The Workshop and the Walled Garden

crs48 with Claude · History

In 2003, somewhere on the internet, a modder known only as Eul sat down with the map editor that shipped in the box with Warcraft III and made a custom map. It wasn’t even an original idea — he was reworking a concept from Aeon of Strife, a fan-made StarCraft map from a few years earlier. Two teams, three lanes, one hero per player. He called it Defense of the Ancients.

Eul eventually drifted away, the way hobbyists do. Other pseudonymous hands picked the map up — first a modder called Guinsoo, then one called IceFrog — each rebalancing and extending it, shipping new versions to a community that play-tested every change by the hundred thousand. No studio green-lit any of this. No product manager wrote a roadmap. It was a mod, passed from hand to hand like a group project with no teacher.

You may know how it ends. Guinsoo was hired by a startup called Riot Games, where the thing he built next was League of Legends — for years the most-played PC game on Earth. Valve hired IceFrog and built Dota 2 around him. The custom map became a genre — the MOBA — an e-sports economy measured in billions, and the direct employer of thousands of people. One of the largest categories of entertainment on the planet started life as a file someone made with the editor that came in the box.

Here is the question this essay is actually about: when was the last time anything like that could have happened to the software you use for work?

The pattern, and where it went

DotA isn’t a fluke; it’s the most famous example of a pattern that built half of modern gaming. Doom shipped in 1993 with its levels and art in separate WAD files — id Software deliberately made the data moddable without touching the engine, and then released the engine’s source code outright in 1997. Team Fortress began in 1996 as a Quake mod; Valve hired its makers. Counter-Strike began in 1999 as a Half-Life mod by two hobbyists, Minh Le and Jess Cliffe; Valve bought it, hired them, and it remains one of the most-played games in the world a quarter-century later. The battle royale — the defining genre of the last decade — came from Brendan Greene, a photographer modding a military simulator’s zombie mod. And Minecraft’s mod ecosystem recently passed one hundred billion downloads on a single hosting site.

flowchart TD
  AOS["Aeon of Strife<br/>a StarCraft custom map"] --> DOTA["Defense of the Ancients (2003)<br/>a Warcraft III custom map"]
  DOTA --> LOL["League of Legends (2009)<br/>its co-author, hired by Riot"]
  DOTA --> D2["Dota 2 (2013)<br/>its maintainer, hired by Valve"]
  QK["Quake (1996)"] --> TF["Team Fortress<br/>a mod"] --> TF2["Team Fortress Classic → TF2<br/>the modders, hired by Valve"]
  HL["Half-Life (1998)"] --> CS["Counter-Strike (1999)<br/>a mod"] --> CS2["CS → CS:GO → CS2<br/>the mod, acquired by Valve"]
  A2["ARMA 2: DayZ<br/>itself a mod"] --> BRM["PlayerUnknown's<br/>battle-royale mods"] --> PUBG["PUBG (2017)<br/>the modder, hired by Krafton"]

Notice what the pattern requires. Not open source, in most cases — Doom was the exception, not the rule. What it requires is humbler: the data separable from the engine, and permission to put your own thing where the old thing was. A WAD file. A custom map. A model folder the game loads at startup. The vendor kept the engine; the players owned the worlds; and the seam between them was documented and load-bearing.

Old desktop software had the same seam in a dozen humble forms — plugins, macros, extensions, a Scripts folder the app would slurp at launch. Then software moved into the browser tab and the app store, and the seam was welded shut. Apple’s App Review Guidelines say it in one clause — an app “may not download, install, or execute code which introduces or changes features or functionality of the app” — which is a precise legal description of what a mod is. On the web, Chrome’s Manifest V3 removed the blocking network API that content blockers are built on; uBlock Origin, with tens of millions of users, could only ship a reduced “Lite” version, and the full one was switched off with the rest of the old extension platform. The SaaS app is the purest case: the program runs on someone else’s computer entirely, and the moddable surface is whatever the vendor’s API team got around to.

We didn’t stop wanting to mod our tools. The DotA community didn’t run out of Euls. The doors got locked — politely, gradually, and with reasons that sound perfectly sensible read one at a time.

In fairness to the wall

And some of those reasons are sensible, so let’s make the strongest version of the other side’s case before arguing with it.

In June 2023, malware researchers untangled fractureiser: attackers had compromised accounts on the biggest Minecraft mod-hosting sites and injected a credential-stealing payload into popular mods and modpacks — including packs with millions of downloads — where it self-propagated into other mod files and stole browser logins, Discord tokens, and Microsoft credentials from players. Some of the compromised accounts had two-factor authentication turned on. The oldest, freest modding culture on the internet shipped professional malware to its most enthusiastic members through its most trusted channel.

That is the real argument behind Apple’s clause 2.5.2 and Chrome’s narrowed APIs, and it deserves to be stated without a sneer: once code is running with your authority, it can do anything you can do. If installing a mod means handing it your file system, your cookies, your saved passwords, and your network — then yes, a review board and a welded seam genuinely protect people. The walled garden is not a conspiracy. It is a reasonable response to a catastrophic default.

But look at the shape of the response. The catastrophic default — all code gets all authority — was treated as a law of nature, and the fix was to ban the code. Nobody banned the default. There was always a second door out of the problem: scope the authority instead of the code. Let the mod exist, and bound what it can touch. This isn’t hypothetical — it’s how every system that still dares to run other people’s code does it. Figma runs plugins inside a JavaScript interpreter compiled to WebAssembly, with a hand-picked list of APIs. Deno makes a program declare, on the command line, which directories and hosts it may touch, and denies everything else. VS Code — host to tens of thousands of extensions, the liveliest modding scene in software today — runs them in a separate, killable process. Security researchers have a name for the underlying principle, object capabilities: code should hold authority the way your hand holds keys — only the ones you were given, and it can’t forge the rest.

The platforms chose the ban because, for them, the ban was cheaper — and, not incidentally, because a welded seam has commercial upside: nobody mods the feed you monetize. But for you, the ban has a cost that compounds. It’s every workflow that stays broken because the vendor’s backlog doesn’t know you exist. It’s every genre of tool that never gets its DotA, because the map editor never shipped.

You can’t mod what you can’t read

There’s a precondition hiding under all the modding stories, so obvious it’s easy to miss. Doom mods were possible because the levels lived in a file, in a documented format, separable from the engine. DotA was possible because the map was data the game would load from anyone, not just from Blizzard. The moddable era’s real invariant was never a licence — it was that the thing you wanted to change was legible and yours to swap.

Flip that around and you have a diagnosis of the present. The modern app is unmoddable, at root, because your data is trapped inside it — on the vendor’s servers, in the vendor’s schema, reachable only through the vendor’s screens. You can’t mod what you can’t read. The app and the data are fused, so wanting a different app means begging the vendor or leaving your life behind.

A quiet lineage of thinkers has been circling the way out for twenty years. In 2004, Clay Shirky described situated software — software “designed in and for a particular social situation,” built by and for a group of dozens, thriving precisely because it ignored every rule about scale. In 2020, Robin Sloan built a messaging app just for his family and called it a home-cooked meal — “I am the programming equivalent of a home cook,” he wrote, and the app never needed to be a restaurant. The Obsidian community distilled the durability half of the idea into three words — file over app: your notes should be files you own, in a format anything can read, so the app is replaceable and your writing outlives it. And in 2025, researchers at Ink & Switch published the fullest statement of the vision, malleable software: computing as a dynamic medium people can reshape to their own needs, rather than a collection of rigid, locked-down applications — with a gentle slope from using a tool to remaking it.

Different decades, one inversion: stop treating the app as the home of your data, and start treating your data as the ground the apps stand on. Own the substrate. Swap the views. That single move is what turns “moddable” from a nostalgic adjective back into an architecture.

The application is a view over your data

This is the bet xNet is built on, so let us show you the machinery — honestly, including the parts that exist as architecture rather than as a crowded bazaar.

In xNet, everything you make — tasks, notes, contacts, messages, ledgers — lives in one store of nodes on your own device, written as a signed, hash-chained change log in an open format. (We walked one note all the way through that machine in The Loom You Can Read.) No app owns the store. Apps subscribe to it. The tasks app is a query over task nodes; the CRM is a query over contact and deal nodes; the finance view is a query over accounts and entries. Three “applications,” one substrate — and each is, in the game modder’s exact sense, a skin over the save file. Replace any of them and your data doesn’t move an inch.

flowchart LR
  subgraph yours["Your substrate — on your device, in the open"]
    LOG["Signed, hash-chained<br/>change log"] --> STORE[("One store of nodes:<br/>tasks, notes, contacts,<br/>accounts, messages")]
  end
  subgraph views["Views — interchangeable, each scoped to a slice"]
    T["Tasks view"]
    C["CRM view"]
    F["Finance view"]
    P["Your mod:<br/>'Focus Board'"]
  end
  STORE -->|"tasks + projects"| T
  STORE -->|"contacts + deals"| C
  STORE -->|"accounts + entries"| F
  STORE -->|"tasks + notes,<br/>nothing else"| P

That last clause is where safety comes back into the story, because “your mod” in that diagram is doing something the walled garden says must never happen: running code the vendor never reviewed, against your real data. Here is the entire trick that makes it tolerable — the mod arrives with a manifest, and the manifest is a consent form:

// A mod, in xNet, is a view plus a consent form.
export default defineFeatureModule({
  id: 'com.you.focus-board',
  name: 'Focus Board',
  version: '1.0.0',
  capabilities: {
    schemaRead:  ['task', 'note'],  // sees your tasks and notes…
    schemaWrite: ['task'],          // …may tick tasks off…
    network:     [],                // …and never phones home.
    secrets:     []                 // no tokens — nothing to leak
  }
})

Those declarations aren’t documentation; they’re walls — just walls in the right place. A guarded store hands the plugin only the schemas it declared, and the authorisation layer scopes reads further to the spaces you’ve shared with it — the mod sees the project you pointed it at, not your whole life. A guarded fetch refuses any network call to a domain outside the manifest — and an empty list means offline, provably. Secrets are brokered: a connector that syncs your RSS feeds or your Slack history gets the rows it produced, never the token that produced them. And every plugin carries its provenance — built-in, written by you, generated by an AI, installed from the marketplace, or synced from a friend — and a trust ladder maps that provenance to a sandbox tier and decides when you must be re-asked for consent. A mod your friend shares with you doesn’t inherit your friend’s permissions; it arrives quarantined and asks you.

This is the Figma/Deno lesson, applied to the software you live in rather than the software you design in: don’t review the code — scope the authority. The fractureiser payload was catastrophic because a Minecraft mod runs with all the authority of the player’s whole machine. The identical attack against a capability-scoped view is a mod that can tick tasks in one shared project and cannot open a socket. Malicious, still — bounded, by construction.

And because a workshop where nobody can make a living stays a hobby shop, the last piece is economic: plugins can carry licences — cryptographically bound to your identity key, verifiable offline, so a mod-maker can charge for their work without a platform sitting in the middle setting the terms and taking the toll. The marketplace distributes and stamps provenance; it doesn’t own the door.

The home-cooked age

Everything so far would have been true five years ago. What’s new is who can cook.

The researcher Geoffrey Litt — one of the authors of that malleable software essay — called large language models “a step change in tool support for end-user programming”: the barrier between a fuzzy personal need and working code is collapsing, for everyone, all at once. You’ve felt this if you’ve asked an AI for a script and gotten one. Sloan’s home-cooked meal stops being a metaphor for the few people who happen to be home cooks and becomes a plain description of anyone with an appetite and an evening.

But notice what the AI does not change. A vibe-coded view is still code you didn’t review, running against your real life — generated by a model that can be confused, prompted maliciously, or just wrong. Handing it the catastrophic default — all your data, all your authority — is fractureiser with extra steps. The age of home-cooked software doesn’t lower the value of a safe kitchen; it raises it to the whole game. The scarce thing is no longer the ability to write your bespoke view. It’s a place where a bespoke view can run — against your real data, with a bounded blast radius, where “what can this thing touch?” has a checkable answer in twelve lines.

That’s the kitchen we’re building. Your data already on your device, in one legible store. A manifest that turns “trust me” into a consent form. A trust ladder that treats AI-generated code as exactly what it is — a provenance, with its own sandbox tier. There’s even a development bridge so your own coding agent can build against your workspace in a scratch copy, behind validation gates, instead of pasting your life into a chat window. Why wouldn’t your software be as bespoke as your notebook? Within reason — and the whole job of the substrate is to make “within reason” a wide, well-lit room.

Leave the door open

This blog has walked through pirate seas, forest soil, a gentle star, a loom you’re allowed to open, a hand on the tiller. The workshop is the same argument wearing overalls: systems worth living in are the ones their inhabitants are free to reshape.

The DotA story is usually told as a business parable — genius found in the wild, hired by the smart companies. Told that way, it flatters the walls. The truer telling is about the door: a big studio shipped a world editor in the box, defaulting to yes, and a photographer, a student, and a string of pseudonyms built genres in the space it left open. The talent was always there. The talent is still there — in your company, in your group chat, in you — and it now has a compiler that speaks English. What it mostly doesn’t have is a single piece of load-bearing software that defaults to yes.

So the question we’d leave you with is the one the walled garden is designed to keep you from asking: what’s your DotA? What’s the view — the tiny, situated, home-cooked, one-team-shaped tool — that doesn’t exist because the app that holds your data won’t let you build it? The genre that never happened because the editor never shipped?

If you want to stand in the workshop: use the app — your data lands in the open store from the first keystroke, so everything here applies to it. If you make things, build a view of your own on the open protocol, or browse the plugin catalogue to see the manifest-and-consent flow for real. The bench is lit. The tools are on the board. The door, on purpose, has a handle on your side.

Sources

• The map that became a genre: Defense of the Ancients (Eul, 2003, from the StarCraft custom map Aeon of Strife; continued by Guinsoo and IceFrog) and the MOBA genre it founded — League of Legends (2009), Dota 2 (2013).
• The pattern before and after: Doom’s WAD files (1993; engine source released 1997), Team Fortress (Quake mod, 1996), Counter-Strike (Half-Life mod, 1999), Brendan Greene’s battle-royale mods (ARMA 2 DayZ mod → PUBG, 2017), and Minecraft modding (100 billion CurseForge downloads, 2025).
• The enclosure: Apple App Review Guidelines, §2.5.2; Chrome’s Manifest V3 and uBlock Origin (see also the EFF’s coverage).
• The honest counterexample: the fractureiser incident (June 2023) — malware distributed through compromised accounts in Minecraft mods and modpacks.
• The intellectual spine: Clay Shirky, Situated Software (2004); Robin Sloan, An app can be a home-cooked meal (2020); Steph Ango, File over app; Ink & Switch, Malleable software (2025) and Local-first software (2019); the Malleable Systems Collective.
• Scoping authority instead of banning code: Figma’s plugin sandbox (2019); Deno’s permission model; Extism; the object-capability model (Mark S. Miller).
• The home-cooked age: Geoffrey Litt, Malleable software in the age of LLMs (2023).
• The machinery and the receipts: The Loom You Can Read (the signed change log, walked end to end), The Tip of the Hook (the developer’s view of the same machine), Build with xNet, and the plugin catalogue.

This is an independent essay. The writers and projects cited are summarized as commentary; xNet is not affiliated with or endorsed by them. The game histories are compressed — follow the citations for the fuller, messier versions. The manifest excerpt is trimmed for reading; the field names match the real source. All artwork here is original.