--- title: Dead Software Walking: The ongoing evolution of... description: Rafael Sadowski shares the story behind his renewed active development of OpenBSD's relayd(8) and httpd(8) daemons, which had stalled due to lack of maintainer... canonical: https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) | daily.dev og:description: Rafael Sadowski shares the story behind his renewed active development of OpenBSD's relayd(8) and httpd(8) daemons, which had stalled due to lack of maintainer... og:url: https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59 og:image: https://api.daily.dev/og/posts/kA3dRya59.png og:image:alt: Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) **[Lobsters](https://daily.dev/sources/lobsters)** · 6 min read · 0 upvotes · 0 comments ## Summary Rafael Sadowski shares the story behind his renewed active development of OpenBSD's relayd(8) and httpd(8) daemons, which had stalled due to lack of maintainer interest. Motivated by a desire to challenge himself with C programming and real-world customer needs, he and kirill@ began modernizing both daemons. Key achievements include: converting the imsg system to safer APIs, switching default TLS cipher sets to 'secure', adding ECDSA support, fixing a reload race condition, rejecting HTTP request smuggling vectors (CL.TE framing, obs-fold headers), adding custom HTTP header support, TLS multi-listener support, and numerous bug fixes and memory leak removals. Development is now hosted on Gothub with mirrors on Codeberg and GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What security fixes were made to OpenBSD's httpd and relayd daemons recently? Both daemons switched their default TLS cipher sets to a more secure configuration (relayd from HIGH:!aNULL, httpd from compat), and httpd now rejects CL.TE request framing to prevent request smuggling and rejects obs-fold headers with an HTTP 400 response per RFC 9112 section 5.2. Both also restrict IMSG_CTL_PROCFD access to the parent process with ID checks. _Teams running relayd or httpd should track security-hardening changes like these through daily.dev before upgrading._ ### Who maintains OpenBSD's relayd and httpd daemons now that Reyk Floeter has retired? Development has been picked up by Rafael Sadowski and kirill@ (Kirill Korinsky), both active users of the daemons with real-world OpenBSD deployment experience. They worked through years of backlogged tech@ mailing list diffs and issues from the original GitHub mirror, and created new git mirrors on Gothub, Codeberg, and GitHub to attract new contributors. _Following daemon maintainer transitions like this on daily.dev helps OpenBSD users anticipate roadmap and support changes._ ### What imsg API changes were made in relayd and httpd's modernization effort? The imsg system was converted to use newer, safer getter functions (imsg_get_data, imsg_get_type, imsgbuf_get) with proper error handling added throughout imsg payload reading in relayd, and httpd's proc.c was converted to the same new imsg API for consistency between the two daemons. _Developers refactoring C IPC code can compare notes on imsg modernization patterns via daily.dev._ ## Similar posts on daily.dev - [A Webserver and a Slack Bot on OpenBSD: Introducing relayd](https://daily.dev/posts/a-webserver-and-a-slack-bot-on-openbsd-introducing-relayd-sovvpi46p) · Atomic Spin · 0 upvotes · 0 comments - [ymawky](https://daily.dev/posts/ymawky-793maq07w) · Lobsters · 1 upvotes · 0 comments - [Getting a Web Server running on my hobby OS on OSHub](https://daily.dev/posts/getting-a-web-server-running-on-my-hobby-os-on-oshub-vw29fjlp7) · Hacker News · 2 upvotes · 0 comments - [Setup a simple web server with bozohttpd on NetBSD](https://daily.dev/posts/setup-a-simple-web-server-with-bozohttpd-on-netbsd-a2hsralp7) · Lobsters · 0 upvotes · 0 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#openbsd](https://daily.dev/tags/openbsd) [View this post on daily.dev](https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8)","url":"https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59"},"datePublished":"2026-08-01T09:12:50.368Z","dateModified":"2026-09-14T06:28:32.012Z","description":"Rafael Sadowski shares the story behind his renewed active development of OpenBSD's relayd(8) and httpd(8) daemons, which had stalled due to lack of maintainer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7b94a2bd271aab5294a6ca71d9624ebc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7b94a2bd271aab5294a6ca71d9624ebc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,openbsd","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dead-software-walking-the-ongoing-evolution-of-relayd-8-and-httpd-8--ka3drya59#faq","mainEntity":[{"@type":"Question","name":"What security fixes were made to OpenBSD's httpd and relayd daemons recently?","acceptedAnswer":{"@type":"Answer","text":"Both daemons switched their default TLS cipher sets to a more secure configuration (relayd from HIGH:!aNULL, httpd from compat), and httpd now rejects CL.TE request framing to prevent request smuggling and rejects obs-fold headers with an HTTP 400 response per RFC 9112 section 5.2. Both also restrict IMSG_CTL_PROCFD access to the parent process with ID checks. Teams running relayd or httpd should track security-hardening changes like these through daily.dev before upgrading."}},{"@type":"Question","name":"Who maintains OpenBSD's relayd and httpd daemons now that Reyk Floeter has retired?","acceptedAnswer":{"@type":"Answer","text":"Development has been picked up by Rafael Sadowski and kirill@ (Kirill Korinsky), both active users of the daemons with real-world OpenBSD deployment experience. They worked through years of backlogged tech@ mailing list diffs and issues from the original GitHub mirror, and created new git mirrors on Gothub, Codeberg, and GitHub to attract new contributors. Following daemon maintainer transitions like this on daily.dev helps OpenBSD users anticipate roadmap and support changes."}},{"@type":"Question","name":"What imsg API changes were made in relayd and httpd's modernization effort?","acceptedAnswer":{"@type":"Answer","text":"The imsg system was converted to use newer, safer getter functions (imsg_get_data, imsg_get_type, imsgbuf_get) with proper error handling added throughout imsg payload reading in relayd, and httpd's proc.c was converted to the same new imsg API for consistency between the two daemons. Developers refactoring C IPC code can compare notes on imsg modernization patterns via daily.dev."}}]} ```