Notes from a Maintainer - Murtaza Aliakbar, Rethink DNS + Firewall

In the beginning was the Word, and the Word was with Matthew

The Rethink DNS + Firewall project got off to a front-foot start after Matthew Prince, CEO at Cloudflare, publicly offered to hire (?) us, 3 jobless ambitious friends to work on it, merely based on the ideas we laid out on Hacker News (in April 2019, during Ramadan, no less), and one that we didn’t even know would materialize, if at all. In a short while, even after being rejected by Y Combinator for the 2020 winter batch (we’re in good company), we found several (Indian) VCs (rather, analysts cosplaying as general partners) beating down our door to meet with us… Needless to say, this was an avoidable exercise in frustration. Still, I was impressionable back then, had too many magical thoughts about being the next Rajoshi Ghosh, the next Sid Sijbrandij, the next Avery Pennarun, & went to all humiliating meetings expecting something different from each. Once bitten, twice shy? Not me. In the end, these interactions disenchanted me pretty early on, to my benefit: Developing a free cybersecurity software out of social responsibility is not for the uninitiated to grok. On the other hand, it is convenient to loathe those who have more of what you desire for yourself. Anyways, 8 months later, Mozilla was kind enough to choose us (the only India-based project) out of the 1200+ projects that applied, for their 4 month (July to Oct 2020) “Fix the Internet” Incubator. It was modeled after Y Combinator, of which our cohort of 22 projects & companies was expected to be the first of many (it remained the first of only). An eventful accelerating experience, as we shipped more features in those 4 months than we have done in any other time period since. Being accountable to someone you respect out of peer pressure and the fear of failure (in this case, our mentors at Mozilla) was a hell of a motivator (Avicenna, the father of modern medicine, was right: classrooms / cohorts breed healthy competition). If I am allowed to be vulnerable, I’ll say that folks at Mozilla didn’t appear all too impressed with us, or our project, despite our herculean effort to build the anti-Onavo (Facebook’s spyware VPN), to succeed where Moxie Marlinspike’s OpenWhisperSystems didn't. So be it…

All it takes is a little push

In January 2020, Android app MVP built & shipped in 14 days, Rethink DNS (a name chosen by our community) started out as Brave DNS before we were hit with a threatening lawyerism for trademark infringement. At the time, it was flattering that we were important enough for any high-flying ponzi crypto businesses based in Silicon Valley to take us seriously, because clearly, the users weren’t: There was nary a relevant forum, Twitter thread, Discord, subreddit, or Telegram group we didn’t spam, but the downloads count just about crawled past 50 by 28 Aug 2020. It caught the attention of those lawyers, though.

On 29 Aug 2020, a popular Android blog featured the app, and we sprinted past 5000 users in one day. From there on, we kept acquiring 10 users a week, then 20, then 30, then 100, which has now settled at 1000 (and stagnant). To think that one blogger can have such an outsized impact is a lesson in timing, luck, and well, influencer marketing. We don’t get popular press nor influencers to shill about us, because we refuse to pay for the privilege. It is either word-of-mouth or bust. Especially if that word comes from project leads at the Guardian Project (Nathan Freitas), CalyxOS (Chirayu Desai), Jigsaw at Google (Vinicius Fortuna, Scott Carpenter), LineageOS (Oliver Scott), Ente (Vishnu Mohandas), GrapheneOS (Daniel Micay), and PrivacyInternational… that’s all the social validation we’ll ever need.

We are also lucky enough to be constantly supported by a selfless community of translators, moderators, group members, code contributors, willing testers, and generous sponsors that organically grew around our many humble projects. FOSS has its perks. I'm not the one to give “prescriptions”, but since this occasion calls for it, the primary reason why all our projects (even the embarrassing ones) are open source is that “you can't fight gravity” (impressed into me at AWS)… of software wanting to be free. This stance isn't at odds with making money with FOSS (especially B2B), but rather consistent with knowing the constraints & rules of the levers that can be pulled.

Retention is all you need

One of the few reasons we don’t want more users is, we’ve plenty of work left to do for a lifetime. Aside from going to town with i18n (translations), the other priceless tactical decision we made (owning to my 8 year kool-aid training at the AWS mothership on “customer obsession”) was to make it straight forward for our non-paying users to direct their frustration & anger at us: We put links right in our app to our subreddit, GitHub issues, Telegram group, Mastodon, and X (formerly Twitter), which till date, brings in a constant stream of hate love, bug reports, and feature requests to keep us busy until we physically die (which could be any instant, if the Universe isn’t kind). With no mentors left to impress but only actual users (and a few well-meaning professors and communities), we had found our pathway to building the most feature-rich bug-ridden firewall that could possibly be built. Thankfully, GLM, DeepSeek, and MiMo don’t tire like we do from mashing keyboards all day long. We do have a credible shot at vibecoding it all, whether we do it or not (due to code quality concerns), is a different matter. And much to my chagrin, there’s no shortage of vibecoded apps that mimic our project’s features, built in mere weeks, with way fewer bugs, by teenagers who don’t even know what "Cloud" is. Am I crazy? Am I being left behind? Possibly, none or both. Strange times.

In the course of our new found popularity, our DNS resolvers (server-side) were being hammered by, I am presuming, bot networks based out of Turkmenistan, Russia, China, and Iran. The peak (that is, the traffic that got past bot detection) we’ve handled thus far records at 40,000 requests per second, pushing 400TB per month in bandwidth. Optimising every part of the server-side stack short of ripping out the runtime (Node, Workerd, Bun, & Deno) seemed like a thankless, endless engineering challenge just to control the burn rate. I learnt well at AWS to craft-fully avoid the scale of it ruining our sleep, so we did sleep well through it all (except for the times when my twins wouldn’t let me). Due to the unkind invoices, not only did my wife’s savings vanish into ether, but all my credit cards maxxed out in what seemed like a blink. I was now relegated to drinking Sunrise instead of Davidoff. Ours was obviously a textbook case of magical thinking, that rich people EAs will appear from nowhere and start funding our marvelously engineered, censorship-resistant, public-benefit resolver. Alas, on the WWW, popularity is not always a good thing, as Wikipedia reminds us.

Aisi vaani boliye, man ka aapa khoye. Auran ko sheetal kare, aapahu sheetal hoye.

In humans, a near-death experience can bring ample philosophical clarity and rewire psychology. For an unsustainable Free & Open Source project in existential crises, there's but repeated burnout, partly from the endless grind of bugs and feature requests, partly from lack of (monetary) incentives beyond motivation & curiosity, which are never in short supply when you're starting out with an intense desire to want this thing to exist and thrive. From experience, there's no clarity, only bitterness. It isn’t uncommon then for disgruntled FOSS maintainers abandon their absurd Sysphiyan journey or go on rants about “rivals” (like we did; it's a rite of passage). For our project, Rethink DNS + Firewall, we drew plans (in other words, “magical thoughts”) to monetise and live off of it. A million users in 2026, but are we there yet? No. Either it isn’t easy, or we are incompetent. I’d like to think the former, because the thought of the latter is uneasy. We do have plenty of reasons to doubt ourselves regardless, because outside of Mozilla, no other like-minded organization incubated us, supported us, or entertained our applications. In one case, an organization outright refused to meet us, despite the fact that we flew over hills and oceans to do so. I digress.

Not all nails and thorns though. Other doors opened. Between FOSS United, Cloudflare, (now defunct) OSOM Inc, and Zerodha’s FLOSS/fund, we found much-needed respite. Without that, we were toast, both personally & professionally. The Cloudflare angle is interesting because we were one of the early ones to abuse the potential of their Workers Platform for anti-censorship purposes. Since then, many other popular tools and projects have cropped up; and to boost my ego, I like to take credit for kickstarting it all. Cloudflare’s Eng Leads, VPs, SVPs continued to give us time as if ours was a project of consequence & importance. Maybe it is. As before, my ego needs no second invitation.

In particular, FOSS United and FLOSS/fund’s contributions have afforded us, for the first time in years, to be more ambitious & fearless; and present our work to the world, at conferences like FOSDEM. We even treated ourselves to one MacBook Pro M4 to build out a Rethink-like DNS + Firewall for iOS (one of the top asks on the subreddit). Perhaps even pwnd billionaires will find utility in network security tools like Rethink. Our rejuvenation reiterates the importance of India-based organisations and how they readily relate and promptly support India-based developers, while the rest simply wouldn’t, for brownies that escape me. If I am allowed to be cynical, I know what colour I am wearing, the race I am running.

I don’t only want to take, take, take, though. I’d like to think we’ve contributed back to FOSS United by showcasing our modest projects at India FOSS since 2023 (in Sep 2022, I was vacationing in London & Bournemouth, just so you know what I'm sacrificing to attend it). We participate despite the unavoidable shade from disinterested onlookers who make us second-guess our life choices. Not blaming them, as maybe, just maybe, our projects are way too sus… or the three 2 of us are going through mid-life crises… but we still show up, & put our best foot forward. Before I go, I’ll also milk the point, even if no one will concede, of bringing Vishnu at Ente into the FOSS United fold (Vishnu wouldn't even enter the NIMHANS premises when I invited him to India FOSS 2023). What a positive addition to this community Ente has been (if I may say so myself)! As for me, the infectious influence emanating from the successes of ERPNext (Frappé) & Rushabh has brought us all here to this moment. Now, with OpenAI Rushabh as our north star, we do want to give back way more solely out of guilt as a reflection of our gratitude. This blog post is one. Aren’t you inspired?