It will surprise more than a few of you to hear that the first social network dates back to 1971.

No accounts, no algorithm, no central server. Your entire profile fits in a single plain text file that you control. John Carmack (co-founder of id Software and programmer of Doom and Quake) used it as a development journal. And chances are you already have a client installed on your operating system without knowing it.

But the most incredible part is that, half a century later, it still works. And do not rule out a comeback.

Its name is Finger, and you can try it right now.

The finger client comes preinstalled on macOS and most Unix systems. On Debian or Ubuntu you install it with apt install finger. Windows also ships its finger.exe. And if you live in Emacs, you have M-x finger, included in net-utils.el out of the box.

finger [email protected]

It will randomly show you a Finger account hosted on happynetbox.com, one of the many directories (or hosts) that make publishing easy if you do not have your own server. Fun, isn't it?

But its origin is just as interesting.

Origin

In 1971, at the Stanford Artificial Intelligence Laboratory (SAIL), researchers shared a computer running the WAITS time-sharing system. The only way to know who was connected was the WHO command, which spat out an endless, hard-to-read list.

Well, Les Earnest, one of the lab's engineers, kept seeing a scene that repeated daily.

I frequently saw people running their fingers down the WHO display saying things like "There's Don and that's Pattie but I don't know when Tom was last seen."

People ran their fingers down the screen, hence the name. Earnest wrote a program that returned that information in a human format: real names, locations and, most importantly, how long each terminal had been idle. He was a practical engineer who preferred talking in person to talking through the computer. He wanted to know whether it was worth getting up and walking down the hall to find someone.

As a side effect, he had invented network presence, or the social network.

In 1977 the protocol was formalized in RFC 742, written by Ken Harrenstien. It was so primitive that only 3 sites supported it: SAIL, SRI and MIT's ITS machines. A little later, the networked implementation was handled by Earl Killian at MIT and Brian Harvey at Stanford.

In 1991, RFC 1288 was written, the definitive specification, making the earlier versions obsolete.

The first microblog: the .plan and .project files

On top of the protocol, there was content. Besides telling whether you were connected, Finger showed the contents of two text files in your home folder: .plan and .project. The original idea was to announce what you were working on and what you planned to do. A kind of static professional "status", with no interactions like likes or comments. As if it were a changelog of your day-to-day or your project.

People did what we always do: humanize it. They started including poems, jokes, personal diaries, ASCII art, articles... anything! Anyone in the world could read your .plan with a simple finger your-user@your-host. Many consider it, rightly, the first microblog on the internet.

As I mentioned, the most famous example is John Carmack's .plan. For years, any fan could type finger [email protected] (dead nowadays) and read, straight from the source, what the graphics engine of their favorite games was up to. He wrote from 1996 to 2010. Today they are preserved, archived on GitHub. It is one of the most valuable technical documents in video game history, and it was distributed over a 1971 protocol. TOO ANGRY TO DIE!

Do not expect prose that brings tears to your eyes, either. His style was telegraphic: task lists and bugs without a word to spare. But every so often a bombshell dropped. For example, on August 18, 1997 he announced through his .plan, not through a website or a press conference, that he planned to release the Doom source code:

-----------------------------------------
John Carmack's .plan for Aug 18, 1997
-----------------------------------------

I get asked about the DOOM source code every once in a while, so here is a
full status update:

[...]

The DOOM code should be a lot more interesting. It is better written, 32 bit,
and portable. There are several interesting projects that immediately present
themselves for working with the code. GLDOOM and a packet server based
internet DOOM spring to mind.

Glory kill!

The first IoT device spoke Finger

Around 1982, some students at Carnegie Mellon University (Mike Kazar, David Nichols, John Zsarnay and Ivor Durham) got tired of walking down to the department's Coca-Cola machine and finding it empty or with warm bottles. They installed microswitches to detect how many bottles were in each column and how long they had been cooling.

They wired it all up to the network and exposed the status over Finger. From any computer you could run finger [email protected] (the machine's exact name changed over the years) and learn not only whether there were sodas, but which button would give you the coldest one. It is considered one of the first connected objects in history, the grandfather of the Internet of Things. And its interface was, once again, Finger.

The protocol

Finger is so simple it can be explained in one paragraph. The client opens a TCP connection to port 79 on the server. It sends a line of text (the username it is looking for, or an empty line to list everyone) terminated by a carriage return and line feed. The server responds with plain text and closes the connection. That's it!

No encryption, no headers, no sessions. Pure simplicity.

sequenceDiagram
    participant C as Client (finger)
    participant S as Server (fingerd, port 79)
    C->>S: Opens TCP connection to port 79
    C->>S: "johnc" + CRLF
    S->>C: Contents of ~johnc/.plan (plain text)
    S->>C: Closes the connection

The basic command is this:

finger user@server

Since the protocol has no secrets, you can speak it by hand with netcat. We send the username via standard input to port 79 and read what comes back:

echo "random" | nc happynetbox.com 79

It will feel familiar because it works like other protocols such as Whois, Gopher or SMTP: connect, ask in plain text, and read the response.

What goes inside a .plan

A .plan is not a wall of posts. It is a single text file where you can write whatever you want. When someone fingers you, the server returns the whole file, as-is. There is no format to follow, it is the wild west.

Does that mean you can only have one post? No. The custom, since the 80s, is to keep a sort of diary inside that same file, adding dated entries, usually with the most recent on top. That is how John Carmack published years of development. His .plan was a file that grew with entries separated by dashed lines:

-----------------------------------------
John Carmack's .plan for Jan 02, 1998
-----------------------------------------

Wired magazine does something that almost no other print magazine...

Yours could look simpler, with a profile header and several entries:

Emily Carter
Marine biologist. Coffee, kayaking and old maps.

--- 2026-08-14 ---
Back from sampling on the coast. Three jars full of plankton to go through.

--- 2026-08-05 ---
Finally finished "Dune". Now I get half the memes on the internet.

--- 2026-07-30 ---
Anyone know how to fix a bike chain that keeps slipping off? Tips welcome.

When the file gets long, you trim the old entries yourself. There is no database behind it storing your history: the .plan is mutable and unversioned, whatever you delete is gone. There is no way to "click" from one profile to another. Everything is manual.

To map it to what you already know:

It looks a bit decaf next to today's social networks. Modern services smooth out some rough edges, as you will see below. But this is not a feature race, it is just your file with your status.

Its decline and resurrection

Finger did not fall into oblivion because of fashion, it fell because of security.

On November 2, 1988 came the Morris worm, one of the first worms to spread across the internet. One of its vectors was a flaw in the fingerd daemon. The worm sent a request that overflowed the buffer and managed to run code on the remote machine. It was, probably, the first malicious buffer overflow in history. It infected around 6,000 computers, roughly 10% of the entire internet at the time!

On top of that there was a deeper design problem. Finger reveals information about people: names, emails, schedules and when they last logged in. RFC 1288 itself carries a warning:

Warning!! Finger discloses information about users; moreover, such information may be considered sensitive.

By the late 90s, the vast majority of administrators had disabled the service. The protocol became a relic after almost 20 years of use, which is not bad at all.

And here comes the unexpected twist. Finger is so forgotten, and at the same time so present, that in 2020 it was discovered that certain attackers were using the finger.exe that ships by default in Windows to download malware without raising suspicion. It is a technique called living-off-the-land: the binary is already there, it is trusted, and almost nobody watches it. The Astaroth malware used it to fetch its payload. That a 1970s protocol still ships on every Windows says a lot about its design.

Simple, functional ideas are very hard to kill. Just look at how many Unix commands there are, many of them written before you were born. And with the revival of the small web, a current of minimalist, decentralized protocols (Gemini, IRC, RSS, NNTP, etc.), Finger has poked its head out again:

• Happy Net Box, by Ben Brown. A reincarnation of the .plan with a web interface to edit your text and a daemon that limits the security risk. Try finger [email protected], or finger [email protected] (my earlier example) to read a random user.
• Finger.Farm, by Jon Roig. Another open source Finger implementation written in Node, with updates via web, REST API or cURL, designed for you to self-host.
• plan.cat, another public server that also bridges to ActivityPub, so your .plan can be read from Mastodon.

It is a living protocol, small and hackable, kept alive by people who find it fun.

There are even directories of active accounts:

finger [email protected]

And I am sure there are more communities I do not know about.

Taking your first steps

Easy: a host like Happy Net Box

You set up nothing. You sign up for free at happynetbox.com, write your text in its web box and save. From that moment on, anyone in the world can read you:

finger [email protected]

The service provides the server and the security. It is the perfect way to have your public .plan in a minute, without touching a console. Zero cost. If you come from Mastodon or X, this is your equivalent of "creating an account".

Intermediate: the Finger daemon on your Linux

If you already have a server (a VPS, a Raspberry Pi), you can run the classic daemon, the good old fingerd. It reads the ~/.plan file of whichever user is being queried and serves it. On Debian it is best to use ffingerd, a security-minded reimplementation and the recommended one for a public service. It is launched from a super-server like inetd, which listens on port 79 and starts the daemon on each connection.

sudo apt install openbsd-inetd ffingerd

Add this line to /etc/inetd.conf and reload the service:

finger stream tcp nowait nobody /usr/sbin/tcpd /usr/sbin/ffingerd

sudo systemctl reload openbsd-inetd

Now create your plan, world-readable, and test it:

echo "Hi, I'm Bob. Today I'm working on my Finger server." > ~/.plan
chmod a+r ~/.plan
finger your-user@your-server

All that is left is to open port 79 in the firewall and point a domain at it. Since Finger reveals information, follow the advice in Debian's security manual: use ffingerd, restrict which hosts can connect, and limit the number of processes.

Hard: your own fingerd in Python

If you want full control and to understand the protocol from the inside, write your own server. Since Finger is plain text over a socket, it fits in a few lines. This is the script I use to serve my .plan.

Create a file called fingerd.py with this content:

import asyncio

PLAN_FILE = "plan.txt"


async def handle(reader, writer):
    # Read the client's query and discard it: we serve a single plan.
    await reader.readline()
    try:
        with open(PLAN_FILE, encoding="utf-8") as file:
            body = file.read()
    except FileNotFoundError:
        body = "No plan yet.\n"
    writer.write(body.encode("utf-8"))
    await writer.drain()
    writer.close()


async def main():
    server = await asyncio.start_server(handle, "0.0.0.0", 79)
    async with server:
        await server.serve_forever()


asyncio.run(main())

Create a plan.txt with whatever you want to publish and start it.

Port 79 is privileged, so it needs permissions:

sudo python3 fingerd.py

Test it from another terminal:

finger anyone@localhost

The server ignores whatever name you send and returns your plan.

To survive reboots, wrap it in a systemd service.

Any improvement you want to add is up to you.

Final notes

Today it is still alive and patched. Modern implementations do not expose the home folder, do not use gets() and isolate the process. The ghost of the Morris worm was a flaw in a specific implementation in 1988, not in the architecture. It is simple, practical and secure. And, on top of that, it makes you the owner of your presence on the network.

That said, today there are more complete solutions, more accessible or riding on other protocols:

If you come from a mainstream social network, RSS is the gentlest gateway: you write on your blog and anyone follows you from their reader. The gemlog of Gemini and the phlog of Gopher are cousins of the small web, with their own clients and the same taste for calm. The /now page (the movement Derek Sivers started in 2015 and cataloged at nownownow.com) is, in practice, the .plan moved to the web: a single page that answers "what are you up to now?". And Org Social is almost Finger from birth: a microblog in a text file you host yourself.

That extreme minimalism, with no rules or defined formats, is exactly what makes it hard to kill and truly enjoyable.

It will not go mainstream again, and who cares? It will live on in the margins of an ever more complex internet, kept alive by the curious, waiting for someone to type finger and rediscover its easter egg. It is probably the smallest and the most yours thing you will have on the internet.

By the way, run finger [email protected] and keep an eye on my .plan. ;)

Sources

Every fact in this article comes from these references:

• RFC 742: NAME/FINGER Protocol (Ken Harrenstien, 1977). The first specification.
• RFC 1288: The Finger User Information Protocol (D. Zimmerman, 1991). The definitive specification, includes the security warnings.
• Finger (protocol) on Wikipedia. History, RFCs and decline.
• Les Earnest, gold medal for FINGER, a Stanford University exhibit, and his first-person account of the origin of the name.
• The Carmack Plan and the archive of John Carmack's .plan files on GitHub.
• The ARPANET Of Things And CMU's History Of Networked Soda Machines (Hackaday) and the official history of CMU's Coca-Cola machine.
• The Ghost of Exploits Past: A Deep Dive into the Morris Worm (Rapid7). Details of the fingerd overflow, and Morris worm on Wikipedia for the date and scope.
• Windows 10 'Finger' command can be abused to download or steal files (BleepingComputer) and Guildma is now using Finger… (SANS ISC). The use of finger.exe as an attack tool, with its entry in LOLBAS.
• Happy Net Box, by Ben Brown.
• Finger.Farm, by Jon Roig. An open source Finger implementation in Node.
• plan.cat, a public Finger server bridged to ActivityPub, and the thebackupbox finger ring, a directory of active accounts (finger [email protected]).
• How and why to make a /now page, by Derek Sivers, and the nownownow.com directory.
• Forgotten Internet: Giving (or Getting) The Finger (Hackaday). An overview of modern Finger.
• 5.9. Securing finger, Debian's security manual, on the ffingerd, cfingerd and efingerd daemons.