EGreg

It is just embedded in a market system, just as, say, USSR or Cuba was embedded in the global economy.

That doesn’t make it not socialist.

And not all socialism is “bad”. It has to do with whether it is voluntary or not. I am a libertarian, and I fully support communes, housing cooperatives, credit unions and the like. I consider the lack of a superfluous extractive landlord or shareholder class a feature.

Come to think of it, Orwell’s 1984 perfectly encapsulates what corporations actually do — even in his own time. Down to the groupthink, wrongthink, doublethink, doublespeak, all of it. Synergy! Concerned. Trust.

In USA we only have a few requirements from the E-SIGN act:

Key Legal Requirements

Intent to Sign: Parties must show a clear, provable action to sign the document. Electronic Consent: Parties must agree to use electronic records, with consumer transactions requiring specific advance disclosures.

Signature Association: The system must capture an audit trail or text linking the signature to the specific document.

Record Retention: Contracts must be accurately stored and remain accessible for future reference by all authorized parties.

Consumer Disclosure Rules

Hardware/Software Notice: Tell users what tools they need to access and save the records.

Paper Copy Rights: Inform users how to get paper copies and whether any fees apply.

Withdrawal Details: Explain how consumers can change their mind and cancel their electronic consent.

http://openclaiming.org/

I know that there are some sites, like proofofexistence.com that acts like a notary service anchored to Bitcoin. Is that similar?

To me, it seems that there are some secret things you might want to hash and sign, and timestamp, like agreements that you can prove that both parties signed them, etc.

Our generation thinks we're so much "smarter", but we're living on an ecological credit card that our children will have to pay, not to mention many of the planet's ecosystems, just so we can all have "memories of actually being in Venice" rather than simply a picture of us in Venice, which in the end is the artifact we have. (If we are that insistent on "being everywhere" and checking off a bucket list, perhaps "Total Recall" was onto something LMAO.)

I grew up reading novels and plays

Inspector Lestrade and Holmes were speaking:

— What’s up?

— Not much

— Cool.

I found that out when reading the recent articls about counterexamples.

Well, I can do you one better — you can compile the entire server and PHP code to a binary, as it says in the README, so you won’t need ANYTHING once you download that LOL.

Also, since you wrote that comment, I also added supports for websockets (wire-compatible with socket.io) and rooms, all of it with the same approach: put files in folders and it “just works”. What is so bad about that?

Also, can you please list the obvious security vulnerabilities here?

1. To share an innovation we developed for ourselves, that can help the wider PHP community (after all, 80% of the Web still runs on PHP!)

2. To pioneer a new approach that can help a bunch of people, like Caddy or FrankenPHP had once pioneered its own approaches

3. To show that PHP by itself can be enough to not only build a decent web server, but actually surpass NGINX together with PHP-FPM both in memory and speed, which surprised us. The memory particularly turns out to be the bottleneck and Qbix Server finally helps solve the 10K issue for PHP!

4. To make a new and very simple way to cleanly build websites and APIs that leverage both HTTP Requests and WebSockets: simply drop appropriately named files in the right places! It is optionally opinionated so the shapes of new codebases using the server, instead of all being ad-hoc, can be standardized along the same lines our own are.

5. To get feedback from the HN community. Speaking of that:

Could you please list the reasonably obvious security issues, so they can be fixed?

Out of all runtimes powering web servers today, I like PHP the most for its shared-nothing architecture, preventing a whole lot of security bugs by default. I think making it evented for HTTP is clutching defeat from the jaws of victory. You win very little, because most web servers code is I/O bound.

With 8GB RAM and no virtual memory swapfile, Qbix Server allows you to handle, say, 1600 concurrent HTTP requests and 40,000 websocket connections simultaneously, so having an HTTP handler PHP process exit and be respawned via fork is cheap (0.5ms to reset it to a state with all the bootstrap already done). Processes simply yield when doing I/O and you let the OS handle the I/O waiting instead of green threads in an event loop. It’s almost as fast, and frankly, dynamic PHP can be 2% or less of all your requests, when you start aggressively sending Cache-Control headers causing this Qbix webserver to cache your PHP results, as well as nginx/varnish and CDNs upstream too.

Yes, these days I work with AI (Claude chat, usually) to do all the "last mile" things, like packaging, writing READMEs, etc. I iterate, do quality control, and I asked it specifically to put emojis in titles. But the actual architecture, and the 10+ years of code in the framework, were hand-rolled.

I just realized I can extract the web-server under an MIT license and gift it to everyone. So I put it up on github and then told HN about it. That's all!

PS: I very much appreciate constructive feedback. Your suggestions have been incorporated: https://github.com/Qbix/webserver/commit/618638ecdc9097722fd...

For one thing, developers who actually code in PHP need a web server. This "just works" out of the box. No need to install Go, or Nginx, or php-fpm, or configure proxy_pass, or certificates, etc. etc. Yes, caddy also handles certificates, but what about the rest?

There is a section in the README comparing this to FrankenPHP, Swoole, etc. You can see where this approach actually beats them. In fact, instead of simply declaring "it sux", why not try it first? It takes 5 minutes. Download and launch.

And a word about about safety. FrankenPHP workers persist between requests, which means every static variable, singleton, and global cache in your app -- and every library you use -- becomes a potential data leak between users. Qbix Server gives you the same performance benefit (zero bootstrap cost) via fork-after-preload, but each request gets its own process. When it's done, everything is gone. No audit needed.

This server is not competing with nginx for serving static files. It's competing with nginx+php-fpm for serving PHP, and there, it wins by a large margin.

You might have a very narrow definition of "serious use". This isn't just for people who want to serve static files. This is for people who want to host PHP applications without having to manually install nginx, configure its proxy_pass to php-fpm, etc.

In some ways, in real-world scenarios, this server would actually be faster than nginx with php-fpm. Because it can prefork processes after it has loaded classes, so all that bootstrapping your PHP scripts do having to load classes over and over, (even with PHP's opcode caching) can be on the order of tens of milliseconds. That's saved per call.

You can still put nginx in front of this, by the way, for much faster https. But you can also put CloudFlare, CloudFront, or any other CDN in front of it instead, and get all the advantages of reverse proxies, etc.

But, all by itself, this server handles reverse proxy, caching (including Cache-Control headers, ETags, etc.) and, very importantly, it allows your PHP to do two things that other webservers don't:

1. Send X-Accel-Redirect headers in order to enforce true access control for static files, based on cookies etc. Gone are the days you have to host files publicly at unguessable URLs, that people can share with others.

2. Send X-Cache-... headers that actually let the server cache parts of the page rather than the whole page. When you invalidate one thing, it intelligently invalidates all the pages that transitively depend on that thing.

There's a lot more to it. You commented 2 minutes after it was posted, so I imagine you haven't actually read the README. Go and read it. Yes, it's for "serious use."

Want to connect and discuss it? https://calendly.com/safebotsai

In the USSR, people of multiple generations grew up watching the same things, e.g. "Nu Pogodi"

In the USA, every 10 years there's some new genre of music, or artists being promoted.

Homer is known because back then, very few people could even read - let alone write. Actually, Homer couldn't, I think.

"I'll eat my hat". No, you won't.

"I'll give you a million dollars." Sir, you likely don't have a million dollars to just give away like that. And even if you had, you wouldn't do it.

So, one of us is making actual, true claims based on years of hard work. You may consider them grandiose -- and you're entitled to your opinion -- but I can back it up with actual actions. Your claims are... well, just false.

Here is "someone credible" mentioning Safecloud just 2 weeks ago, and by mentioning, I mean writing an article about it appearing on their front page: https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...

Here are their own "grandiose" claims about themselves:

Help Net Security is an industry-leading cybersecurity publication with over 350,000 readers per month. Since 1998, we have been committed to providing high-quality information to our audience through publishing relevant original content and analyzing market trends. https://www.linkedin.com/company/helpnetsecurity

Okay, that was Safecloud, not Safebots. But what if, say, I give a talk at a conference about Safebots, or it's starting to get covered in magazines? If we get a thousand users all using safebots? Ten thousand? What if Robert Scoble interviews me, or a bunch of influencers start using it? At what point can you say "someone credible mentioned safebot and here's your million dollars" LOL

And I don't mean mention in a dubious way, like when the BBC covered our unfortunate flirtation with using monero mining to pay for our apps... somehow our app was used by enough people around the world that Newsweek, the BBC, 9to5Mac, ArsTechnica (which broke the story) etc. cared: https://www.bbc.com/news/technology-43386918

That's not the kind of publicity I'm looking for. But honestly, I'm curious. Are you a secret billionaire with a few exits under your belt who would toss a million bucks to me if "safebot is ever mentioned by someone credible"? No? Then maybe the "grandiose" claims are not on my side :)

Also, sadly, your common predilection on HN to ridicule and scorn everything is biasing you against the most important set of solutions in AI. It ain’t about making the models safer - more aligned - or refusals. For what it’s worth I’ll try to share one more article with you, but I doubt you’ll get it: https://safebots.ai/about

So you’d have me engage in “discussion” by which you mean criticizing work others do. Sorry to disappoint you by ACTUALLY building working solutions to actual problems, instead of just bitching 24/7. Must make you really aggravated to have to hear about that. Yes, I have been working on free software for a decade before LLMs. And giving it away for free. Ooh, I’m such a moocher on your time! You’re always free to scroll past and continue “contributing” the next 10 years of snarky comments. Maybe you can even speed it up with LLMs — I am sure it will greatly improve people’s lives :)

Qbix Platform is based on PHP, and everything else (MySQL, NginX, Apache etc.) is optional. PHP can be used by itself to host your site, including turning it into a static site, and even manage HTTPS certificates for you.

But even beyond that, it can also enable personal mesh networks without the Internet. It's completely free and open source, and designed to work out of the box. Here is the overview of how it all works:

https://qbix.com/server.html

The front page of safebots.ai contains stuff I put up quickly 6 months ago when I was first making the site. I used Google Notebook LM to create the presentation, based on my notes, since people like “pretty designs”. And it put the word encrypted in there, which was wrong. Yes, the data (and graph) is in fact encrypted at rest, so technically it’s true, but not the main point.

I have since actually built the code, and wrote many articles around it, none of which have the word “encrypted”. Here is a good jumping off point:

https://safebots.ai/about

I didn’t expect you to ignore the entire article I linked to, go clicking around the website and into a PDF from a completely different page, go to slide 11 and post it. Suffice it to say - your conclusion is totally wrong. But I’m glad you highlighted that specific title. It is time to thoroughly redo that front page - so it is more accurate to what the project has become!

Excuse me, for actually trying to build things instead of just bitching and then let people on HN know about them, or posting things that I believe in. According to you, I guess I should have spent more % of my posts being snarky and attacking things others have built, like our friend here.

I have contributed quite a bit — not i n the form of snark, but in the form of actual SOLUTIONS that I built and put on github as open source. If you don’t want to click or use it or even look at it, that says more about you than me.

The actual point of the article was: recursive self improvement is scary and upredictable, you can get 99% of the benefit by doing the reliable and predictable thing instead. Did you even read the actual article? I didn’t see anything in your comment about that main thesis which is woven through — well — every paragraph.

Update: oh, I went through your recent comment history and apparently most of it is just snarky criticisms of surface level things. Okay :)

Question though — what do you have against what I’m saying or working hard towards?

Trying to create healthier versions of technologies and help people?

https://www.laweekly.com/restoring-healthy-communities/

https://safebots.ai/declarative.html

This is just because JS is single threaded. Python has the Global Interpreter Lock, which makes it effectively single threaded too. That means you don’t have to deal with true parallelism, and critical sections, semaphores etc. It’s like Ethereum: only one thing happens at a time.

But you don’t have to parse JSON without yielding. You can make anything async by just using setTimeout once in a while. Here is one such implementation: https://www.npmjs.com/package/yieldable-json

The guy may as well have said while(1) locks up Node.

Now they get into multithreaded work-stealing, and isolates. But the solution in Node is to spin up multiple processes and pass messages between them. This is approaching the Erlang actor model, and is also shared-nothing. They even say "the schedule is a single-threaded loop per core" and "all cross-core communication occurs via the messaging subsystem".

This can also be achieved in most other single-threaded languages, too. Python with asyncio, for instance.

Tina may provide a nice opinionated implementation with bounded queues and deterministic scheduling, but those are architectural choices rather than evidence that async/await itself has failed.

Node has isolates, but it's more for sandboxing.