Mat Trudel on Building Bandit - the Web Server Running Your Phoenix App
Show notes
Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.
This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don't have to.
Topics include:
how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right
what "one process per connection" actually buys you at 3am when something's on fire: a stack trace that's entirely Elixir frames, all the way up
why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in
the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous
how José Valim looked at Mat's first WebSocket implementation and told him he was doing too much
an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn't merged it
why Mat still writes Bandit entirely by hand while using agents for everything in his day job
the cabinet maker's son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point
what it means when "finding bugs got cheap but judging and fixing them didn't"
Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.
Recorded June 22, 2026.
Bandit quietly became the default web server in Phoenix. Mat Trudel wrote it by hand, in pure Elixir, as a side project - and kept it that way even as AI changed how everyone else writes code.
This episode goes two places at once: the engineering of a foundational piece of infrastructure most developers never think about, and an honest conversation about what it means to keep building something by hand when you don't have to.
Topics include:
how a six-month debugging session - Wireshark, a 30-page RFC, and a single misread line in the HPACK spec - explains why HTTP is genuinely hard to get right
what "one process per connection" actually buys you at 3am when something's on fire: a stack trace that's entirely Elixir frames, all the way up
why HTTP parsers have a million attack vectors that have nothing to do with which language you write them in
the WebSock and WebSock Adapter split - and why a web server depending on another web server is ridiculous
how José Valim looked at Mat's first WebSocket implementation and told him he was doing too much
an AI-generated PR sitting open on the Bandit repo that implements the entire HTTP/3 stack - and why Mat hasn't merged it
why Mat still writes Bandit entirely by hand while using agents for everything in his day job
the cabinet maker's son analogy that explains the whole thing: if you want cabinets, go to IKEA; if you want to build them, the journey is the point
what it means when "finding bugs got cheap but judging and fixing them didn't"
Companion episode: Peter Ulrich and Jonathan Machin on CVEs and security - the same story from the reporting side.
Recorded June 22, 2026.