DEV Community: Zane Beckett

You Don't Own Your Phone. You Don't Own Your Data. You Barely Own Your Opinions.

Zane Beckett — Fri, 24 Jul 2026 21:41:52 +0000

Author: Alex Voste
Originally published on CoderLegion: You Don't Own Your Phone. You Don't Own Your Data. You Barely Own Your Opinions.

Fair warning before the disclaimers even start: this one's a little long, a little uncomfortable, and not really written for someone who's going to bounce after the first two paragraphs. If you're still here by the end, you'll know things about your own phone that most people never bother to check.

A disclaimer before we start, because apparently that's how it works now: this is one person's opinion, built on public facts and the collective paranoia of people who still bother reading terms of service. I'm not trying to cancel Google — please, Google, I'm a competent engineer, hire me, I'm kidding, I'm not kidding. I just think somebody should say the quiet part out loud before saying it becomes a compliance violation.

A bigger, more boring disclaimer, because this one actually matters: everything below is built on real, checkable sources — court verdicts, regulator fines, academic research, and independent audit tools like Exodus Privacy. Where a specific claim couldn't be independently verified, I've labeled it explicitly as a theory or an unverified report, not a fact, and I'd rather under-claim than dress up a rumor as a courtroom finding. I also touch on identity-verification laws and proposals from a few different countries — Vietnam, the EU, Russia — purely as a technical and factual comparison of what each is doing and when. That's not a scorecard, and it's not me passing judgment on any government, political system, or policy choice. I'm not qualified to rule on sovereign lawmaking and I'm not trying to. This is a breakdown of mechanisms, not a verdict on the people who built them.

The myth everyone gets wrong (so let's kill it properly)

Let's start with the thing you think you know: "my phone is listening to me." You said "air fryer" out loud once and an ad for an air fryer showed up. Spooky, right?

It's not spooky. It's worse.

Every major platform — Meta, Google, Apple — has said on record, repeatedly, under oath in Meta's case, that they don't use your microphone to target ads. Independent security researchers have tested this claim for years, tearing apart thousands of apps looking for secret always-on listening, and they keep finding basically nothing. No hidden audio pipeline running in the background of TikTok. No microphone spyware baked into Instagram.

Why? Because they don't need it. They already know you searched for kitchen gadgets three times last week, follow four cooking accounts, paused two seconds longer on a fryer ad last month, and that your friend with identical shopping habits just bought one. That's not surveillance through a microphone. That's a statistical ghost of you, built from years of clicks and dwell time, predicting your next move before you've made it. Ad tech doesn't need your voice. It has something better.

That said — the myth isn't entirely fantasy. A marketing outfit branded "Active Listening" got dragged in front of the FTC for claiming it could target ads via smart-device microphones in real time; the "service" turned out to be repackaged data-broker email lists sold at a markup, but the pitch decks named Google as a partner. Apple paid $95 million in a class-action settlement over Siri recordings potentially reaching third parties. Amazon is currently defending a federal class action in Seattle over Alexa recordings allegedly retained and used to train its AI models.

So no, your phone probably isn't listening to your dinner plans. The industry built entirely around not needing to listen is more unsettling, because there's no toggle for "please stop knowing me."

The receipts, because "trust me" isn't a source

If this sounds like tinfoil-hat energy, here's what regulators and juries have actually done about it in the last few years — not allegations, verdicts and settled fact:

Meta / Cambridge Analytica. A UK firm harvested the data of roughly 87 million Facebook users through a single quiz app, built psychological profiles from it, and sold political targeting off the back of it. The FTC fined Meta $5 billion — still one of the largest privacy penalties ever issued against a single company.
Meta / Flo period-tracking app. In August 2025, a federal jury found Meta liable under a 1967 California wiretapping law for secretly collecting menstrual and pregnancy data from the Flo app — cycle dates, whether users were trying to conceive — through an embedded software kit, then using it for ad targeting. The jury needed three hours to decide Meta had eavesdropped without consent. Damages could run into the billions once the full class is counted.
Google / "Web & App Activity." In September 2025, a San Francisco jury ordered Google to pay $425.7 million after finding it kept collecting data from about 98 million users across an eight-year stretch — even after those users had explicitly flipped the privacy switch meant to stop it.
Amazon / Alexa Voice ID. A federal judge in Chicago certified a class of roughly 1.18 million Illinois Alexa users in November 2025, over allegations that Amazon built biometric "voiceprints" from their voices without the written consent Illinois law requires.
Meta and Yandex / the localhost trick. In 2025, researchers caught Meta's Facebook and Instagram apps — and Yandex's apps, reportedly since 2017 — quietly listening on local network ports on Android phones. Any website with a Meta Pixel or Yandex Metrica tracker could use this to silently hand your anonymous browsing session to the app sitting on your phone and stitch it to your actual identity. It worked straight through incognito mode, cookie clearing, and ad-ID resets — the three things privacy-conscious people are told will protect them. Meta paused it within days of the research going public, calling it a "miscommunication" about Google's policies.
GDPR, cumulatively. European regulators have now handed out more than €7 billion in fines since 2018, including a €1.2 billion penalty against Meta for unlawful US data transfers and €530 million against TikTok for sending EU user data to China. Enforcement isn't slowing down — more fines have hit small and mid-sized companies in the last three years than in GDPR's entire first five.

None of this required a conspiracy theory. It required a courtroom, a jury, and people willing to read the fine print out loud.

VK: the eastern giant nobody in the West is watching

Everything above is Western Big Tech getting dragged into courtrooms, mostly because Western courtrooms exist for that purpose and Western journalists chase that beat. But swap hemispheres and you find a mirror image: VKontakte (VK), the dominant social network across Russia and much of the CIS, running the same playbook with a different flag on it.

Independent app-auditing tools like Exodus Privacy — which do static analysis on Android APKs to catalogue embedded tracking SDKs and requested permissions rather than take a developer's word for it — put VK's official Android app at 16 separate tracker SDKs and 99 requested permissions in its most recent scanned build (full report here — go look yourself, don't take my word for it). The tracker list alone reads like a cross-section of the entire ad industry: Google AdMob and Firebase Analytics, Yandex Ad, Huawei's HMS Core (which bundles location, advertising, and analytics in one package), plus ad-mediation networks like ironSource, Mintegral, and Unity3d Ads, alongside VK's own first-party identification SDK. The permissions list goes well past what a messaging-and-newsfeed app needs to function: precise GPS location, reading your call log, reading and writing your contacts and calendar (including a permission that explicitly lets the app "send email to guests without owners' knowledge" when it modifies calendar events), reading your phone number and device identity, recording audio, using the camera, and reading fitness data like step count and calories burned. Not all 99 are sinister on their own — plenty are mundane plumbing every app needs — but stacked together with 16 separate third-party trackers quietly reporting home, it's a genuinely large surface area for a platform whose stated job is "let people message their friends." Worth being precise about what VK actually is here, because it matters for how you read the rest of this: VK isn't just a private company that happens to be popular in Russia, it's a platform with formal ties to the Russian state and legal obligations to cooperate with its authorities on request, and unlike Meta or WhatsApp, VK's messages carry no end-to-end encryption at all — meaning that data, once collected, isn't just sitting in a corporate server somewhere abstract, it's structurally reachable by a government. That's a documented, publicly reported fact about how the platform is built and regulated, not a political opinion about Russia, and I'd say the exact same thing about any platform, in any country, built the same way. So if you're weighing which regional giant to worry about, the honest answer is: don't pick a side. East and West both built the same machine — they just answer to different governments when the machine gets audited.

A theory worth reading, not a verified fact

While we're here — a claim that's been floating around tech circles that I want to flag as a claim, not smuggle in as fact: reports have circulated alleging that in 2026, Meta ran an internal program collecting employee activity — keystrokes, screen content, even messages — from company laptops, ostensibly to train AI systems, and that some of those records ended up visible to a far larger internal audience than intended, triggering an employee petition. I haven't been able to independently verify the specifics — the numbers attached to it move depending on which forum you read — so take it exactly as advertised: an interesting, plausible-sounding story making the rounds, not a courtroom fact like the ones above. If true, it's the same surveillance logic Big Tech applies to its users, just pointed inward at the people building the tools. If it's exaggerated, it's still a useful thought experiment: what happens when the company that profiles you for a living starts applying the same instincts to its own staff?

The data doesn't have to be sold to end up in the wrong hands

Right now, while you're reading this sentence, a screenshot of somebody's desktop is sitting on a server they never explicitly agreed to. Somewhere, a password nobody's changed in five years is sitting in a database that already leaked once. Statistically, given how many billions of records are already circulating, the odds that none of it is yours are getting worse every year, not better.

Here's the part that ties everything above together, and it's arguably the most important one: none of this requires a company to be evil on purpose. Every dataset described in this post — location history, voiceprints, screenshots, browsing profiles, passport scans — sits somewhere on a server. And servers get breached. Constantly. At a scale that's honestly hard to hold in your head.

2025 alone produced the largest credential leak ever recorded: roughly 16 billion login records — usernames, passwords, session tokens — pulled together from infostealer malware infections across services including Apple, Google, Facebook, and Telegram, surfacing on criminal marketplaces in June 2025. Separately, a data broker called National Public Data lost roughly 2.9 billion records covering an estimated 170 million people — full names, Social Security numbers, decades of address history (IBM's writeup of the incident is worth a read) — and that dataset kept circulating on dark web markets throughout 2025, more than a year after the original breach. Qantas got hit in 2025 too: attackers social-engineered their way into a third-party customer service platform in June, and after the airline refused to pay a ransom, dumped roughly 5.7 million customer records — names, emails, birth dates, frequent-flyer numbers — onto the dark web that October (Qantas's own public breach timeline confirms it). None of these companies wanted this to happen. It happened anyway, because a large enough pile of valuable data is, by definition, a target worth attacking.

And this isn't hypothetical for the platform we just spent a whole section on. VK has been breached, leaked, or scraped repeatedly across more than a decade: around 100 million account credentials — plaintext passwords included — were stolen and put up for sale on the dark web for the price of a fast-food meal back in 2016 (Have I Been Pwned has the full record); over 32 million scraped and API-pulled records, including data from supposedly private and closed profiles, surfaced in a 2022 leak; more than 390 million user records were dumped on a hacking forum in September 2024 (Cybernews covered it in detail); and as recently as February 2026, researchers found malicious Chrome extensions had hijacked over half a million VK accounts to spread malware and manipulate security tokens. Whatever VK collects doesn't just sit in a vault under VK's control forever — history shows it eventually ends up copy-pasted onto a forum where anyone with a few dollars in cryptocurrency can buy it. And once your name, phone number, location history, or password is sitting in a criminal marketplace, it isn't used to sell you sneakers anymore. It's used for account takeovers, SIM-swap fraud, blackmail, and identity theft — by people with considerably worse intentions than an ad network.

This is the actual argument for minimizing what gets collected in the first place, and it has nothing to do with distrusting any single company's intentions. It's just math: the less data exists about you in any one place, the less there is to steal when — not if — that place eventually gets broken into.

Windows would like to remember everything you've ever looked at

Microsoft shipped a feature that screenshots your desktop every few seconds and uses on-device AI to let you search your own life like a browser history. It's called Recall. The first version stored everything in a folder, unencrypted, extractable by a two-minute script researchers named — I am not making this up — "TotalRecall." After the backlash, Microsoft rebuilt it: encrypted, tied to Windows Hello, wrapped in a hardware-isolated enclave, off by default.

Great. Except security researchers have gone back in more than once and found new ways to reach the stored data anyway — most recently in early 2026. The pattern repeats: Microsoft hardens it, someone breaks it again, Microsoft patches it. The core problem was never really the encryption implementation. A running photographic log of everything you've ever typed or clicked is an extraordinarily attractive target no matter how good the lock is. A vault is still a vault worth robbing.

Plot twist: your "no-logs" VPN might have a footnote

Quick detour, because you're probably thinking "fine, I'll just get a VPN." Good instinct. Bad ending, sometimes.

I actually did this — emailed a mid-market paid VPN provider (Russian-jurisdiction, "no-logs" is literally in their marketing) with one clean question: do you store IP addresses and connection timestamps, and can you confirm no-logs in writing?

Their first reply: "We don't store or share client data with third parties." Clean. Confident. Case closed, right?

So I sent back their own privacy policy. Turns out their own terms define "processing" — using the exact wording from Russia's data protection law — as including collection, storage, and retention. And their own clauses say IP addresses and login timestamps get "processed." And a separate clause says processing happens on Russian territory. And another says data gets handed over if Russian law requires it.

Their second reply, paraphrased because their actual answer ran three defensive paragraphs: "technically it's only in RAM, only for the session, destroyed after you disconnect, and we're legally required to use that wording from the law, we can't change it."

Here's the part that matters and takes five seconds to understand: RAM is still storage. If your IP and timestamp exist anywhere a system can read them — disk or memory, doesn't matter — while your session is active, and that system sits inside a jurisdiction that can legally compel a live extraction, then "no-logs" was never really a technical guarantee. It was a marketing sentence sitting on top of a legal document that says the opposite in its own words.

I'm not naming the company, and I'm not telling you every VPN does this — plenty of providers publish real, independently audited no-logs reports and mean it. I'm telling you to do exactly what I did: ask the pointed question, then actually read the policy they hand you afterward, especially the definitions section. If "processing" quietly includes "storage" and the company sits under a jurisdiction with broad data-access laws, you haven't bought anonymity. You've bought a very polite waiting room.

Your phone is a rental, and you're the tenant who can't change the locks

You paid full price — sometimes over a thousand dollars — for a device you don't fully control. Bootloaders are locked. Bloatware is preinstalled and often can't be removed without voiding a warranty or tripping hardware checks that quietly break your banking app. The manufacturer decides what OS you're allowed to run, which repair shops count as "authorized," and how long the device gets security updates before it's engineered into obsolescence. You're the owner on paper and the guest in practice. The device is the hook; your data and your next upgrade purchase are the actual product.

The passport paradox

Here's where it gets genuinely interesting, and where I want to be careful, because this isn't a story with a villain — it's a story with a trade-off, and different countries are answering it completely differently at the same time.

Vietnam just did something almost nobody expected: starting January 1, 2026, its new Law on Personal Data Protection bans social platforms operating there — local or foreign — from requiring users to upload a photo of their ID card or passport just to verify an account. It also bans platforms from reading private messages or recording calls without consent. That's a real, enforceable ban with serious financial penalties attached. At the same time, Vietnam is separately rolling out rules requiring accounts to be linked to a verified local phone number or national ID number for anti-fraud purposes. So the picture isn't "more privacy" or "less privacy" — it's "no more handing platforms a photo of your actual passport," while identity still gets tied to you through a different, arguably less exploitable channel. Genuinely nuanced, genuinely worth watching.

Europe took the opposite visual approach for an entirely different reason. In early 2026, a new EU-based platform called W Social launched as a deliberate alternative to X, built specifically to be bot-resistant: to post, you verify your identity by scanning a passport or national ID card and a selfie through a separate companion app. The pitch is that the scan and match happen on your own device, and the company says it doesn't store the document itself centrally — you can also browse anonymously with reduced functionality if you skip verification entirely. Whether "we process it locally and don't store it" survives contact with millions of users and a few years of pressure is exactly the kind of promise worth revisiting in twelve months. It's the same core question as always — how much of "prove you're human" ends up as "here's your permanent identity record" — just answered by a private company instead of a government this time.

Russia's telecom regulator, Roskomnadzor, put forward a proposal back in 2021 that would have required new social media and messenger users to submit passport details, home address, and contact information, cross-checked against the state's Gosuslugi portal, as part of consent-management infrastructure for personal data. To be clear about where this actually stands: it was a draft proposal, not a law that took effect, and it hasn't been implemented as originally floated. I'm not going to pretend to have a verdict on whether that specific idea was good policy or bad policy — plenty of countries debate identity requirements for online services, for all kinds of legitimate and illegitimate reasons, and that's a conversation about tradeoffs, not a referendum on any one government. What's actually worth sitting with is the pattern above it: state ID portals, private "trust and safety" platforms, and social networks are all reaching for the same solution — link your face and your legal identity to your online activity — at almost exactly the same moment, for reasons ranging from fighting bots to fighting fraud to fighting disinformation. Some of those reasons are good. The output is still the same: your passport, your biometrics, and your posting history increasingly living in the same place.

And that's the actual tension, stripped of any single country's politics: identity verification is a genuinely reasonable answer to bots, fraud, and disinformation. It is also, structurally, a new centralized target. So next time something asks you to prove you're human, the interesting question isn't whether they have a good reason today. It's what happens to that proof on the day their reason stops mattering. You don't need me to answer that one for you — but here's a hint: databases don't retire. They just wait.

So what do we actually do about it?

Here's the part where I disappoint anyone expecting a manifesto: I'm not telling you to throw your phone in a lake and move to a cabin. I use the apps too. I like fast information and dumb memes as much as anyone. This isn't a call to abandon convenience — it's a call to stop pretending the convenience is free.

You can also do nothing. Close the tab, keep scrolling, change nothing — that's a real option and nobody's coming to stop you. Or you can spend the next two minutes doing this, right now, before you close this tab:

Open your phone's settings.
Pick one app you use daily — VK, Instagram, whatever's already open in another tab.
Turn off its access to your microphone, contacts, and location if the app doesn't strictly need them to function.

Done. That's it. You just did more for your own privacy in two minutes than most people will do all year. Not a revolution. Not a lake cabin. Just one small door you closed that used to be wide open.

A few more things that cost five minutes each and nothing beyond that:

Turn off ad personalization in your Google, Meta, and TikTok settings. It doesn't stop collection, but it shrinks the targeting surface.
Use a real password manager and 2FA. Most "hacks" are just reused passwords from a breach nobody rotated.
Read one privacy policy this year. Just one. You'll never look at "free" the same way again.
If you're a developer, push back inside your own stack. You decide what telemetry ships in the product you build. That's more power than most people in this conversation will ever have.

Here's the uncomfortable part, though. You probably think of yourself as a person — opinions, habits, a face. Every system described in this post thinks of you as a row. A data point with a name attached purely for convenience. You don't have to agree with that framing. But once you've actually sat with it for a second, it's a little harder to just close the tab and pretend you didn't read this.

Now, about why you actually read this whole thing

Since we're being honest with each other: this post used a specific structure on purpose, and it's worth naming, because recognizing the pattern here is the same skill that protects you from the next one.

It opened with a myth I could confidently debunk — trust, earned fast.
It escalated with dollar figures and jury verdicts — specificity that reads as credibility, whether or not you checked it yourself (you should).
It made the threat feel like it's happening to you, right now, not to some abstract "user out there."
It gave you a way out that felt like a choice, not an order — do nothing, or spend two minutes. Either way, you decided.
It handed you one small, immediate action instead of a vague suggestion, because five minutes of resistance beats another lecture you'll forget by tomorrow.
It pulled you into an unresolved debate — the passport paradox — with no clean villain, because open loops keep people reading.
It's closing on a moment of "wait, is this article doing the thing it just described" — a little vertigo is what makes people screenshot something and send it to a friend.

None of that makes the verified parts above less true. The Flo verdict happened. The $425 million happened. The localhost tracking happened. I flagged the one item I couldn't fully verify as exactly that — a claim, not a fact — because the moment you stop distinguishing the two, you've become exactly the kind of unreliable narrator this whole post is warning you about. But the fact that true information can be arranged to hook you exactly like an ad can is, honestly, the whole point of this post. The mechanism doesn't care whether the payload is a sneaker ad or a privacy manifesto. Worth remembering the next time something online makes you feel like you have to keep scrolling — including this one.

One last note, plainly stated: everything in this piece is either a matter of public court record, a regulatory decision, published academic research, or the output of an open, independently verifiable auditing tool that anyone can run themselves — sources are linked or named where they exist specifically so you don't have to trust me. The one exception is flagged inline as an unverified claim, not presented as fact. This is a personal, informational write-up, not legal advice, not a security audit of any product named here, and not a statement about the character, intentions, or legitimacy of any company or government mentioned. Company names, product names, and country names appear because they're the ones with public data behind them — not because I'm accusing anyone of anything beyond what's already a matter of public record. If something here is factually wrong, I'd rather be corrected than be right — go check the sources, that's what they're there for.

ForgeZero Now Supports musl Cross-Compilation and Objective-C on Linux

Zane Beckett — Sat, 06 Jun 2026 08:55:36 +0000

🚀 ForgeZero Now Supports musl Cross-Compilation and Objective-C on Linux

I've been spending the last few weeks improving ForgeZero, adding support for more toolchains and making cross-platform development a little easier.

The latest update introduces two features that I wanted for quite some time:

✅ musl cross-compilation powered by the Zig toolchain
✅ Objective-C support on Linux with automatic compiler and linker selection

The best part? No additional configuration is required.

Just write your code and let ForgeZero handle the rest.

Static musl Builds

ForgeZero can now generate fully static musl binaries, making cross-compilation almost effortless.

fz -cc main.c -musl=riscv64 -toolchain zig

The resulting binary:

main: ELF 64-bit LSB executable, UCB RISC-V, RVC, double-float ABI, version 1 (SYSV), statically linked, with debug_info, not stripped

Static binaries are incredibly useful when building:

🐳 Minimal Docker images (scratch)
📦 Portable standalone executables
🔌 Embedded & IoT applications
🖥️ Systems without glibc
🌍 Cross-platform deployment pipelines

Using Zig as the backend compiler makes targeting different architectures surprisingly simple while keeping the ForgeZero interface exactly the same.

Objective-C on Linux

This is probably the feature I'm most excited about.

ForgeZero now automatically detects .m Objective-C source files and switches to the correct compilation pipeline without requiring any flags.

fz -cc main.m

Verbose output:

Objective-C detected!
Bypassing Zig linker to use Clang with -lobjc

Running:
clang main.o -o main -lobjc -Wl,--build-id=none

Built: main

No custom scripts.

No Makefiles.

No manually remembering linker flags.

ForgeZero simply detects the language and invokes the correct backend automatically.

Why Objective-C?

Most developers associate Objective-C exclusively with macOS and Apple's ecosystem.

However, GNU Objective-C works perfectly fine on Linux through Clang and libobjc.

Supporting it means ForgeZero can now build another systems programming language using exactly the same interface as C or Assembly:

fz -cc hello.c
fz -cc hello.m
fz -asm boot.asm

The command stays the same—the build pipeline adapts automatically.

Where ForgeZero is Going

ForgeZero originally started as a tiny utility to avoid typing endless compiler and linker commands.

Over time, it has evolved into a unified build frontend capable of orchestrating multiple toolchains while automatically selecting the right backend for the current source language.

The philosophy remains simple:

Write code, run one command, and let the build system figure out the details.

There's still a lot of work ahead, but I'm happy with the direction the project is taking.

Links

⭐ GitHub & Documentation:
https://github.com/forgezero-cli/forgezero

👤 Author:
https://github.com/alexvoste

Feedback, ideas, and contributions are always welcome.

Gloria JIT v4.4.0 — Bare-Metal Control, Memory Primitives, and Structured Flow

Zane Beckett — Mon, 01 Jun 2026 22:23:30 +0000

What is Gloria JIT?

Gloria JIT is a low-level programming language and compiler that is part of the ForgeZero ecosystem. It is written in Go and compiles source code directly to x86-64 machine code — no LLVM, no GCC, no Clang in the middle.

The goal is straightforward: give the programmer direct, unmediated control over the machine. No intermediate representation handed off to a third-party backend. No optimizer making decisions you didn't ask for. The compiler emits raw bytes, and those bytes run.

This makes Gloria JIT an interesting project for anyone curious about how compilers actually work, or for developers who want to explore bare-metal programming without the abstraction layers that most toolchains introduce.

v4.4.0 expands the language significantly, adding structured control flow, direct memory and I/O access, and a bare-metal output path for VGA framebuffer writing.

`while` Loops — Structured Control Flow

Before this release, repeated execution required manual branching. v4.4.0 adds proper while loops.

A loop runs as long as its condition is non-zero. Inside the loop body you can use standard assignment and mutation operators (=, +=, -=), and built-in calls are permitted as well. This is a meaningful step toward the kind of control flow you'd expect from a general-purpose language.

Memory Primitives — `peek` and `poke`

Two new built-in functions expose direct memory access:

peek(address) — reads a 16-bit value from the given address
poke(address, value) — writes a 16-bit value to the given address

Both accept either immediate values or runtime variables as arguments.

This is the kind of primitive that exists in very few high-level languages, but is essential for bare-metal work — writing to hardware registers, inspecting memory-mapped I/O, or building your own allocator from scratch. Handle with care.

x86-64 Port I/O

For environments that use port-mapped I/O (common in older PC hardware and embedded x86 systems), two new built-ins are available:

in8(port) — reads a single byte from the given I/O port (zero-extended)
out8(port, value) — writes a byte to the given I/O port

This enables direct hardware interaction at a level that most programming languages simply do not expose.

VGA Framebuffer Output

print(string) now supports a bare-metal execution path that writes directly to the VGA text buffer at memory address 0xB8000.

For context: on x86 PCs, this address is where text-mode video memory lives. Writing bytes there places characters directly on screen — no operating system, no drivers, no system calls involved. This is how early PC software (and modern bootloaders) produce output.

Details of the implementation:

Default text color is green (0x0A)
Register R15 is reserved as a cursor offset and is preserved across calls
Escape sequences \n and \t are resolved at compile time into the appropriate control characters

To support testing without real hardware, two utilities are included: patchVGA() swaps the real framebuffer address for a heap-allocated buffer, and dumpVGA() renders that buffer to stdout via a direct syscall, with zero heap allocations.

Register Constants

To reduce ambiguity in the backend IR and make generated code easier to reason about, named constants have been introduced for all general-purpose x86-64 registers:

regRAX(0), regRCX(1), regRDX(2), regRBX(3),
regRSP(4), regRBP(5), regRSI(6), regRDI(7),
regR8(8) ... regR15(15)

Internal Changes

A few backend improvements shipped alongside the language features:

emitLowLevelPrint now accepts a kernelMode flag to switch between syscall-based output and direct VGA writes
emitPushReg and emitPopReg now cover the full register set including R8–R15
New operations: emitMovMemToReg64, emitMovRegToMem64
parseStringLiteral handles escape sequences at compile time rather than at runtime
emitBareMetalPrint introduced for the VGA output path

Where This Is Heading

With v4.4.0, Gloria JIT operates in two modes simultaneously: as a userspace compiler with kernel-aware syscall output, and as a bare-metal code generator capable of running without an operating system underneath it.

The next focus areas are optimization passes and IR stability. If you're interested in how compilers work from the ground up — or in low-level x86 programming without giving up a proper language — this is worth following.

Gloria JIT is part of the ForgeZero project. Follow along on dev.to/alexvoste.

ForgeZero 4.1 vs GNU Make: Up to 4.5x Faster Build Performance

Zane Beckett — Tue, 26 May 2026 13:37:57 +0000

ForgeZero 4.1 vs GNU Make: Up to 4.5x Faster Build Performance

I've been working on ForgeZero, a modern build system designed to replace traditional make with a faster, zero-config approach.

With the release of ForgeZero 4.1, I benchmarked it against GNU Make on multiple machines to answer one simple question:

Can a modern build system still significantly outperform make in 2025?

Turns out: yes.

Benchmark setup

GNU Make

make -j4

ForgeZero

./fzt -dir . -out fz_out

Measurement tool

Benchmarks were run using hyperfine:

hyperfine './fzt -dir . -out fz_out' 'make -j4'

Results

Platform	ForgeZero	GNU Make	Speedup
Ryzen 9 7950X3D (KVM, 1 vCPU)	~80–84 ms	~350–364 ms	4.1x–4.5x
Intel Core i5-10310U	82.2 ms	291.1 ms	3.54x
AMD FX-8370E (AM3+)	111.0 ms	238.5 ms	2.15x

Across very different CPUs and environments, ForgeZero consistently outperformed GNU Make.

Example benchmark output

Ryzen 9 7950X3D

Benchmark 1: ./fzt -dir . -out fz_out
Time (mean ± σ): 84.5 ms ± 7.6 ms

Benchmark 2: make -j4
Time (mean ± σ): 350.4 ms ± 16.4 ms

Summary:
4.14x faster than make -j4

Intel i5-10310U

Benchmark 1: ./fzt -dir . -out fz_out
Time (mean ± σ): 82.2 ms ± 4.2 ms

Benchmark 2: make -j4
Time (mean ± σ): 291.1 ms ± 11.2 ms

Summary:
3.54x faster than make -j4

AMD FX-8370E

Benchmark 1: ./fzt -dir . -out fz_out
Time (mean ± σ): 111.0 ms ± 17.9 ms

Benchmark 2: make -j4
Time (mean ± σ): 238.5 ms ± 24.4 ms

Summary:
2.15x faster than make -j4

Why is ForgeZero faster?

1. No shell overhead

GNU Make spends a surprising amount of time spawning shell processes (fork/exec) for build commands.

ForgeZero executes the build pipeline directly.

No unnecessary shell orchestration.

2. Lightweight dependency graph

make still carries decades of legacy behavior:

Makefile parsing
implicit rules
pattern matching
recursive variable expansion

ForgeZero builds a direct dependency graph and updates only what actually changed.

3. Better task scheduling

Instead of the classic make -j job model, ForgeZero uses a lightweight internal scheduler with lower synchronization overhead.

4. Zero-config design

No giant Makefiles.

No boilerplate.

ForgeZero analyzes project structure automatically and starts building immediately.

Why this matters

make was introduced in 1976.

Almost 50 years later, many developers still accept build-system latency as unavoidable.

These benchmarks suggest otherwise.

If your team runs hundreds of builds per day—locally and in CI—even saving 100–250 ms per build adds up quickly.

ForgeZero 4.1 is available

GitHub:

https://github.com/forgezero-cli/forgezero

I'd love feedback from developers still using make, ninja, or other build systems.

Zero Heap Allocations at 1.18 GB/s: Deep Dive into ForgeZero 4.0.x

Zane Beckett — Mon, 25 May 2026 15:14:42 +0000

What happens when you migrate a system tool from pure Node.js to Go, strip out the standard GC-heavy paths, and force a file system engine to hit 0 allocs/op?

You get ForgeZero (fz) — an open-source bare-metal system software builder created by @AlexVoste. Designed to eliminate bloated Makefiles for low-level developers, it orchestrates NASM, GAS, FASM, GCC, and Clang concurrently under a single unified .fz.yaml configuration.

With the recent launch of version 4.0 and its subsequent 4.0.1 patch, the project underwent a radical low-level optimization sprint targeting Go's runtime overhead.

Here's a technical breakdown of how it achieves near-native bare-metal execution speeds.

⚡ The Benchmark Reality Check

Running on an Arch Linux testbed (Intel i5-10310U), the updated engine delivers striking performance metrics:

Metric	Result
Data throughput	~1.18 GB/s steady state
File hashing (100 MB payload)	~78–84 ms
Memory footprint	0 allocs/op across all hot-path runs

goos: linux
goarch: amd64
BenchmarkHadesEngine/Process100MB-8   14   78411200 ns/op   0 B/op   0 allocs/op

By completely avoiding heap allocations on critical execution paths, the application bypasses Go's Garbage Collector entirely — achieving deterministic latency similar to C or Rust.

🛠️ The Architecture: Under the Hood of HADES

To pull off 0 allocs/op while scanning deeply nested directory structures and executing multiple sub-processes, the compiler architecture leans on three internal layers.

1. The HADES Engine & Memory Re-use

The file system sub-engine (fs, seal, and the linker/assembler modules) was fully overhauled. Instead of spawning new byte slices or strings during recursive scans, ForgeZero:

Pre-allocates localized memory arenas and sliding ring buffers
Handles path strings via direct string-to-[]byte headers (unsafe.Pointer), dodging the typical heap allocation penalty associated with dynamic string manipulation in Go

2. Multi-Engine Concurrency & Automated Fallbacks

ForgeZero dynamically parallelizes multi-file assembly:

Single file: matches input files directly to object targets (fz -asm boot.asm)
Directory: parses whole structures recursively (fz -dir ./src)

The engine also implements an aggressive link-level degradation system:

Try gcc compilation
Fallback to gcc -no-pie if position-independent execution fails
Degrade cleanly to a bare ld link for completely naked environments

3. Explicit Mode Switches

For strict bare-metal control, devs can override automated link behaviors via targeted CLI flags:

-mode c — explicitly lock execution strictly through GCC
-mode raw — bypass safety overrides and link unmanaged binaries directly with raw ld

🚀 What's New in Patch 4.0.1?

While 4.0 laid the groundwork for memory optimization, the 4.0.1 hotfix secures edge cases in bare-metal pipeline execution.

Silent-by-Default Pipeline
Hides external noise from standard tooling (like nasm or gcc), displaying a clean single-line state block: Built: program.out. Errors are trapped and viewable in full via the -verbose flag.

Collision Resolution
Fixes namespace collisions on identical file names using distinct low-level syntax extensions — e.g., main.asm and main.s now map correctly to independent main_asm.o and main_s.o components without cross-contamination.

Garbage Cleanup
Refined -clean runtime structures to ensure all cross-compilation objects (.fz_objs temporary workspaces) are recursively pruned using zero-allocation OS system calls.

💻 Getting Started

For system engineers moving away from manually typed, multi-stage assembly toolchains:

# Pull the latest bare-metal builder package directly via Go
go install github.com/forgezero-cli/forgezero@latest

Make sure your underlying assembly tools (nasm, fasm, ld, etc.) are globally mapped within your system $PATH.

Check out the fully-tested source tree, architecture specs, and documentation over at the official ForgeZero GitHub Repository.

DEV Community: Zane Beckett

You Don't Own Your Phone. You Don't Own Your Data. You Barely Own Your Opinions.

The myth everyone gets wrong (so let's kill it properly)

The receipts, because "trust me" isn't a source

VK: the eastern giant nobody in the West is watching

A theory worth reading, not a verified fact

The data doesn't have to be sold to end up in the wrong hands

Windows would like to remember everything you've ever looked at

Plot twist: your "no-logs" VPN might have a footnote

Your phone is a rental, and you're the tenant who can't change the locks

The passport paradox

So what do we actually do about it?

Now, about why you actually read this whole thing

ForgeZero Now Supports musl Cross-Compilation and Objective-C on Linux

🚀 ForgeZero Now Supports musl Cross-Compilation and Objective-C on Linux

Static musl Builds

Objective-C on Linux

Why Objective-C?

Where ForgeZero is Going

Links

Gloria JIT v4.4.0 — Bare-Metal Control, Memory Primitives, and Structured Flow

What is Gloria JIT?

while Loops — Structured Control Flow

Memory Primitives — peek and poke

x86-64 Port I/O

VGA Framebuffer Output

Register Constants

Internal Changes

Where This Is Heading

ForgeZero 4.1 vs GNU Make: Up to 4.5x Faster Build Performance

ForgeZero 4.1 vs GNU Make: Up to 4.5x Faster Build Performance

Benchmark setup

GNU Make

ForgeZero

Measurement tool

Results

Example benchmark output

Ryzen 9 7950X3D

Intel i5-10310U

AMD FX-8370E

Why is ForgeZero faster?

1. No shell overhead

2. Lightweight dependency graph

3. Better task scheduling

4. Zero-config design

Why this matters

ForgeZero 4.1 is available

Zero Heap Allocations at 1.18 GB/s: Deep Dive into ForgeZero 4.0.x

⚡ The Benchmark Reality Check

🛠️ The Architecture: Under the Hood of HADES

1. The HADES Engine & Memory Re-use

2. Multi-Engine Concurrency & Automated Fallbacks

3. Explicit Mode Switches

🚀 What's New in Patch 4.0.1?

💻 Getting Started

`while` Loops — Structured Control Flow

Memory Primitives — `peek` and `poke`