diff --git a/daemon/remote.c b/daemon/remote.c
index 94613c5b0..d4b7ae7a5 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -219,7 +219,7 @@ void daemon_remote_delete(struct daemon_remote* rc)
  * @return false on failure.
  */
 static int
-add_open(char* ip, int nr, struct listen_port** list, int noproto_is_err)
+add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err)
 {
 	struct addrinfo hints;
 	struct addrinfo* res;
@@ -554,7 +554,7 @@ do_verbosity(SSL* ssl, char* str)
 
 /** print stats from statinfo */
 static int
-print_stats(SSL* ssl, char* nm, struct stats_info* s)
+print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 {
 	struct timeval avg;
 	if(!ssl_printf(ssl, "%s.num.queries"SQ"%u\n", nm, 
diff --git a/daemon/unbound.c b/daemon/unbound.c
index 6325a5eef..2a53ca0b5 100644
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -315,7 +315,7 @@ detach(void)
 /** daemonize, drop user priviliges and chroot if needed */
 static void
 perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
-	char** cfgfile)
+	const char** cfgfile)
 {
 #ifdef HAVE_GETPWNAM
 	uid_t uid;
@@ -477,7 +477,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
  * @param debug_mode: if set, do not daemonize.
  */
 static void 
-run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
+run_daemon(const char* cfgfile, int cmdline_verbose, int debug_mode)
 {
 	struct config_file* cfg = NULL;
 	struct daemon* daemon = NULL;
@@ -546,7 +546,7 @@ int
 main(int argc, char* argv[])
 {
 	int c;
-	char* cfgfile = CONFIGFILE;
+	const char* cfgfile = CONFIGFILE;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
 
diff --git a/doc/Changelog b/doc/Changelog
index 2eacdb9d7..646628408 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+4 November 2008: Wouter
+	- fixed -Wwrite-strings warnings that result in better code.
+
 3 November 2008: Wouter
 	- fixup build process for Mac OSX linker, use ldns b32 compat funcs.
 	- generated configure with autoconf-2.61.
diff --git a/services/localzone.c b/services/localzone.c
index a7452ea39..d0c7af830 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -580,7 +580,7 @@ lz_nodefault(struct config_file* cfg, const char* name)
 /** enter AS112 default zone */
 static int
 add_as112_default(struct local_zones* zones, struct config_file* cfg,
-        ldns_buffer* buf, char* name)
+        ldns_buffer* buf, const char* name)
 {
 	struct local_zone* z;
 	char str[1024]; /* known long enough */
diff --git a/smallapp/unbound-checkconf.c b/smallapp/unbound-checkconf.c
index d23f5c040..539710270 100644
--- a/smallapp/unbound-checkconf.c
+++ b/smallapp/unbound-checkconf.c
@@ -260,7 +260,7 @@ check_chroot_filelist(const char* desc, struct config_strlist* list,
 
 /** check configuration for errors */
 static void
-morechecks(struct config_file* cfg, char* fname)
+morechecks(struct config_file* cfg, const char* fname)
 {
 	warn_hosts("stub-host", cfg->stubs);
 	warn_hosts("forward-host", cfg->forwards);
@@ -353,7 +353,7 @@ morechecks(struct config_file* cfg, char* fname)
 
 /** check config file */
 static void
-checkconf(char* cfgfile)
+checkconf(const char* cfgfile)
 {
 	struct config_file* cfg = config_create();
 	if(!cfg)
@@ -379,7 +379,7 @@ extern char* optarg;
 int main(int argc, char* argv[])
 {
 	int c;
-	char* f;
+	const char* f;
 	log_ident_set("unbound-checkconf");
 	log_init(NULL, 0, NULL);
 	checklock_start();
diff --git a/smallapp/unbound-control.c b/smallapp/unbound-control.c
index 232956869..728667e3f 100644
--- a/smallapp/unbound-control.c
+++ b/smallapp/unbound-control.c
@@ -124,7 +124,7 @@ setup_ctx(struct config_file* cfg)
 
 /** contact the server with TCP connect */
 static int
-contact_server(char* svr, struct config_file* cfg)
+contact_server(const char* svr, struct config_file* cfg)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
@@ -220,9 +220,9 @@ send_file(SSL* ssl, FILE* in, char* buf, size_t sz)
 static int
 go_cmd(SSL* ssl, int argc, char* argv[])
 {
-	char* pre="UBCT";
-	char* space=" ";
-	char* newline="\n";
+	const char* pre="UBCT";
+	const char* space=" ";
+	const char* newline="\n";
 	int was_error = 0, first_line = 1;
 	int r, i;
 	char buf[1024];
@@ -261,7 +261,7 @@ go_cmd(SSL* ssl, int argc, char* argv[])
 
 /** go ahead and read config, contact server and perform command and display */
 static int
-go(char* cfgfile, char* svr, int argc, char* argv[])
+go(const char* cfgfile, char* svr, int argc, char* argv[])
 {
 	struct config_file* cfg;
 	int fd, ret;
@@ -300,7 +300,7 @@ extern char* optarg;
 int main(int argc, char* argv[])
 {
 	int c, ret;
-	char* cfgfile = CONFIGFILE;
+	const char* cfgfile = CONFIGFILE;
 	char* svr = NULL;
 #ifdef USE_WINSOCK
 	int r;
diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c
index f7949906a..43b05432d 100644
--- a/smallapp/unbound-host.c
+++ b/smallapp/unbound-host.c
@@ -99,7 +99,7 @@ isip6(const char* nm, char** res)
 {
 	struct in6_addr addr;
 	/* [nibble.]{32}.ip6.arpa. is less than 128 */
-	char* hex = "0123456789abcdef";
+	const char* hex = "0123456789abcdef";
 	char buf[128];
 	char *p;
 	int i;
diff --git a/testcode/delayer.c b/testcode/delayer.c
index 4bf8d98e7..9ed7ca2e5 100644
--- a/testcode/delayer.c
+++ b/testcode/delayer.c
@@ -966,8 +966,8 @@ service_loop(int udp_s, int listen_s, struct ringbuf* ring,
 
 /** delayer main service routine */
 static void
-service(char* bind_str, int bindport, char* serv_str, size_t memsize, 
-	int delay_msec)
+service(const char* bind_str, int bindport, const char* serv_str, 
+	size_t memsize, int delay_msec)
 {
 	struct sockaddr_storage bind_addr, srv_addr;
 	socklen_t bind_len, srv_len;
@@ -1098,8 +1098,8 @@ extern char* optarg;
 int main(int argc, char** argv) 
 {
 	int c;		/* defaults */
-	char* server = "127.0.0.1@53";
-	char* bindto = "0.0.0.0";
+	const char* server = "127.0.0.1@53";
+	const char* bindto = "0.0.0.0";
 	int bindport = 0;
 	size_t memsize = 10*1024*1024;
 	int delay = 100;
diff --git a/testcode/harvest.c b/testcode/harvest.c
index 08ce08d33..f0b6f90c4 100644
--- a/testcode/harvest.c
+++ b/testcode/harvest.c
@@ -168,7 +168,7 @@ static void usage(char* nm)
 static int hverb = 0;
 
 /** exit with error */
-static void error_exit(char* str)
+static void error_exit(const char* str)
 {
 	printf("error: %s\n", str);
 	exit(1);
@@ -235,7 +235,7 @@ lab_cmp(const void *x, const void *y)
 
 /** create label entry */
 static struct labdata*
-lab_create(char* name)
+lab_create(const char* name)
 {
 	struct labdata* lab = (struct labdata*)calloc(1, sizeof(*lab));
 	if(!lab) error_exit("out of memory");
diff --git a/testcode/replay.c b/testcode/replay.c
index 8e3e03653..22b8908b3 100644
--- a/testcode/replay.c
+++ b/testcode/replay.c
@@ -54,7 +54,7 @@
  * @return: true if found, false if not. 
  */
 static int 
-parse_keyword(char** line, char* keyword)
+parse_keyword(char** line, const char* keyword)
 {
 	size_t len = (size_t)strlen(keyword);
 	if(strncmp(*line, keyword, len) == 0) {
diff --git a/testcode/streamtcp.c b/testcode/streamtcp.c
index ebfec9007..aaa5892c5 100644
--- a/testcode/streamtcp.c
+++ b/testcode/streamtcp.c
@@ -62,7 +62,7 @@ void usage(char* argv[])
 
 /** open TCP socket to svr */
 static int
-open_svr(char* svr, int udp)
+open_svr(const char* svr, int udp)
 {
 	struct sockaddr_storage addr;
 	socklen_t addrlen;
@@ -96,7 +96,7 @@ open_svr(char* svr, int udp)
 /** write a query over the TCP fd */
 static void
 write_q(int fd, int udp, ldns_buffer* buf, int id, 
-	char* strname, char* strtype, char* strclass)
+	const char* strname, const char* strtype, const char* strclass)
 {
 	struct query_info qinfo;
 	ldns_rdf* rdf;
@@ -210,7 +210,7 @@ recv_one(int fd, int udp, ldns_buffer* buf)
 
 /** send the TCP queries and print answers */
 static void
-send_em(char* svr, int udp, int noanswer, int num, char** qs)
+send_em(const char* svr, int udp, int noanswer, int num, char** qs)
 {
 	ldns_buffer* buf = ldns_buffer_new(65553);
 	int fd = open_svr(svr, udp);
@@ -251,7 +251,7 @@ extern char* optarg;
 int main(int argc, char** argv) 
 {
 	int c;
-	char* svr = "127.0.0.1";
+	const char* svr = "127.0.0.1";
 	int udp = 0;
 	int noanswer = 0;
 
diff --git a/testcode/testbound.c b/testcode/testbound.c
index d3b75e849..a83ea0f13 100644
--- a/testcode/testbound.c
+++ b/testcode/testbound.c
@@ -82,9 +82,9 @@ testbound_usage()
  * @param pass_argv: the argv to pass to unbound. Modified.
  */
 static void
-add_opts(char* optarg, int* pass_argc, char* pass_argv[])
+add_opts(const char* optarg, int* pass_argc, char* pass_argv[])
 {
-	char *p = optarg, *np;
+	const char *p = optarg, *np;
 	size_t len;
 	while(p && isspace((int)*p)) 
 		p++;
diff --git a/testcode/unitmain.c b/testcode/unitmain.c
index 66fc5c73c..7837e3836 100644
--- a/testcode/unitmain.c
+++ b/testcode/unitmain.c
@@ -89,7 +89,7 @@ alloc_test() {
 static void 
 net_test()
 {
-	char* t4[] = {"\000\000\000\000",
+	const char* t4[] = {"\000\000\000\000",
 		"\200\000\000\000",
 		"\300\000\000\000",
 		"\340\000\000\000",
diff --git a/util/config_file.c b/util/config_file.c
index 5d91f5d9d..5fcc35c01 100644
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -423,7 +423,7 @@ create_cfg_parser(struct config_file* cfg, char* filename)
 }
 
 int 
-config_read(struct config_file* cfg, char* filename)
+config_read(struct config_file* cfg, const char* filename)
 {
 	FILE *in;
 	if(!filename)
@@ -433,7 +433,7 @@ config_read(struct config_file* cfg, char* filename)
 		log_err("Could not open %s: %s", filename, strerror(errno));
 		return 0;
 	}
-	create_cfg_parser(cfg, filename);
+	create_cfg_parser(cfg, (char*)filename);
 	ub_c_in = in;
 	ub_c_parse();
 	fclose(in);
@@ -965,7 +965,7 @@ char* cfg_ptr_reverse(char* str)
 
 	if(addr_is_ip6(&addr, addrlen)) {
 		struct in6_addr* ad = &((struct sockaddr_in6*)&addr)->sin6_addr;
-		char* hex = "0123456789abcdef";
+		const char* hex = "0123456789abcdef";
 		char *p = buf;
 		int i;
 		for(i=15; i>=0; i--) {
diff --git a/util/config_file.h b/util/config_file.h
index c26a5f74e..363a24ea9 100644
--- a/util/config_file.h
+++ b/util/config_file.h
@@ -298,7 +298,7 @@ struct config_file* config_create_forlib();
  * @return: false on error. In that case errno is set, ENOENT means 
  * 	file not found.
  */
-int config_read(struct config_file* config, char* filename);
+int config_read(struct config_file* config, const char* filename);
 
 /**
  * Destroy the config file structure.
diff --git a/util/module.h b/util/module.h
index 68308835b..216828490 100644
--- a/util/module.h
+++ b/util/module.h
@@ -289,7 +289,7 @@ struct module_qstate {
  */
 struct module_func_block {
 	/** text string name of module */
-	char* name;
+	const char* name;
 
 	/** 
 	 * init the module. Called once for the global state.