This week weâre talking with Daniel Thompson about Tauri and their journey to their recent 1.0 release. Tauri is often compared to Electron - itâs a toolkit that lets you build software for all major desktop operating systems using web technologies. It was built for the security-focused, privacy-respecting, and environmentally-conscious software engineering community. The core libraries are written in Rust and the UI layer can be written using virtually any frontend framework. We get into all the details, why Rust, how the project was formed, their resistance (thus far) to venture capital, their full commitment to the freedom virtues of open source, and all the technical bits you need to know to consider it for your next multi-platform project.
Daniel Thompson: Oh, gosh. Well, weâve been working on it for just over three years now, since May⌠And it goes back to a different open source project that I was involved in. My friends and I, we were working on a project called Quasar, which is a Vue.js system for building websites and SPAs and SSR apps and Electron apps and Cordova apps. And I was always kind of interested in outreach and getting into other ecosystems, and I reached out to the wonderful people over at Purism.
[08:23] They make this PureOS open source-conform system. I mean, the company is following these ideas of open source, and the products are following these ideas⌠And I thought, âWell, hey, maybe I can stop over there and ask if itâs possible for us to figure out a way to work together and we start putting some of these Quasar apps on their app store. And theyâre like âOh, cool, thatâs awesome. So how are they made?â And I was like âWell, you know, we use Vue.js and Electronâ and theyâre like âWhoa⌠We canât. Hereâs a long thread over at the FSF, and read through about un-Googled Chromium, and why some header files arenât appropriateâŚâ And I was like âOkayâŚâ So three days later, and miles of threads later, it was kind of clear that what I thought open source was wasnât always what open source really was. And just saying that something is open source and putting it on GitHub, doesnât mean it really fulfills the needs of the FLOSS community, right? I guess the difference between free/libre open source software and open source software, and open core software - everyoneâs kind of has these different feelings about how you enable other people to use your code. And at any rate, and as fate would have it kind of dejected, a couple of days later a really good friend said, âHey, did you check out the WebView library?â And I was like, âOkay, well, fine. Iâll go look at it.â And this was like a combination of projects. There was a developer named ZSerge, who wrote a bunch of C and Objective-C bindings for the platform-specific web views on Windows, Mac, and Linux. And then we found a Rust port.
So we did a first practice, Lucas and, with Go. I think I did the first C example, and then Lucas did Go, and weâre both like âThis isnât really nice.â And then we found the Rust library. The Rust library kind of helped us, and allowed us to get to a kind of proof of concept really quickly. And what we were seeing was kind of this, like âDaniel?â Lucas said, âIs this right? The app is only two megabytes.â And weâve been using Electron apps, and are used to things weighing 600-700 megabytes and then download. And okay, it was it was just a dot app. It wasnât like all of the crazy MSI installers and DMGs. And donât get me started on the Linuxes, but⌠It was kind of tangible and real. And we were both really new to Rust. Totally unaware of the complexities of the stuff we were getting ourselves into⌠And we had these proof of concepts, we got it working on Mac, and we got it working on Linux, and we got it working on Windows, and thatâs kind of the time when I think we got slashdotted. No, we got hacker-newsed first. And it was kind of this almost raging, how dare you not ship Chromium?! And it was interesting, because it kind of gave us an uptick, and it gave us some visibility to the larger community⌠And then just one after the other, these amazing people joined us, who really believed in âYeah, we can make it more energy-efficient, we can make it more secure, and we can really follow in these open source ideals and do our best and stay transparent and accountable.â
[12:27] And you know, things went pretty well. We got further and further, and then boom, COVID happened. And I think, for those of us who were around and active in software, and especially open source, it kind of got to be â I donât know, I mean⌠I know personally I had just this crazy experience of not knowing when to stop, and that kind of led to this weird COVID burnout, and weâre all just like âOh my gosh, alright, so the worldâs ending, letâs go have a barbecue.â And you know, things kind of got back on track, and then the investors started ringing the doorbell, and the venture capitalists, who will remain unnamed⌠I donât think thereâs anything wrong with open source software becoming commercialized, but it scared me, because Iâve been working in open source projects for almost two decades, and I didnât want this project to become corrupted by some kind of capital that starts dictating the direction it has to take. We kind of ghosted the first VCs to call us, and went into overdrive and registered Tauri as a program within the Commons Conservancy, which is a Dutch organization around NLnet, that really exists to support open source projects and protect them, and especially to protect the code and to protect the community. I mean, weâve all heard of bus factor, but I think that the ability for money to corrupt ideas such that the original vision gets lost⌠I mean, Iâm not saying thatâs the kind of militarization of open source that Iâm most worried about⌠But for our project, we really wanted to keep it in the hands of the community. And I think that that was really the right decision at the time, because as time went on, we got really close. We built our betas, and then we decided to get audited, which is a little silly⌠I mean, who are we areâŚ? Itâs just some friends and an open source project, and then we got some grant funding, and we took our donations together⌠And we had an external horizontal audit of all of the libraries, and a vertical audit of an example app⌠And I have to tell you, if youâve never had your code audited, it can be scary, but I think what we all learn from the experience is that itâs really exciting when your presumptions are challenged, and you get to a point where you realize through the help of the external pen testers or auditors or code reviewers, or whatever it is you want to call them, that you can actually continue to make your thing better.
And we obviously published the finding after we did six months of work, rebuilding the parts that were problematic⌠And yeah, now here we are, a couple of weeks post 1.0 launch, and itâs so exciting to see the gravitas of the future in the team. Because you know, up till now, we â we do have a change log that we implemented in probably the first six months, so that we can maintain the history of what weâve built⌠But now you have other concerns, like what parts do we have to audit next? And what is our release strategy going to be? How are we going to branch this? And itâs really exciting to see the working group come together.