C-Kermit has spent 45 years negotiating with machines that disagree about nearly everything. Word size, character set, line endings, filenames, packet limits, link quality, and operating-system conventions all become its problem. The software survived because it treats incompatibility as the normal condition of computing.
On August 3, the Open Kermit project released C-Kermit 11.0.506, the first non-beta release since 2011. The version number understates the event. A communications system born at Columbia University in 1981 now has IPv6, OpenSSL 3 and 4 support, automated release builds, cross-platform CI, and over 1,700 tests. It still transfers files over serial lines. It still builds for operating systems that modern toolchains barely remember.
That combination makes C-Kermit a rare kind of preservation project. The artifact stays useful while carrying old machine assumptions forward. Its archive can answer questions because the code still talks to the hardware.
a protocol built for disagreement
Frank da Cruz and Bill Catchings designed Kermit to move data between Columbia’s DEC-20 and IBM mainframes. The early protocol had to survive links that could not reliably process packets longer than 96 bytes, machines that handled 7-bit and 8-bit data differently, and systems divided between ASCII and EBCDIC. Adaptation sat inside the design from the beginning.
Kermit spread to MS-DOS and Unix by 1982. C-Kermit grew beyond a file-transfer implementation into a communications package with terminal sessions, serial and network connections, a scripting language, remote file management, and support for other transfer protocols. The software later moved data for systems ranging from pocket calculators and bulletin-board services to embedded devices, radios, hurricane sensors, manufacturing equipment, and the International Space Station.
These uses sound like retrocomputing trivia until one notices the shared constraint. Each endpoint carries a local theory of what a file, terminal, connection, or safe default should be. C-Kermit became valuable by translating between those theories without demanding that either machine join the current decade.
tests became the new compatibility layer
John Goerzen, Debian’s Kermit maintainer, began with patches for security and transfer defaults. Distribution patch queues were a bad custody model for changes that affected every platform. Linux and BSD packages also disagreed about which Kermit generation to ship, ranging from the 2011 full release to later betas. Open Kermit moved the work into a public repository with a common release line.
The test suite changed what maintainers could safely touch. Running it under load exposed race conditions. NetBSD testing found binary corruption caused by strlen() measuring data that could contain null bytes, a bug whose code path dated to 1992. macOS testing exposed unreliable FIONREAD behavior and long-lived pseudoterminal hangs. Compatibility tests found packet-negotiation failures against E-Kermit and the 2011 C-Kermit release.
A maintained protocol implementation needs this kind of adversarial memory. Documentation records intended behavior. Old peers preserve behavior that escaped the documentation. Tests turn both into claims a new build has to satisfy.
The release also removed dead branches hidden behind conditional compilation. Despite new features, the codebase excluding comments became roughly 2,600 lines smaller than the last version 10 beta. Preservation often gets framed as a refusal to delete. Here, deletion made the surviving behavior easier to audit and carry.
forty-five years changed the threat model
C-Kermit’s original environment assumed cooperation between endpoints. A remote Kermit server could ask the local client to perform actions, retrieve data, print files, or invoke mail handling. Automatic transfer-mode detection guessed whether a file was text or binary. Filename collisions created backups. Those choices served workflows built around trusted machines and scarce operator attention.
Connected systems now meet strangers. Version 11 restricts remote actions, fixes CVE-2025-68920, disables mail and print handling by default, and hardens them against shell injection. It rejects filename collisions instead of silently creating backups. It asks before receiving an unsolicited filename. Manual transfer mode replaces automatic guessing because a mistaken text conversion can corrupt binary data.
The compatibility commands expose the cost honestly. SET COMPATIBILITY 9 and SET COMPATIBILITY 10 restore older behavior for scripts and peers that require it, while the release notes state that doing so weakens security protections. Compatibility remains available as an explicit operator decision rather than an inherited ambient risk.
custody moved without freezing the project
The custody chain matters because software preservation fails quietly. Source archives can remain online while build knowledge disappears. A project can keep compiling on one maintainer’s machine while its release process dies. A protocol specification can survive while every implementation that speaks to real devices rots around undefined behavior.
Open Kermit addresses those failure modes with boring machinery: Git history, regression fixtures, compatibility peers, automated builds, platform documentation, static binaries, and mirrors of the older Columbia and Kermit Project sites. None carries much romance. Together they let future maintainers separate a protocol regression from a compiler regression, an operating-system quirk, or a broken remote peer.
The platform spread gives the work cultural weight. C-Kermit can still build for modern Unix systems while retaining code for VMS, OS/2, old Unix variants, and pre-ANSI compilers. Its test infrastructure cannot cover every extinct machine. It can preserve enough shared behavior to keep those machines inside the conversation.
the useful archive is still connected
C-Kermit 11 rejects the museum model of old software. The release does not polish a screenshot and declare victory. It sends files, drives serial ports, wraps SSH sessions, connects to BBSes, updates embedded equipment, and exposes its own assumptions to tests.
That operational life creates better history. A pocket calculator receiving a file can reveal character-set and packet-edge behavior that a source snapshot will not. A radio firmware update can expose timing and flow-control constraints. A 2011 binary disagreeing with the current release can turn a vague compatibility complaint into a reproducible case.
The deeper lesson belongs far beyond Kermit. Software history lives in relationships among programs, protocols, devices, defaults, and users. Keeping one executable in cold storage preserves a specimen. Keeping the communication path alive preserves the weird machine that formed between endpoints.
C-Kermit remains stubbornly unglamorous infrastructure. Good. The industry produces enough ceremonial rewrites that discard working knowledge for a cleaner repository and a launch post. Version 11 demonstrates a harder craft: change the threat model, modernize the toolchain, reduce the code, and keep the ancient calculator talking.