Developer imtomt created ymawky, a static-file HTTP web server written entirely in ARM64 assembly for macOS, bypassing standard C libraries and using direct syscalls. The project, shared on Hacker News on May 10, 2026, gained 338 points and 172 comments, demonstrating community interest in low-level systems programming.
Fork-Per-Connection Architecture With Pure Syscalls
The server implements a fork-per-connection model where each client connection spawns a separate process. The codebase is approximately 87% assembly code, using pure syscalls without libc. It supports HTTP/1.0 and HTTP/1.1 protocols with required Host header validation.
Core functionality includes HTTP methods GET, PUT, DELETE, OPTIONS, and HEAD. The server implements range requests for byte-range serving, enabling video scrubbing in browsers. MIME type detection covers 40+ formats across web, image, font, document, audio, video, and archive categories. Directory listing functionality activates when a directory is requested without a default file.
Security Features Include Slowloris Mitigation and Atomic Writes
The implementation includes multiple security measures: symlink rejection using O_NOFOLLOW_ANY, path length limits (4096 bytes maximum), and path traversal protection blocking '..' sequences. Percent-encoding decoding handles URL-encoded characters correctly.
For Slowloris attack mitigation, the server enforces 10-second timeouts between data reception. PUT operations use atomic writes with temporary files (named www/.ymawky_tmp_) followed by rename, preventing partial uploads from corrupting existing files. The server enforces a maximum file upload size of 1 GB (configurable) and limits concurrent connections to 256 processes by default.
Novel Signal Handling Bypasses Standard C Library
A unique implementation detail involves signal handling. Rather than using standard sigreturn, imtomt exploited macOS's sa_tramp field in the sigaction struct as the handler itself. This approach works because the timeout handler only needs to send a 408 response and exit, requiring no complex state management.
Learning Exercise in Low-Level Systems Programming
The project appears driven by technical curiosity rather than production deployment goals. Documentation humorously credits "Bob Johnson" and "Bob Johnson's Therapist," suggesting this was a learning exercise exploring low-level systems programming concepts. A detailed writeup is available at imtomt.github.io/ymawky/.
Key Takeaways
- ymawky is an HTTP web server for macOS written entirely in ARM64 assembly (87% assembly code) using direct syscalls without libc
- Supports HTTP/1.0 and HTTP/1.1 with GET, PUT, DELETE, OPTIONS, and HEAD methods, plus range requests for video scrubbing
- Security features include Slowloris mitigation (10-second timeouts), atomic PUT operations with temporary files, symlink rejection, and path traversal protection
- Fork-per-connection architecture limits concurrent connections to 256 processes by default with 1 GB maximum upload size
- Novel signal handling bypasses standard sigreturn by using macOS's sa_tramp field directly as the timeout handler