Matt’s Script Archive: The Scripts That Reshaped The Net

Presently, I’m within the midst of writing a giant publish in regards to the roots of internet boards, however I hit on an apart bizarre sufficient that I made a decision to cease writing that and work on a separate publish. As a result of I feel it truly explains rather a lot about the best way individuals use the web.

Basically, right here’s the deal. Round 1995 or so, a excessive schooler named Matt Wright determined to launch a web site that shared some primary web site instruments that he programmed. Many of those have been dead-simple, issues like contact kinds, guestbooks, and internet counters. One specifically, WWWBoard, turned an enormous hit, turning into one of many first extensively used internet discussion board apps on the web.

The positioning Wright constructed, Matt’s Script Archive, unwittingly helped to focus on the divergence between how regular individuals take into consideration software program, and the developer’s perspective.

Wright, and others like him, stumble on an apparent want. Common individuals discovered these scripts, ran them, and immediately had boards, counters, and phone kinds. They obtained the job completed. However programmers who weren’t in highschool and weren’t so moist behind the ears seemed aghast at what Wright had completed: He had unfold poorly designed, however extensively used software program throughout the web. This software program was filled with safety points, however worst of all, it wasn’t actually getting up to date all that a lot.

How severe are the safety points? Nicely, a take a look at OpenCVE factors out some very severe issues that vary from bugs that emerged from huge publicity to some questionable design selections. (Conserving an encrypted password file within the root? Making it doable to seize env variables by way of a URL? Not sensible!)

One exploit specifically, affecting Wright’s textcounter device, stands out among the many record: CVE-1999-1479, with a rating of 10.0 important, successfully permits exploiters to execute code on the server as root.

This state of affairs obtained severe sufficient {that a} competing web site, known as nms, primarily was launched to interchange Matt’s buggy scripts with drop-in variations aren’t filled with safety exploits from dangerous coding. Their POV:

The issue is that the scripts in Matt’s Script Archive aren’t superb. The scripts are well-known amongst the Perl neighborhood to be badly written, buggy, and insecure. Anybody asking for assist on Matt’s scripts in any discussion board can be instructed in no unsure phrases that they shouldn’t use his scripts.

Sadly for a while there have been no replacements for Matt’s scripts that you’d need individuals to make use of. In 2001, the London Perl Mongers determined to deal with this downside and write a collection of drop-in replacements for Matt’s scripts. This undertaking is the outcome.

That mentioned, you shouldn’t use nms both, as a result of it hasn’t been up to date in about 20 years. What offers? After I wrote this, Dave Cross, who helped develop the nms device, reached out and famous that whereas he nonetheless packages in Perl, the mechanisms we use to program and host web sites have sharply diverged over the previous 30 years. “The most effective practices in Perl internet improvement moved on from CGI a very long time in the past,” he wrote in an e mail.

On prime of all that, safety practices have continued to evolve.

“The web is a really completely different and much much less trusting place today,” Cross added. “One of many issues with FormMail, for instance, is that it could possibly be used to ship spam. That gap was fastened however, right this moment, issues like SPF and DKIM would make it very laborious to ship e mail to its meant recipient.”

(Even when Cross truly wished to replace the nms scripts, he can be unable to—as he doesn’t have his SourceForge login anymore, nor does he actually keep in mind how Subversion works. However we’re not precisely missing for options, both.)

Matt’s scripts, the simple choice, and the issue with overexposure

When so many individuals use one thing that it turns into a part of the web’s lingua franca, it’s inevitable exploits are going to emerge. There’s a motive WordPress and Home windows every have reputations as bug-ridden, and it’s largely due to the variety of eyes on the given instruments.

With that in thoughts, I don’t suppose it’s honest responsible Wright for having dangerous code—in any case, it wasn’t like he knew it was going to change into an enormous platform.

(For what it’s price, Wright himself later advisable the nms scripts as an alternative of his personal, reminding people he wrote his unique scripts as a child. “The code you discover at Matt’s Script Archive shouldn’t be consultant of how even I’d code today,” he wrote on his website. “My pursuits and actions have moved on, nonetheless, and I simply haven’t discovered the time to replace all of my scripts.”)

I feel there’s a lesson for safety groups, nonetheless, who’re going to be caught making an attempt to work round individuals who seize the bottom hanging fruit.

The typical particular person doesn’t need to spend hours trying over each choice beneath the solar to seek out one thing good. They simply need it to work, and so they could not essentially suppose a lot about how one can make it higher.

That, in fact, is why vibe coding is such a giant factor these days. It hits on the exact same pressure that an easy-to-access script archive did. And simply as with these scripts, you’ll be able to take a look at vibe-coded apps as insecure dreck created by somebody who didn’t know higher, or you’ll be able to take a look at them as a democratizing device.

Downside is, they’re technically each. Are you able to admire one whereas appreciating the opposite? I’ve the reply, and it’s sure.

Matt’s scripts, remembered

Just lately, I noticed an unbelievable undertaking on the area that when hosted Matt’s Script Archive. As of a 12 months in the past, worldwidemart.com was internet hosting spam playing content material of the type which may give your laptop a virus.

However that proprietor let the area expire late final 12 months. This turned out to be the most effective factor. Somebody who actually cared in regards to the legacy of Matt’s Script Archive determined to purchase the area to construct a brand new website explaining the legacy of what as soon as existed there, and why these scripts, as damaged as they’re, matter.

The brand new website has the particular scent of vibe coding, however you realize what? It’s additionally doing one thing extremely vital for the historical past of the web. As you realize, I’m the form of man that complains loudly when somebody takes over a traditionally vital web site for less-than-stellar causes. However I’ve seemed by way of this web page and I don’t see any motive to complain—no under-the-radar sketchy “yeah, we did this to promote you one thing” drama. The web page the place I believed I’d see that, a hyperlink situated at /internet hosting/, is as an alternative an evidence of how webhosting has modified up to now 30+ years.

Put one other means, this web site guidelines. If we’re going to revive domains into zombie web sites, I’d moderately it was a vibe-coded factor that explains why this was as soon as traditionally related than one thing {that a} spammer doesn’t even need.

What was Matt considering? He simply wished to be useful. And that he was.

Up to date 05/23/2026

Added extra particulars in regards to the nms scripts from Dave Cross, who helped construct them a quarter-century in the past. (Thanks for reaching out!)

If you happen to love outdated stuff like this, I like to recommend trying out the dead-website archive rip.so, which hits this very dopamine zone.

On a associated word, this Verge story in regards to the safety dangers of vibe coding feels particularly related given right this moment’s piece.

I discover the truth that LinkedIn has like a dozen video games that it expects you to play on daily basis to be weird. We wanted a reputation for it, and “company puzzleslop,” what Juniper Dev landed on, is principally good. (Nice channel, too, she is aware of her stuff.)

—

Discover this one an fascinating learn? Share it with a pal! (Did Matt run your guestbook in 1997?)

And be sure you try the newest stuff on the Tedium Purchasing Community.