Many links in this document contain content that is unsavory and potentially illegal in your country, however we have censored the images and do not download them unless you click through the warnings.
Drew DeVault has an odd and frankly disturbing fascination with viewing and distributing explicit depictions of pre-pubescent girls doing sexual acts. This isn’t just a one-off event or something that has happened by accident, but a long and storied history of such behavior that spans over a decade. In this document, we will present evidence to back accusations that have been leveled against DeVault by various users in the FOSS community and try to give him a fair shake (while being personally disgusted by what has been found).
DeVault is best known for his contributions to Wayland and SwayWM. He is the owner of Sourcehut, a GitHub alternative. Over the years DeVault has been known to butt heads with numerous people in the open source community, partly due to his propensity to be highly opinionated on a wide range of subject matter. Most recently, DeVault penned an investigative report titled "The Stallman Report", targeting Richard Stallman, head of the Free Software Foundation.
The report, of which he intended to remain the anonymous author, was revealed to be published by DeVault due to his hosting of stallman-report.org on the same IP address as drewdevault.com.
Following this, a draft of DeVault's report was found on https://rms-draft-84eb252.drewdevault.com/, a subdomain of drewdevault.com, DeVault's personal website, after being automatically recorded by the Internet Archive. It was captured on September 29th, 2024, prior to stallman-report.org's launch on October 14th, 2024.
"The Stallman Report" is beyond the scope of this document, and we will not be addressing the veracity of the claims made by DeVault about Richard Stallman here. We mention it to illustrate DeVault's understanding of how harmful and destructive pedophilia is to both victims and consumers and how the knock-on effects are felt by victims for the rest of their lives.
For those who are unfamiliar with Drew DeVault, he commonly uses the online moniker “sircmpwn” (he owns cmpwn.com and uses the email address [email protected])
This post from the sircmpwn reddit account also implies the account belongs to DeVault:
[Archive] [Backup archive] 
A Reddit user by the name of WillowDRosenberg made a post pointing out that another Reddit user by the name of STRONTJESBERG is a pedophile and the self-admitted moderator of r/preteen_girls (why this was even allowed to exist is beyond our comprehension), to which DeVault replied:
What an ass, you don't have to call him out in the middle of a (mostly) unrelated post. I pity pedophiles - you can't control what turns you on, and they happen to be turned on by something illegal. It's a dick move to try and bring it up and shame him publicly.
- Drew DeVault [Archive] [Backup Archive]
This seems to conflict with the opinions presented in his blog, which states:
[...] Then I went to GPN, a hacker event in Germany, at the start of June. It was a welcome relief from the stress I’ve faced this year, a chance to celebrate hacker culture and a warm reminder of the beauty of our community. It was wonderful. Then, on the last night, a friend took me aside and confided in me that they are a pedophile, and told me it was okay because they respected the age of consent in Germany – which is 14. What began as a wonderful reminder of what the hacker community can be became a PTSD episode and a reminder that rape culture is fucking everywhere.
- Drew DeVault (emphasis added)
[Archive] [Backup of first message] [second message] [third message] I'm of the opinion that 14 year old girls should be required to have an IUD installed. Ten years of contraception that requires a visit to the doctor to remove prematurely.
- Drew DeVault
The image above illustrates his absurd opinions about forced teen contraception and the misogynistic opinion that no 24-year-old woman could support a family.
Evidently, DeVault did not think about it, or "jump off a bridge", as the Reddit user in the previous section advised. Instead, he went on to create a Reddit bot called "SauceHunt" that finds sources for anime images uploaded to Reddit.
We have confirmed that this could not possibly be a wiki edit intended to frame DeVault as the owner of the bot, as he has made a post clearly confirming ownership:
[Archive] [Backup archive] The list of subreddits he programmed his bot to run on includes one, "r/pomf" so pedophilic that it was banned by Reddit, along with many other pedophilic and racist subreddits [Vice News].
Finding archives of the subreddit in question, "r/pomf", we were appalled at what we saw:Warning: Clicking this text will reveal censored explicit images.
Note: The original image are not censored.
For those unaware, wikipedia's definition of Loli or Lolicon is as follows:
Lolicon is a genre of fictional media which focuses on young (or young-looking) girl characters, particularly in a sexually suggestive or erotic manner. The term, a portmanteau of the English-language phrase "Lolita complex", also refers to desire and affection for such characters (ロリ, "loli"), and their fans.
The above explicit subreddit is archived here. (WARNING: EXPLICIT)
The source code repository for SauceHunt has also been archived as being present on his SirCmpwn GitHub account. It notably had zero forks or pull requests as late as 2018, meaning the only contributor to its code was him, and he was the one to add r/pomf to the Reddit bot. This GitHub account is additionally linked by the "ddevault" account on Hacker News.
It is also worthy of mention that r/pomf links an image hosting service in its sidebar, imgrush, which is running an instance of DeVault's MediaCrush software.
Additionally, all of mediacru.sh was copied to imgrush.com following the shutdown of mediacru.sh.
In 2020, a user by the name of “dmpwn” commented on an image of an anime girl on danbooru.donmai.us (an image-sharing board where users share often pornographic anime images):
You may have noticed that the handle "dmpwn" is quite similar to "cmpwn", and the user additionally links to an image hosted on DeVault's project hosting website, SourceHut. The link is hosted on SourceHut's legacy software, l.sr.ht, which can be found here. As stated on the page for legacy.sr.ht, DeVault runs a private file hosting service on l.sr.ht, available only to himself and people he knows personally.
DeVault happens to have hosted his desktop configuration files on SourceHut. Upon cursory inspection, we found Danbooru in his Qutebrowser bookmarks, along with multiple Japanese learning/translation resources.
This account has a long history of tagging images on Danbooru, such as the following image, which the account tagged "happy sex":Warning: Clicking this text will reveal censored explicit images.
Note: The original image is not censored.
This image was found in the list of changes the account has made to image tags and is archived here. (WARNING: EXPLICIT)
It's worth mentioning that even other users of Danbooru disagreed with the judgment to add the "happy sex" tag, and removed it directly after it was added it. (This screenshot was taken after the account's username was changed.)
Warning: The same image as above.
Note: The original image is not censored.
This account also translates images on Danbooru, including a large number of sexually drawn children. Many of these images have tags such as "kindergarten uniform" and "no panties", "nude" and "nipples". Note that users do not have to translate these images. They were picked entirely at the will of the account owner.Incomplete list of images translated by the account. Explicit.
Click to see the image's page on Danbooru (larger, not censored).
Note: The original images are not censored.
Incomplete list of images translated by the account. Not explicit.
Click to see the image's page on Danbooru (larger).
This account is still active as well. Its latest translation was in August of 2024, proving continued active use of the website.
Another thing to note about the Danbooru account is that it is a Platinum account.
The significance of this is that, according to Danbooru's Wiki, Platinum members have the additional ability to view "censored tags".
This is important because the only censored tags on Danbooru are loli and shota. (Shota is the same as Loli, except involving boys.)
This shows that this account is almost certainly used to intentionally view pedophilic images, however, we cannot see which ones without having a paid account.
We call upon the community to stop supporting Drew DeVault either directly or indirectly, financially or otherwise. We recommend that community members cease to use or support SourceHut, a hosting platform run by DeVault. (Regardless of these incidents, SourceHut should be avoided as DeVault has a tendency to ban projects he personally dislikes.) We also encourage members of the community to voice their support for these calls to action, disseminate our report as broadly as possible, and raise our voices in condemnation of sexual violence and those who protect perpetrators of it.
The editors of this report may be reached by email to [email protected].
Our PGP public key is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEZxjRFBYJKwYBBAHaRw8BAQdAC6GF/TgNn1gSVrHGGX+KOC5YZY020/Ru9yFU
LI/Ip8i0LkRlVmF1bHQgUmVwb3J0IDxkZXZhdWx0X3JlcG9ydEBwcm90b25tYWls
LmNvbT6ImQQTFgoAQRYhBJdYBfEvYhNwbH3nSK0x5+zNzEaHBQJnGNEUAhsDBQkF
o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEK0x5+zNzEaHdfwBAO1k
CFxe4dKs6wlqZ+eaOLUeVdNd+83eFTqiI5GnYT9WAQC8zMzAFULCkVot9Wc3kvO1
YiPmucXnowUbrt+bdSf2A7g4BGcY0RQSCisGAQQBl1UBBQEBB0AJdsj8l/5OkHAB
cCakh3ib6Qo46UX6wMzXg2ujbMuvIwMBCAeIfgQYFgoAJhYhBJdYBfEvYhNwbH3n
SK0x5+zNzEaHBQJnGNEUAhsMBQkFo5qAAAoJEK0x5+zNzEaHtV8BALvSR5plg1iu
PSWPDPmowG1nWttDz8cvQQBZWVyF4016AQD6TuU9tcdwfCx5WiscPUi1KUT5q3Cn
K/8GYQcJdv4sCg==
=Mscz
-----END PGP PUBLIC KEY BLOCK-----This document will be updated as new information is discovered, which has already happened multiple times during writing.
Last updated October 27th, 2024