EGreg

Why does Lean always have a way to mess up your file system, writing to any files, rather than just proving proofs?

I found that out when reading the recent articls about counterexamples.

It’s quite ironic that you are pointing out I still need PHP to run … PHP. Whereas if I download a Go binary, then I won’t.

Well, I can do you one better — you can compile the entire server and PHP code to a binary, as it says in the README, so you won’t need ANYTHING once you download that LOL.

Also, since you wrote that comment, I also added supports for websockets (wire-compatible with socket.io) and rooms, all of it with the same approach: put files in folders and it “just works”. What is so bad about that?

I wrote that answer with my own fingers on my iPhone

They are open. Can you not submit an issue?

Also, can you please list the obvious security vulnerabilities here?

Should absolutely be possible, yes. What headers are usually missing?

The goals are several:

1. To share an innovation we developed for ourselves, that can help the wider PHP community (after all, 80% of the Web still runs on PHP!)

2. To pioneer a new approach that can help a bunch of people, like Caddy or FrankenPHP had once pioneered its own approaches

3. To show that PHP by itself can be enough to not only build a decent web server, but actually surpass NGINX together with PHP-FPM both in memory and speed, which surprised us. The memory particularly turns out to be the bottleneck and Qbix Server finally helps solve the 10K issue for PHP!

4. To make a new and very simple way to cleanly build websites and APIs that leverage both HTTP Requests and WebSockets: simply drop appropriately named files in the right places! It is optionally opinionated so the shapes of new codebases using the server, instead of all being ad-hoc, can be standardized along the same lines our own are.

5. To get feedback from the HN community. Speaking of that:

Could you please list the reasonably obvious security issues, so they can be fixed?

Not at all. You are probably thinking of evented programming that happens in Node, Swoole or FrankenPHP. Qbix server makes sure each PHP process is isolated, so you also don’t leak any memory or secrets across requests.

Out of all runtimes powering web servers today, I like PHP the most for its shared-nothing architecture, preventing a whole lot of security bugs by default. I think making it evented for HTTP is clutching defeat from the jaws of victory. You win very little, because most web servers code is I/O bound.

With 8GB RAM and no virtual memory swapfile, Qbix Server allows you to handle, say, 1600 concurrent HTTP requests and 40,000 websocket connections simultaneously, so having an HTTP handler PHP process exit and be respawned via fork is cheap (0.5ms to reset it to a state with all the bootstrap already done). Processes simply yield when doing I/O and you let the OS handle the I/O waiting instead of green threads in an event loop. It’s almost as fast, and frankly, dynamic PHP can be 2% or less of all your requests, when you start aggressively sending Cache-Control headers causing this Qbix webserver to cache your PHP results, as well as nginx/varnish and CDNs upstream too.

The original source is here: https://github.com/Qbix/Platform/tree/main/platform/classes/...

Yes, these days I work with AI (Claude chat, usually) to do all the "last mile" things, like packaging, writing READMEs, etc. I iterate, do quality control, and I asked it specifically to put emojis in titles. But the actual architecture, and the 10+ years of code in the framework, were hand-rolled.

I just realized I can extract the web-server under an MIT license and gift it to everyone. So I put it up on github and then told HN about it. That's all!

PS: I very much appreciate constructive feedback. Your suggestions have been incorporated: https://github.com/Qbix/webserver/commit/618638ecdc9097722fd...

FrankenPHP uses Go. This is pure userland PHP. No other dependencies.

For one thing, developers who actually code in PHP need a web server. This "just works" out of the box. No need to install Go, or Nginx, or php-fpm, or configure proxy_pass, or certificates, etc. etc. Yes, caddy also handles certificates, but what about the rest?

There is a section in the README comparing this to FrankenPHP, Swoole, etc. You can see where this approach actually beats them. In fact, instead of simply declaring "it sux", why not try it first? It takes 5 minutes. Download and launch.

And a word about about safety. FrankenPHP workers persist between requests, which means every static variable, singleton, and global cache in your app -- and every library you use -- becomes a potential data leak between users. Qbix Server gives you the same performance benefit (zero bootstrap cost) via fork-after-preload, but each request gets its own process. When it's done, everything is gone. No audit needed.

Not sure I follow. Many webservers have 55% or less of nginx throughput. NGinx is written in C, the fact that you can even achieve over half its throughput in PHP for static files is pretty incredible to me.

This server is not competing with nginx for serving static files. It's competing with nginx+php-fpm for serving PHP, and there, it wins by a large margin.

You might have a very narrow definition of "serious use". This isn't just for people who want to serve static files. This is for people who want to host PHP applications without having to manually install nginx, configure its proxy_pass to php-fpm, etc.

In some ways, in real-world scenarios, this server would actually be faster than nginx with php-fpm. Because it can prefork processes after it has loaded classes, so all that bootstrapping your PHP scripts do having to load classes over and over, (even with PHP's opcode caching) can be on the order of tens of milliseconds. That's saved per call.

You can still put nginx in front of this, by the way, for much faster https. But you can also put CloudFlare, CloudFront, or any other CDN in front of it instead, and get all the advantages of reverse proxies, etc.

But, all by itself, this server handles reverse proxy, caching (including Cache-Control headers, ETags, etc.) and, very importantly, it allows your PHP to do two things that other webservers don't:

1. Send X-Accel-Redirect headers in order to enforce true access control for static files, based on cookies etc. Gone are the days you have to host files publicly at unguessable URLs, that people can share with others.

2. Send X-Cache-... headers that actually let the server cache parts of the page rather than the whole page. When you invalidate one thing, it intelligently invalidates all the pages that transitively depend on that thing.

There's a lot more to it. You commented 2 minutes after it was posted, so I imagine you haven't actually read the README. Go and read it. Yes, it's for "serious use."

Yes, I’m very interested in exploring this stuff.

Want to connect and discuss it? https://calendly.com/safebotsai

America doesn't have a "Homer", because it has a very rich competitive market.

In the USSR, people of multiple generations grew up watching the same things, e.g. "Nu Pogodi"

In the USA, every 10 years there's some new genre of music, or artists being promoted.

Homer is known because back then, very few people could even read - let alone write. Actually, Homer couldn't, I think.

Come on, who's making ridiculous claims here?

"I'll eat my hat". No, you won't.

"I'll give you a million dollars." Sir, you likely don't have a million dollars to just give away like that. And even if you had, you wouldn't do it.

So, one of us is making actual, true claims based on years of hard work. You may consider them grandiose -- and you're entitled to your opinion -- but I can back it up with actual actions. Your claims are... well, just false.

Here is "someone credible" mentioning Safecloud just 2 weeks ago, and by mentioning, I mean writing an article about it appearing on their front page: https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...

Here are their own "grandiose" claims about themselves:

Help Net Security is an industry-leading cybersecurity publication with over 350,000 readers per month. Since 1998, we have been committed to providing high-quality information to our audience through publishing relevant original content and analyzing market trends. https://www.linkedin.com/company/helpnetsecurity

Okay, that was Safecloud, not Safebots. But what if, say, I give a talk at a conference about Safebots, or it's starting to get covered in magazines? If we get a thousand users all using safebots? Ten thousand? What if Robert Scoble interviews me, or a bunch of influencers start using it? At what point can you say "someone credible mentioned safebot and here's your million dollars" LOL

And I don't mean mention in a dubious way, like when the BBC covered our unfortunate flirtation with using monero mining to pay for our apps... somehow our app was used by enough people around the world that Newsweek, the BBC, 9to5Mac, ArsTechnica (which broke the story) etc. cared: https://www.bbc.com/news/technology-43386918

That's not the kind of publicity I'm looking for. But honestly, I'm curious. Are you a secret billionaire with a few exits under your belt who would toss a million bucks to me if "safebot is ever mentioned by someone credible"? No? Then maybe the "grandiose" claims are not on my side :)

Wrong again. I didn’t use Grok, and I hardly use Elon’s AI models for anything LOL

Also, sadly, your common predilection on HN to ridicule and scorn everything is biasing you against the most important set of solutions in AI. It ain’t about making the models safer - more aligned - or refusals. For what it’s worth I’ll try to share one more article with you, but I doubt you’ll get it: https://safebots.ai/about

So you’d have me engage in “discussion” by which you mean criticizing work others do. Sorry to disappoint you by ACTUALLY building working solutions to actual problems, instead of just bitching 24/7. Must make you really aggravated to have to hear about that. Yes, I have been working on free software for a decade before LLMs. And giving it away for free. Ooh, I’m such a moocher on your time! You’re always free to scroll past and continue “contributing” the next 10 years of snarky comments. Maybe you can even speed it up with LLMs — I am sure it will greatly improve people’s lives :)

Today we've added support for IndieWeb to the Qbix Platform, so people can have a powerful way to publish and maintain sites on the IndieWeb: https://github.com/Qbix/IndieWeb

Qbix Platform is based on PHP, and everything else (MySQL, NginX, Apache etc.) is optional. PHP can be used by itself to host your site, including turning it into a static site, and even manage HTTPS certificates for you.

But even beyond that, it can also enable personal mesh networks without the Internet. It's completely free and open source, and designed to work out of the box. Here is the overview of how it all works:

https://qbix.com/server.html

I understand your predilection for being snarky, but you actually helped.

The front page of safebots.ai contains stuff I put up quickly 6 months ago when I was first making the site. I used Google Notebook LM to create the presentation, based on my notes, since people like “pretty designs”. And it put the word encrypted in there, which was wrong. Yes, the data (and graph) is in fact encrypted at rest, so technically it’s true, but not the main point.

I have since actually built the code, and wrote many articles around it, none of which have the word “encrypted”. Here is a good jumping off point:

https://safebots.ai/about

I didn’t expect you to ignore the entire article I linked to, go clicking around the website and into a PDF from a completely different page, go to slide 11 and post it. Suffice it to say - your conclusion is totally wrong. But I’m glad you highlighted that specific title. It is time to thoroughly redo that front page - so it is more accurate to what the project has become!

No you won’t. You won’t eat your hat — but I’ve written quite a few substantive comments on quite a few subjects that didn’t have to do with self-promotion. The difference is that those comments actually contributed LESS to HN, because they involved random arguments that were ultimately forgotten.

Excuse me, for actually trying to build things instead of just bitching and then let people on HN know about them, or posting things that I believe in. According to you, I guess I should have spent more % of my posts being snarky and attacking things others have built, like our friend here.

I have contributed quite a bit — not i n the form of snark, but in the form of actual SOLUTIONS that I built and put on github as open source. If you don’t want to click or use it or even look at it, that says more about you than me.

Pretty sure there is nothing about “complex workflows broken down into encrypted graph segments”. Did you just make that up to add some oomph?

The actual point of the article was: recursive self improvement is scary and upredictable, you can get 99% of the benefit by doing the reliable and predictable thing instead. Did you even read the actual article? I didn’t see anything in your comment about that main thesis which is woven through — well — every paragraph.

Update: oh, I went through your recent comment history and apparently most of it is just snarky criticisms of surface level things. Okay :)

I’m flattered that you followed my posts long enough to have an opinion on all this and even can recognize if a site is “definitely mine”.

Question though — what do you have against what I’m saying or working hard towards?

Trying to create healthier versions of technologies and help people?

https://www.laweekly.com/restoring-healthy-communities/

If I may, I think it has to do with this... and it's about to get weirder and weirder unless you change the paradigm:

https://safebots.ai/declarative.html

In a cooperative runtime like Rust’s Tokio or Node.js, the thread does not yield until it hits an await point.

This is just because JS is single threaded. Python has the Global Interpreter Lock, which makes it effectively single threaded too. That means you don’t have to deal with true parallelism, and critical sections, semaphores etc. It’s like Ethereum: only one thing happens at a time.

But you don’t have to parse JSON without yielding. You can make anything async by just using setTimeout once in a while. Here is one such implementation: https://www.npmjs.com/package/yieldable-json

The guy may as well have said while(1) locks up Node.

Now they get into multithreaded work-stealing, and isolates. But the solution in Node is to spin up multiple processes and pass messages between them. This is approaching the Erlang actor model, and is also shared-nothing. They even say "the schedule is a single-threaded loop per core" and "all cross-core communication occurs via the messaging subsystem".

This can also be achieved in most other single-threaded languages, too. Python with asyncio, for instance.

Tina may provide a nice opinionated implementation with bounded queues and deterministic scheduling, but those are architectural choices rather than evidence that async/await itself has failed.

Node has isolates, but it's more for sandboxing.

Poe

Twain

Wait wait. How does PWA when I click "install to home screen" actually show me that rich preview screen, with instructions? That's crazy!

Edit: I have been truly wowed today https://web.dev/learn/pwa/installation-prompt

On iOS, I think the only two reasons to have an app are: notifications and access to contacts.

It’s not about the companies specifically, or even AI specifically, but the incentive structure. I think the issue is more that they are embedded in a system of competition, where they can’t afford not to do things to “win” and fend off competitors’ practices. The people in the companies feel and understand this better than anyone.

I think Anthropic, being a Public Benefit Corporation, can absolutely do better than OpenAI. OpenAI was a nonprofit but flipped. Many people left from OpenAI to Anthropic, I think all original founders of Anthropic are still with Anthropic.

We have seen the same things in Web2 and Web3, this is not at all unique to AI companies! How many people at HN went to work for Facebook, or Google etc? The “don’t be evil” motto is nice but when you have to compete, you often end up doing the things you think you didn’t have to do.

With Web2 the stakes were: “centrally controlling speech”. With Web3 the stakes were: “people lose programmable money they gambled with”. With AI the stakes are much bigger. This isn’t about a company being moral or not. This is about incentives of the broader ecosystem, and how the products are designed.

As long as people (like Kevin O’Leary) say “but are you going to just let China pull ahead of us” we’re all going to be in a race (to the bottom, for a lot of affected people). It isn’t about OpenAI or Anthropic specifically. Hate the game, not the player.

It doesn’t have to be this way. The game can change: https://safebots.ai/singularity.html

I strongly believe that the future is the other way. New programming languages and environments designed for strong auditability and preventing bugs will dominate. Only bad actors will use latent space representation, and it might even be outlawed. But the bad actors will proliferate underground…

I actually built such a language: https://magarshak.com/U.html

It seems their incentives aren’t exactly aligned with their users, including corporate users. Look at the latest statements from Alex Karp, and now Satya Nadella etc.

Is this user-hostile? Encrypting stuff from the user is what RIAA used to do with DRM, worried about copyright infringement.

Why don’t they also capture information you enter into forms on Chrome?

They control the entire browser surface, technically they can know everything, even TLS and E2E encrypted data, that they silently phone home…

If you think this is silly, consider that Microsoft Recall had been observing everything on people’s entire SCREENS and phoning home much of it. That is how a guy was caught recently: https://x.com/t3chfalcon/status/2074134314145489195

And it is actually much worse than even that:

https://community.qbix.com/t/increasing-state-of-surveillanc...

Why don’t they also read your gmail and get your bank passwords?

And maybe have access to EVERY site actually, with “forgot password” type stuff in addition to providing oauth tokens…

This is what the problem is with DNS.