Mat Trudel on Building Bandit - the Web Server Running Your Phoenix App

Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.

This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don't have to.

Topics include:

• — how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right
• — what "one process per connection" actually buys you at 3am when something's on fire: a stack trace that's entirely Elixir frames, all the way up
• — why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in
• — the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous
• — how José Valim looked at Mat's first WebSocket implementation and told him he was doing too much
• — an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn't merged it
• — why Mat still writes Bandit entirely by hand while using agents for everything in his day job
• — the cabinet maker's son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point
• — what it means when "finding bugs got cheap but judging and fixing them didn't"

Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.

Recorded June 22, 2026.

Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.

This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don't have to.

Topics include:

• — how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right
• — what "one process per connection" actually buys you at 3am when something's on fire: a stack trace that's entirely Elixir frames, all the way up
• — why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in
• — the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous
• — how José Valim looked at Mat's first WebSocket implementation and told him he was doing too much
• — an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn't merged it
• — why Mat still writes Bandit entirely by hand while using agents for everything in his day job
• — the cabinet maker's son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point
• — what it means when "finding bugs got cheap but judging and fixing them didn't"

Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.

Recorded June 22, 2026.