You are looking at a webpage. Groundbreaking.
The thing that sent it, however, does not know what a webpage is.
It knows frames. It knows streams. It knows
flow-control windows and Huffman tables and
the exact wording of RFC 9113 §5.1 at 4am. It does
not know net/http, because we never introduced them.
scroll. it gets worse. ↓
Act I
Go ships a perfectly excellent HTTP/2 implementation. Battle-tested.
Maintained by people with actual credentials. Free. Right there.
import "net/http". Done in one line.
We looked at it. We said "no thank you."
Then we spent 72 hours reimplementing the entire protocol by hand from the RFCs, because the rules of this hackathon said zero dependencies and we are the kind of people who read that as a dare.
Our build gate physically refuses to compile if net/http
appears anywhere in the dependency graph. We didn't trust ourselves. Correctly.
go.mod is
three lines and lists nothing. go.sum does not exist —
that file only exists when you've let someone else's code in. The compiled
binary reports its own dependency count as 0, read out of its
embedded build info, so you don't have to take our word for any of it.
Act II · the main event
Press the button. A real request leaves your browser, crawls through every layer we wrote by hand, and comes back with a file. The dot below is the dramatization. The numbers at the bottom are the actual measurements from the actual request. We are narrating our own crime scene.
YOUR BROWSER
zdh · EVERY BOX IS OURS
Press the button. I'm not going to beg.
Every step below is a real layer in this server, and every citation is a real sentence in a real RFC that we have read more times than is healthy.
↑ that was a cartoon. these are your real numbers, straight out of your browser's own network stack:
Act III
If two goroutines write frames to the same socket, their bytes interleave and the entire connection becomes cursed nonsense forever. The peer reads a header, takes the next N bytes as payload, and every frame after that is misaligned until the heat death of the connection.
So we made it structurally impossible. One writer. It owns the pen.
Reads frames. Dispatches them. Never writes. Not allowed. Doesn't have the pen.
Build responses in parallel. When they want to send something they
politely Enqueue() it and go away.
SOLE OWNER of the write half. The only one with the pen. Everything on the wire went through here, in order, alone.
Act IV
HTTP/1.1 needs one connection per request in flight. Your browser opens six and makes everything else wait in line like it's 1997. HTTP/2 interleaves all of them on a single connection.
Don't take our word for it. Fire requests and watch. Every bar is one real request. Count the new connections. We'll wait.
Act V
A file server that serves any path you ask for is not a file server, it's a data breach with extra steps. Each row below is a real request going out right now. The first one is the control — proof the file is really there and really servable. Every other row is the same file, asked for in a way that deserves a 404.
| what we asked for | got | why it deserved that |
|---|
Act VI
A green test suite proves your code passes your tests. It says absolutely nothing about whether your tests would notice if the code stopped working. That thought kept us up. So we did something about it.
For every single guard in this server — every deadline, every bound, every protocol rule — there is a script that deletes that guard and demands that a specific named test fail as a result. If the test doesn't fail, we don't get to say the guard is tested. That's 1,218 deliberate self-inflicted wounds across 18 campaigns, and every single one of them is caught.
h2spec --strict
guards, each observed failing
If a guard has never been seen failing, nobody has tested it. It's decoration. We don't ship decoration.RFC quotations, verified
A script checks every quoted sentence in our comments actually appears in the RFC we credited. We caught ourselves misquoting nine times. From memory. Confidently.real CVEs defended
Rapid reset (CVE-2023-44487) and the CONTINUATION flood (CVE-2023-45288). Both attacks are in our own test suite, both bounce.Act VII
Everything you just read was delivered by the thing it's describing. Here is every asset this page loaded, with the protocol your browser reports for each one — not what we claim, what it observed.
| resource | protocol | how | bytes | ms |
|---|
And no, this page has no dependencies either. No React. No Tailwind. No charting library. No font from a CDN. Every diagram is hand-written SVG and every animation is CSS. It would have been deeply embarrassing to ship a zero-dependency server with a demo page that dragged in three megabytes of somebody else's JavaScript.