In September 2024, the good name of crates.io was invoked and besmirched by a phishing attack that targeted the owners of many popular crates, much as other language ecosystems had been the target of attacks in the preceding couple of weeks.
This talk will go over how this all went down, what we did, and how a worldwide Rust Project <-> Rust Foundation <-> Alpha-Omega collaboration was crucial in its rapid mitigation.
Over the past few years, npm, PyPI, RubyGems, and Maven Central have implemented attestations to provide build provenance: linking a package to its exact source code and build instructions. Some of these ecosystems also implemented publish/release attestations detailing exactly what files a specific version of a package should contain. These attestations are distributed as Sigstore bundles, so we'll start out by going over enough Sigstore to understand how to verify and get the attestation information from these bundles, the APIs to get these attestations for each ecosystem, and discuss the implementation tradeoffs made by each ecosystem, as well as alternatives for non-programming language ecosystems to consider.
Package management systems tackle resolving package dependencies in different ways, which usually involves associating a package a name and version at least. In this talk I am doing a bit of an exploration of the solution space, including how dependencies are resolved in: - a language specific package manager with a lock file (example: cargo https://doc.rust-lang.org/cargo/) - by a typical distribution (example: Debian https://www.debian.org/ ) - by Nix(https://nixos.org/) and Guix(https://guix.gnu.org/) (example: Guix) Then I will reflect on these solutions from the perspective of reproducible builds(https://reproducible-builds.org/).
Package managers are legion. Every language and operating system has its own solution, each with subtly different semantics for dependency resolution. This fragmentation prevents multi-lingual projects expressing precise dependencies across language ecosystems, means external system and hardware dependencies are implicit and unversioned, and obscures security vulnerabilities that lie in the full dependency graph. We present the Package Calculus, a formalism for dependency resolution that unifies the core semantics of diverse package managers. Through a series of formal reductions, we show how real-world package manager features reduce to our core calculus. We define the language Pac to translate between distinct package managers and show we can perform dependency resolution across ecosystems.
Get in touch at https://ryan.freumh.org/about.html
See the slides at https://ryan.freumh.org/talks/slides/2026-fosdem-pac.html
While reproducible builds provide a gold standard for artifact integrity, they often treat the build process itself as a black box: either it matches or it doesn't. But in an era of sophisticated supply chain attacks like the XZ backdoor and Shai Hulud, understanding why a build behaves the way it does is just as critical as the final output. To secure the open-source package ecosystem, we needed to look inside this black box. In this talk, we explore how OSS Rebuild instruments the build environment to detect "badness" in real-time. We detail our open-source observability suite, featuring a transparent network proxy for uncovering hidden remote dependencies and an eBPF-based system analyzer for examining build behavior in fine detail.
At FOSDEM 2018, we introduced Package-URL (PURL: https://github.com/package-url/purl-spec), a "mostly" universal URL to identify and locate software packages: https://archive.fosdem.org/2018/schedule/event/purl/
Now, PURL is an international standard to accurately and consistently reference packages across ecosystems, regardless of whether you're working with language-specific managers, OS distributions, or containerized environments.
This talk highlights the journey of PURL, from its first presentation to Ecma standard and planned ISO standard. We'll share how PURLs enable accurate package tracking across ecosystems for vulnerability management (PURL is now part of CVE format), tool interoperability (already adopted by security tools, SCA platforms, and package registries), and compliance and security workflows (generating accurate and actionable SBOMs and VEXs).
Whether you maintain a package manager, build supply chain security tools, query packages or vulnerability databases, or just want better visibility into your polyglot dependencies, you'll learn how this lightweight standard is the essential infrastructure for modern software ecosystems.
Package manifests record source-level dependencies: pandas depends on numpy's code. The story is different for binary dependencies: numpy depends on OpenBLAS's binaries, but package managers can't easily see this. We must map the OSS ecosystem's binary dependency relationships to reliably (1) identify upstream security vulnerabilities and (2) properly credit and financially support maintainers. I propose solving this problem by creating a global index of binary dependencies, using a global linker that tracks binaries' symbols across the entire Open Source ecosystem, combined with auxiliary strategies like statically analysing build recipes. (read more)
Package registries are critical infrastructure used by almost all software. As they scale, package registries become critical points of supply chain security. They also become leveraged points of attack. Most registries operate on dwindling funding from grants, donations, and in-kind resources while facing increased costs across every facet of their operation and development. Something has to change.
The Alpha-Omega project has been raising the alarm, funding security improvements, and exploring a revenue-generating options with the major package registries. This is a hard problem with multiple players and tradeoffs.
This talk will go over the economic models underlying package registries, the security risks and expectations, and look at some of the revenue experiments happening today.
Homebrew released v5.0.0 in November 2025. I'll walk through some of the major changes that landed in that Homebrew version, what expectations we're aiming to improve based on other package managers and things other package managers could learn from Homebrew's approach.
The gaming industry, outside of console and mobile games, is mainly focused on three operating systems: Windows, GNU/Linux, and macOS. This leaves FreeBSD with a library mostly restricted to open-source native games. These restrictions may decrease the interest of new and current gaming users for FreeBSD as their main OS as they are accustomed to having access to a wider variety of games (as is the case for GNU/Linux ). Today, thanks to a handful of contributors and through the use of Linuxulator or Wine FreeBSD users have the necessary tools to enjoy gaming :) Firstly, the port of Steam, which allows us to run both GNU/Linux games on FreeBSD under a chroot, and the multiple ports of wine, wine-devel, and wine-proton, which will enable us to play Windows games under FreeBSD. Secondly In addition to these ports, the upstreaming first approach with Wine allowed us to quickly update the Wine version available after a release. This talk will shed a light on the available compatibility tools and how we can leverage these tools to improve the gaming experience on FreeBSD.
Links to the mentioned project: https://docs.freebsd.org/en/articles/linux-emulation/ https://www.winehq.org/ https://github.com/shkhln/linuxulator-steam-utils https://github.com/ValveSoftware/wine https://github.com/shkhln/libc6-shim
FreeBSD has first tier level support in Valgrind. Valgrind on illumos works fairly well. They are both supported "out of the box" in upstream Valgrind.
The other BSDs are not in the picture, which is a shame since there aren't too many fundamental differences between the BSDs.
This talk will be about what needs to be done in order to be able to get Valgrind up and running on DragonFly/Net/Open BSD. I'd like it to be both a source of information for anyone that would like to work on Valgrind and also a source of motivation.
This isn't a promise that I will have the time to do this development work!
Talk that I gave at Fosdem 2022 (video only, during Covid) https://archive.fosdem.org/2022/schedule/event/valgrind_freebsd/
Here is the upstream Valgrind web site https://valgrind.org/
And the upstream git repo https://sourceware.org/git/valgrind.git
Here is a repo that I used when I was adding arm64 support to FreeBSD Valgrind https://github.com/paulfloyd/freebsdarm64_valgrind
NetBSD 11 introduces a new MICROVM kernel that can boot in QEMU in about 10 ms, thanks to PVH support, MMIO VirtIO devices, and various low-level optimisations. Building on this foundation, we created smolBSD, a meta-OS and microVM generator that assembles tiny, versatile and fully isolated services using the MICROVM kernel plus selected pieces from NetBSD and pkgsrc. Recent work by Pierre “khorben” Pronchery enables even faster startup by embedding the root filesystem as an initrd-style RAMdisk. This talk presents smolBSD’s design, capabilities, and how it enables ultra-fast, minimal, and reproducible micro-services.
The OpenSolaris Operatingsystem came with one Component that always fascinated me and I am using extensively to package the OpenIndiana Operating System. This talk shows IPS History (why it was created and how) What it currently can do. The Concepts used (Repositories, Packages, FMRI, Facets, Variants, and Manifests, History) and what you can do with them and what IPS does with them. And why Self-Assembly is a major factor in that. As last section I will also talk about porting IPS to rust and Improvements we can make thanks to 10 years of technology advancement since it's Original creation. https://github.com/openindiana/ https://github.com/OpenIndiana/pkg5
Swift is a general-purpose programming language often associated with app development for the Apple ecosystem. Over the years, Swift has extended its reach and is now a cross-platform language with support for Linux, Windows, and more recently, Android. Now, we are bringing Swift to FreeBSD and there are truly devils in the details. How do you start porting a language to a new environment? How do you debug issues before you have a working debugger? This is the story of how we overcame challenges like these while porting Swift to FreeBSD.
It is no secret that certain applications, such as firewalls, routers, and hardened web services, perform best on BSD systems. Yet Linux dominates cloud infrastructure, forcing users to either port these applications or run them as full BSD virtual machines, each requiring special handling and management. This talk presents urunc, a container runtime for unikernels and single-application kernels that enables BSD workloads to run efficiently in Linux environments. urunc executes BSD applications in tiny microVMs and software-based sandboxes while integrating them seamlessly with existing Linux container platforms. This allows Kubernetes and similar systems to manage BSD workloads alongside Linux containers without extra effort or special handling. A live demo will walk through building, packaging, and deploying BSD applications with urunc, with initial performance metrics on startup time and network throughput, showing that BSD applications remain practical even in BSD-“hostile” environments.
In this talk I will:
* introduce the unusual I/O needs of databases and PostgreSQL's new I/O architecture and direction
* show how PostgreSQL works on FreeBSD, NetBSD, OpenBSD and illumos today
* compare those systems' available support for native asynchronous I/O with Windows and Linux
* speculate on the pathways that need to be drilled through their kernels to achieve the state of the art
* speculate on the API design constraints and options I see
* discuss OpenZFS's exciting new direct I/O and block cloning features and their relevance to PostgreSQL
* show-and-tell some experimental patches for full-featured direct I/O on FreeBSD's UFS
* show-and-tell some experimental patches for PostgreSQL with FreeBSD's native AIO and kqueue
My goal is to provide a database hacker's take on the I/O concerns that "go together" and explain how and why they are linked. It is written for a cross-project kernel and file system hacker audience, a rare opportunity provided by this FOSDEM devroom. The presentation begins with a high-level problem space overview, before diving down to user space, VFS and device levels to discuss the options as I see them. It includes some exploratory patches developed over the past few years of working full time on PostgreSQL I/O, porting and testing on ~10 operating systems, and hacking on FreeBSD for fun and education.
It is a 25 minute talk, broken up into 5 subtopics consisting of 5 one-minute slides, and the pace will be fast:
gotwebd is the web interface for browsing Git repositories provided as part of Game of Trees—a project grown out of the OpenBSD community whose goal is to develop a new version control system that relies on prior art, takes what makes Git's design great, leaves out the parts that make Git hard for us to use, and invents new parts for an end result that serves our needs.
Other than the most obvious features, such as browsing repositories, reading commit logs, and inspecting diffs, gotwebd has a few unique features.
First, the privsep design and the use of sandboxing techniques on different operating systems; then the built-in SSH "web" authentication for access control, which also serves as protection against relentless AI scraping; and finally, the ability to directly serve static web content from a Git repository without the need for CI or external hosting.
In this talk, we'll walk through the design of gotwebd, its evolution over time, and present its unique features in detail.
We live in an age where internet is a requirement for our own leisure, whether it is to work from home, keep in contact with our family or our own leisure. It is common to hear about how some company we trusted with our data has been hacked, and all our data is now floating around the internet. Many of us take steps to increase the security of our laptops, and our mobile phones. Some of us reject the use of SaaS products (such as Google Drive, Dropbox, Discord etc) and host our own, either on our own hardware or hardware rented in the cloud.
Unfortunately, this often leads us to assume that our local network is secure, thinking only about the security of our services and not the connectivity to them. Many routers issued to consumers by an ISP or bought often miss security patches and reach EOL within a very short lifespan. It is also not uncommon for these routers to have their own custom configuration format, which is device specific, making migration to new hardware more difficult.
Introducing OpenBSD, "free, functional and secure"! Any old hardware could become a router, that Raspberry Pi you have lying around? That old desktop you do not use anymore? OpenBSD comes with all the software you need for a router (and more!) within the base system.
Join me, and lets discuss how to keep your network secure, and give you more control over your network.
Welcome to the "Local First, sync engines and CRDTs devroom", first edition this year at FOSDEM'26. We are excited to propose you a full day of amazing talks ranging from CRDT libraries and frameworks, to local first projects using them, and including academic research, UX design, sync protocols and engines.
We believe Local First software is the future of app development. But what is Local First software? In this short introduction we will touch upon the general concepts and describe this new paradigm that gathers an ever growing community of enthusiast engineers, designers, researchers and developers, following the motto: "You own your data, in spite of the cloud".
Please come early to the devroom to take your seat, as we will start on time (9:00AM sharp). The room will be open as early as 8:30AM. It has limited capacity, and when reached, the door will be closed. We have an amazing lineup of great speakers, and you surely do not want to miss one bit of it. See you on Sunday morning! Advice from the devroom managers: Don't miss the next talk: Jazz is a great framework and Giordano will start with an introduction to CRDTs for those who don't have prior knowledge. And then, second advice: stay with us all day, we have selected only amazing talks!
CRDTs are an exciting primitive for distributed state. In local-first apps, synced CRDTs can be framed as a natural extension to reactive local state, allowing developers to build eventually consistent multi-device and multi-user apps, with business logic living completely on the client, only requiring generic syncing infrastructure.
A key feature that traditional backends solve remains a challenge, though: how do permissions work in this world? In addition to being a batteries-included framework that makes local-first state practical, Jazz uniquely solves local-first permissions, by coupling public-key cryptography with CRDTs in a way that allows for dynamic, expressive permission structures which can be defined on the client and are enforced globally, in an auditable way.
Advice from the devroom managers: Don't miss this talk! Jazz is great framework and Giordano will start with an introduction to CRDTs for those who don't know what it is. And then, second advice: stay with us all day, we have selected only amazing talks!
Yjs is one of the oldest and most widely used libraries that enhance web editors by allowing multiple users collaborate over documents in real time, also without requiring continuous network connection. Evernote and Jupyter Notebooks are among many of its prominent users.
During this presentation we'll address some of the common pitfalls that new developers may encounter when working with Yjs library, what architectural foundations are causing them to happen and what can we do to overcome them.
Plane is an open source project management tool used by thousands of teams. A year ago, we shipped Wiki — a collaborative documentation system built on Yjs with real-time editing, offline support, and version history.
Yjs is remarkable. Kevin Jahns and the community have built something incredible — real-time sync, conflict resolution, offline editing, all handled elegantly. But integrating a powerful library is just the start. This talk is about what comes after.
I'll cover the production challenges we solved building on top of Yjs, the crux of it would be around:
Plane is fully open source with 38k+ stars and a vibrant OSS community. Real problems, real code, no theory slides.
Automerge is a mature library for building local first applications by enabling version control for structured data. The strategy is to capture all edits to data at a very fine grain (e.g. per keystroke when editing text) and then present a good API for managing concurrently edited versions of this data.
The version control approach to collaboration makes working concurrently feasible and makes servers fungible - it increases user autonomy, but it introduces problems as you can't rely on access control on the network boundary. Keyhive is a local first access control architecture which we think is a compelling point in the design space which solves these problems.
In this talk we will give a high level overview of the motivation, design, problems, and future directions of the broader Automerge ecosystem.
NextGraph is a protocol, a framework, and a platform that supports easy development of Local-First, decentralized, secure and private apps.
By combining the best of the local first world (Yjs, Automerge CRDT libraries), a graph database, DID (decentralized identifiers) for users and documents, and end-to-end encryption plus encryption at rest, we provide an SDK that offers all the requirements of portability, interoperability and security needed today for building a true alternative to Big Tech platforms and products.
This talk will be composed of two parts. Niko will first introduce the general architecture of our platform, engine, protocol and SDK, giving an overview of its components, and some details on the E2EE sync protocol, cryptographic capabilities/permissions/access control. We will show how we support any kind of CRDT, including Automerge and Yjs, and the CRDT for Graph database (RDF) that we have developed.
Then Laurin will introduce the new ORM TypeScript SDK for NextGraph that turns document/database records into ordinary, typed objects with two‑way binding. By proxying those objects and emitting signals, the SDK provides a framework‑agnostic reactive layer that integrates cleanly with React, Vue, and Svelte. And more frameworks could be easily added in the future.
CRDT support - The SDK works with Yjs, Automerge, and, most notably, RDF - a graph data format designed for application interoperability. The SDK includes a converter that transforms SHEX shapes (an RDF schema language) into TypeScript type definitions for type safety.
Reactive POJOs - Objects are wrapped in a proxy, so any property change triggers a signal, which updates both the UI and sends a JSON patch to the backend. Signals provide an efficient, event‑driven mechanism for state propagation and have been gaining popularity in modern front‑end ecosystems.
You will see a live demo walking through a simple property change, showing how the mutation is instantly persisted to the local database, reflected in UI components across React, Vue, Svelte, and synchronized with the network across devices and user accounts.
Building fast, resilient, and collaborative applications increasingly demands more than reactive UI frameworks and client-side state management. The next generation brings reactivity to the data layer itself—letting applications stay in sync with the backend automatically through a sync-engine architecture.
This talk explores how TanStack DB provides a practical path toward such architectures without requiring a rewrite or commitment to a particular backend. You can start with familiar API-driven workflows using TanStack Query and progressively adopt richer sync through Electric or any real-time backend. TanStack DB acts as the connective tissue: a unified, fast, reactive client database that keeps application state synchronized with your backend.
The focus of this presentation is TanStack DB’s newest capability: query-driven sync. Instead of preloading large collections or keeping oversized in-memory datasets, TanStack DB loads exactly the data a query needs—whether that’s a page of results, a slice of a document, or a relational join. Under the hood, an incremental view-maintenance engine built on differential dataflow ensures queries update efficiently as new data arrives.
This enables applications to handle larger data volumes, compute reactive queries efficiently, and move toward a true sync-engine architecture—without sacrificing the incremental adoption story that makes TanStack DB practical for real-world teams.
Yjs is a widely used library to build collaborative applications. BlockNote and Prosemirror are text editors that closely integrate with Yjs.
In this talk, we'll preview upcoming functionality for Attributed Version History (who wrote what, and when?) and Track Changes (suggestions). We'll explore major new functionality coming in Yjs 14 (changesets and attributions), y-prosemirror and BlockNote that will make this possible.
The BlockNote team (Nick, Yousef and Matthew) has collaborated closely with Yjs (Kevin Jahns) on these topics, funded by ZenDiS (OpenDesk) and DINUM (La Suite Docs).
This talk will introduce our work within various collectives working together toward a more local-first future for modern Linux desktop and mobile platforms.
We'll introduce you to Modal, a collective focused on bringing local-first principles to Linux Desktop and Mobile. We'll also showcase Reflection, our GTK-based text editor, and p2panda, the underlying peer-to-peer stack.
Modal is a new collective dedicated to development, design, organizing, policy campaigning, and more, to make computing more useful, secure, and resilient. Our work centeres around software infrastructure projects, including GNOME, postmarketOS, p2panda, systemd, and the Linux kernel. We aim to make it simple to sync data across your devices while providing easy-to-use local-first APIs for applications. By doing this, we're creating an ecosystem of free software apps that leverage this infrastructure for synchronization and real-time collaboration. The foundation of all this technology is the p2panda project, which is built with "walkaway" principles in mind. p2panda's modular networking stack allows applications to operate autonomously on a wide variety of infrastructures—whether it's the Internet, Bluetooth, Wi-Fi Direct / Aware, or even sneakernet - giving you flexibility and control over how and when your devices sync.
p2panda aims to provide everything you need to build modern, privacy-respecting and secure local-first applications. Over five years of research, testing, exploration and collaboration with other teams, we've identified emergent patterns which have been solidified in p2panda's "building blocks". We'll present an overview of the peer-to-peer problem space and describe how each of our modules are designed to provide Connectivity, Discovery, Sync, Encryption, Access Control, and more.
We'll showcase concrete software built around Modal and p2panda, including Reflection, our native, GTK-based text editor. Reflection not only serves as a real-world example of a local-first application, but also as a "template" for developers looking to build similar apps. Alongside Reflection, we're developing a GObject interface for common p2p primitives, wrapped around p2panda and UI components. This interface aims to simplify the process of integrating decentralized networking into applications.
Finally, we'll discuss our work on a system service designed to enhance applications with p2p features, enabling a unified user experience at the OS level. This system service manages key tasks like permissions for networking activity, node trust management, multi-device support, and identity management through the address book. It is agnostic to any specific p2p framework, which we hope will foster greater interoperability across different platforms and p2p technologies in the future.
Files on your hard drive are the ultimate local-first storage. But to allow real-time collaboration from within text editors, developers currently have to reinvent the wheel each time: Figure out how to hook into buffer changes correctly, implement displaying remote cursors, finding a way to get the required events in and out of the editor.
In addition, for each combination of editor and collaborative use-case, there needs to be a separate plugin: For example, there is a Vim plugin to connect to an Etherpad, or you need individual editor plugins when wanting to live-code music or visuals together.
Similar problems have already been solved by different editor-facing protocols: To integrate "language intelligence" tools (that provide autocompletion or refactorings), you can use the Language Server Protocol (LSP). Likewise, debugging support can be added via the Debug Adapter Protocol (DAP), and support for LLM tooling is now provided via the Model Context Protocol (MCP).
We think that there's a gap for a "Collaborative Editing Protocol" (CEP, working title) that allows text editors to talk to "collaboration servers", and thus provides them with collaboration functionality. Per editor, this protocol would only need to be implemented once, making the resulting software components interoperable. You'd have plugins for Neovim and for Emacs that speak CEP, and you'd have an Etherpad bridge that also speaks it, and you could use all of them together!
In this talk, we want to outline the requirements for a protocol like that. We'll discuss different approaches, and demonstrate the proof-of-concept protocol we built for our local-first peer-to-peer pair programming software "Teamtype". We're looking to form a group to iterate on a "collaboration protocol" together, and eventually standardize it!
Git came and changed the landscape of collaborating on code in a decentralised and efficient manner – once you get to grips with the command-line, of course. GitHub capitalised on the fact that the social element of collaboration was missing from Git, while social platforms were emerging left, right, and centre. Our beloved, decentralised tool succumbed to the powers of centralisation...
To empower Git users once more, the Radicle protocol (heartwood^1) is a decentralised forge to allow people to collaborate in a sovereign and local-first manner. It introduces the ability to define social artifacts that live alongside your code and are present right-there on your disk.
Let's dive in to see how we did this, and how you can get involved in shaping a better future for collaborating together.
Miru is a set of web-based tools for media editing. In this talk, I'll present the video editing features that we're developing, and our journey to intuitive collaboration with offline support using CRDTs. I'll outline some similarities and differences between a video editing timeline and a rich text document, the CRDT libraries we evaluated, and what approaches did and didn't work for our editor.
We implemented a prototype that enables real-time collaborative editing in Writer.
This prototype takes the form of a special read-only mode that allows inserting, deleting, and editing comments by way of the y-crdt/yrs CRDT library.
Teleportal is a framework for creating a web-standards based backend & client for realtime collaborative applications. It is based on the popular Y.js CRDT, and implements a synchronization protocol on top. Teleportal focuses on giving the building blocks to create a server implementation, rather than being a single monolithic implementation. The project was built out of the desire for an optimized replacement of Hocuspocus (in both scale, performance & features). It currently implements communication over HTTP, HTTP + SSE, Websockets, but should scale to other bidirectional protocols. As well as being storage implementation agnostic & offering E2EE (alpha), there are plans to implement file uploads, user customizable messaging & more.
The DINUM introduces LaSuite, an MIT-licensed open-source collaborative suite designed to streamline the work of public servants. It includes four core applications:
Docs (real-time collaborative editing, co-developed with Germany and the Netherlands)
Drive (WOPI-compatible file sharing)
Meet (LiveKit-based video conferencing)
AI Assistant (powered by Vercel AI).
LaSuite prioritizes seamless UI/UX and offers a fully reusable design system and UI Kit—from simple components to complex interfaces (e.g., search and sharing modals).
We're following closely the work of the Local First community as it is part of our requirement to deliver e2ee collaboration accross the whole state.
This talk will cover the architecture, development workflow, and highlight the UI Kit as a reusable resource for the Local First community to build their own collaborative apps.
CRDTs allow for decentralized replication of data. Capability security allows for decentralized control over behavior. Local-first applications often use access-control list (ACL) security which has significant downsides versus capabilities, especially in a decentralized context. In this talk, I'll examine how CRDTs and capabilities can be composed to improve the security of local-first applications using a group chat prototype as a case study.
CRDTs and local-first sync engines provide exciting opportunities for creating new experiences for our users, but with technological advances come new challenges, such as:
These are questions that hadn’t needed to be addressed in a world of server-first apps, but we will need to take some thought in how to pair clear and informative UX with sync technologies to create the best possible user experiences for our apps.
In this talk, we will go over pitfalls that we should avoid when making local-first apps and some patterns that can help make better experiences for our users.
I am working on several prototypes with js-libp2p, IPFS and OrbitDB for peer-to-peer syncing CRDTs in OrbitDB. I'd like to talk about what it all means in practice from a web developer perspective working with those technologies, WebAuthN/Passkeys, DIDs, UCANs, decentralised storage and pinning networks — also from a security perspective in times when cloud services are failing and account breaches are becoming the norm.
An account-less, offline-first and local-first simple-todo PWA with WebAuthN: https://simple-todo.le-space.de/#/orbitdb/zdpuAskw4Xes4nxR1YNV8TxK2qmrDgceAqEoGHDtTAUhQWvDP
SQLRooms (GitHub) is an open-source React framework for building local-first data analytics applications powered by DuckDB. SQLRooms can run entirely in the browser using DuckDB-WASM, or connect to a shared session-backend running native DuckDB for larger datasets—in both cases, enabling privacy-preserving analytics where data stays under user control.
In this talk, I'll present SQLRooms' local-first architecture and our ongoing work on real-time collaboration using Loro CRDT. We're building a Canvas module with SQL query cells and Vega-Lite visualization cells, a Notebooks module, and an underlying DAG (directed acyclic graph) engine that tracks dependencies between cells—automatically re-executing downstream cells when data changes. These modules will support collaborative editing via @sqlrooms/crdt, with sync enabled through WebSockets using sqlrooms-duckdb-server.
A key insight for analytics apps: DuckDB serves as a read-only query engine—the underlying data doesn't need to be synced. Only the UI state requires CRDT synchronization: queries, notebooks, canvas layouts, annotations, and comments. This CRDT state can be persisted both in a shared session-backend DuckDB and on local machines for offline access.
For session-backend deployments, sqlrooms-duckdb-server provides a shared DuckDB instance where all connected clients query the same data—useful for large datasets or when consistent results matter. This can be deployed with e.g. Cloudflare Containers for on-demand, per-session instances.
I'll discuss our choice of Loro over Yjs and how separating data (read-only DuckDB) from collaborative state (CRDT) simplifies the sync architecture while enabling privacy-preserving collaborative analytics.
Distributed systems replicate data to improve availability, scalability, and fault tolerance. Ensuring that replicas remain eventually consistent is difficult. Current practices advocate for the use of Replicated Data Types (RDTs) which guarantee convergence out-of-the-box, e.g. CRDTs. However, programming distributed systems using these RDTs is non-trivial due to the lack of appropriate abstractions for replica discovery, update propagation, etc.
At our research lab at the Vrije Universiteit Brussel, we look at what it means for developers to build and utilise eventually consistent data types in their applications. The majority of current RDT approaches are ad-hoc, they require a dedicated implementation for each data type. However, building advanced collaborative applications requires custom RDTs that are tailored to the needs of the application. That implies extending or composing existing RDTs, or designing new ones.
Our goal is to develop abstractions and methodologies for the systematic construction of applications requiring replicated state. In this talk, we particularly focus on two main aspects: (1) non-ad hoc approaches to efficient RDT implementations, and (2) simplifying the development of application-specific RDTs:
Many approaches use ad-hoc solutions to track causality and ensure eventual convergence, e.g. keeping meta-data in the implementation. In a lot of cases, their design does not translate well into efficient implementations and is not suitable for resource-constrained runtimes. We present Flec[1, 2, 3], a framework that guides developers in making informed decisions during the development process, by providing an API that gives developers a uniform and structured way to deal with functional system requirements. This can range from network constraints to security and authorization aspects.
To simplify the development of collaborative applications using RDTs, we investigate alternative approaches where RDTs can be automatically derived from their sequential implementation [4, 5]. By means of an analysis we can detect conflicting operations, and automatically derive functional CRDTs. In some datatypes, certain application invariants would be impossible to guarantee with CRDTs. For these cases, we support automatically detecting where an application would have to synchronise and output an RDT with mixed consistency.
[1] Jim Bauwens, 2024. Flexible CRDTS for a demanding world. PhD Thesis [2] Jim Bauwens and Elisa Gonzalez Boix. 2020. Flec: a versatile programming framework for eventually consistent systems. Proceedings of the 7th Workshop on Principles and Practice of Consistency for Distributed Data. Association for Computing Machinery, New York, NY, USA, Article 12, 1–4. DOI [3] https://gitlab.soft.vub.ac.be/jimbauwens/flec [3] Kevin De Porre, Carla Ferreira, Nuno Preguiça, and Elisa Gonzalez Boix. 2021. ECROs: building global scale systems from sequential code. Proc. ACM Program. Lang. 5, OOPSLA, Article 107 (October 2021), 30 pages. DOI [4] https://github.com/verifx-prover/verifx/tree/main
Centralised systems were designed with the best of intentions, but were turned against us anyway. And peer-to-peer systems will be exactly the same.
How do we make the next generation of protocols more difficult to weaponise?
This is the lens which we'll use to look at Willow, a family of publicly-funded, open source peer-to-peer protocols. How can we learn from the ways both centralised and peer-to-peer systems have been abused in the past, and apply that to new designs? We'll take a look at some of the (surprising) paths Willow has taken to make it harder to turn against us.
Please enjoy this illustrated, slightly musical presentation from the worm-blossom collective.
PouchDB and CouchDB have been an absolute Local-First Dream Team since 2013. In this workshop, we’ll show you why. Join us for hands-on time with PouchDB itself, a look at a fleshed out demo app to see how the Open Source projects PouchDB, CouchDB and app state fit together, and a quick glance at a convenient Open-Source way to easily host your own CouchDB.
We’ll cover:
We’ll also share a bit about why we believe it is important to build on Open Source projects with a clear governance structure, so you can rely on it for the long-term.
Time permitting, we’ll share some of the extraordinary projects we have built with PouchDB & CouchDB:
What if the web was designed for sovereign communities, instead of centralized platforms? Seed Hypermedia brings first-class support for decentralized identity, provenance, and community governance, unlike the traditional web where these features are afterthoughts. Local-First principles and CRDTs are foundational to our protocol and software. The result isn’t just “offline-first documents,” it’s a model of a resilient and deeply-connected web that cannot be captured.