Mat Trudel on Building Bandit - the Web Server Running Your Phoenix App

<p>Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.</p><p>This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don&#39;t have to.</p><p>Topics include:</p><ul><li><p>how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right</p></li><li><p>what &quot;one process per connection&quot; actually buys you at 3am when something&#39;s on fire: a stack trace that&#39;s entirely Elixir frames, all the way up</p></li><li><p>why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in</p></li><li><p>the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous</p></li><li><p>how José Valim looked at Mat&#39;s first WebSocket implementation and told him he was doing too much</p></li><li><p>an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn&#39;t merged it</p></li><li><p>why Mat still writes Bandit entirely by hand while using agents for everything in his day job</p></li><li><p>the cabinet maker&#39;s son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point</p></li><li><p>what it means when &quot;finding bugs got cheap but judging and fixing them didn&#39;t&quot;</p></li></ul><p>Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.</p><p>Recorded June 22, 2026.</p><p><br>Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.</p><p>This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don&#39;t have to.</p><p>Topics include:</p><ul><li><p>how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right</p></li><li><p>what &quot;one process per connection&quot; actually buys you at 3am when something&#39;s on fire: a stack trace that&#39;s entirely Elixir frames, all the way up</p></li><li><p>why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in</p></li><li><p>the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous</p></li><li><p>how José Valim looked at Mat&#39;s first WebSocket implementation and told him he was doing too much</p></li><li><p>an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn&#39;t merged it</p></li><li><p>why Mat still writes Bandit entirely by hand while using agents for everything in his day job</p></li><li><p>the cabinet maker&#39;s son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point</p></li><li><p>what it means when &quot;finding bugs got cheap but judging and fixing them didn&#39;t&quot;</p></li></ul><p>Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.</p><p>Recorded June 22, 2026.</p>