ferros

I spent 20 years climbing cell towers and debugging RF systems. You know what I learned? Every OS we use is built on 50-year-old assumptions that don't make sense anymore.

So I built ferros. It's not Android with modifications. It's not Linux for mobile. It's a ground-up rethinking of what an operating system should be when you actually care about security, performance, and mathematical correctness.

Power loss at any moment is normal operation. Not an edge case. Not something to "handle gracefully." Just normal.

Traditional systems need complex shutdown because they maintain invariants: "page table must be consistent," "superblock must be updated," "buffers must be flushed."

ferros has one invariant: the ring is always valid. And because it's a ring, any point on it is as good as any other.

What Makes ferros Different

Ring Memory Architecture

No beginning, no end. Addresses wrap using two's complement. Buffer overflows? Can't happen - there are no boundaries to overflow.

Every process gets two numbers:

• offset: Random position in the ring (signed, arbitrary)
• limit: Size of their allocation (arbitrary, not power-of-2)

Memory access check is two instructions:

fn check_access(ptr: usize, offset: usize, limit: usize) -> bool {
    (ptr.wrapping_sub(offset)) < limit
}

Two CPU cycles. No page table lookups, no TLB, no segmentation faults.

Traditional systems: 5-10 memory accesses every TLB miss
ferros: 2 CPU cycles every time

Hardware Key Storage

Encryption keys live in CPU registers, never RAM. Custom RISC-V CSRs or ARM TrustZone. Even root can't read them.

Keys are stored in:

• Debug registers (x86-64) - read-disabled, DMA-proof
• Custom CSRs (RISC-V) - hardware enforced isolation
• TrustZone (ARM) - secure world separation

ChaCha20 crypto coprocessor encrypts faster than RAM bandwidth. All storage and memory encrypted by default.

Kill-switch zeroes keys instantly - hardware operation, not software cleanup.

TOKEN Integration

Passless authentication via device fingerprints. Social attestation for identity. No passwords, no biometric theater.

A=1 - authenticate once per device lifetime, never again.

• Device generates hardware fingerprint (Android_ID + IMEI + characteristics)
• Social attestation maps device→human ("I vouch this is Nick's phone")
• Keys derived deterministically in secure hardware
• Device loss? Social revocation by threshold of friends
• Multiple devices? Each independently attested

NFID (Near Field Identity): Optional paranoia layer. Prevents unauthorized device binding when someone borrows your car. Configurable from "unlocked" to "high security."

Not required for core passless operation - just prevents adding rogue devices.

VSF Compositor

Spectral color from sensor to display. Ring-based damage tracking. Only renders what you can actually see.

VSF (Versatile Storage Format):

• Replaces HTML/CSS/JS with single unified format
• Native spectral color (RGB 462nm/523nm/703nm)
• Compositor optimized for ring memory architecture
• Occlusion-aware rendering (widgets know when they're visible)

Performance:

• Only damaged regions redraw
• Occluded widgets don't render at all
• No "layers" or "backing stores" - direct ring rendering
• Compositor and filesystem use same ring semantics

Ring Filesystem

Superblock at random location. No fragmentation because rings rotate. Power loss? Any ring state is valid.

Key features:

• Superblock location: Random ring position, stored encrypted in UEFI
• Dual SSDs at different offsets (different manufacturers for resilience)
• Header ring buffer with generation numbers (1000+ valid states)
• Stochastic block placement (natural wear leveling, exploit prevention)
• No beginning, no end - files live in the ring

Power loss handling:

• Kernel scans header ring on boot
• Finds highest valid generation number
• Continues from there
• No fsck, no journal, no "filesystem needs repair"

Based on RedoxFS with ring topology instead of linear blocks.

Crypto Coprocessor

ChaCha20 in dedicated silicon. Encrypts faster than RAM bandwidth. All storage and memory encrypted by default.

Hardware acceleration:

• 64 bytes/cycle at 1 GHz = 64 GB/s throughput
• CPU cost: Zero - runs independently via DMA
• Software ChaCha20: ~250 MB/s (256x slower)

Integration:

• Keys from CSRs feed crypto unit directly
• Modem, storage, memory all go through coprocessor
• Kill-switch zeroes crypto unit + CSRs simultaneously

ChaCha20 is faster than RAM on modern hardware (~3-4 GB/s per core). Dedicated unit is even better.

The Glyph Device

ferros runs on Glyph - hardware I designed from scratch for this OS. Not Android on commodity chips. Purpose-built silicon running purpose-built software.

RISC-V Custom Silicon

• Custom CSRs for key storage (read-disabled, write-only)
• Crypto coprocessor integrated on die
• Hardware kill-switch circuit
• Debug registers for additional key isolation

No proprietary secure elements. No vendor black boxes. Just open RISC-V with custom extensions you can audit.

Bring Your Own SIM

Physical SIM slot. No carrier lock-in. No eSIM DRM. Use any carrier's data plan worldwide.

Why physical SIM:

• User swaps freely between carriers
• No provisioning bullshit
• No remote carrier control
• SIM is just dumb auth token for network

Software eSIM support: Implemented via GSMA SGP.22 client in ferros. Download profiles, store credentials in CSRs, use standard 3GPP authentication. Works with any carrier's SM-DP+ server.

Physical slot as fallback for carriers without eSIM support.

Crypto Only

Purchase with BTC, SOL, XMR, or TOKEN. No credit cards. No fiat. No compromises.

No exceptions.

If you can't acquire cryptocurrency, you can't buy Glyph. That's not a bug - it's the filter. People who understand crypto understand why Glyph matters.

No Phone Numbers

Photon messenger via TOKEN identity. No SMS. No legacy telephony. Pure sovereignty.

Glyph doesn't support:

• Phone numbers (never coming)
• SMS fallback (never coming)
• Voice calls to PSTN (never coming)
• Traditional 2FA via SMS (use TOTP or hardware keys)

What it does support:

• Photon messenger (TOKEN-based, E2E encrypted)
• Data connectivity via any SIM
• IP-based voice (if someone builds it on Photon)
• TOTP for services that require 2FA

If you need to call 911, get a burner phone for emergencies. Glyph is for sovereignty, not legacy infrastructure.

Available on Sovereign Web Only

You can't buy Glyph on Amazon. You can't buy it with a credit card. You can't buy it on this website.

Glyph is available exclusively on the decentralized web. Same compositor that runs on the device renders the purchase experience. If you can't access fgtw.org/portal, you're not ready for Glyph.

Requirements to purchase:

• Cryptocurrency (BTC, SOL, XMR, or TOKEN)
• WASM-capable browser for VSF rendering
• Understanding that phone numbers aren't supported
• Willingness to use new stack (TOKEN, Photon, VSF)

Glyph is not for everyone.

You CANNOT use Glyph if you:

• Need phone numbers for work
• Require legacy SMS for banking 2FA
• Can't acquire cryptocurrency
• Need to call 911 from your primary device
• Expect traditional customer support

Glyph works if you:

• Communicate primarily online (Photon, messaging apps)
• Can handle emergency calls via separate device
• Already use crypto or are willing to learn
• Value sovereignty over convenience
• Understand this is cutting-edge technology

Still here? You might be ready for Glyph.

The Launch Plan

Founders Edition: 1,000 units, $5,000, crypto only

• Serial #0001-1000 (blockchain verified)
• 12-year warranty (yes, twelve)
• Direct access to engineering team
• GREEN check in all Photon communications forever

Elite Edition: 10,000 units, $3,000, 6 months after Founders

Pro Edition: 100,000 units, $1,500, 12 months after Founders

Standard: 1M+ units, $600, 18-24 months after Founders

No traditional launch. No press releases. No review units. Just: "Portal is open. If you know, you know."

Learn More

Open Source

ferros is open source (MIT license). The OS, ring memory architecture, filesystem - all open.

What's open:

• ferros kernel and userspace
• Ring memory implementation
• VSF renderer and compositor
• TOKEN protocol
• Photon messenger

What's closed:

• Glyph hardware schematics (initially)
• Custom RISC-V CSR implementations (until silicon ships)
• Manufacturing processes

Hardware will open-source after Founders Edition ships and we've proven the design.

First Published: January 1, 2025

License: MIT (ferros modifications)
+
MIT (original Redox OS code)

Status

Current: Architecture design, early implementation

Next 3 months:

• Ring memory kernel complete
• RedoxFS → ring filesystem conversion
• Basic TOKEN integration

Next 6 months:

• VSF compositor alpha
• Photon messenger beta
• Hardware prototype (FPGA)

Next 12 months:

• Silicon tapeout (RISC-V + crypto coprocessor)
• Founders Edition manufacturing
• Portal opens for purchases

FAQ

Built by Nick Spiker and contributors.

Sovereignty is a choice. Make it.