Most Software Ages. Some Software Is Hunted.

What building a forum-tracker monitor taught me about the one category of software that gets more fragile the more successful it is, and why the tool you’d reach for is already dead.

Most software ages the way a house ages. You build it on solid ground, it settles, and if you do nothing it mostly keeps standing. Bugs are potholes: annoying, but the road does not move.

There is a small category of software where this is just not true. Here the ground itself is alive and it does not like you. You do not maintain it because it decayed on its own; you maintain it because something on the other side changed on purpose, to keep tools like yours out. This software is not aging. It is being hunted.

I spent the last couple of months living inside this category (I built a monitor for forum torrent trackers), and the thing surprised me most was not technical. It was that the usual intuition about software is exactly backwards here. Normally a project gets more stable as it matures. This kind gets more fragile the more successful it becomes. I want to explain why, because once you see the shape of it, a lot of dead projects suddenly make sense, and so does the way I ended up building mine.

A contract versus a moving target

Start with the thing that does not rot, so the contrast is clear.

The mainstream torrent automation tools (Sonarr, Radarr, Prowlarr, the whole arr family) are wonderful, and a big reason they are wonderful is that they live on a contract. They talk to indexers over Torznab and Newznab: a structured API that promises a stable set of fields, a search verb, categories, a shape. A contract is a promise. Nobody is allowed to remove a field without a version bump. You build against it once and it keeps meaning the same thing tomorrow. That stability is exactly why the arr stack feels so solid, and not by accident it is also why it can not even perceive the world I was working in. A forum thread is not a contract. It is a webpage that owes my scraper nothing.

Because that is what these trackers are. On RuTracker or LostFilm a “release” is not a row in an API response. It is a post in a forum thread, and when a new episode comes the uploader swaps the attachment inside the same post. There is no field set, no version, no promise. The HTML is whatever the site felt like rendering this morning. To follow a show I have to read a page the way a human reads it and notice when it changed. The whole job lives in contract-free territory, which is precisely the territory the contract-based tools were built to avoid.

So the first half of the thesis is simple: software that lives on a contract ages slowly, and software that lives on someone else’s webpage does not get to age at all. It gets hunted.

The four clocks

What hunts it is not one thing. It is at least four, and the cruel part is they tick independently, on schedules nobody tells you, and any one of them can break your tool on a quiet Tuesday.

There is the platform clock. Most of these trackers sit behind Cloudflare, and Cloudflare’s bot detection gets meaner every single year. That is its actual job, and it is very good at it. It does not care that you are a personal automation tool and not a scraper farm. The bar to look like a real browser keeps rising.

There is the site clock. The tracker itself moves. LostFilm rotates its CMS and its login flow. NNM-Club slides behind a CDN. A phpBB skin changes a class name and your selector points at nothing. None of this is announced. You find out because something quietly stopped working.

There is the human-proof clock. The captcha mutates. The thing standing between you and a session cookie is specifically designed to be hard for software, and it is improved on its own cadence, by people whose whole goal is to make this week’s solution stop working.

And there is the delivery clock, the one I did not expect. Even the friendly end moves. qBittorrent changed the shape of its Web API between releases, so the part of your tool that hands off the download breaks too, independent of everything upstream.

Four clocks. Four independent sources of breakage, none coordinated with you, none owing you a warning. This is the defining physics of the category, and everything about how you should build follows from it.

The arithmetic that kills these projects

Now the deeper claim, and it is the part that made me a little sad.

There was a tool built for exactly this niche, monitorrent. It pioneered the whole idea, years ago, and the experience it offered is the one I wanted. Marauder owes it the entire problem statement and I say so plainly. It did not die because someone was lazy or because the code was bad. It died of arithmetic.

Think about the load. A monitor that supports one tracker faces those four clocks. A monitor that supports fifteen trackers faces, roughly, fifteen times the site-and-captcha breakage, plus the shared platform and delivery clocks on top. The maintenance burden does not stay flat as you add trackers; it grows with every one. Which means the more useful the tool becomes, the more surface there is to rot. Success makes it heavier. And on the other side of the equation there is usually one person, maintaining it in the evenings, against an open-ended set of adversaries who each improve on their own time.

That is not a fight a single maintainer wins forever. Eventually the breakage arrives faster than one human can patch it, the fixes fall behind, users drift back to opening tabs by hand, and the project goes quiet. Not from neglect, but from losing a race that was rigged from the start. The category eats its maintainers. That is the real reason the corner of the shelf was empty when I went looking, and no amount of “just write a better scraper” changes the math.

So the product is not the scraper

Once I accepted that decay is not a risk but a certainty, the whole design question flipped. The valuable thing is not “does it work today”; anything works the day you ship it. The valuable thing is “when a clock ticks and something breaks, how cheap is the repair, and who is allowed to do it.” Build for the repair, not for the demo.

That single reframing is most of Marauder’s architecture.

Each tracker is a small, isolated plugin, roughly a three-hundred-line Go file behind one interface. This is not for elegance, it is for blast radius. When one site rotates its HTML, exactly one plugin breaks, in a way you can read, while the other fifteen keep running. A rotting tracker should be a contained, legible failure, never a cascade.

Every plugin pins its expectations as recorded HTTP fixtures, real captured responses from the site. So when the site moves, a test goes red and points a finger at exactly what changed, instead of the failure showing up as a silent nothing-downloaded at three in the morning. The point of the fixtures is not to prove the code is correct forever. It is to make decay visible the moment it happens. You can not patch a break you can not see.

For the platform clock I stopped trying to be clever. You do not win the Cloudflare arms race with smarter headers. That is a race you are structurally going to lose, because the other side is bigger and it is their full-time job. So Marauder sidesteps it: a small sidecar container drives a real headless Chromium to solve the interstitial, because the cheapest way to look exactly like a real browser is to be one. That is architectural surrender to a clock you can not outrun, and surrendering to it on purpose is cheaper than fighting it badly.

And the load-bearing decision, the one the arithmetic forced: a community of hands. If one maintainer can not outrun N trackers, then the only winning move is more maintainers, ideally the very people who use each tracker and feel its breakage first. So the plugin contract is deliberately a weekend project for a first-time Go contributor, not an archaeological dig through undocumented mixins. The whole architecture is a bet that you beat a hunted-software category not with heroics but by distributing the maintenance across the people it actually serves.

Where it honestly stands

I will not pretend the bet is already won, because that would betray the whole point of the essay. Two trackers, RuTracker and LostFilm (including LostFilm’s captcha login), are validated end to end against the live sites today. The other ten CIS trackers are written and tested against fixtures but not yet verified against live accounts, and that gap is not an embarrassment to hide. It is the thesis in plain sight. Validating them needs real accounts and many hands, which is exactly the kind of work this category has always demanded and exactly the kind a lone maintainer can not finish alone. The honest status is the argument.

So here is the whole thing in one line. The contract-based tools can not enter this world because there is no contract to hold onto. The one tool that did enter it got everything right and still lost, because the math beats any single person eventually. The corner is empty not because nobody tried, but because the category is structurally hostile to the way we usually build and maintain software, alone, expecting things to settle. Marauder’s whole reason to exist is the guess that you survive a hunted category a different way: small contained failures, breakage you can see, surrender to the clocks you can not outrun, and enough hands that the arithmetic finally tips the other way.

I do not know yet if the guess is right. That is sort of the fun part of doing it in public. If you live in this world too, if your shows hide on login-walled forum threads and you are tired of being the maintenance department of one, the tool is called Marauder, it is free and open source, and the most useful thing you could give it is a second pair of hands on the next tracker.

marauder.cc · github.com/artyomsv/marauder

(The usual footnote, because it matters: Marauder is an automation tool. It hosts nothing and ships no tracker URLs. What you point it at is your responsibility, under the laws where you live.)