the instance; the guest operating system, packages, configuration and applications remain the customer's responsibility.

Shopware: A German open-source commerce platform built on Symfony, declaring 165 direct dependencies. Its repository carries 55 GitHub workflow files, one of which exists solely to warm the static-analysis cache.

SiFive: A US company that designs and licenses RISC-V processor cores, one of the earliest commercial RISC-V vendors.

signify: OpenBSD's signature tool, written by Ted Unangst in 2014, using Ed25519. It signs releases and packages; pkg_add verifies each file against its recorded checksum immediately after extraction, before doing anything with it.

silent data corruption: A stored block that comes back changed while every component reports success. NetApp recorded over 400,000 such checksum mismatches across 1.53 million drives, eight per cent of them discovered only during a RAID rebuild.

single sign-on: One authentication against a central identity provider that then grants access to many services, typically via SAML or OIDC. In business software it is frequently confined to the most expensive tier, which is why organisations end up there for reasons unrelated to the tool itself.

Single UNIX Specification: The written standard a system must conform to in order to be certified UNIX, maintained by The Open Group and aligned with POSIX; its current edition, Issue 8, aligns with POSIX.1-2024. It certifies the interface (the C library, the shell, the standard utilities), not the kernel beneath.

single-page application: A web application that loads once and then rewrites the page in the browser instead of requesting new documents from the server. It suits software people live in for hours and suits a product catalogue rather badly.

SiPearl: A French company building high-performance server processors for the European Processor Initiative. Its Rhea1, taped out in 2025 as the most complex chip designed in Europe, is built on licensed ARM Neoverse cores and fabricated in Taiwan.

Slackware: The oldest surviving Linux distribution, first released as version 1.00 on 17 July 1993 on twenty-four floppy disks and still maintained. Its package tools deliberately make no attempt to resolve dependencies, while keeping a complete plain-text record of every installed package.

SLSA: Supply-chain Levels for Software Artifacts, a framework of provenance and integrity guarantees for build pipelines (pronounced salsa). It raises the bar for tampering, but, as Miasma showed, a valid SLSA attestation certifies the pipeline that built an artifact, not that its publishing identity is uncompromised.

SmartBear: Software-tooling company whose study of 2,500 code reviews across 3.2 million lines at Cisco established the practical limits of human review: 200 to 400 lines in one sitting, with defect detection falling away beyond roughly 500 lines an hour.

SmartOS: An illumos distribution for cloud virtualisation, combining zones with a hypervisor, originally from Joyent.

SMIC: Semiconductor Manufacturing International Corporation, China's largest chip foundry. It has produced 5nm-class parts (the Huawei Kirin 9030) using deep-ultraviolet multi-patterning, without the extreme-ultraviolet tools restricted to it.

Snap: Canonical's cross-distribution package format, which bundles more per application than Flatpak's shared runtime model and installs through the snapd daemon.

snapshot: A read-only record of a filesystem at one moment. Under copy-on-write it costs almost nothing, because it merely declines to free blocks that already exist.

Socket: A behavioural supply-chain security tool that inspects package code for risky behaviour (network calls, file-system and shell access, install scripts) rather than waiting for a published advisory. It caught the node-ipc compromise, but is itself installed through npm into the environment it audits.

SoftBank: The Japanese holding company that has owned ARM since 2016. NVIDIA's attempt to buy ARM from SoftBank in 2020-2022 was blocked by regulators; ARM listed publicly in 2023 but remains majority SoftBank-owned.

Sonar: The company behind the SonarQube and SonarCloud static analysis tools, and publisher of the State of Code Developer Survey. Its 2026 edition found 96 per cent of professional developers do not fully trust generated code to be functionally correct.

SPA: Single-Page Application. A web app that loads one HTML document and rewrites it dynamically via JavaScript, avoiding full page reloads.

SPDX: The Software Package Data Exchange, a Linux Foundation project that maintains a canonical list of licence identifiers and their exact texts. Quoting a licence as SPDX-License-Identifier: BSD-2-Clause removes the ambiguity that plain-language references leave behind.

Specificity: The algorithm browsers use to determine which CSS rule wins when multiple rules target the same element. Based on selector weight: ID > class > element.

Spryker: A modular PHP commerce framework built from several hundred small packages, split into a shop front called Yves and a back office called Zed. Its B2C reference shop declares 266 direct dependencies and resolves to 1,202 packages, 899 of them Spryker's own modules.

SQLite: A self-contained SQL database engine stored in a single file. No server process. Handles terabytes with zero configuration.

src.conf: The FreeBSD configuration file governing the build of the base system and kernel. Its WITHOUT_ switches remove whole components before they are compiled, so the code is never present to be patched.

ss: The socket statistics tool from Linux's iproute2 suite, the designated successor to netstat.

SSH: Secure Shell. A cryptographic protocol for secure remote login, command execution, and tunnelling over untrusted networks.

SSR: Server-Side Rendering. Generating the full HTML of a page on the server before sending it to the browser, as opposed to client-side rendering.

Stack Overflow: The question-and-answer site for programmers, and publisher of the annual Developer Survey, the largest recurring census of the profession.

static analysis: Examining source code without running it, to find type errors, unreachable branches or rule violations. In languages with a strong compiler this work happens during compilation; elsewhere it needs a separate tool and a separate pipeline stage.

Steam Deck: Valve's handheld games console (2022), running the Linux-based SteamOS. The Linux counterweight in a console market otherwise dominated by FreeBSD-derived systems from Sony and Nintendo.

Stimulus: The small JavaScript framework in Hotwire (37signals) for the islands of a page that genuinely need client-side behaviour. Controllers attach to HTML via data attributes; deliberately modest, meant to complement server-rendered HTML, not replace it.

Stormshield: A French network-security vendor whose appliances run on FreeBSD. One of the security-appliance tier, alongside pfSense and OPNsense, that quietly runs BSD in the gap between the public internet and the office.

strict liability: Liability imposed without proof of fault or negligence: the claimant need only show the product was defective and caused harm. California's AB 316 pointedly does not create it; the EU Product Liability Directive applies a no-fault regime to products with digital elements.

subresource integrity: A mechanism by which a page states the expected hash of a script or stylesheet, so the browser refuses to execute a file that has been altered. Since 2025 an import map can carry this metadata alongside the names it resolves.

subvolume: Btrfs's equivalent of a dataset: an independently mountable filesystem tree inside the same pool, which can be snapshotted and, unlike a ZFS snapshot, may be writable.

supply chain: In software, the full chain of third-party code, registries, maintainer accounts and build steps a project depends on. A supply-chain attack compromises one of those links to reach everyone downstream.

SUSE: A German-founded Linux vendor and its enterprise distribution (SUSE Linux Enterprise, openSUSE). One of the long-established distributions that select, patch and integrate upstream components into a coherent system: an assembly process, not a single tree.

Swift: A compiled, statically typed language from Apple, used here only as a reference point: a compiled binary that does nothing starts in 4.2 milliseconds, against 64.7 for an empty Node process.

System V: The commercial Unix line developed by AT&T from 1983, ancestor of the certified commercial Unixes AIX and HP-UX. One of the two great branches of the Unix genealogy, alongside BSD.

systemd: The init system and service manager in most Linux distributions. Manages processes, logging, networking, and device events. Controversial for its scope.

single-threaded: Running on one thread, and therefore one core, at a time; the design Node.js chose in 2009 for safety, no shared-memory threads and no locks, at the cost of not using a multi-core machine on its own.

seed round: The earliest formal round of outside investment in a start-up, meant to get an idea off the ground before a Series A. npm, Inc. raised a 2.6-million-dollar seed round led by True Ventures in February 2014.

Series A: The first substantial priced round of venture funding a start-up raises after seed capital, usually to scale a model that is already working. npm, Inc. raised an eight-million-dollar Series A in April 2015.

sourcemap: A file that maps compiled, bundled or minified code back to the source a human wrote, so that debugging production means translating through the build step's output.

supply chain attack: An attack that compromises a dependency, a build system or a distribution channel rather than the target itself, so that malicious code arrives through a route the target already trusts.

SLSA Build Level 3: The tier of the Supply-chain Levels for Software Artifacts framework at which a build runs on hardened, isolated infrastructure and produces signed provenance that the build itself cannot forge. In spring 2026 a worm minted valid attestations at this level for its own malicious packages.

state of the art: A legal test rather than a compliment. It appears in Article 32 GDPR and Article 21 NIS2, and is defined on a three-stage ladder from the 1978 Kalkar decision as the best-performing measure available on the market that achieves the legal protection objective. It sits above the generally accepted rules of technology and below existing scientific knowledge and research.

Sysdig: A cloud security vendor whose annual usage report measures container vulnerabilities in the field, distinguishing what sits in a registry from what is actually reachable at runtime.

sync tracker: A tool that stores curves of values against a musical timeline, so that a running production knows where the music is at any instant and can cut, move or colour accordingly.

shader: A small program that runs on the graphics processor to decide the colour of pixels or the position of vertices. The building block of nearly every modern demo effect.

Solaris 10: The 2005 release of Sun's Unix in which DTrace first shipped, alongside ZFS and Zones. The release that established dynamic instrumentation as part of a base system rather than a product to procure.

T

tape-out: The point at which a finished chip design is sent to a foundry for manufacture; the milestone SiPearl's Rhea1 reached in 2025.

TCP/IP: The core networking protocols of the internet, whose reference implementation Berkeley shipped in 4.2BSD in 1983; every modern operating system on the internet uses what Berkeley wrote.

Terraform: An infrastructure-as-code tool by HashiCorp. Declares cloud resources in HCL files and manages their lifecycle.

The Gathering: A Norwegian computer party running since 1992, historically one of the major demoscene events in Scandinavia alongside its competitions for demos and intros.

Tokio: An asynchronous runtime for Rust that drives non-blocking I/O and schedules tasks across all cores from a single binary, without an external process supervisor.

Time to Interactive: A web-performance metric measuring how long until a page can reliably respond to user input. A page heavy with client-side JavaScript can render and yet stay unresponsive; reducing the script is the most direct way to improve it.

TLS: Transport Layer Security. The cryptographic protocol securing HTTPS, email, and other network traffic. Successor to SSL.

tmux: A terminal multiplexer. Runs multiple shell sessions in one terminal, supports detaching and reattaching, split panes, and session persistence.

TOP500: The twice-yearly ranking of the world's five hundred fastest supercomputers, published since 1993. Every machine on the list has run Linux since November 2017, when the last two non-Linux systems dropped off it; a plain measure of how far the kernel reaches at the largest scale.

touchless rate: The share of documents an accounts-payable process handles without any human contact. Best-in-class finance operations report eighty to ninety-five per cent, which removes the last point at which a wrong figure would have been read by a person.

transitive closure: The full set of dependencies a project pulls in: not only the packages you declared, but everything they depend on, recursively. A package.json of 30 to 50 entries routinely resolves to a transitive closure of well over a thousand packages.

transpiling: Translating source code into different source code of comparable level, typically a newer language dialect into an older one. It is the line that separates bookkeeping from building: a process that hashes files writes a catalogue, a process that transpiles ships something you did not write.

TSMC: Taiwan Semiconductor Manufacturing Company, the world's largest contract chip foundry and the dominant maker of leading-edge silicon, including Europe's SiPearl Rhea1.

Turbo: The navigation half of Hotwire (37signals): it intercepts link clicks and form submissions, fetches the new HTML over the wire, and swaps it into the page without a full reload. No client-side router, no virtual DOM.

TypeScript: A typed superset of JavaScript that compiles to plain JS. Adds static type checking at build time.

typosquat: A malicious package given a name deliberately close to a popular one, so that a typo, an autocomplete or an injected dependency line pulls in the impostor instead of the real library. easy-day-js was a typosquat of dayjs.

transitive dependency: A package a project does not depend on directly, pulled in because something it depends on depends on it. A modern install resolves a whole tree of them, so most of what lands in node_modules was never chosen by name.

True Ventures: An early-stage venture capital firm based in San Francisco. Led npm, Inc.'s USD 2.6 million seed round in February 2014.

type stripping: Running TypeScript by deleting its type annotations instead of compiling: the types are replaced with whitespace and the remaining JavaScript runs directly. Node.js has shipped it unflagged since version 23.6, January 2025.

TeleTrusT: IT Security Association Germany. Publishes, together with ENISA, the reference guideline on what state of the art means in IT security law, last revised in September 2025.

The T.J. Hooper: A 1932 decision of the US Court of Appeals for the Second Circuit, 60 F.2d 737, in which Judge Learned Hand held that industry custom is no defence: a whole calling may have unduly lagged in the adoption of new and available devices, and courts must in the end say what is required.

tracing: Recording what a program actually does as it runs, at chosen points, rather than sampling it statistically or reasoning about it from the outside.

U

UEFI: Unified Extensible Firmware Interface, the modern replacement for the BIOS: the system firmware that initialises hardware and hands control to the operating-system bootloader. Some hardware admits open alternatives such as coreboot; much does not.

Ultrix: DEC's Unix flavour for its own hardware, one of the proprietary workstation Unixes of the 1980s Unix wars.

UNIX: The registered trademark, held by The Open Group, for operating systems certified against the Single UNIX Specification. Written in capitals it denotes the mark; written Unix it denotes the wider family. Not a roof over that family but a certification mark, kept deliberately narrow: it sits only on tested, fee-paying products, and the holder disowns loose use of the word.

Unix Philosophy: Design principles favouring small, composable programs that do one thing well, connected via text streams.

Unix System Laboratories: AT&T's subsidiary, spun out in 1991, that held the UNIX trademark and the System V source before both passed to Novell in 1993. The first owner in the trademark's chain of custody.

UNIX System Services: The certified-UNIX component of IBM's z/OS: a POSIX environment layered on top of the mainframe MVS kernel. The part of z/OS that holds the certificate, proof that a system can speak Unix at the surface while being a mainframe all the way down.

UNIX V7: The stricter brand level of the UNIX certification, corresponding to the Single UNIX Specification version 4 (POSIX.1-2008). IBM's AIX 7 is the only product on the register certified at this level; macOS sits one rung lower, at UNIX 03.

Unix wars: The 1980s period in which DEC, IBM, HP, Sun, SGI, NeXT and others each shipped an incompatible proprietary Unix flavour for their own hardware; the fragmentation POSIX was created to bridge.

unixoid: A Unix-like system: one that rebuilt the Unix design from resemblance without inheriting a line of Bell Labs or Berkeley code. Linux is the most widely deployed unixoid, QNX another. A unixoid resembles Unix without being Unix by descent.

upstreaming: Contributing a local modification back into the project it came from, so that future releases carry it. The alternative is a private patch set that has to be reapplied and retested against every new version, which is why upstreaming is usually the cheaper path.

USE flag: Gentoo's mechanism for selecting which optional features a package is compiled with, set globally or per package. The FreeBSD Ports Collection calls the equivalent mechanism options.

userland: Everything that runs outside the kernel: the C library, the shell, the standard utilities and the applications. On Linux the userland is supplied separately from the kernel (GNU, musl, Bionic, BusyBox); in a BSD base system it is maintained in the same source tree as the kernel.

UiPath: Robotic process automation vendor. Its packages were among the 172 taken across npm and PyPI in the supply chain campaign of April and May 2026.

USENIX: The Advanced Computing Systems Association. Its Annual Technical Conference is where the DTrace paper, Dynamic Instrumentation of Production Systems, was presented in 2004.

V

Variform: Kewlers' breakthrough demo, shown at Assembly 2002, which took several Scene.org Awards and established the group's reputation years before their 2006 farewell.

vCPU: A virtual CPU as counted by cloud providers, which on current x86 instances corresponds to one hardware thread rather than one physical core. Two vCPU therefore match one core with simultaneous multithreading.

vdev: A virtual device in a ZFS pool: a mirror, a RAIDZ group or a single disk. Pools are built from vdevs, and redundancy is a property of the vdev rather than the pool.

veriexec: A file signing and verification scheme, present in FreeBSD as mac_veriexec. A list of paths and hashes is loaded into the kernel, which then verifies contents at exec and open, at four levels of strictness up to refusing anything unsigned.

Version 6: Unix Version 6 (V6), released by Bell Labs in 1975, the first version to spread widely outside the Labs and the subject of Lions' line-by-line Commentary.

vigilance decrement: The measured decline in detection performance during sustained monitoring. Norman Mackworth demonstrated it in 1948 with observers watching a clock hand for two hours: accuracy fell by ten to fifteen per cent within the first half hour and continued to decline. No training regime has been found that removes it.

virtual DOM: An in-memory representation of the page that a framework such as React diffs against the real DOM to decide what to update. A core mechanism of single-page-application frameworks, and one that hypermedia approaches like HTMX deliberately do without.

verifier: In eBPF, the static analyser that inspects a loaded program's bytecode before it runs and tries to prove it cannot access kernel memory unsafely: the single gate between foreign code and Ring 0, and a recurring source of privilege-escalation bugs, since a flaw in the proof engine is a hole in the kernel.

Vite: A frontend build tool using native ES Modules for instant dev server startup and Rollup for production builds. Replaces Webpack.

VNET: Virtual Network Stack in FreeBSD. Gives each jail its own interfaces, routing table, and firewall rules. Kernel-native network isolation without overlay networks.

W

wabi-sabi: A Japanese aesthetic that finds beauty in the imperfect, the impermanent and the worn, described for Western readers by Leonard Koren in 1994. In engineering terms, the honoured wear of a coherent maintained thing, distinct from the unmanaged decay of one no one owns.

wavetable synthesis: A sound-synthesis technique that builds audio by reading through waveforms rather than replaying recorded samples. In size-constrained demos the waveforms are themselves produced in code, so no audio files are needed.

WebAssembly: A binary instruction format for a stack-based virtual machine. Runs near-native speed in browsers alongside JavaScript.

WebKit: The browser engine Apple forked from KHTML in 2001. It powers Safari, the WKWebView system web view on Apple platforms and WebKitGTK on Linux, and it is the ancestor of Blink.

WebKitGTK: The WebKit port used as the system web view on Linux desktops. Its version is whatever the distribution shipped, which is the practical reason cross-platform frameworks end up bundling an engine anyway.

Webpack: A JavaScript module bundler that resolves dependency graphs and outputs optimised bundles. Largely replaced by Vite and native ES Modules.

WebSocket: A persistent, full-duplex communication channel over a single TCP connection, enabling real-time data exchange between browser and server.

WebView2: Microsoft's system web view on Windows, based on Blink and distributed on an evergreen channel, so that applications using it receive engine updates from Microsoft rather than shipping their own.

WireGuard: A modern VPN protocol using state-of-the-art cryptography. One C file, ~4,000 lines, replaces IPsec and OpenVPN.

webpack: The bundler that defined the build-step era. Begun by Tobias Koppers in March 2012 as a side project of a master's thesis, version 1.0 in February 2014; it faked modules before browsers had them and became the default toolchain of a decade.

WKWebView: The system web view on Apple platforms, based on WebKit. It arrives with the operating system and is updated with it, which means an application using it does not carry or patch its own engine.

Work Trend Index: Microsoft and LinkedIn's annual survey of the working world. The 2024 edition measured 75 per cent of knowledge workers using generative AI at work, 78 per cent bringing their own tools, and half declining to admit use on their most important tasks.

X

WorkCentre: Xerox multifunction printer and scanner range, standard office equipment in administrations, practices and engineering firms. Several model lines carried the 2013 JBIG2 character-substitution fault.

write hole: The failure mode of classic RAID 5: if power is lost partway through writing a stripe, the data and its parity no longer agree, and nothing reports it. It surfaces later during a rebuild, when the parity reconstructs rubbish with complete confidence.

X/Open: The industry consortium that received the UNIX trademark from Novell in 1993 and merged with the Open Software Foundation in 1996 to form The Open Group. Custodian of the mark in the years between AT&T and the present.

Xbox 360: Microsoft's games console, released in 2005. Through XNA it briefly became the most accessible closed platform of its generation for developers without a publishing deal.

XDP: eXpress Data Path: an eBPF hook that processes network packets at the earliest point in the Linux networking stack, close to the driver, for very high throughput. One of the capabilities that makes eBPF genuinely useful, alongside Cilium's networking.

x86: The dominant desktop and server processor architecture, designed by Intel and also built by AMD under licence, held behind a patent thicket dense enough that the practical number of vendors is two.

Xerox: American document-technology company. In 2013 its WorkCentre and ColorQube scanners were found to silently alter digits in scanned documents through faulty JBIG2 pattern matching, across four product families and dozens of model lines.

XFS: A high-performance journalling filesystem, the default on Red Hat systems; like ext4 it sits above the volume manager rather than incorporating it.

XNA: Microsoft's managed framework and toolkit for game development in C#, published from 2006. XNA Game Studio Express was free and aimed at students and hobbyists, and for a few years it allowed code written at home to run on a retail Xbox 360.

XuanTie: Alibaba's T-Head line of RISC-V processors; its C930, announced in 2025, is a RISC-V server CPU for AI and high-performance workloads.

Z

yum: The former package manager of Red Hat systems, since replaced by dnf.

zero-day: A vulnerability exploited in the wild before a fix is available. Google shipped fixes for five actively exploited Chrome zero-days in the first half of 2026 alone, which is the record any application bundling that engine takes on.

ZFS: Zettabyte File System. A combined filesystem and volume manager with checksumming, snapshots, clones, and built-in RAID.

Zscaler: A cloud-security company whose service edge has run on FreeBSD. Part of the FreeBSD security-appliance tier that handles a large share of corporate traffic between the public internet and the office.

buildworld: The make target that compiles the entire FreeBSD userland, the C library and the system tools from the single source tree, before make installworld puts them in place. With make buildkernel it rebuilds the base as one whole.

Fedora: A community Linux distribution sponsored by Red Hat, run as the upstream proving ground for Red Hat Enterprise Linux. One of the two best-known Red Hat-based systems.

man hier: A FreeBSD manual page documenting the layout of the filesystem: where the kernel and C library live, and where locally added software is kept apart from the base. It ships in the base system, so it describes the very tree it is part of.

NixOS: A Linux distribution built on the Nix package manager, in which the whole machine's configuration is written declaratively into one functional expression and built reproducibly. One of the newer distributions that rethink how a system is assembled.

ports: FreeBSD's collection of third-party software, kept deliberately apart from the base system. Each port is a recipe to build and install an application, so the line between the system and what you added to it stays clear; 37,958 as of the Q1 2026 status report.

Red Hat: An American open-source software company, now part of IBM, whose packaging and system conventions define one of the major Linux families. Red Hat-based systems include Fedora and Red Hat Enterprise Linux.

RHEL: Red Hat Enterprise Linux, the commercial, long-support Linux distribution from Red Hat. With Fedora, one of the two best-known members of the Red Hat family.

Silverblue: Fedora Silverblue, an immutable, image-based variant of Fedora in which the operating system is delivered as a versioned, read-only image and updated atomically. One of the newer takes on how a Linux system is shipped.

Ubuntu: A widely used Debian-based Linux distribution released by Canonical since 2004. The best known of Debian's many relations, and a common first encounter with the Debian way of arranging a system.

zero probe effect: The property that an instrumentation facility costs nothing at all while disabled, so that the system behaves exactly as if the facility were not present. Stated in the 2004 DTrace paper as a precondition for anything that is to be switched on in production.

People

A

Norman Mackworth: British psychologist who investigated sustained attention for the Royal Air Force during the Second World War. His 1948 clock test established the vigilance decrement and remains the founding paradigm of vigilance research.

Chris Mason: The engineer who started Btrfs in 2007 after moving from SUSE to Oracle. He has said the motivation was less about ZFS than about Linux keeping up with the storage devices of the following decade.

Jens Axboe: Linux kernel engineer, maintainer of the block layer and author of io_uring (merged in Linux 5.1, 2019) and the fio benchmark tool.

Jonathan Lemon: FreeBSD developer who designed and wrote kqueue, the unified event-notification interface shipped in FreeBSD 4.1 in 2000 and later adopted by macOS and the other BSDs.

Jonathan Anderson: Computer scientist, co-creator of Capsicum with Robert Watson. Their 2010 USENIX Security paper introduced capability-based sandboxing to FreeBSD. Now at Memorial University of Newfoundland.

Andrea Arcangeli: Linux kernel developer. Created the original seccomp strict mode in 2005 (Linux 2.6.12), permitting only four syscalls. Also known for work on KVM and Transparent Huge Pages.

B

Lisanne Bainbridge: British cognitive psychologist. Her 1983 paper “Ironies of Automation” showed that automating most of a task leaves the operator the parts that cannot be automated and the duty to take over when it fails, just when their skills have decayed for want of practice.

Kent Beck: Creator of Extreme Programming and co-inventor of story points with Ron Jeffries. Wrote the SUnit testing framework that became JUnit. Advocate of simplicity in software design.

Fabrice Bellard: French computer scientist. Created FFmpeg, QEMU, TinyCC, JSLinux, and Bellard's formula. Computed 2.7 trillion digits of pi on a desktop PC. Builds fundamental tools, then moves on.

Jeff Bonwick: Engineer at Sun Microsystems who designed the Slab Allocator and co-created ZFS with Matthew Ahrens. Built the filesystem that trusts mathematics over hardware.

D

Edsger Dijkstra: Dutch computer scientist (1930-2002). Described the THE multiprogramming system in 1968 as a strict hierarchy of levels, an early discipline of layering to contain complexity, and shaped structured programming, the shortest-path algorithm and much of the field's early rigour.

Cory Doctorow: Canadian-British author, journalist, and digital rights activist. Coined 'enshittification' in November 2022. Published on Pluralistic. Won Word of the Year 2023. Author of Little Brother, Walkaway, and the 2025 book Enshittification.

Stephen Dolan: Creator of jq (2012). PhD in Algebraic Subtyping at the University of Cambridge, supervised by Alan Mycroft. Now at Jane Street, working on the OCaml compiler. Wrote a functional language for JSON in 510 KB of C.

Will Drewry: Google engineer who introduced seccomp-bpf in Linux 3.5 (2012). Extended seccomp from a binary four-syscall mode to programmable BPF-based filtering, enabling practical process sandboxing on Linux.

Dubmood: Swedish chiptune musician and demoscene legend. Two decades of tracker music across Amiga, C64, and PC platforms. Composed the soundtrack for Razor 1911's 'The Scene Is Dead' (2012).

F

Rich Felker: Author of musl libc, a clean-room lightweight C standard library for Linux. Vocal advocate for POSIX correctness and minimal PID 1 design.

Michael Färber: Computer scientist. Published the first formal specification of the jq language in 2024 (arXiv:2403.20132), twelve years after Dolan wrote the implementation. Also wrote jaq, a Rust reimplementation of jq that is 5-10x faster.

Martin Fowler: Software author and Chief Scientist at ThoughtWorks. Coined 'Microservices' with James Lewis. Wrote Refactoring, Patterns of Enterprise Application Architecture, and the 'Monolith First' essay.

Nat Friedman: American technology executive who was GitHub's CEO from 2018 to 2021, following Microsoft's acquisition. Announced GitHub's purchase of the npm registry in March 2020, with the promise that the public registry would remain free.

H

David Heinemeier Hansson: Creator of Ruby on Rails. Co-founder of Basecamp and HEY. Now advocates software ownership over SaaS subscriptions with ONCE.

Rich Harris: Creator of Svelte and Rollup. Former graphics editor at The New York Times. Demonstrated that the Virtual DOM is 'pure overhead'.

William Hoskins: Director of the Office of Technology Licensing at the University of California, Berkeley, who signed the letter of 22 July 1999 that struck the advertising clause from the BSD licence.

J

Ron Jeffries: Co-creator of Extreme Programming. Agile Manifesto signatory. In 2018, wrote 'Developers Should Abandon Agile' — a rare recantation from an original author.

K

Poul-Henning Kamp: Danish FreeBSD developer. Created Jails (1999), the GEOM storage framework, and Varnish Cache. Known for phk's bikeshed argument and decades of kernel-level systems work.

Phil Karlton: Netscape and Silicon Graphics engineer (1947-1997), credited with the line that there are only two hard things in computer science: cache invalidation and naming things. The quip was first recorded publicly on Tim Bray's site.

Greg Kroah-Hartman: Senior Linux kernel maintainer responsible for stable releases. In 2024, removed Russian-affiliated maintainers from the MAINTAINERS file on compliance grounds.

L

James Lewis: Software architect at ThoughtWorks. Co-coined the term 'Microservices' with Martin Fowler in their 2014 article defining the architectural style.

Little Bitchard: Finnish demoscene musician, credited with the main part of the soundtrack to 1995 by Kewlers and mfx, which won Best Soundtrack at the Scene.org Awards; the closing part of that soundtrack is by 1in10.

M

Alan Mycroft: Professor of Computing at the University of Cambridge. Supervised Stephen Dolan's PhD in Algebraic Subtyping. Co-designed the Nanopass framework and contributed to static analysis research spanning four decades.

Ethan Mollick: Professor at the Wharton School studying AI and work, author of Co-Intelligence and the One Useful Thing newsletter. Coined the term secret cyborgs for employees who automate their work with AI and stay silent about it.

Sebastian McKenzie: Creator of Babel: released in September 2014 as 6to5, the compiler that translated tomorrow's JavaScript for yesterday's browsers and became standard equipment of the build-step era. Later the initial author of Rome.

P

Pacioli: Luca Pacioli, Italian mathematician who published the first printed description of double-entry bookkeeping in 1494. The method is the earliest widely adopted instrument that gives a numerical error a detectable shape.

David Parnas: Canadian software engineer who, in a 1972 paper on decomposing systems into modules, coined the term information hiding: a module should hide a design decision that is likely to change. One of the foundational ideas of modular software design.

Lennart Poettering: Creator of systemd and PulseAudio. His replacement of SysVinit with a monolithic init system remains one of the most divisive decisions in Linux history.

R

Theo de Raadt: Founder and leader of the OpenBSD project. Forked OpenSSH in 1999. Three decades of security-first development, auditing every line, removing attack surface instead of adding features.

S

Salvatore Sanfilippo: Sicilian developer known as antirez. Created Redis in 2009, a single-threaded in-memory data structure server. Maintained it personally for fifteen years.

Isaac Schlueter: The American software engineer who created npm in 2010 and, in 2014, co-founded npm, Inc. with Laurie Voss to run the registry. An early and prominent contributor to the Node.js project.

Ken Schwaber: Co-creator of Scrum with Jeff Sutherland. Founded the Scrum Alliance, later Scrum.org. Admitted that 75 per cent of organisations using Scrum will not succeed.

T

Dave Thomas: Agile Manifesto signatory. Co-author of The Pragmatic Programmer. Declared 'Agile is Dead' in 2014, arguing the word had been hijacked by consultancies.

Ken Thompson: Co-creator of Unix (1969), the B programming language, and the first cron (1975) at Bell Labs. Co-designed UTF-8 and Plan 9. Turing Award winner (1983) with Dennis Ritchie.

Linus Torvalds: Creator and principal developer of the Linux kernel. Also wrote Git. Maintains kernel development from Portland, Oregon.

Andrew Tridgell: Australian computer scientist. Created rsync (1996), Samba (Windows file sharing on Unix), ccache, and co-developed Git's delta compression with Linus Torvalds.

Dominic Tarr: British developer and prolific author of small Node.js modules. Maintained event-stream unpaid from 2012 and handed it to a volunteer in 2018, which became the textbook case of a maintainer handover used as an attack route.

Learned Hand: American appellate judge (1872-1961), among the most cited jurists never to sit on the Supreme Court. Wrote The T.J. Hooper in 1932, establishing that conformity with industry practice does not by itself discharge a duty of care.

V

Paul Vixie: Author of Vixie cron (1987), BIND (the DNS server running a third of the internet), and numerous RFCs. Internet Hall of Fame inductee (2014). The five-field crontab syntax is his.

Laurie Voss: Co-founder of npm, Inc. with Isaac Schlueter in 2014, and long the company's data and operations lead, building a business around the npm registry.

Patrick Volkerding: Creator and maintainer of Slackware, which he released in July 1993 after improving the Softlanding Linux System for his own use. He has kept the distribution's package tools free of automatic dependency resolution for more than three decades.

W

RLHF: Reinforcement learning from human feedback, the training stage that shapes a raw predictive model into one that answers helpfully and refuses sensibly. It is much of a model's character, and one of the layers most often withheld even when the weights are released.

Philip Walton: Engineer at Google working on web performance and the author of the reference account of cascading cache invalidation, which documents why fingerprinted filenames written into importing files multiply a single change across a dependency chain. His own recommended remedy is an indirection layer, of which he calls import maps the simplest to implement.

Robert Watson: Computer scientist at the University of Cambridge. Co-created Capsicum with Jonathan Anderson (2010, Best Student Paper at USENIX Security). Also contributed to FreeBSD's MAC framework and TrustedBSD.

Y

Jeremy Wolfe: American visual-attention researcher at Harvard. His 2005 Nature paper showed that rare targets are missed far more often than common ones, with miss rates of thirty per cent and above at low prevalence against seven per cent at high prevalence.

Greg Young: Popularised Event Sourcing and CQRS as architectural patterns. Author of Versioning in an Event Sourced System.