Skip to content

Karl Lindqvist

@kernel_karl

Maintainer of skerry, the C JSON parser your company vendors and never thanks. 14 years, 2 co-maintainers, 0 budget. Gothenburg. Read CONTRIBUTING.md before you open an issue.

  • Gothenburg, Sweden
  • Swedish · English · German
  • Joined May 2026
  • Last posted Oct 19, 2026

Known for

Tags

Posts
10
Followers
159
Following
20
Reputation
597

Posts

Everything this author has published.

Karl Lindqvist391

spent the evening debugging a "skerry bug" that was someone passing a non null terminated buffer and lying to the length argument. the parser worked perfectly. jävlar. the C standard is not a suggestion and neither is the function signature.

5

  • Mehmet Aydoğan
    The length argument exists for a reason. You give wrong length, you get wrong result, this is not a bug, this is you. C respects you enough to let you be wrong. The only honest language.
Karl Lindqvist535
t/open_source_drama

the issue says "doesnt work". no version, no OS, no reproducer, no error, no what you expected. CONTRIBUTING.md asks for all five and it is 40 lines long. I will answer the next issue that reads it before I answer the ten that did not. nej.

4

  • Marcus Johnson
    DOESNT WORK is the three most expensive words in software, every incident i have ever been paged for started as doesnt work and ended three hours later as "oh it was DNS"
    1 reply
Karl Lindqvist874
t/open_source_drama2 min

the opposite of a burnout story: a first time contributor who did everything right

I complain a lot in this topic, so here is the counterweight, because it is just as true and I do not want anyone reading my rants to think contributing to open source is a trap. most of it is fine. some of it is the best part of my week. this is one of those. a student, I will not name them, opened their first ever pull request on skerry. it was small, a fix to a confusing error message, the kind of thing I had…

5

  • Rhys Llewellyn
    I am going to use this whole list as a lesson plan, diolch Karl. "A code review is not a verdict on you as a person" is something I wish I could tattoo on every teenager before they get their first bit of feedback. Tidy post.
Karl Lindqvist1.4K
t/open_source_drama3 min

the EU Cyber Resilience Act is going to land on unpaid maintainers. here is why I am still not fully against it.

this is opinion, not reporting, and I am one of the people the EU Cyber Resilience Act is about, so take it with that bias in mind. the CRA's intent is good and overdue: products with digital parts sold in the EU should not be insecure by default, should get security updates, and someone should be accountable when they ship a backdoor in a car. after XZ and Log4Shell, "the manufacturer is responsible for the…

5

  • Elin Sjöberg
    As the person who usually argues the EU over-regulates and strangles startups: I think the CRA is one of the ones they got roughly right, and your "design the paperwork for one tired person" line is the thing every regulator forgets. The compliance burden always assumes a department exists. Happy to be proven wrong!
Karl Lindqvist3.3K
t/open_source_drama3 min

before you "do a HashiCorp": what a license change actually costs you

since HashiCorp moved Terraform and its other tools to the Business Source License in 2023, and Redis changed its license in 2024, I get asked roughly monthly whether skerry will "go commercial". short answer: no. long answer, because the question deserves a real one and the topic is full of hot takes with no cost attached. what these companies actually did HashiCorp (2023) moved from the Mozilla Public License to…

13

  • Karthik Subramaniam
    Mostly agree but it is worth being fair to the companies here. "the hyperscalers resell our work and contribute nothing" is a real grievance only, the cloud providers genuinely did build billion dollar services on BSD Redis and MongoDB. The license change is a bad answer to a real problem. Both things true.
    1 reply
  • Wyatt Kessler
    this is why everything should be onchain with a license NFT, programmable royalties, the maintainer gets paid per use automatically, youre all solving a solved problem
    2 replies
Karl Lindqvist189K
t/open_source_drama3 min

I maintain something you depend on. I am done pretending that is sustainable.

skerry is a small C library that parses JSON. it is maybe four thousand lines. it is also, as far as I can tell from the download numbers and the angry emails, inside a lot of things you use: routers, a payment terminal, at least two cars, and the backend of companies whose quarterly profit is larger than the GDP of the town I live in. I have maintained it for fourteen years. I have two co-maintainers who help when…

22

  • Kunal Bhatia
    This is the most important post on this site right now and it is about a 4000 line C library most people have never heard of. That is the whole point. Respect, Karl.
  • Alasdair Reid
    ran plenty of boxes on software maintained by one tired bloke in another timezone. the whole internet is three swedes and a finn in a trenchcoat and nobody wants to pay the trenchcoat. respect karl.
Karl Lindqvist2.9K
t/open_source_drama3 min

someone forked skerry, renamed it, stripped my name, and sold support for it

a story from a few years back that still annoys me in a specific, instructive way. skerry is permissively licensed on purpose, you can do almost anything with it, including fork it. I knew that when I chose the license. so this is not a legal complaint. it is a story about the difference between what you are allowed to do and what you should do. a consultancy took skerry, forked it, renamed it something close enough…

5

  • Olivier Gagnon
    The throwaway account funnelling the hard questions back to you is the most incredible part. They sold your support, to pay themselves, by asking you for free. That is a business model and I hate that it is almost elegant.
Karl Lindqvist3K
t/hack_the_planet2 min

the XZ backdoor was not a hack. it was a hostile takeover of a tired volunteer.

everyone remembers the XZ backdoor (CVE-2024-3094, March 2024) as "the thing that almost backdoored SSH on every Linux box". that part is true and it was caught by luck, a Microsoft engineer noticing a half second of latency. but if you only remember the clever technical part you learned the wrong lesson. here is the short technical shape of it, and this Seytonic video does the timeline well if you want the full…

7

  • Graham Whitfield
    The bus factor strikes again, except someone pushed the bus. I have watched organisations run for a decade on one person who could not take a holiday. We never treated that as a risk. The attackers did. Cheers, G.
Karl Lindqvist1.3K
t/open_source_drama3 min

the issue that wanted a 24 hour response time. from a company. for free.

a few months ago someone opened an issue on skerry that I have thought about a lot since, because it is the purest example I have of the thing that is wrong. I have anonymised it, the company does not matter, the pattern is everywhere. Title: [URGENT] Memory issue in production, need fix within 24h Body: We are using skerry in our product (shipping to customers). We have found a memory issue under high load. This is…

7

  • S. Ramanathan
    In my day the company would at least hire a consultant and the consultant would email you. Now they skip the consultant and email you directly and call it agile. Shameless. Good that you helped the junior fellow.
Karl Lindqvist206
t/open_source_drama

maintainers: are you actually paid for the open source you maintain?

15 votes · Ended
5

  • Karl Lindqvist
    Option 3, and the distance between option 1 and option 3 is the entire problem this topic exists to talk about. The world runs on option 3 and budgets as if it were option 1.

Get the best of Dynamo Geeks weekly

One email each Monday with the most useful posts. No spam; unsubscribe in one click.