Ferron ⚡🦀

A fast, modern, and easily configurable web server with automatic TLS.
Serving sites with HTTPS and secure defaults! 😄

[Ferron ⚡🦀 @ferron_web]

Here it is - Ferron 2 is here! 🥳
A faster, easier to use, more powerful web server.
It can even obtain TLS certificates for you...

[Ferron ⚡🦀 @ferron_web]

@TheSuperEng Thank you! 😄

[Ferron ⚡🦀 @ferron_web]

The next version of Ferron 2 will support environment variable placeholders (thank you "rousbound" on GitHub!).

We still have quite some improvements to backport from Ferron 3 beta though...

[Ferron ⚡🦀 @ferron_web]

And by "Ferron 2", we meant a development build from develop-2.x branch (likely with "vibeio", though "monoio" is the default).

[Ferron ⚡🦀 @ferron_web]

We couldn't reproduce the OOM with Ferron 2, but we found that memory usage increased (by several megabytes), but not too much...

We tried the Pingora POC, since Ferron 2 uses "h2" (indirectly) for HTTP/2, which is the same library used by Pingora...

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[Ferron ⚡🦀 @ferron_web]

Welcome back! 😄

[Ferron ⚡🦀 @ferron_web]

🚧 Starting today, there would be no activity for Ferron projects until a week later.

We believe solo maintainers' (such as Ferron's) well-being matters more than whether they would respond fast... We don't want the maintainers to burn out.

[Ferron ⚡🦀 @ferron_web]

@LundukeJournal What about XZ Utils backdoor incident, which had nothing to do with AI or Rust? 🥲

[Ferron ⚡🦀 @ferron_web]

🚧 Starting today, there would be no activity for Ferron projects until a week later.

We believe solo maintainers' (such as Ferron's) well-being matters more than whether they would respond fast... We don't want the maintainers to burn out.

[Ferron ⚡🦀 @ferron_web]

@awesomekling @ladybirdbrowser Left one looks a lot like a modern browser... 😄

[Ferron ⚡🦀 @ferron_web]

Subtle performance differences in web server localhost benchmarks don't matter.

What matters is the correctness under edge cases, and how well the infrastructure could withstand the clients' load.

[Ferron ⚡🦀 @ferron_web]

Why run parallel AI agents when you can run parallel fuzzers? 😅

[Ferron ⚡🦀 @ferron_web]

@adityawaslost What about hand-coders? 🥲

[Ferron ⚡🦀 @ferron_web]

Thinking about experimenting with building a L4 reverse proxy or load balancer with kernel offload, via eBPF...

[Ferron ⚡🦀 @ferron_web]

@lucaronin Oh... Same when we posted a hit piece against Bun... 🥲

[Ferron ⚡🦀 @ferron_web]

@jarredsumner Oh, so we don't think the Rust rewrite of Bun would be all bad... 🙂

[Ferron ⚡🦀 @ferron_web]

@rustaceans_rs We could say what an why, but the changelog is getting bigger and bigger... 🥲
https://t.co/kiPMXdJzFV

[Ferron ⚡🦀 @ferron_web]

@FrancescoCiull4 @piyushgarg_dev "... is dead" is dead...

[Ferron ⚡🦀 @ferron_web]

@K19Unknown @Sujay__Raj In our case, there would be a Microsoft Defender SmartScreen warning, because our binaries for Windows aren't digitally-signed... 🥲

[Ferron ⚡🦀 @ferron_web]

@RicsDev We recommend using Ferron 2 for now, as it's a stable release. Ferron 3 would need some battle-testing, and it's currently a beta version.

[Ferron ⚡🦀 @ferron_web]

Two AI agents running in parallel to improve Ferron 3... 😅

1. Zed Agent + Qwen3.6 35B A3B (local) - splitting large reverse proxy source files into smaller files.
2. OpenCode + DeepSeek V4 Flash (free) - removing redundant E2E tests, adding better edge-case E2E tests.

[Ferron ⚡🦀 @ferron_web]

When we get too many changes in the changelog for a beta version... 🥲