by DonHopkins | 2026-01-30 11:43:41+00:00
Speaking of netnews UIs...

Eric S. Raymond (aka "Eric The Flute") spent the late 1980s obsessively promoting his "Teenage Mutant Ninja Netnews" (TMNN) project at science fiction conventions, calling himself the "mad mastermind of TMN-Netnews" in his usenet signature (comp.lang.misc, December 13, 1989). He would corner people and drone on endlessly about it at inappropriate times.

Two years in secret laboratories. The future "Cathedral and the Bazaar" guy. The "release early, release often" guy. The "given enough eyeballs, all bugs are shallow" guy.

None of it materialized. The project was abandoned. Wikipedia: "A rough version of the software was released and drew attention from around the network, but the project was abandoned shortly thereafter."

His resume at catb.org/~esr/resume.html still lists it under "Independent Consulting" as simply "A rewrite of the USENET netnews software" - burying the embarrassing name and omitting that it was abandoned.

OMFG, in researching this post, I just ran across the source code, archived:

https://web.archive.org/web/20191205160937/https://fi.archiv...

Hey, after all those hours of listening to him drone on and on about it, I finally found the code. Let's pull it down and take a look.

His BRAGSHEET file announced: "after two years of development the software construct known as TEENAGE MUTANT NINJA NETNEWS has escaped from the secret laboratories of Thyrsus Enterprises and will soon assume a very public identity as News 3.0."

The BRAGSHEET promised grandiose features under "the future": "TMN-Netnews is intended to provide a starting point for experiments in advanced logical-network services... intelligent filtering agents... and hypertext." He even asked readers to email him "working C source" for a "public-key encryption system for authentication purposes."

His LICENSE file included an actual commercial plug: "I am available at competitive rates as a consultant... (215)-296-5718 or by mail at 22 South Warren Avenue, Malvern PA 19355." He also explicitly distanced himself from FSF: "My action is not to be construed as an endorsement of the political or economic views... of any member, agent, or ally of the Free Software Foundation other than myself."

The version.h file confirms: abandoned at "beta level 7.8".

I asked Cursor to perform a code review of ESR's magnum opus. Here's what two years in "secret laboratories" produced:

874 uses of unsafe string functions (sprintf, strcat, strcpy) with no bounds checking - buffer overflows everywhere. The actual gets() function - so dangerous it was removed from the C standard entirely - listed as available in his system.h. 42 instances of mktemp(), the function that creates predictable temp file names, enabling symlink attacks. Even in 1989, mkstemp() existed. 61 uses of system() and popen() passing unsanitized user input directly to shell - textbook command injection. Lock files stored in /tmp with hardcoded magic numbers - any local user can DoS or hijack the news system.

In D.priv/lock.c, his own comment admits: "This whole module is ugly and flaky." Then ships it anyway.

In fascist.c - yes, that's really the filename - he embedded his libertarian political philosophy directly into the access control system. FASCIST mode controls who can post. COMMUNIST mode controls who can read. The nasty_t struct holds user restrictions. The main function is literally called fascist().

His example configuration uses Lord of the Rings names: a "wizards" group with Gandalf and Radagast, while sites named "mordor" and "orthanc" are suppressed from posting to "alt.goodguys". Peak 1980s nerd projecting himself as a righteous wizard fighting Sauron.

His example of a restricted user is called "miscreant" - allowed to post to "junk" and "talk.politics" but forbidden from security groups. This is how ESR thought about users he wanted to control.

The function that looks up user groups has this comment: "This routine is a HOG!!!!!" Five exclamation points. Very professional. What does this "HOG!!!!!" do? Concatenates group names into a fixed buffer with no bounds checking. Buffer overflow.

Oh, and the FASCIST code? The original was by Eugene Spafford - one of the most respected security researchers in computing history. ESR "rewrote" it, adding the political dog-whistles, the Tolkien cosplay, and the buffer overflows.

By The Numbers:

Years ESR spent developing TMNN in "secret laboratories": 2

Number of subjective hours ESR subjected people he cornered at SF cons to bragging about TMNN: ∞

Beta level when abandoned: 7.8

Promised features that materialized (hypertext, encryption, intelligent agents): 0

Amount of money HN's own Thomas Ptacek raised for charity to stop posting racist ESR quotes: $30,000

Uses of unsafe string functions without bounds checking: 874

Instances of mktemp(), the predictable temp file function: 42

Shell command injection vulnerabilities via system()/popen(): 61

Times gets() - removed from C11 for being unfixably dangerous - appears in system.h: 1

His own assessment of his locking code: "ugly and flaky"

Exclamation points in "This routine is a HOG!!!!!": 5

Political ideologies embedded as compile-time flags: 2 (FASCIST, COMMUNIST)

Lord of the Rings characters in example config: 3 (Gandalf, Radagast, Saruman)

Evil fortresses used as example banned sites: 2 (Mordor, Orthanc)

Name for example restricted user: "miscreant"

Years between TMNN's abandonment and "The Cathedral and the Bazaar": 8

Books ESR later wrote about Unix programming best practices: 1

Buffer overflows in his own Unix code: uncounted

Times his resume mentions "Teenage Mutant Ninja": 0

Original author of the fascist.c code (respected security researcher): Eugene Spafford

Person who "rewrote" it with buffer overflows and Tolkien cosplay: ESR

Core thesis of "The Cathedral and the Bazaar": release early, release often; given enough eyeballs, all bugs are shallow

Years ESR kept his own code in "secret laboratories" before releasing: 2

Eyeballs that reviewed it before release: unclear

Bugs that remained: shallow they were not

The guy who wrote fascist.c to restrict who could post to newsgroups later spent decades arguing that any form of content moderation is tyranny.

The guy who spent two years in "secret laboratories" refusing to share his code until it was "perfect" (it wasn't) later preached "release early, release often."

The guy who promised "intelligent filtering agents" and "hypertext" and "public-key encryption" - and delivered none of it - later became famous for pontificating about how open source development works.

The guy whose own code is riddled with buffer overflows and command injection vulnerabilities wrote a book called "The Art of Unix Programming."

The Bazaar guy's own magnum opus was a Cathedral that never got built. He just kept giving talks about it.