Category: Technology

  • Cyberdeck Build — RISC-V + E-Paper Bill of Materials

    A portable, clamshell cyberdeck built around an open-ISA RISC-V core and a paper-like (e-ink) display — the closest real-world echo of Gibson’s “neural slab”: low-power, readable in daylight, no glare, silent. Parts are chosen to be actually purchasable today, with a 3D-printable case.

    Design intent: A distraction-free, off-grid, daylight-readable writerdeck/field terminal — not a gaming laptop. E-ink is slow to refresh, so this is a text/code/notes machine, which fits the “console cowboy” minimal-HMI aesthetic better than a color LCD anyway.


    Bill of materials

    #PartRoleExample productPrice (USD)Notes
    1RISC-V SoC boardCompute coreStarFive VisionFive 2 (JH7110, quad U74 @1.5 GHz, up to 8 GB LPDDR4)~$70–90 (4 GB); ~$100–120 (8 GB)Best-supported RISC-V SBC. Has 40-pin GPIO, HDMI, MIPI-DSI, USB 3.0, M.2 NVMe, gigabit Ethernet, Wi-Fi (with module). Boots Debian/Fedora/Ubuntu RISC-V. Pi-shaped, so most Pi HATs and cases physically fit.
    1bAlt computeSmaller/lower-powerMilk-V Mars (same JH7110, Pi-form-factor) or Milk-V Duo S (ultra-low-power, microcontroller-class)~$50–80Mars = same chip, more Pi-compatible GPIO; Duo S = tiny, for a truly minimal slab.
    2E-paper display (EPD)Display — “liquid paper”Waveshare 5.83″ E-Paper HAT (648×480, B/W, SPI)~$30–40Reflective, daylight-readable, near-180° viewing angle, ~1–2 s full refresh. SPI attaches to the 40-pin GPIO. Pair with the Waveshare driver HAT for plug-and-play.
    2bAlt displayLarger panelWaveshare 7.5″ E-Paper HAT (800×480, B/W or B/W/Red, SPI)~$40–55Bigger reading area; same SPI interface. (G) variant adds red/yellow accent. Choose for writerdeck vs. compact.
    2cFast-refresh altIf you need motionWaveshare 7.5″ E-Paper Display with partial-refresh support, or a low-power transflective LCD~$50–80Full-color e-ink with fast refresh is still slow; use only if you need a cursor that moves smoothly.
    3Keyboard / keypadHMI inputCorne CRKBD (split ortho 40%, QMK, hand-wired or PCB kit) or Planck EZ / OLKB Planck~$50–90 kit; ~$120 prebuiltOrtholinear grid packs cleanly into a rectangular clamshell; QMK layers give you arrows/numbers without a number row. This is the community-favorite cyberdeck keyboard.
    3bAlt keypadBuilt-in pointingThinkPad-style keyboard with trackpoint (salvaged USB unit) or Rii K12+ (wireless mini KB + trackpad)~$25–45If you need a pointer without a separate mouse. Trackpoint = compact; Rii = cheap and self-contained.
    3cUltra-mini altThumb typingSolder Party BBQ20K (Blackberry-style thumb keyboard)~$25–35For a pocket/very-small slab.
    4BatteryPowerWaveshare UPS HAT (B) — 5V/5A, dual 18650 Li-ion, pogo-pin connector, Pi-compatible 40-pin~$30 (no cells)Clips onto the 40-pin GPIO; provides regulated 5V, charge + output simultaneously, overcharge/over-discharge protection. Two 18650 cells (~2600 mAh each ≈ 5200 mAh) give roughly 2–4 h runtime.
    4bCellsEnergy storage18650 Li-ion, 2600–3500 mAh, protected~$10–20 totalUse name-brand (Samsung, Sony, Panasonic). The VisionFive 2 idles ~1–2 W, peaks ~5 W under load; e-ink draws almost nothing when static.
    4cHigh-capacity altLonger runtimeUSB-C PD power bank, 10000–20000 mAh, 5V/3A out~$25–40Simpler (no HAT) but no auto-shutdown/protection; fine if you treat it as an external pack.
    5HingeClamshell pivotTorque/friction hinge — buy or print. Options: (a) GoPro-style mount hinge (3D-printed, strong, universal); (b) metal torque hinge (e.g. Southco/Sugatsune laptop-style friction hinge, ~$8–15); (c) printed nylon-on-nylon friction sleeve over an M2/M3 bolt with spring washers~$5–15Printed plastic-only hinges wear out — use a metal friction hinge or a printed mechanism with a nylon sleeve + spring washers for durability. Must hold the e-paper panel at any angle.
    6CaseEnclosure3D-printed clamshell (STL from community or custom) — e.g. Jay Doscher’s Recovery Kit STLs (jaydosacher.com), ALX/Nearphuture deck, or a custom OpenSCAD/Fusion design sized to your panel + keyboardFilament ~$15–30Print in PETG/ABS/ASA for strength and heat resistance; PLA is OK for a prototype but warps in a hot car. Print the hinge bosses to take metal inserts. Vent the SoC area.
    6bReady-made altSkip the printPelican/Pelican-style 1150/1200 hard case (used as the base, panel hinged into the lid)~$30–50The canonical cyberdeck enclosure; rugged, waterproof, easy to mount into.

    Estimated total

    TierBuildApprox. cost
    BudgetVisionFive 2 (4 GB) + 5.83″ EPD + Corne kit + UPS HAT (no cells) + 2× 18650 + printed case + printed hinge~$220–270
    BalancedVisionFive 2 (8 GB) + 7.5″ EPD + prebuilt Corne + UPS HAT + cells + Pelican case + metal torque hinge~$330–400
    Minimal slabMilk-V Duo S + 5.83″ EPD + BBQ20K thumb KB + USB-C PD power bank + printed case~$140–180

    Integration notes

    SoC ↔ Display: The e-paper HAT uses SPI on the 40-pin GPIO header. The VisionFive 2 exposes SPI on its 40-pin header (Pi-compatible). Use Waveshare’s epd driver library; enable spi0 in the device tree. Refresh is partial (fast, ~0.3 s for text deltas) or full (~1–2 s, clears ghosting). Drive a console framebuffer (epd-fb) or a minimal Wayland/TUI app — not a full DE, which will feel sluggish on e-ink.

    SoC ↔ Keyboard: USB (the Corne is USB-C). Map QMK layers for arrows, function keys, and a “deck mode” key. If you want the keyboard to be the only input, give one layer a mouse-key mode (QMK supports this) — no trackpad needed.

    Power path: UPS HAT sits on the 40-pin header between the SBC and the cells. It supplies regulated 5V and reports battery level over I²C (sysfs). Configure the SBC to auto-shutdown on low battery via the UPS HAT’s GPIO interrupt. Charge via the HAT’s USB-C input while running.

    Hinge mounting: Mount the e-paper panel to the lid half, the keyboard + SBC + battery to the base half. Route the SPI ribbon through the hinge (a short flexible FFC or a slack wire bundle with strain relief). Keep the hinge torque high enough to hold the panel but low enough to flip with one hand — ~1.5–3 Nm typical for a small panel.

    Thermals: The JH7110 needs a small passive heatsink (or the starter-kit fan) under load; e-ink and the keyboard are passive. Vent the base; the battery HAT generates a little heat while charging.

    Network: VisionFive 2 has gigabit Ethernet + Wi-Fi (with the optional module). For an off-grid writerdeck you may disable Wi-Fi entirely — true to the “neural slab, no distractions” ethos.


    How this maps to the source dimensions

    DimensionThis build
    SoCRISC-V (open ISA) — JH7110, quad U74. Philosophically the “open” choice, closer to the hacker ethos than a closed ARM/x86 chip.
    HMIOrtholinear mechanical keypad (Corne) — a real, tactile interface, not a neural one. The honest real-world substitute for Gibson’s dermatrodes.
    DisplayE-paper — reflective, no backlight, daylight-readable. The closest material analogue to “a surface that shows text” without the glare of an LCD. Slow refresh forces a text-first use case.
    Case3D-printed clamshell or Pelican hard case — the maker’s enclosure, individual and modifiable.
    Power18650 UPS HAT — internal, swappable, field-serviceable cells.
    NetworkOptional Wi-Fi/Ethernet; can be disabled for a focused, off-grid “deck.”
    Aesthetic formMinimal slab + grid keypad + paper screen — restrained, functional, near-monochrome. Closer to Gibson’s underspecified minimalism than to the maximalist Alien-terminal look.
    FunctionPortable Linux terminal for text, code, notes, low-bandwidth work.
    Use caseDistraction-free writerdeck / field terminal / open-ISA learning machine.

    Prices are approximate 2026 retail and fluctuate; verify at vendors such as Waveshare, PiShop US, Amazon, DigiKey/Mouser (for hinges and cells), and the keyboard’s respective store.

  • Cyberdeck — Definition, Source & Taxonomy

    Working definition

    A cyberdeck (short for cyberspace deck) is a personal, portable computing rig used to enter cyberspace. The term originates in William Gibson’s 1984 novel Neuromancer and has since spawned three distinct but related meanings:

    1. The Source — the literary device as Gibson actually wrote it.
    2. Media tropes — how the concept was codified, elaborated, and visualized across Cyberpunk, Shadowrun, the Alien franchise, and other cyberpunk media.
    3. Actual builds — real-world machines, both commercial products and hobbyist constructions, that emulate the concept.

    These three are not the same object. They differ in form, function, and use case. Conflating them is the most common error in “what is a cyberdeck” discussions.


    1. The Source — Gibson’s Neuromancer (1984)

    In Neuromancer, Case’s deck is an Ono-Sendai Cyberspace VII, a “matrix simulator.” Gibson deliberately leaves it underspecified, but the consistent textual details are:

    • Neural interface, not a screen/keyboard box. The deck’s primary I/O is a terry cloth sweatband fitted with flat Sendai dermatrodes (electrodes) worn across the forehead. Case “settled the black terry sweatband across his forehead, careful not to disturb the flat Sendai dermatrodes.”
    • A “stud with the ridges on it” serves as the power switch: “Found the ridged face of the power stud and jacked into a custom cyberspace deck that projected his disembodied consciousness into the consensual hallucination that was the matrix.”
    • Green and red LEDs on the face.
    • Lap-sized, carried by hand. Case “stared at the deck on his lap” and “carried the Ono-Sendai to one of the new work tables.”
    • A visualization/translation unit, paired with a separate computer. The Ono-Sendai renders the matrix; a Hosaka box handles processing and data transfer. The two are used together: “He wiped his forehead with a towel, took a quick sip of water from the bicycle bottle beside the Hosaka, and checked the map of the library displayed on the screen.”
    • Deck is a generic term for an I/O peripheral: the text also names “simstim deck,” “matrix deck” (obsolete military), and “navigation deck.”
    • Decks are simplified simstim units — “the trodes he used and the little plastic tiara dangling from a simstim deck were basically the same.” The interface is direct neural stimulation that drowns out external sensation.
    • Cyberspace itself is “a consensual hallucination experienced daily by billions of legitimate operators… A graphic representation of data abstracted from the banks of every computer in the human system.” The deck is the doorway, not the destination.

    Key insight: Gibson’s deck is closer to a neural-interface terminal than a portable laptop. There is no keyboard in the canonical description, no screen the user looks at while jacked in (the Sony monitor is for checking data between runs). The “console cowboy” operates bodiless, by thought. This is the detail most modern reinterpretations discard.


    2. Media Tropes — How the concept was codified

    Successive media re-encoded the deck as a more tangible, visualizable object — usually adding screen + keyboard and shrinking the neural element.

    Cyberpunk TTRPG & Cyberpunk 2077 (CDPR):

    • A cyberdeck (aka cybermodem) is “about the size of a paperback book, made of plastic, weighs about half a kilogram.”
    • Portable Decks have internal rechargeable power cells lasting ~4 hours.
    • Netrunners require Interface Plugs and a Neural Link (cyberware) to operate one.
    • Post-DataKrash, the Net fractured into closed NET Architectures a netrunner must physically approach — making the deck a proximity tool, not a global gateway.
    • Game mechanics: decks accept quickhacks, have slots, ratings, and rarity tiers — turning the literary device into a stat-bearing equipment slot.

    Shadowrun (FASA / Catalyst):

    • Cyberdeck + decker terminology (echoing Gibson). The matrix is accessed via ASIST (direct neural interface) and datajack.
    • Decks are modular: MPCP processor, programs (attack/defense/utility), and hardware slots. Again, a gameable object with stats.

    Alien franchise (Ridley Scott et al.):

    • The Nostromo terminals and MOTHER mainframe set the visual vocabulary: chunky industrial chassis, CRT/amber phosphor readouts, mechanical keys, exposed cabling, “used future” aesthetic. No neural interface — these are screen+keyboard workstations. This look is what most hobbyist “cyberpunk aesthetic” builds actually mimic.

    Tropification effect: across media the deck drifted from neural doorway (Gibson) to stat-bearing portable hacker computer with a screen (TTRPGs/games) to industrial retro-terminal (Alien). Each layer added visual specificity Gibson intentionally omitted.


    3. Actual Builds — Real-world machines

    Real cyberdecks are physical computers, built to evoke the source/trope. They split into commercial products and hobbyist builds.

    Commercial products

    • ClockworkPi uConsole — modular handheld: QWERTY keyboard, 5″ 1280×720 IPS, integrated battery, slot for Raspberry Pi Compute Module 4/5 or other SBCs. ~$220–280. The closest thing to an “off-the-shelf cyberdeck.”
    • ClockworkPi DevTerm — wider “portable terminal” form factor, chunky, with a trackball and expansion bays; explicitly retro-futuristic.
    • Raspberry Pi 400 — keyboard-form-factor SBC; a low-effort “deck” when paired with a portable monitor.
    • Framework mainboard kits — repurposed laptop motherboards (the Framedeck lineage) for x86-class portable builds.
    • Mini PCs with touchscreen — higher performance, but mains-dependent.
    • Kali NetHunter on a phone — a software-only “deck” approach, often unstable.

    Hobbyist builds

    • Pelican-case decks — the canonical build (Jay Doscher’s Raspberry Pi Recovery Kit): rugged hard case, milled aluminum face plate, 7″ display, mechanical keyboard, Ethernet switch.
    • Repurposed-object decks — Altoids tins, lunchboxes, briefcases, mint tins, old pocket computers, wooden boxes — “hide computing in ordinary things.”
    • Wearables & body-mounted — strap-mounted rigs, visor-integrated builds.
    • Writerdecks — purpose-stripped for distraction-free writing (e.g. Freewrite-style, often e-ink).
    • Pen-test / cybersecurity decks — running Kali, paired with SDRs, NFC, Wi-Fi pineapple radios.
    • RF / SDR / satellite decks — receive weather satellites, radio surveillance, off-grid data.
    • “Data ark” / off-grid decks — knowledge preservation for post-disaster or remote scenarios.
    • Pure aesthetic / prop replicas — built to look like a Neuromancer deck or an Alien terminal; function secondary.

    Component-dimensional comparison

    The three strata compared across the dimensions that define a build: SoC (compute), HMI (human-machine interface), Network, Display, Case, Power, plus aesthetic form, function, and use case.

    DimensionSource (Neuromancer)Media tropesActual builds (real)
    SoC / ComputeOno-Sendai = visualization unit; Hosaka = separate processing box. Compute is split, not monolithic.Single integrated deck unit with onboard processor + program slots (gameable stats).Single-board computer (Raspberry Pi), laptop motherboard (Framework), or compute module (uConsole). Integrated.
    HMIDermatrodes (forehead electrodes) — direct neural I/O. No keyboard. A ridged power stud. LED indicators only.Datajack / neural link + (in games) abstracted controls; in Alien, mechanical keyboard + chunky switches.Mechanical keyboards, trackballs, touchscreens, gamepad controls. Neural interface is absent or simulated.
    NetworkJacks into the global matrix — a single consensual hallucination spanning “every computer in the human system.”Global matrix (CP/Shadowrun) → fragmented NET Architectures post-DataKrash (CP2077).Wi-Fi, Ethernet, SDR, satellite, LoRa, mesh. Bounded by real physics, not fiction.
    DisplayNone during use — the user’s eyes are closed; cyberspace is seen in the mind. A Sony monitor is used only between runs to check data.Often a small CRT/amber screen, holographic readout, or HUD; visualized for the audience.LCD panels (3.5″–10″), e-ink, OLED, round displays, goggles/visor combos.
    CaseLap-sized slab, plastic, with LEDs. Intentionally vague.Paperback-sized plastic box (CP2077), industrial terminal chassis (Alien).Pelican hard cases, 3D-printed shells, Altoids tins, briefcases, lunchboxes, repurposed objects.
    PowerImplied mains/bench use; laptop-grade portability implied by lap placement.Internal rechargeable cells, ~4 h runtime (CP2077).Li-ion battery banks, USB-PD, solar, mains-dependent mini PCs.
    Aesthetic formMinimal, neural, almost meditative — a slab + a sweatband. Anti-visual. Gibson resists depicting it.Maximalist industrial — chunky, lit, mechanical, “used future.” Built to be seen on screen/page.Retro-futuristic maker aesthetic — exposed hardware, mechanical keys, neon, repurposed enclosures.
    FunctionProject disembodied consciousness into the matrix; navigate data by thought.Gameable hacker tool: breach ICE, run quickhacks, steal data, fight in cyberspace.Real portable Linux workstation: coding, pentesting, writing, RF work, art, self-expression.
    Use caseConsole cowboy’s livelihood and addiction — “the body was meat.” Bodiless exultation.Heist narrative device; combat in cyberspace; a character class’s signature equipment.Secondary/specialized machine — pentesting rig, writerdeck, off-grid knowledge store, cosplay prop, art piece.

    Taxonomy

    mindmap
      root((Cyberdeck))
        Source (Gibson 1984)
          Ono-Sendai Cyberspace VII
            Dermatrodes (neural I/O)
            Ridged power stud
            Green/red LEDs
          Paired Hosaka (compute)
          Sony monitor (between-run)
          Simstim-deck lineage
        Media tropes
          Cyberpunk TTRPG / 2077
            Cybermodem, paperback-sized
            Internal battery, ~4h
            Quickhacks, rarity tiers
            NET Architectures (post-DataKrash)
          Shadowrun
            Deck + decker + ASIST
            MPCP, program slots
          Alien franchise
            Industrial terminal look
            CRT amber, mechanical keys
        Actual builds
          Commercial
            ClockworkPi uConsole
            DevTerm
            Raspberry Pi 400
            Framework mainboard kits
            Mini PC + touchscreen
            NetHunter (phone)
          Hobbyist
            Pelican hard-case
            Repurposed object (tin, box)
            Wearable / body-mounted
            Writerdeck
            Pen-test / cybersec
            RF / SDR / satellite
            Data-ark / off-grid
            Aesthetic / prop replica
        Build dimensions
          SoC (compute core)
          HMI (interface)
          Network
          Display
          Case
          Power
    Parse error on line 1:
    mindmap  root((Cybe
    ^
    Expecting 'NEWLINE', 'SPACE', 'GRAPH', got 'ALPHA'
    ```mermaid
    mindmap
      root((Cyberdeck))
        Source (Gibson 1984)
          Ono-Sendai Cyberspace VII
            Dermatrodes (neural I/O)
            Ridged power stud
            Green/red LEDs
          Paired Hosaka (compute)
          Sony monitor (between-run)
          Simstim-deck lineage
        Media tropes
          Cyberpunk TTRPG / 2077
            Cybermodem, paperback-sized
            Internal battery, ~4h
            Quickhacks, rarity tiers
            NET Architectures (post-DataKrash)
          Shadowrun
            Deck + decker + ASIST
            MPCP, program slots
          Alien franchise
            Industrial terminal look
            CRT amber, mechanical keys
        Actual builds
          Commercial
            ClockworkPi uConsole
            DevTerm
            Raspberry Pi 400
            Framework mainboard kits
            Mini PC + touchscreen
            NetHunter (phone)
          Hobbyist
            Pelican hard-case
            Repurposed object (tin, box)
            Wearable / body-mounted
            Writerdeck
            Pen-test / cybersec
            RF / SDR / satellite
            Data-ark / off-grid
            Aesthetic / prop replica
        Build dimensions
          SoC (compute core)
          HMI (interface)
          Network
          Display
          Case
          Power
    ```
    </pre><pre class="visualizeMermaid__error visualizeMermaid__error--hidden js-visualize-error">Parse error on line 1:
    ```mermaidmindmap 
    ^
    Expecting 'NEWLINE', 'SPACE', 'GRAPH', got 'PUNCTUATION'
    #mermaid-1788298690320{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#ccc;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-1788298690320 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-1788298690320 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-1788298690320 .error-icon{fill:#a44141;}#mermaid-1788298690320 .error-text{fill:#ddd;stroke:#ddd;}#mermaid-1788298690320 .edge-thickness-normal{stroke-width:1px;}#mermaid-1788298690320 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-1788298690320 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-1788298690320 .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-1788298690320 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-1788298690320 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-1788298690320 .marker{fill:lightgrey;stroke:lightgrey;}#mermaid-1788298690320 .marker.cross{stroke:lightgrey;}#mermaid-1788298690320 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-1788298690320 p{margin:0;}#mermaid-1788298690320 .edge{stroke-width:3;}#mermaid-1788298690320 .section--1 rect,#mermaid-1788298690320 .section--1 path,#mermaid-1788298690320 .section--1 circle,#mermaid-1788298690320 .section--1 polygon,#mermaid-1788298690320 .section--1 path{fill:#1f2020;}#mermaid-1788298690320 .section--1 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon--1{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge--1{stroke:#1f2020;}#mermaid-1788298690320 .edge-depth--1{stroke-width:17;}#mermaid-1788298690320 .section--1 line{stroke:#e0dfdf;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-0 rect,#mermaid-1788298690320 .section-0 path,#mermaid-1788298690320 .section-0 circle,#mermaid-1788298690320 .section-0 polygon,#mermaid-1788298690320 .section-0 path{fill:#0b0000;}#mermaid-1788298690320 .section-0 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-0{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-0{stroke:#0b0000;}#mermaid-1788298690320 .edge-depth-0{stroke-width:14;}#mermaid-1788298690320 .section-0 line{stroke:#f4ffff;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-1 rect,#mermaid-1788298690320 .section-1 path,#mermaid-1788298690320 .section-1 circle,#mermaid-1788298690320 .section-1 polygon,#mermaid-1788298690320 .section-1 path{fill:#4d1037;}#mermaid-1788298690320 .section-1 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-1{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-1{stroke:#4d1037;}#mermaid-1788298690320 .edge-depth-1{stroke-width:11;}#mermaid-1788298690320 .section-1 line{stroke:#b2efc8;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-2 rect,#mermaid-1788298690320 .section-2 path,#mermaid-1788298690320 .section-2 circle,#mermaid-1788298690320 .section-2 polygon,#mermaid-1788298690320 .section-2 path{fill:#3f5258;}#mermaid-1788298690320 .section-2 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-2{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-2{stroke:#3f5258;}#mermaid-1788298690320 .edge-depth-2{stroke-width:8;}#mermaid-1788298690320 .section-2 line{stroke:#c0ada7;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-3 rect,#mermaid-1788298690320 .section-3 path,#mermaid-1788298690320 .section-3 circle,#mermaid-1788298690320 .section-3 polygon,#mermaid-1788298690320 .section-3 path{fill:#4f2f1b;}#mermaid-1788298690320 .section-3 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-3{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-3{stroke:#4f2f1b;}#mermaid-1788298690320 .edge-depth-3{stroke-width:5;}#mermaid-1788298690320 .section-3 line{stroke:#b0d0e4;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-4 rect,#mermaid-1788298690320 .section-4 path,#mermaid-1788298690320 .section-4 circle,#mermaid-1788298690320 .section-4 polygon,#mermaid-1788298690320 .section-4 path{fill:#6e0a0a;}#mermaid-1788298690320 .section-4 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-4{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-4{stroke:#6e0a0a;}#mermaid-1788298690320 .edge-depth-4{stroke-width:2;}#mermaid-1788298690320 .section-4 line{stroke:#91f5f5;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-5 rect,#mermaid-1788298690320 .section-5 path,#mermaid-1788298690320 .section-5 circle,#mermaid-1788298690320 .section-5 polygon,#mermaid-1788298690320 .section-5 path{fill:#3b0048;}#mermaid-1788298690320 .section-5 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-5{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-5{stroke:#3b0048;}#mermaid-1788298690320 .edge-depth-5{stroke-width:-1;}#mermaid-1788298690320 .section-5 line{stroke:#c4ffb7;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-6 rect,#mermaid-1788298690320 .section-6 path,#mermaid-1788298690320 .section-6 circle,#mermaid-1788298690320 .section-6 polygon,#mermaid-1788298690320 .section-6 path{fill:#995a01;}#mermaid-1788298690320 .section-6 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-6{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-6{stroke:#995a01;}#mermaid-1788298690320 .edge-depth-6{stroke-width:-4;}#mermaid-1788298690320 .section-6 line{stroke:#66a5fe;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-7 rect,#mermaid-1788298690320 .section-7 path,#mermaid-1788298690320 .section-7 circle,#mermaid-1788298690320 .section-7 polygon,#mermaid-1788298690320 .section-7 path{fill:#154706;}#mermaid-1788298690320 .section-7 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-7{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-7{stroke:#154706;}#mermaid-1788298690320 .edge-depth-7{stroke-width:-7;}#mermaid-1788298690320 .section-7 line{stroke:#eab8f9;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-8 rect,#mermaid-1788298690320 .section-8 path,#mermaid-1788298690320 .section-8 circle,#mermaid-1788298690320 .section-8 polygon,#mermaid-1788298690320 .section-8 path{fill:#161722;}#mermaid-1788298690320 .section-8 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-8{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-8{stroke:#161722;}#mermaid-1788298690320 .edge-depth-8{stroke-width:-10;}#mermaid-1788298690320 .section-8 line{stroke:#e9e8dd;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-9 rect,#mermaid-1788298690320 .section-9 path,#mermaid-1788298690320 .section-9 circle,#mermaid-1788298690320 .section-9 polygon,#mermaid-1788298690320 .section-9 path{fill:#00296f;}#mermaid-1788298690320 .section-9 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-9{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-9{stroke:#00296f;}#mermaid-1788298690320 .edge-depth-9{stroke-width:-13;}#mermaid-1788298690320 .section-9 line{stroke:#ffd690;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-10 rect,#mermaid-1788298690320 .section-10 path,#mermaid-1788298690320 .section-10 circle,#mermaid-1788298690320 .section-10 polygon,#mermaid-1788298690320 .section-10 path{fill:#01629c;}#mermaid-1788298690320 .section-10 text{fill:lightgrey;}#mermaid-1788298690320 .node-icon-10{font-size:40px;color:lightgrey;}#mermaid-1788298690320 .section-edge-10{stroke:#01629c;}#mermaid-1788298690320 .edge-depth-10{stroke-width:-16;}#mermaid-1788298690320 .section-10 line{stroke:#fe9d63;stroke-width:3;}#mermaid-1788298690320 .disabled,#mermaid-1788298690320 .disabled circle,#mermaid-1788298690320 .disabled text{fill:lightgray;}#mermaid-1788298690320 .disabled text{fill:#efefef;}#mermaid-1788298690320 .section-root rect,#mermaid-1788298690320 .section-root path,#mermaid-1788298690320 .section-root circle,#mermaid-1788298690320 .section-root polygon{fill:hsl(180, 1.5873015873%, 48.3529411765%);}#mermaid-1788298690320 .section-root text{fill:#2c2c2c;}#mermaid-1788298690320 .icon-container{height:100%;display:flex;justify-content:center;align-items:center;}#mermaid-1788298690320 .edge{fill:none;}#mermaid-1788298690320 .mindmap-node-label{dy:1em;alignment-baseline:middle;text-anchor:middle;dominant-baseline:middle;text-align:center;}#mermaid-1788298690320 :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;}CyberdeckGibson 1984Media tropesActual buildsBuild dimensionsOno-Sendai Cyberspace VIIcomputebetween-runSimstim-deck lineageCyberpunk TTRPG / 2077ShadowrunAlien franchiseCommercialHobbyistcompute coreinterfaceNetworkDisplayCasePowerneural I/ORidged power studGreen/red LEDsCybermodem,paperback-sizedInternal battery, ~4hQuickhacks, rarity tierspost-DataKrashDeck + decker + ASISTMPCP, program slotsIndustrial terminal lookCRT amber, mechanicalkeysClockworkPi uConsoleDevTermRaspberry Pi 400Framework mainboard kitsMini PC + touchscreenphonePelican hard-casetin, boxWearable / body-mountedWriterdeckPen-test / cybersecRF / SDR / satelliteData-ark / off-gridAesthetic / prop replica
    Parse error on line 1:
    #mermaid-17882986903
    ^
    Expecting 'NEWLINE', 'SPACE', 'GRAPH', got 'BRKT'

    Takeaways

    • The source is neural, the tropes are visual, the builds are physical. Gibson’s deck is a doorway for disembodied consciousness; media turned it into a screen-and-keyboard hacker box; builders make real portable computers that quote the look of the tropes.
    • Modern “cyberdecks” are aesthetic descendants, not functional ones. A Raspberry Pi in a Pelican case cannot project your mind into the matrix. It is a portable Linux machine dressed in the visual language Gibson’s successors invented.
    • The component dimensions (SoC, HMI, Network, Display, Case, Power) are the honest comparison frame. Across all three strata, the biggest divergence is HMI: neural I/O (source) vs. gameable controls (tropes) vs. real keyboards/touchscreens (builds).
    • Use case inverts from fiction to reality. In fiction the deck is the cowboy’s primary instrument of self-actualization. In reality it is almost always a secondary, specialized, or expressive machine — rarely a daily driver.

    Sources: William Gibson, Neuromancer (1984) — text via Genius/annotated chapters & LitCharts; Neuromancer Wiki & William Gibson Wiki (Ono-Sendai Cyberspace VII, Case, cyberspace deck); Cyberpunk Wiki (cyberdeck, NET Architecture); Shadowrun; Wikipedia (Cyberdeck); Forbes; Raspberry Pi Foundation; Hackaday; cyberdeck.cafe; Vapor95 (2026 build guide); Eclypsium; Science Fiction & Fantasy StackExchange.

    mindmap
      root((Cyberdeck))
        Source (Gibson 1984)
          Ono-Sendai Cyberspace VII
            Dermatrodes (neural I/O)
            Ridged power stud
            Green/red LEDs
          Paired Hosaka (compute)
          Sony monitor (between-run)
          Simstim-deck lineage
        Media tropes
          Cyberpunk TTRPG / 2077
            Cybermodem, paperback-sized
            Internal battery, ~4h
            Quickhacks, rarity tiers
            NET Architectures (post-DataKrash)
          Shadowrun
            Deck + decker + ASIST
            MPCP, program slots
          Alien franchise
            Industrial terminal look
            CRT amber, mechanical keys
        Actual builds
          Commercial
            ClockworkPi uConsole
            DevTerm
            Raspberry Pi 400
            Framework mainboard kits
            Mini PC + touchscreen
            NetHunter (phone)
          Hobbyist
            Pelican hard-case
            Repurposed object (tin, box)
            Wearable / body-mounted
            Writerdeck
            Pen-test / cybersec
            RF / SDR / satellite
            Data-ark / off-grid
            Aesthetic / prop replica
        Build dimensions
          SoC (compute core)
          HMI (interface)
          Network
          Display
          Case
          Power
    Parse error on line 1:
    mindmap  root((Cybe
    ^
    Expecting 'NEWLINE', 'SPACE', 'GRAPH', got 'ALPHA'

  • Open-Source Office Environment — Reference Architecture

    A coherent, end-to-end open-source stack for a small-to-mid-size office. “Coherent” means one identity domain, one OS family, one virtualization platform, one storage/collaboration hub, and single sign-on woven through every service — the open-source analogue of a Windows-Server + Active-Directory + Microsoft-365 estate.

    Every component below is free/open-source software (OSI-approved license) and self-hostable on hardware the office owns and controls.

    License note — AGPL is treated as open-source here. “Community Edition” products are only included where their core is genuinely FOSS (not feature-gated freemium).


    1. Design Principles

    1. One OS family. Debian (stable) everywhere — clients, servers, appliances. One package model, one update cadence, one set of sysadmin skills.
    2. One identity. FreeIPA is the directory of truth (LDAP + Kerberos + DNS + CA). All services authenticate against it; SSSD joins clients to the domain.
    3. One SSO plane. Keycloak (OIDC/SAML) sits in front of web apps, federated to FreeIPA. One login per person across mail, files, chat, conferencing, accounting, project boards.
    4. One collaboration hub. Nextcloud for files, calendars, contacts, and as the auth bridge to Collabora/OnlyOffice.
    5. One virtualization platform. Proxmox VE runs all VMs/LXCs; Proxmox Backup Server handles snapshots + dedup.
    6. Own the hardware, own the firmware. coreboot/Libreboot firmware on clients, OpenBMC on servers, OpenWrt on the network edge.
    7. No telemetry-leaking proprietary clients. Firefox/LibreWolf as the standard browser; no Chrome, no proprietary meeting clients.
    8. Everything backed up, everything reproducible. Infrastructure-as-code (Ansible) so the whole estate can be rebuilt from a Git repo.

    2. High-Level Architecture



    Core Infrastructure (Proxmox VE cluster)LDAP/KerberosHTTPS / KerberosOIDCOperationsPrometheus + GrafanaWazuh
    SIEM / XDRProxmox Backup ServerBorgmatic offsiteProductivity & Business AppsMattermost / Matrix
    chatJitsi Meet
    video conferencingOpenProject
    project / planningERPNext
    accounting · CRM · inventoryKimai
    time trackingZammad
    helpdeskForgejo
    git + CINetwork Edge (OpenWrt / OPNsense)Firewall + VPN
    WireGuardUnbound + Pi-hole
    DNSSEC / ad-blockKea DHCPWi-Fi APs
    OpenWrtUsers & DevicesWorkstations
    Debian + SSSDLaptops
    Debian + corebootThin clients
    LTSP PXE bootMobile
    Nextcloud/DAVx5FreeIPA
    LDAP + Kerberos + DNS + CAKeycloak
    SSO / OIDC / SAMLNextcloud
    files · cal · contactsCollabora / OnlyOffice
    document co-editingPostfix + Dovecot
    + Rspamd + ClamAVRoundcube
    webmail

    3. The Stack, Layer by Layer

    LayerPrimary choiceRoleAlternatives
    Firmware — clientscoreboot + SeaBIOS (Libreboot where supported)Boot firmware with no proprietary blobsU-Boot (RISC-V/ARM)
    Firmware — serversOpenBMCOut-of-band server mgmt (IPMI replacement)OpenBMC on vendor BMCs
    HardwareSystem76 / Framework laptops; OpenPower or standard x86 servers; RISC-V for niche appliancesOpen / vendor-open hardwareRaspberry Pi, Raptor Talos
    Network OS — routerOPNsense (free, hardened FreeBSD fork)Firewall, routing, NAT, VPN concentratorOpenWrt on x86, VyOS
    Network OS — switches/APsOpenWrtManaged switches and Wi-Fi APsOpenSwitch
    VPNWireGuardSite-to-site + remote accessOpenVPN, Tailscale/Headscale (OSS control plane)
    DNSUnbound (recursive, DNSSEC) + Pi-hole (local ad/block) + FreeIPA DNS (internal zones)Resolution + filtering + internal namingCoreDNS, Knot Resolver, AdGuard Home
    DHCPKea DHCPAuthoritative DHCP / DHCPv6dnsmasq
    Client OSDebian (stable), GNOME or KDE desktopStandard workstation/laptop OSRocky/Alma, Fedora, Ubuntu LTS
    Client joinSSSD + FreeIPA clientDomain join, Kerberos login, sudo/HBAC rulesrealmd
    Thin clientsLTSP (PXE/NFS root)Diskless Debian boot from network
    Directory / identityFreeIPALDAP + MIT Kerberos + integrated DNS + CA — the “Active Directory for Linux”389 DS, OpenLDAP + Kerberos (manual)
    SSO / web authKeycloakOIDC / SAML IdP, federated to FreeIPA; SSO for every web appAuthentik, LemonLDAP::NG
    VirtualizationProxmox VE (KVM + LXC)All workloads as VMs/LXC containersoVirt, libvirt+virt-manager
    Container runtimePodman + LXCApp-level containers where appropriateDocker, Kubernetes (k3s)
    Reverse proxy / TLSTraefik or Nginx + Certbot (internal step-ca or FreeIPA CA)TLS termination, routing, ACME certsHAProxy, Caddy
    Mail — MTA/MDAPostfix + DovecotSMTP, IMAP/POP3, sieve
    Mail — anti-spam/anti-virusRspamd + ClamAVSpam scoring, DKIM/DMARC/SPF, AVSpamAssassin, Amavis
    Mail — webmailRoundcube (or SnappyMail)Browser mail access
    Mail — listsMailman 3Mailing listsSympa
    Calendar/contactsNextcloud (CalDAV/CardDAV) + optionally RadicaleShared calendars/address booksBaïkal
    Files / syncNextcloudFile sync, share, WebDAV, sharing linksSeafile, ownCloud
    Office suite (desktop)LibreOfficeDocument authoringCalligra
    Office suite (collab web)Collabora Online (or OnlyOffice Docs Community, AGPL)Real-time co-editing of ODF/OOXML in browser
    Document scanning/OCRPaperless-ngxScan, OCR, archive, full-text search
    ChatMattermost (Slack-like) or Matrix (Synapse + Element)Team messagingRocket.Chat
    Audio/voiceJitsi Meet’s jigasi bridge, or MumbleVoice channels
    Video conferencingJitsi Meet (self-hosted, no client install for browser/SIP)Meetings, webinars, screen shareBigBlueButton (e-learning heavy)
    Project / PMOpenProjectProject planning, Gantt, time, bug trackingTaiga, Redmine, Leantime
    KanbanWekanLightweight boardsFocalboard
    Accounting / ERPERPNext (Frappe framework, GPLv3)Books, invoicing, payroll hooks, CRM, inventory, manufacturingOdoo Community (watch AGPL/OOL modules), GnuCash (desktop-only), Ledger CLI
    Invoicing (light)Invoice Ninja (self-hosted)Standalone invoicing if ERPNext is overkill
    Time trackingKimaiTimesheets, billing export
    HROrangeHRMStaff records, leave
    Helpdesk / ITSMZammadTicketing, knowledge baseosTicket, Request Tracker
    Version control / CIForgejo (+ Forgejo Actions) or GiteaGit hosting, code review, CIGitLab CE (heavier)
    Wiki / knowledge baseBookStack or MediaWikiInternal docsDokuWiki
    DatabasePostgreSQL (primary), Redis, MariaDB (where an app needs it)App data stores
    Object storageMinIO (S3-compatible)App-level object storage, Nextcloud S3 backend
    Monitoring — metricsPrometheus + Grafana + AlertmanagerTime-series, dashboardsZabbix
    Monitoring — networkLibreNMSSNMP device inventory & uplink graphsZabbix
    Monitoring — uptimeUptime KumaSynthetic checks / status page
    Logging / SIEMWazuhLog aggregation, HIDS, XDR, complianceElastic Stack (Free tier), Graylog
    Backups — VMProxmox Backup ServerDedup, incremental, encrypted VM/LXC backups
    Backups — file/appBorgmatic (BorgBackup) / ResticApp + file backups to offsite targetBareos, UrBackup
    Security hardeningOpenSCAP, fail2ban, AIDE, certbot/step-caCompliance scans, intrusion detection
    BrowserFirefox ESR (or LibreWolf)Standard, privacy-respecting browser
    Printing / scanningCUPS + SANEPrint & scan spooling
    File sharing (legacy)SambaSMB shares for any Windows-guest or scanner needsNFS (internal)
    Configuration mgmtAnsible (+ Forgejo repo)Declarative infra, reproducible rebuildsSalt, Puppet
    Remote access / supportRustDesk (self-hosted) or MeshCentralRemote desktop / support sessions
    DNS records automationlexicon / FreeIPA DNS API + AnsibleKeep DNS in sync with deployments

    4. How Coherence Works (the “glue”)

    The estate is coherent because five things are shared across every service:

    4.1 Identity — FreeIPA is the source of truth

    • Every person and service is a FreeIPA principal (Kerberos) and LDAP entry.
    • HBAC (Host-Based Access Control) rules decide who can SSH into which hosts; sudo rules are centrally managed.
    • FreeIPA runs the internal DNS (zone office.local) and an internal CA so every service gets a real TLS certificate — no self-signed warnings, no browser exceptions.

    4.2 Single Sign-On — Keycloak

    • Keycloak federates to FreeIPA (LDAP user federation + Kerberos).
    • Each web app (Nextcloud, Jitsi, Mattermost, OpenProject, ERPNext, Zammad, BookStack, Roundcube, Paperless, Grafana) is registered as an OIDC or SAML client.
    • A user logs in once per day; everything else is seamless. Joining a new app = registering one OIDC client in Keycloak + pointing the app at it.

    4.3 Storage — Nextcloud as the hub

    • Home directories for “personal cloud” files; group folders for departments.
    • Calendars (CalDAV) and contacts (CardDAV) live in Nextcloud and sync to mobile via DAVx⁵.
    • Nextcloud mounts the Samba-backed scanner drop folder so Paperless-ngx ingests scans automatically.
    • Nextcloud integrates Collabora/OnlyOffice for in-browser document editing with the same SSO identity.

    4.4 Mail tied to identity

    • Postfix uses FreeIPA LDAP for recipient validation; Dovecot authenticates IMAP against Kerberos/LDAP.
    • Mailing lists (Mailman) and shared mailboxes (Dovecot’s acl) reuse the same directory groups, so “finance@”, “sales@”, etc. are just FreeIPA group memberships.

    4.5 Observability & secrets shared

    • Prometheus scrapes every exporter via the same TLS CA; Grafana authenticates via Keycloak OIDC.
    • Secrets (DB passwords, API keys) are stored in Vaultwarden (self-hosted Bitwarden) or FreeIPA’s password vault, never sprinkled in Ansible vars.

    5. Deployment Topology (example: 3-node office)

    #Host (VM/LXC on Proxmox)RolesNotes
    1ipa1FreeIPA, internal DNS, CAReplicas: ipa2
    2keycloak1Keycloak SSOBehind reverse proxy
    3mail1Postfix, Dovecot, Rspamd, ClamAV, RoundcubeDMARC/DKIM via Rspamd
    4nextcloud1Nextcloud + Collabora + MinIO (S3 primary storage)Postgres on db1
    5chat1Mattermost (or Synapse)OIDC to Keycloak
    6jitsi1Jitsi Videobridge + Jicofo + ProsodyBehind reverse proxy
    7erp1ERPNext + MariaDBOIDC to Keycloak
    8pm1OpenProjectOIDC to Keycloak
    9help1Zammad + ElasticsearchOIDC to Keycloak
    10git1Forgejo + Forgejo Actions runnersOIDC to Keycloak
    11obs1Prometheus, Grafana, Alertmanager, Uptime KumaOIDC to Keycloak
    12sec1Wazuh manager + indexer + dashboard
    13db1PostgreSQL (for Nextcloud, Keycloak, Zammad, OpenProject)Point-in-time recovery
    14pbs1Proxmox Backup Server (physical or dedicated)Offsite sync with Borgmatic
    15edge1OPNsense + WireGuard (physical, dual-WAN)
    16sw1..n, ap1..nOpenWrt switches & Wi-Fi APs (physical)

    The three Proxmox nodes form a Ceph or ZFS-over-replication cluster with live migration; losing one node moves workloads automatically. pbs1 holds encrypted, deduplicated backups; an offsite Borgmatic target holds a second copy.


    6. Security & Compliance Posture

    • TLS everywhere, internal CA (FreeIPA / step-ca); Certbot/ACME for public-facing names. No plaintext protocols on the LAN.
    • WireGuard for all remote access; no exposed RDP/SSH to the internet.
    • SELinux/AppArmor enforcing on servers; OpenSCAP profiles applied (Debian CIS baseline).
    • fail2ban + Wazuh for brute-force detection and host-based detection; logs ship to Wazuh indexer.
    • AIDE file-integrity monitoring on ipa1, db1, mail1.
    • DNS filtering via Pi-hole; DNSSEC validation via Unbound.
    • Least privilege via HBAC — developers can’t reach finance DBs, finance can’t reach git runners, all enforced centrally in FreeIPA.
    • Backups follow 3-2-1: PBS (on-site, deduped), Borgmatic offsite, nextcloud files also snapshotted to MinIO.

    7. Adoption & Migration Path

    1. Stand up the spine first — Proxmox cluster → FreeIPA → Keycloak → reverse proxy + TLS. Nothing else is built until SSO works.
    2. Migrate identity — create users/groups in FreeIPA matching existing roles; join a pilot Debian workstation via realm join.
    3. Email — cut over Postfix/Dovecot, migrate mailboxes with imapsync, configure DKIM/DMARC.
    4. Files & office — deploy Nextcloud + Collabora; migrate shared drives into group folders; install LibreOffice on clients.
    5. Collaboration — Mattermost/Matrix + Jitsi; switch the office off proprietary meeting clients.
    6. Business apps — ERPNext for accounting/invoicing; OpenProject for delivery; Kimai for time; Zammad for IT requests.
    7. Observability & backup — Prometheus/Grafana/Wazuh last, once there’s something to watch; PBS from day one.
    8. Automate everything — the entire build is captured in an Ansible playbook in Forgejo, so the estate is reproducible and rebuildable in hours, not weeks.

    8. Where Proprietary Stays Out (intentional)

    AvoidedOpen replacement
    Windows Server / Active DirectoryFreeIPA
    Exchange / OutlookPostfix+Dovecot+Roundcube, Nextcloud for calendar
    Microsoft 365 / SharePointNextcloud + Collabora
    Teams / ZoomJitsi Meet + Mattermost/Matrix
    SlackMattermost
    QuickBooks / XeroERPNext (or GnuCash for simple bookkeeping)
    JiraOpenProject
    GitHub (cloud)Forgejo (self-hosted)
    Zoom/Webex client installJitsi (browser-only)
    Chrome / EdgeFirefox ESR / LibreWolf
    Dropbox / Google DriveNextcloud
    LastPass / 1Password (cloud)Vaultwarden (self-hosted Bitwarden)

    9. Total Licensing

    Every component above ships under an OSI-approved license (GPL, AGPL, LGPL, MPL, Apache-2.0, or BSD). The whole estate can be operated with zero per-seat licensing fees, auditable end-to-end, and rebuildable from a single Git repository. That is the definition of “completely open source.”

  • FreeIPA Implementation Document

    A step-by-step implementation guide for deploying FreeIPA as the identity,
    authentication, and directory backbone of the open-source office estate
    defined in the Open-Source Office Environment — Reference Architecture Series.

    FreeIPA combines 389 Directory Server (LDAP), MIT Kerberos, Bind DNS,
    an integrated Certificate Authority (Dogtag / certmonger), NIS/SSSD and
    HBAC + sudo policies into one managed domain. It is the Linux-native
    equivalent of Microsoft Active Directory.

    Scope. This document covers a two-server, highly-available FreeIPA
    realm for a single office (office.local), with Debian 12 (bookworm)
    clients joined via realmd/sssd. It lists every input decision you must
    make up front, all dependencies, and the concrete commands to install and
    verify the domain.


    1. Document Control

    FieldValue
    DocumentFreeIPA Implementation Document
    Version1.0
    StatusDraft for implementation
    OwnerIT / Systems Administration
    AudienceSystem administrators, network engineers, security officer
    RelatedOpen-Source Office Environment — Reference Architecture
    Target realmOFFICE.LOCAL (Kerberos), office.local (DNS)
    Target OS (server)Debian 12 (bookworm) or Rocky/Alma 9
    Target OS (client)Debian 12 (bookworm)

    2. Key Inputs

    These are the decisions and values that must be agreed before
    installation. Every command downstream references them.

    2.1 Naming & realm

    InputExample valueNotes
    Kerberos realm nameOFFICE.LOCALConventionally uppercase FQDN. Must match across all replicas and clients. Cannot be renamed later without rebuilding.
    DNS domainoffice.localFreeIPA will host this zone. Use a subdomain of a real domain if you need external trust, e.g. corp.example.com.
    Directory Manager (root DN) passwordstrong, stored in VaultwardenRoot password for LDAP (cn=Directory Manager). Rotate yearly.
    FreeIPA admin passwordstrong, stored in VaultwardenInitial admin superuser. Create named admins after install; disable the generic admin for daily use.
    NTP / time sourcentp1.office.local (or pool.ntp.org)Kerberos dies without synchronized clocks. Max skew 5 min.

    2.2 Network topology

    InputExample valueNotes
    Primary server FQDNipa1.office.localFirst FreeIPA server (the “initial master”).
    Primary server IP10.10.10.10Must be static. This IP is the LDAP/Kerberos/DNS endpoint.
    Replica server FQDNipa2.office.localSecond FreeIPA server for HA.
    Replica server IP10.10.10.11Static.
    Client subnet10.10.10.0/24Workstations, laptops, thin clients.
    Client DNS serverFreeIPA server IPsClients resolve via FreeIPA DNS so SRV records work.
    Reverse DNS zone10.10.10.in-addr.arpa.Optional but recommended for Kerberos/GSSAPI sanity.

    2.3 Certificate authority

    InputExample valueNotes
    CA typeIntegrated Dogtag CASelf-signed root, internal to the realm. Trusted on all joined clients.
    CA subject DNCN=Certificate Authority,O=OFFICE.LOCALCustomize to org name if desired.
    Certificate validity20 years (root), 2 years (service)Defaults; tune per policy.
    External trust needed?No (standalone realm)If you later need a forest trust with AD, plan the CA cross-signing now.

    2.4 DNS policy

    InputExample valueNotes
    FreeIPA manages office.local?Yes (bind integrated)Lets FreeIPA publish _ldap._tcp, _kerberos._tcp, _kpasswd SRV records automatically.
    Forwarders1.1.1.1, 9.9.9.9Upstream recursive resolvers for everything outside office.local.
    DNSSEC validationOn (via forwarders)Recommended.
    Reverse zone managed?YesEnables PTR records for Kerberos sanity.

    2.5 Host / account policy

    InputExample valueNotes
    Default login shell/bin/bashSet in FreeIPA config.
    Home directory pattern/home/%uAuto-created on first login via pam_mkhomedir.
    UID/GID range10000–999999 (POSIX), SIDs auto-allocatedAvoid collision with local /etc/passwd ranges.
    User naming schemefirstname.lastnameEnforced via a helper script, not native policy.
    Password policyMin 14 chars, 90-day max, 5 history, lockout after 5Set in ipa pwpolicy.
    HBAC defaultdeny_all + named allow_<role> rulesStart from deny-all, open explicitly.
    sudo rule defaultNamed role-based rules, no broad ALL=(ALL) ALLCentralized via ipa sudorule.

    3. Dependencies

    3.1 Platform / OS dependencies

    DependencyPurposeInstalled by
    Debian 12 (bookworm) or RHEL-family 9Supported server OSManual
    freeipa-server packageServer binaries (389 DS, MIT Kerberos, bind, Dogtag)apt install
    freeipa-server-dnsIntegrated bind + DNS SRV automationapt install
    freeipa-server-trust-adAD trust support (only if needed later)optional
    sssd, krb5, oddjob, certmongerClient-side servicesclient install
    chrony (or systemd-timesyncd)Time sync — mandatory for Kerberosbase OS
    softhsm2PKCS#11 store for CA keys (newer FreeIPA)pulled in

    3.2 Infrastructure dependencies

    DependencyWhyNotes
    Static IPs for both IPA serversDNS + SRV records point at fixed addressesConfigure before install.
    Working NTP on all hostsKerberos tickets require <5 min clock skewConfigure before ipa-server-install.
    Forward/reverse DNS resolvableFreeIPA validates the host FQDN matches PTR during installPre-create A + PTR, or let FreeIPA create them.
    Firewall open: 53/udp+tcp (DNS), 80/tcp (HTTP), 88/udp+tcp (Kerberos), 123/udp (NTP), 389/tcp (LDAP), 443/tcp (HTTPS), 464/udp+tcp (Kadmin), 636/tcp (LDAPS)FreeIPA service portsConfigure on OPNsense/OpenWrt and host firewalls.
    Sufficient RAM/CPU389 DS + Dogtag + bind are memory-hungryMin 4 GB RAM, 2 vCPU; 8 GB recommended.
    Fast, redundant diskLDAP DB and CA storeSSD-backed; LVM for easy growth.
    Proxmox VE cluster (per reference arch)VMs for ipa1, ipa2Snapshot before each change.

    3.3 Soft / organizational dependencies

    DependencyWhy
    Signed-off naming conventionRealm name, DNS domain, OU layout can’t be renamed cheaply.
    Privileged-credential store (Vaultwarden)Directory Manager + admin passwords must not be in plaintext scripts.
    Ansible control node (per reference arch)Reproducible client joins, HBAC/sudo policy rollout.
    Backup target (Proxmox Backup Server)VM-level snapshots of ipa1/ipa2 before every change.
    Maintenance windowFirst install and replica promotion require brief DNS/Kerberos disruption.

    3.4 Dependency map

    chrony / NTP
    (mandatory)FreeIPA Server
    ipa1 + ipa2Forward+reverse DNS
    (static A/PTR)Firewall ports
    53/80/88/123/389/443/464/636SSD LVM
    4GB+ RAMVaultwarden
    for secretsProxmox cluster + PBS
    VM + backupKeycloak SSOClient joins via realmd/sssdPostfix/Dovecot LDAP authSamba (optional AD-like shares)HBAC + sudo rules

    4. Pre-Installation Checklist

    Run through this before ipa-server-install. Each item blocks install if false.

    • Two static IPs reserved (ipa1=10.10.10.10, ipa2=10.10.10.11) with matching A and PTR records (or agreement to let FreeIPA create them).
    • /etc/hosts on both servers contains only their own FQDN mapped to their primary IP — no stale 127.0.1.1 hostname entries.
    • hostnamectl set-hostname ipa1.office.local set on both hosts.
    • chrony running and clocks within 1 second of an external source.
    • Firewall opened on ports listed in §3.2 on both the host firewall and the network edge.
    • Debian 12 fully updated: apt update && apt full-upgrade.
    • Directory Manager and admin passwords generated and stored in Vaultwarden.
    • DNS domain office.local chosen and not overlapping any external domain you use.
    • Proxmox snapshot of both VMs taken.
    • Maintenance window booked (30 min for primary, 15 min for replica).

    5. Installation: Primary Server (ipa1)

    5.1 Install packages

    apt update
    apt install -y freeipa-server freeipa-server-dns chrony
    

    5.2 Run the installer

    ipa-server-install \
      --realm=OFFICE.LOCAL \
      --domain=office.local \
      --ds-password='&lt;DIRECTORY_MANAGER_PASSWORD>' \
      --admin-password='&lt;ADMIN_PASSWORD>' \
      --hostname=ipa1.office.local \
      --ip-address=10.10.10.10 \
      --setup-dns \
      --forwarder=1.1.1.1 \
      --forwarder=9.9.9.9 \
      --reverse-zone=10.10.10.in-addr.arpa. \
      --mkhomedir \
      --no-ntp \
      --unattended
    

    Key flags explained:

    FlagMeaning
    --realm / --domainKerberos realm + DNS zone from §2.1.
    --ds-passwordRoot LDAP (Directory Manager) password.
    --admin-passwordInitial admin superuser.
    --setup-dnsInstall + configure integrated bind.
    --forwarderUpstream resolvers for non-office.local names.
    --reverse-zoneManage PTR records; needed for clean Kerberos.
    --mkhomedirAuto-create /home/<user> on first login (clients).
    --no-ntpWe use chrony already running; prevents conflicts.
    --unattendedNon-interactive; all values from flags.

    5.3 Verify the primary

    kinit admin                          # get a Kerberos ticket
    ipa ping                             # should return IPA server version
    ipa-replica-manage list              # (empty until replica added)
    host ipa1.office.local               # resolves via FreeIPA DNS
    dig _ldap._tcp.office.local SRV      # SRV record published
    

    5.4 Harden the primary

    # Create a named super-admin and disable generic admin for daily use
    ipa user-add sysadmin --first=Sys --last=Admin --password
    ipa group-add-member admins --users=sysadmin
    # Optionally disable generic admin after first named admin verified
    ipa user-mod admin --nsaccountlock=TRUE
    

    6. Installation: Replica (ipa2)

    A replica provides LDAP/Kerberos/DNS/CA redundancy. Clients configured with
    both server IPs keep authenticating if ipa1 fails.

    6.1 Prepare the replica host

    On ipa1, generate a replica promotion file:

    kinit admin
    ipa-replica-prepare ipa2.office.local --ip-address=10.10.10.11
    # Produces /var/lib/ipa/replica-info-ipa2.office.local.tar.gz
    # Copy it to ipa2 (e.g. via scp behind WireGuard).
    

    6.2 Install on the replica

    On ipa2:

    apt update
    apt install -y freeipa-server freeipa-server-dns chrony
    # (host name, NTP, firewall per §4 already done)
    
    ipa-replica-install \
      --setup-dns \
      --forwarder=1.1.1.1 \
      --forwarder=9.9.9.9 \
      /root/replica-info-ipa2.office.local.tar.gz \
      --unattended
    

    6.3 Verify replication

    ipa-replica-manage list             # shows ipa1 &lt;-> ipa2 agreement
    ipa-csreplica-manage list           # CA replication
    ipa host-find                        # both servers listed
    

    Delete the replica-info tarball after success: rm /root/replica-info-ipa2.office.local.tar.gz.


    7. Client Join (Debian 12 workstation)

    7.1 One-time inputs

    InputValue
    RealmOFFICE.LOCAL
    Domainoffice.local
    FreeIPA serversipa1.office.local, ipa2.office.local
    Client DNSpointed at FreeIPA server IPs (DHCP option 6)
    Join principaladmin (or a delegated “join” service account)

    7.2 Join a client

    apt install -y realmd sssd sssd-tools libnss-sss libpam-sss adcli \
      krb5-user oddjob oddjob-mkhomedir packagekit
    
    # Tell realmd where the IPA servers are (via DNS SRV, or explicit):
    realm discover office.local
    
    # Join
    realm join -v --computer-ou="CN=Computers,DC=office,DC=local" \
      --user=admin office.local
    

    7.3 Post-join configuration

    # Use FreeIPA for all lookups
    realm permit --all                      # or realm permit --groups &lt;group>
    # Enable mkhomedir so first login creates /home/&lt;user>
    pam-auth-update --enable mkhomedir
    # Confirm
    id &lt;someuser>@office.local              # should resolve UID/GID
    kinit &lt;someuser>                        # should get a TGT
    
    [domain/office.local]
    ipa_domain = office.local
    ipa_server = _srv_, ipa1.office.local, ipa2.office.local
    ldap_tls_cacert = /etc/ipa/ca.crt
    krb5_store_password_if_offline = true
    cache_credentials = true
    enumerate = false                       # do not list all users (perf)
    

    8. Policy Configuration

    8.1 Password policy

    ipa pwpolicy-mod --minlength=14 --maxlife=90 --minlife=1 \
      --history=5 --maxfail=5 --failinterval=60 --lockouttime=600
    

    8.2 HBAC rules (host-based access control)

    # Deny all by default
    ipa hbacrule-disable allow_all
    # Create role rules
    ipa hbacrule-add --hostcat=host --usercat=user allow_finance
    ipa hbacrule-add-member --hosts=erp1.office.local allow_finance
    ipa hbacrule-add-member --groups=finance allow_finance
    
    ipa hbacrule-add --hostcat=host --usercat=user allow_devops
    ipa hbacrule-add-member --hosts=git1.office.local allow_devops
    ipa hbacrule-add-member --groups=devops allow_devops
    

    8.3 Sudo rules

    ipa sudorule-add sysadmin-sudo
    ipa sudorule-add-allow-command --commands=ALL sysadmin-sudo
    ipa sudorule-add-host --hostcat=all sysadmin-sudo
    ipa sudorule-add-user --group=sysadmin sysadmin-sudo
    

    8.4 User lifecycle

    ActionCommand
    Create useripa user-add jane.doe --first=Jane --last=Doe --password
    Add to groupipa group-add-member finance --users=jane.doe
    Disableipa user-disable jane.doe
    Stage (pre-hire)ipa stageuser-add ... then ipa stageuser-activate
    Deleteipa user-del jane.doe (preserves UID for audit)

    9. Backup & Recovery

    WhatHowCadence
    Full VM snapshotProxmox Backup ServerNightly + before each change
    Online LDAP backupipa-backup --data --online on ipa1Nightly, keep 14 days
    Full IPA backup (with CA)ipa-backup (offline)Weekly
    Replica rebuildPromote a fresh VM via ipa-replica-install from ipa1On-demand
    Disaster recoveryRestore ipa1 VM from PBS, then re-add replicasTested quarterly

    Keep at least one ipa-backup archive offsite (Borgmatic) — it contains the CA private material; without it the realm cannot be fully recovered.


    10. Validation & Acceptance Tests

    Run all of these to sign off the implementation.

    • kinit admin succeeds on ipa1 and ipa2.
    • ipa ping returns from both servers.
    • A joined client can kinit a normal user and ssh into another joined host without a password (GSSAPI).
    • Disabling ipa1 leaves clients still authenticating via ipa2 (kill the VM, confirm logins).
    • HBAC deny_all + a role rule blocks a user from a host they should not reach.
    • Sudo rule grants sysadmin group elevated rights only where defined.
    • ipa user-disable instantly revokes login across all clients (SSSD cache honored).
    • Certificates issued by FreeIPA CA are trusted on a freshly joined client (openssl s_client -connect ipa1:443 validates).
    • DNS SRV records _ldap._tcp, _kerberos._tcp, _kpasswd._tcp.office.local resolve.
    • ipa-backup runs cleanly and the archive can be restored to a test VM.
    • Clock-drift test: stop chrony on a client, skew 6 min, confirm Kerberos login fails (proves NTP dependency).

    11. Operational Runbook (excerpt)

    EventAction
    Add a useripa user-add → assign group → user changes password at first login.
    Add a hostrealm join from the host; it auto-creates a host principal + keytab.
    Promote a new replicaipa-replica-prepareipa-replica-install.
    Rotate Directory Manager passwordipa user-mod for admin; for DM use dsconf / re-run ipa-server-install password tooling; update Vaultwarden.
    Renew certsFreeIPA auto-renews via certmonger; monitor getcert list.
    Decommission a hostipa host-del <fqdn> (revokes keytab).
    Certificate expires/CA issuesipa-cacert-manage + ipa-certupdate on all clients.
    Replica failedipa-replica-manage del <fqdn> on a healthy master, rebuild.

    12. Rollover to the Rest of the Estate

    Once FreeIPA is validated, downstream services consume it:

    • Keycloak — LDAP user federation + Kerberos; all web apps inherit identities.
    • Postfix/Dovecot — LDAP recipient maps + Dovecot auth_ldap.
    • Nextcloud — LDAP/SCIM user backend.
    • Samba (optional) — join as an AD-trust peer if Windows guests need shares.
    • Ansible — inventory reads FreeIPA host groups; playbooks enforce HBAC/sudo state.

    This closes the loop: one directory of truth, one login, one CA, fully open-source.

  • AI Conversation – Part 3 – Regulatory

    Regulatory Frameworks

    Regulatory frameworks like the EU GDPR and the EU AI Act approach corporate algorithmic scoring and automated profiling through two distinct, highly complementary lenses.

    While the GDPR regulates the data powering the decision and grants individuals structural rights to contest it, the EU AI Act regulates the system itself, imposing hard architectural limits and classification barriers based on how much risk the scoring model poses to human rights.

    Here is how both frameworks attempt to check corporate profiling and scoring algorithms:

    1. The EU AI Act: Structural Bans and High-Risk Gates

    The EU AI Act targets algorithmic scoring by dividing AI systems into strict risk tiers, completely outlawing certain types of profiling while placing heavy compliance burdens on others.

    • The Absolute Prohibition on Social Scoring (Article 5): The AI Act explicitly bans AI-enabled social scoring systems—whether deployed by governments or private corporations. If a company builds an algorithm that evaluates or classifies individuals or groups over time based on their social behavior, personality traits, or predicted lifestyle, resulting in detrimental or unfavorable treatment in unrelated contexts (e.g., a corporate algorithm tracking consumer habits to arbitrarily deny housing, insurance access, or employment opportunities), it is outlawed outright.
    • The High-Risk Classification for Credit and HR: Any corporate scoring algorithm used to evaluate creditworthiness, determine credit scores, manage recruitment, filter job applicants, or monitor worker performance is automatically classified as High-Risk.
    • Mandatory Constraints on High-Risk Scoring: To deploy a credit-scoring or worker-evaluation model legally, companies must implement:
    • Data Governance: Rigorous training data protocols to ensure the scoring model doesn’t ingest biased variables that produce discriminatory outcomes.
    • Traceability and Logging: Automatic logging of events and model outputs so auditors can trace why a specific score or denial was generated.
    • Human Oversight: Designing the system so that a human operator can actively review, override, or reverse automated scores before they cause tangible harm to a citizen.

    2. The GDPR: The Right to Explanation and Contestability

    While the AI Act governs the design and deployment of the system, the GDPR governs the personal data processed by that system. It targets automated profiling via foundational rights enshrined in Article 22 (and mirrored in national data protection laws).

    • The Restriction on Solely Automated Decisions: The GDPR traditionally restricts decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects (such as an automated corporate system instantly rejecting a loan or a mortgage).
    • The Right to Meaningful Information: If a corporation uses automated scoring to judge a consumer, the GDPR forces transparency. Companies cannot hide behind “black-box proprietary algorithms.” They must provide meaningful information about the logic involved, the significance of the profiling, and the anticipated consequences.
    • Human Intervention on Demand: Under data protection guardrails, individuals targeted by automated corporate profiling have the enforceable right to demand that a human being look at their case, express their point of view, and contest the algorithmic score.

    The Convergence: Catching the Corporate Black Box

    When combined, these two frameworks dismantle the corporate excuse that “the algorithm decided it.”

    If a company deploys an opaque algorithmic scoring model to evaluate human beings, they face a pincer movement: GDPR forces them to open the black box to the individual user and justify the score, while the AI Act forces them to prove beforehand that the scoring architecture is non-discriminatory, heavily logged, supervised by humans, and clear of prohibited “social scoring” traps.


    Penalties for non-compliance

    Both the EU AI Act and the GDPR use a “whichever is higher” formula for financial penalties—calculating the maximum fine using a flat baseline cash cap or a percentage of a corporation’s total worldwide annual turnover, whichever yields the greater amount.

    For multinational technology corporations, the percentage-based global turnover caps dwarf the flat sums, exposing them to billions in potential losses.

    1. The EU AI Act Penalties

    The EU AI Act structures its maximum penalties into a tiered pyramid based on the severity of the violation. Breaches involving banned practices or data governance failures carry the harshest teeth ever written into European tech regulation.

    • Tier 1: Prohibited AI Practices (e.g., Social Scoring & Behavioral Manipulation)
      • Applies to: Deploying banned systems like citizen social-scoring algorithms, subliminal manipulation, or exploitative biometric categorization.
      • Maximum Penalty: Up to €35 million or 7% of the company’s total worldwide annual turnover (whichever is higher).
      • Context: This 7% ceiling explicitly exceeds the GDPR’s maximum cap, specifically designed to ensure tech giants cannot absorb fines as a mere cost of doing business.
    • Tier 2: High-Risk AI Obligations & Transparency Failures
      • Applies to: Violating compliance mandates for high-risk systems (such as corporate credit-scoring algorithms, recruitment filters, or biometric tools) or failing transparency requirements.
      • Maximum Penalty: Up to €15 million or 3% of global annual turnover (whichever is higher).
    • Tier 3: Procedural Integrity & Misleading Authorities
      • Applies to: Supplying incorrect, incomplete, or misleading information to national competent authorities or notified bodies during audits.
      • Maximum Penalty: Up to €7.5 million or 1% of global annual turnover (whichever is higher).

    2. The GDPR Profiling & Data Protection Penalties

    Under GDPR (Article 83), fines are similarly split into two tiers depending on which core rights or principles were violated. Unlawful automated profiling, lack of a lawful basis for tracking consumer behavior, or ignoring data subject rights fall squarely into the higher tier.

    • Upper Tier: Serious Infringements (e.g., Unlawful Profiling & Consent Violations)
      • Applies to: Breaching fundamental processing principles, running automated profiling without a valid legal basis, violating user rights (Articles 12–22), or executing illegal international data transfers.
      • Maximum Penalty: Up to €20 million or 4% of total worldwide annual turnover (whichever is higher).
      • Real-World Precedent: This tier has driven massive historical enforcement actions against major tech firms, such as Ireland’s DPC issuing a €310 million fine to LinkedIn for unlawful behavioral profiling and targeted advertising.
    • Lower Tier: Administrative & Governance Breaches
      • Applies to: Technical security failures, failure to maintain adequate records of processing activities, or failing to notify a supervisory authority of a data breach within 72 hours.
      • Maximum Penalty: Up to €10 million or 2% of total worldwide annual turnover (whichever is higher).

    The Cumulative Regulatory Pressure

    When corporations deploy automated scoring and profiling systems that cross legal boundaries, they do not just face single-file fines. Regulators routinely issue concurrent penalties—hitting a company simultaneously under GDPR for unlawful personal data profiling and under the AI Act for non-compliant, high-risk algorithmic architecture. For a global enterprise, a systemic failure in its scoring models can trigger combined turnover-pegged penalties reaching up to 11% of global annual revenue.


    Auditing the Blackbox

    Auditing complex neural networks and proprietary scoring algorithms—the ultimate “black boxes”—presents a massive technical hurdle. If a model consists of hundreds of billions of opaque weights distributed across a high-dimensional vector space, a human regulator cannot simply read the source code to find a violation.

    To bypass this, European regulators (operating through the European AI Office, national market surveillance authorities, and independent Notified Bodies) do not just try to reverse-engineer the math line-by-line. Instead, they approach the audit through a combination of structural compliance mandates, systematic behavioural probing, and cryptographic logging.

    The auditing toolchain relies on three core operational strategies:

    1. White-Box Documentation & Data Governance (Before Deployment)

    Under the EU AI Act and GDPR, the easiest way to prove a violation is to inspect what the corporation built before the model ever touched live data. Regulators bypass the black box by forcing companies to open their engineering notebooks.

    • Data Provenance and Training Audits: Under Article 10 of the AI Act, providers of high-risk scoring systems must prove the datasets used to train the model were representative, clean, and free of systemic bias. Auditors inspect the version-controlled records of data-cleaning steps, gap analyses, and labeling protocols. If a credit-scoring algorithm discriminates against a protected class, regulators trace it straight back to biased training data.
    • The Technical Documentation Dossier (Annex IV): Companies must legally submit comprehensive documentation detailing the system’s architecture, optimization objectives, hardware requirements, and the logic behind its classification thresholds. If the deployed model behaves differently than what was documented, the provider faces immediate fines for deceptive compliance.

    2. Behavioral Probing and Counterfactual Testing (Black-Box Audits)

    When regulators or independent researchers test an active system (such as a corporate hiring filter or insurance scoring engine), they rely on behavioral and counterfactual probing.

    Instead of looking inside the model, they systematically manipulate inputs and observe the statistical outputs to map the hidden decision boundaries:

    • The Sock-Puppet Audit: Auditors generate hundreds of synthetic profiles with identical financial or professional credentials—varying only a protected characteristic (such as gender, ethnic indicator, or zip code). If the automated scoring model systematically assigns lower trust scores or loan approvals to one demographic, the statistical disparity serves as empirical proof of algorithmic discrimination.
    • Adversarial Stress-Testing: Regulators inject edge-case inputs designed to force the model to fail or reveal hidden biases, testing whether the system maintains robustness against manipulation or generates unauthorized profiling metrics.

    3. Automated Event Logging and Traceability (The Flight Data Recorder)

    Neural networks may be non-deterministic and opaque, but the infrastructure running them is completely deterministic.

    Article 12 of the EU AI Act mandates that high-risk AI systems must feature automatic logging capabilities throughout their entire operational lifecycle.

    • System Telemetry: The hosting servers must maintain secure, immutable logs recording every significant event: inputs received, confidence scores generated, system errors, and triggers for human oversight intervention.
    • Reconstructing the Decision Path: If a citizen files a grievance claiming an illegal automated profiling decision, regulators do not need to understand every neural weight. They pull the system logs for that specific transaction to reconstruct the exact data state, feature weights, and threshold triggers that produced the negative score.

    The Ultimate Regulatory Checkmate

    The genius of these frameworks is that they convert an impossible computer science problem (explaining a trillion-parameter neural network) into a strict legal liability framework.

    A corporation can no longer hide behind the defense that “the AI is a black box and we don’t know why it made that decision.” Under EU regulation, if a proprietary scoring algorithm produces an unlawful discriminatory outcome or violates profiling restrictions, the opacity of the model is not an excuse—it is a regulatory violation in itself.


    Open Source

    The European Union’s AI Act approaches open-source foundational models (such as Meta’s Llama or Mistral AI’s open-weight releases) with a specific, highly nuanced distinction: it grants partial exemptions to the model provider based on licensing, but it offers zero immunity to the deployer who puts that model to work.

    The regulatory treatment of these models maps directly onto your classification framework. The EU realized that penalizing open-weight models with heavy bureaucratic friction would kill the open-source ecosystem, yet it could not allow powerful models to escape accountability entirely.

    1. The Four-Pronged Open-Source Exemption Test

    Under Article 53(2) of the AI Act, providers of General-Purpose AI (GPAI) models are granted a partial exemption from certain administrative burdens, but only if their models satisfy four strict conditions:

    1. True Open-Source License: Released under a free and open-source license (e.g., Apache 2.0, MIT) that permits access, usage, modification, and redistribution. (Licenses with “research-only” or restrictive commercial clauses do not qualify).
    2. Publicly Available Weights: The actual model parameters (weights) must be public—”open architecture, closed weights” models do not qualify.
    3. Architectural Transparency: Information concerning the model’s architecture must be publicly released.
    4. Usage Documentation: Clear documentation on model usage must be accessible.

    If a model like Mistral or an open-weight Llama variant meets these criteria, the provider is exempt from two major administrative duties:

    • They do not have to generate and maintain exhaustive internal technical documentation specifically formatted for EU regulatory bodies (Annex XI).
    • They do not have to supply proprietary downstream documentation packages to every enterprise integrator who builds on top of their model (Annex XII).

    2. The Non-Negotiable Baseline (What Open-Source Cannot Escape)

    Even if a model is fully open-source and satisfies all four conditions, two obligations can never be waived:

    1. Copyright Compliance: The provider must maintain an explicit policy ensuring compliance with EU copyright law, specifically respecting machine-readable rights reservations (like web-crawler blocks and robots.txt protocols) used during training.
    2. Training Data Summaries: The provider must publish a sufficiently detailed, standardized summary of the content used to train the model.

    3. The “Systemic Risk” Ceiling (The Compute Threshold)

    The open-source exemption operates as a sliding scale that instantly snaps shut if a model crosses a critical capability threshold.

    The AI Act establishes that any GPAI model trained using a cumulative compute power greater than $10^{25}$ FLOPs (Floating-Point Operations) is automatically classified as a Model with Systemic Risk.

    • When frontier open-source models scale up to or past this threshold, the open-source exemption vanishes entirely.
    • They are subjected to the full suite of systemic risk obligations: mandatory adversarial red-teaming, rigorous tracking and reporting of serious incidents, cybersecurity evaluations, and structural energy-consumption reporting.

    4. The Deployer Trap: Where the Exemption Stops

    The most crucial rule of the EU AI Act regarding open-source models is this: The license on the model governs the developer, but the use case governs the deployer.

    If a bank, a hospital, or an enterprise downloads an open-weight Llama model from Hugging Face under a completely free Apache 2.0 license and integrates it into a High-Risk AI System (such as credit scoring, biometric categorization, or recruitment filters), the open-source nature of the underlying model provides zero legal protection.

    The enterprise deploying the model inherits the full weight of the High-Risk obligations:

    • They must establish rigorous risk-management systems.
    • They must guarantee data governance and mitigate algorithmic bias.
    • They must ensure immutable event logging.
    • They must bake in active human oversight.

    The Verdict on Open-Source Regulation

    The EU AI Act treats open-source foundational models as raw infrastructure—similar to how a traditional legal system treats a public highway or a block of steel. The person who mines the steel (the model creator) gets a break on documentation, but the person who builds a vehicle out of it and drives it on public roads (the deployer) is held strictly accountable for its safety.


    Model Tuning

    If an enterprise fine-tunes an open-source model like Llama for internal use, does that enterprise legally become the ‘provider’ of a new AI system under the EU AI Act?

    Under the EU AI Act, the short answer is no, not usually—standard internal fine-tuning does not automatically make an enterprise the “provider” of a General-Purpose AI (GPAI) model. For most routine customisations, the enterprise remains legally classified as a deployer.

    However, the law establishes a precise, mathematical boundary where minor customisation ends and “substantial modification” begins.

    The regulatory test governing whether an enterprise fine-tuning an open-source model like Llama inherits provider obligations relies on the following criteria:

    1. The Standard Rule: Fine-Tuning is Not “Developing”

    The European Commission’s guidelines clarify that adapting, prompting, quantising, or performing standard parameter-efficient fine-tuning (like LoRA or standard instruction-tuning) on an existing open-source model does not make you the model provider.

    If your internal fine-tuning falls within the scope of what the upstream creator (e.g., Meta) originally anticipated or permitted in their technical documentation, you are treated as a downstream deployer. Your legal duties are limited to using the model responsibly, ensuring human oversight if deployed in a high-risk context, and respecting transparency rules—you do not have to recreate upstream GPAI technical documentation or training data summaries.

    2. The Exception: The “One-Third” Compute Rule (Substantial Modification)

    The line between a deployer modifying a model and becoming a new provider is measured by computational weight—specifically, floating-point operations (FLOPs):

    • If your fine-tuning process consumes cumulative compute resources that exceed one-third (33%) of the original model’s base pre-training compute, the EU AI Act presumes you have substantially altered the model.
    • For a massive model like Llama, 33% of its original pre-training compute is an astronomical amount of energy. Routine, targeted enterprise fine-tuning on internal clusters rarely comes close to touching this threshold.

    If an enterprise does cross that one-third compute threshold through heavy, foundational retraining, it legally crosses the boundary and becomes a GPAI provider for that newly modified version.

    3. The “Internal Use” Catch (The Deployment Context)

    Even if your fine-tuning stays well below the compute threshold and you avoid becoming a GPAI model provider, the intended use of that fine-tuned model still dictates your legal reality.

    If an enterprise fine-tunes Llama entirely for internal use (e.g., an internal document search or code assistant), it avoids many external-facing burdens. However, if that same fine-tuned internal model is integrated into a High-Risk AI System (such as an automated recruitment filter screening incoming job resumes, or an internal credit-scoring tool for applicants), the enterprise instantly inherits all strict High-Risk deployer obligations under the Act—regardless of whether it fine-tuned the model or downloaded it straight off Hugging Face.

    When an enterprise takes a fine-tuned, open-source model (like a custom version of Llama) and deploys it in a high-risk context (such as automated recruitment, credit scoring, biometric identification, or essential public services), it triggers Article 26 of the EU AI Act.

    Because the enterprise is acting as a deployer rather than the original foundation model provider, its duties shift from building the architecture to governing its operational safety, oversight, and traceability.

    The specific documentation and risk-management duties mandated by the EU framework include:

    1. Fundamental Rights Impact Assessment (FRIA)

    Before putting the fine-tuned model live in a high-risk scenario, certain deployers (including private entities providing public services or operating in sensitive sectors like credit scoring and insurance pricing) must conduct and document a Fundamental Rights Impact Assessment (FRIA).

    • What it requires: A formal evaluation mapping out how the AI model will impact the fundamental rights (e.g., non-discrimination, privacy, worker dignity) of the individuals it interacts with.
    • Administrative duty: This assessment must be registered in the EU database before the system is put into service.

    2. Mandatory Human Oversight (The “Kill Switch” Mandate)

    Deployers cannot let a high-risk fine-tuned model operate autonomously without human-in-the-loop safeguards.

    • What it requires: The enterprise must assign natural persons to oversee the system who possess the necessary competence, training, authority, and support.
    • Operational duty: Overseers must be positioned to fully understand the model outputs, disregard or override automated decisions when necessary, and have the technical ability to halt or pause the system instantly if an anomaly or systemic bias appears.

    3. Rigorous Input Data Governance

    Even if the upstream open-source model was trained on general internet data, the enterprise controls the local input data fed into the fine-tuned model during deployment.

    • What it requires: To the extent the enterprise exercises control over the input data, it must ensure that data is relevant, representative, and cleansed of historical biases that could trigger discriminatory automated profiling.

    4. Automated Event Logging (The Flight Recorder)

    Neural networks are non-deterministic, but the infrastructure running them must be fully auditable.

    • What it requires: Under Article 26(6), deployers must ensure that the logs automatically generated by the high-risk AI system are retained for a minimum of six months (unless superseded by sector-specific financial or data protection laws like GDPR).
    • Auditing duty: These logs must be kept under the enterprise’s control so that regulators or auditors can reconstruct the exact feature weights, inputs, and thresholds that triggered a specific decision.

    5. Post-Market Monitoring and Incident Reporting

    Deployers cannot simply launch a fine-tuned model and walk away.

    • What it requires: The enterprise must continuously monitor the operation of the system based on the provider’s instructions for use.
    • The Escalation Trigger: If the enterprise identifies a serious incident (e.g., a catastrophic bias cascade, systematic discrimination, or a failure threatening fundamental rights), it must immediately suspend use of the system and notify both the original provider and the relevant national market surveillance authority.

    6. Transparency and Worker Notification

    If the fine-tuned model is deployed internally for workforce management or recruitment:

    • What it requires: The enterprise must explicitly inform workers’ representatives and affected employees before they are subjected to the high-risk AI system, adhering strictly to labor consultation rules.

    AI & GDPR compliance

    The intersection between the EU AI Act’s Fundamental Rights Impact Assessment (FRIA) (Article 27) and the GDPR’s Data Protection Impact Assessment (DPIA) (Article 35) represents one of the most critical compliance overlaps for enterprises deploying AI systems.

    Because almost every high-risk AI application (like automated recruitment, credit scoring, or worker monitoring) processes personal data, enterprises routinely find themselves triggering both assessments simultaneously.

    Rather than treating them as isolated silos, the European Union designed the frameworks to interact through structural bridges, overlapping scopes, and explicit legal linkages.

    1. Scope and Focus: Data Privacy vs. Total Human Rights

    To understand how they intersect, you first have to look at what each assessment is built to evaluate:

    • The GDPR DPIA (Article 35): Narrower, deeper, and strictly focused on information privacy and data protection rights. It asks: How does processing personal data impact an individual’s privacy, data security, and informational self-determination? It evaluates necessity, proportionality, data minimization, and technical safeguards.
    • The AI Act FRIA (Article 27): Broader and focused on holistic fundamental rights. It asks: How does the deployment of this automated system impact human dignity, non-discrimination, worker rights, freedom of expression, and access to essential services? Data privacy is just one small slice of a FRIA.

    2. The Direct Legal Bridge (Article 27(4))

    The EU explicitly anticipated the administrative nightmare of forcing companies to run two entirely separate bureaucratic processes for the same software.

    Under Article 27(4) of the AI Act, the law provides a legal reuse mechanism:

    • If an enterprise has already conducted a DPIA under Article 35 of the GDPR, it can re-use and integrate those findings directly into its FRIA.
    • Because a DPIA already maps out data flows, system logic, and data-privacy risks, it serves as the foundational data-architecture chapter of the broader Fundamental Rights Impact Assessment.

    3. Key Differences in Operational Requirements

    While they can be merged or cross-referenced, a standard GDPR DPIA cannot simply be copy-pasted to satisfy a FRIA. A FRIA demands metrics that a data protection assessment completely ignores:

    RequirementGDPR DPIA (Article 35)EU AI Act FRIA (Article 27)
    Primary TriggerHigh risk to data privacy/freedoms via personal data processing.Deployment of a High-Risk AI system (regardless of underlying data nuances).
    Core FocusLawfulness, minimization, security, and storage limits of personal data.Societal harm, systemic bias, socio-economic exclusion, and discrimination.
    Human OversightEvaluates if staff are trained on privacy rules.Maps out operational protocols for the human “kill-switch”—ensuring overseers can actually override or halt the AI.
    Stakeholder MappingMaps data subjects.Explicitly maps vulnerable groups or communities likely to be impacted by the system’s decisions.
    Time/Frequency ScopeFocuses on data life-cycle and retention periods.Focuses on the duration, frequency, and operational context of the system’s active deployment.

    4. The Unified Compliance Workflow in Practice

    In an enterprise environment, compliance officers do not treat these as two separate tasks. Instead, they run an Integrated Impact Assessment structured around the following timeline:

    1. Phase 1 (The GDPR Base): The data protection officer (DPO) maps out the data flows, ingestion pipelines, storage limits, and privacy risks, completing the DPIA.
    2. Phase 2 (The AI Act Extension): The compliance team takes that data-flow foundation and expands it into a FRIA. They evaluate how the model’s outputs affect human dignity, test for demographic bias (counterfactual probing), outline the exact procedures for human oversight, and identify vulnerable groups who might be harmed by a false classification.
    3. Phase 3 (Filing and Registration): For high-risk systems, the completed impact assessment package (incorporating both the DPIA data metrics and the FRIA fundamental rights analysis) is logged into the EU database or made available to national market surveillance authorities upon request.

    By merging the two, enterprises avoid redundant paperwork while satisfying the dual demand of protecting both data privacy (GDPR) and systemic human rights (AI Act).

  • The Silent Search

    On the Probability, Semiotics, and Politics of Detecting Extraterrestrial Intelligence


    I. The Universal Language That Isn’t

    There is a story we tell ourselves about first contact, and it goes like this: mathematics is the universal language. Any sufficiently advanced civilisation, regardless of its biology, its sensory apparatus, its evolutionary history, will have discovered the same primes, the same geometric constants, the same physical relationships. If we want to speak to the stars, we encode mathematics, because mathematics is what we share. It is the lingua franca of the cosmos, the one thing that is true everywhere and independent of the speaker.

    This is a cultural claim dressed as a scientific one. It is, more precisely, a semiotic claim, a claim about the relationship between signs, meaning, and minds, and it has rarely been examined as one.

    The discipline that would examine it is semiotics: the study of how meaning is made, transmitted, and received. Semiotics, in the tradition of Charles Sanders Peirce, holds that a sign requires three things, a sign vehicle (the physical form of the sign, the signal itself), an object (the thing the sign refers to), and an interpretant (the meaning constructed by the receiver). A sign is not a sign in itself; it is a sign only in the act of interpretation. Meaning does not reside in the signal. It is constructed, by the receiver, from the signal, using the only tool available: context.

    This matters more than it might seem. When we say that mathematics is universal, we are making a claim about the sign vehicle, that the same mathematical structures will be independently discovered by any intelligence. This is plausible, though not as certain as we like to think; even mathematics, as a human practice, is shaped by culture, by language, by the contingent history of the species that produced it. The ancient Greeks did geometry differently from the medieval Islamic mathematicians, who did it differently from the calculus tradition that emerged in Europe. These are not different mathematics, the relationships are the same, but they are different semiotic systems, different ways of encoding and interpreting the same underlying structures. If mathematics were truly transparent, if the sign vehicle mapped unambiguously to the object, then mathematical notation would not have a history. It does.

    But the deeper problem is not at the level of the sign vehicle. It is at the level of the interpretant. Even if an extraterrestrial intelligence has discovered the same mathematical relationships, the meaning they construct from a signal encoding those relationships depends on their context, their biology, their sensory world, their temporal experience, their cognitive architecture. A signal that encodes prime numbers, for us, means “intelligence, because primes are a non-natural pattern that requires a mind to generate.” This interpretation depends on a chain of assumptions: that the receiver recognises primality as a non-natural pattern; that they associate non-natural patterns with intelligence; that they associate intelligence with communication; that they associate communication with the intent to be understood. Each of these is a cultural inference, grounded in the specific semiotic world of a species that evolved on a particular planet with a particular evolutionary history.

    The Estonian biologist Jakob von Uexküll coined the term Umwelt to describe the perceptual world inhabited by an organism, the specific slice of reality available to it through its particular sensory and cognitive apparatus. A tick’s Umwelt consists of temperature, light, and the smell of butyric acid. A bat’s Umwelt is built from echolocation. A human’s Umwelt is built from vision, hearing, and a peculiar cognitive architecture that is, as far as we know, unique: the capacity for recursive symbolic thought, which has produced language, mathematics, and the stories we tell about the stars.

    The assumption underlying SETI, the Search for Extraterrestrial Intelligence, is that the Umwelt of a technological alien species would overlap sufficiently with ours that a signal meaningful in one would be meaningful in the other. This is an assumption, not a fact. We have no evidence for it, because we have no data. We have one data point: ourselves. And the one data point we have is not a sample; it is a case study, and a case study of one tells you nothing about the distribution of the population from which it is drawn.


    II. The Imperative of Life

    There is a second assumption, deeper and less examined than the first, that underlies the entire enterprise. It is the assumption that life, once it arises, tends toward intelligence, and that intelligence, once it arises, tends toward communication, and that communication, once it is possible, tends toward the stars. This is a narrative of progress, a kind of cosmic teleology, and it is, in its structure, remarkably similar to the Great Chain of Being, the medieval concept that all of creation is arranged in a hierarchy from the lowest to the highest, with humanity (naturally) near the top. We have secularised the Great Chain. We no longer place God at the top. We place technological civilisation there instead, and we assume that the universe, if it contains life at all, will produce civilisations like ours, because ours is the natural endpoint of the chain.

    This is not what the observable facts suggest.

    The observable facts are these. Life on Earth arose approximately 3.8 billion years ago, possibly earlier. For the first 2.5 billion years of that history, more than half the planet’s lifetime, life consisted of single-celled organisms. Multicellularity arose perhaps 600 million years ago. Complex multicellular life, with differentiated tissues and organs, arose perhaps 550 million years ago. The first animals appeared in the Cambrian, roughly 540 million years ago. From the Cambrian to the present, life on Earth has experienced at least five major mass extinction events, each of which reset the trajectory of evolution and eliminated a significant fraction of existing species.

    Intelligence, in the sense relevant to SETI, which is to say, intelligence capable of building technology capable of transmitting or receiving interstellar signals, has arisen exactly once in 3.8 billion years. Not twice. Not in multiple lineages. Once. In a single species, Homo sapiens, which has existed for approximately 300,000 years and has been technologically capable of radio transmission for approximately 120 years.

    Let us sit with those numbers. 3.8 billion years of life. One instance of the kind of intelligence we are searching for. 120 years of the kind of technology we are searching with. The fraction of life’s history on this planet during which it has been detectable by the methods SETI uses is approximately:

    120 / 3,800,000,000 ≈ 3.2 × 10⁻⁸

    Three ten-millionths of the time life has existed. And that is the fraction for our own planet, where we know life exists. For any other planet, we do not even know whether life exists, let alone intelligence, let alone technology.

    This is not an argument that life is rare. It is an argument that the specific thing SETI is searching for, a technological civilisation, producing detectable electromagnetic signals, during the narrow window in which we are listening, is, on the evidence available to us, vanishingly improbable. Not impossible. Not absent. But the probability is not a number we can calculate, because we have one data point, and one data point cannot populate a distribution.

    What we can say is this: the assumption that intelligence is convergent, that it arises independently in many lineages the way that eyes have evolved independently dozens of times, is not supported by the evidence. On Earth, we have many examples of social complexity (eusocial insects, cetaceans, elephants, corvids, cephalopods), many examples of tool use (chimpanzees, crows, otters, dolphins), many examples of cognitive sophistication (parrots, octopuses, pigs, dogs). We have exactly one example of technology-building intelligence. Eyes have evolved independently because light is a physical constant and the selective advantage of detecting it is overwhelming. Technology-building intelligence is not eyes. It is a specific, contingent, historically bounded phenomenon that arose in a specific lineage under specific conditions, and the evidence that it is a convergent adaptation, that it arises reliably, like vision, wherever the conditions permit, is, at present, zero.

    This does not mean it is rare. It means we do not know. And the not-knowing is the honest position, and the not-knowing is the position that the SETI industry, as a matter of institutional logic, cannot afford to occupy.


    III. The Signal Problem, What We Are Actually Looking For

    Setting aside the semiotic and philosophical questions, let us consider the physics. What would it actually take to detect an extraterrestrial signal?

    The problem has three components: attenuation, noise, and coincidence.

    Attenuation

    Electromagnetic radiation propagates according to the inverse square law. A signal that leaves a transmitter with power P will arrive at a distance d with power density P / (4πd²). At interstellar distances, this is a brutal fact. A signal transmitted from a star 6,000 light-years away, roughly the distance to the Cygnus arm, a reasonable estimate for the scale of any plausible target, arrives at Earth with a power density that is a factor of roughly 10⁻¹⁵ of its transmitted value. To detect a signal at that distance, the transmitter must either emit with enormous power or beam the signal tightly in our direction.

    A tight beam is energy-efficient but covers a tiny fraction of the sky. The beamwidth of a transmitting antenna is inversely proportional to the ratio of the antenna’s diameter to the wavelength. To beam a signal at 1.42 GHz (the hydrogen line, a popular SETI frequency) to a target the size of the Earth’s orbit from a transmitter 6,000 light-years away requires an antenna with an effective diameter of approximately 500,000 kilometres, larger than any structure any civilisation we can imagine could build, unless it is distributed across a solar system. And even then, the beam would only reach the Earth if the transmitter knew exactly where the Earth was and was pointed at it with precision.

    The alternative is an omnidirectional beacon, a signal broadcast in all directions, detectable from any point in the sky. But an omnidirectional signal at interstellar distances requires power that beggars the imagination. A signal detectable by the Arecibo telescope (when it existed) at 1,000 light-years, broadcast omnidirectionally, would require a transmitter power of approximately 10¹⁵ watts, roughly 100 times the total current electrical generating capacity of human civilisation. At 6,000 light-years, the requirement scales by a factor of 36, to roughly 3.6 × 10¹⁶ watts, a significant fraction of the total solar output intercepted by the Earth.

    This is not impossible. A civilisation that has access to the energy of a star, a Kardashev Type II civilisation, which is the kind that science fiction routinely assumes, could, in principle, broadcast omnidirectionally at interstellar distances. But we are now no longer doing science. We are doing speculation, and the speculation is unconstrained by any observation, which means it is, in Karl Popper’s sense, unfalsifiable, which means it is not, strictly speaking, science at all.

    The attenuation problem means that the vast majority of plausible transmission scenarios are undetectable. A civilisation that is broadcasting toward us, with a beam pointed at our solar system, using a power level we could detect, at a frequency we are monitoring, at a time we are listening, is a civilisation that is, by construction, very similar to us in its assumptions about how communication works. We are, in effect, searching for ourselves.

    Noise

    The universe is loud. The cosmic microwave background provides a floor of approximately 2.7 K of thermal noise at all frequencies. Galactic synchrotron radiation adds frequency-dependent noise that is particularly strong at lower frequencies. Earth’s atmosphere emits thermal noise. The receiver itself contributes thermal noise, quantified by its system temperature. And, increasingly, our own civilisation contributes radio frequency interference, satellites, radar, broadcast transmitters, industrial equipment, that contaminates the very frequencies we are searching for.

    The signal-to-noise ratio determines detectability. A signal is detectable only if it is significantly stronger than the noise floor integrated over the observation time. For a narrowband signal, the kind SETI traditionally searches for, because a narrowband signal is an indicator of engineering, of a transmitter that has been deliberately designed, the noise in a single frequency bin is proportional to the system temperature divided by the integration time. Longer observations reduce noise, but longer observations cost more telescope time, and telescope time is the scarcest resource in the SETI enterprise.

    The “water hole”, the band of frequencies between the hydrogen line (1.42 GHz) and the hydroxyl line (1.66 GHz), is relatively quiet, because galactic background noise decreases with frequency and the atmosphere is transparent in this range. The choice of the water hole is, however, a semiotic choice: it assumes that an alien civilisation would choose to broadcast in this band for the same reasons we would choose to listen in it. The reasoning is that hydrogen and hydroxyl are the components of water, and water is the solvent of life (as we know it), and therefore the band between them is a “cosmic meeting place”, a frequency band that any water-based life would find significant.

    This is a lovely idea. It is also, in its structure, an argument from analogy: we find the hydrogen line significant because hydrogen is the most abundant element in the universe and its spectral line is a natural reference frequency. We assume that an alien intelligence would find it significant for the same reasons. But the significance is not in the frequency; it is in the interpretation. And the interpretation depends on the interpretant, which depends on the Umwelt, which depends on the species.

    Temporal Coincidence

    A civilisation must be transmitting during the window in which another civilisation is listening. We have been listening, in one form or another, for approximately 60 years. If technological civilisations have lifetimes of, say, 10,000 years (a number chosen for illustrative purposes, because we have no basis for choosing any number), and if they arise at some rate per galaxy per unit time (a rate we cannot estimate because we have one data point), then the probability of temporal overlap depends on the ratio of the combined listening-and-transmitting window to the total time available. If both civilisations are rare and short-lived, the probability of overlap is small. If both are common and long-lived, it is large. We do not know which, and the range of plausible values spans many orders of magnitude.

    The one observable fact we have is that we have been listening for 60 years and have heard nothing. This is a null result, and null results in science are informative but notoriously difficult to interpret. A null result can mean the phenomenon does not exist. It can mean the phenomenon exists but is below the detection threshold. It can mean the phenomenon exists and is detectable but we are looking in the wrong place, at the wrong frequency, at the wrong time, or with the wrong assumptions. The history of science is rich with null results that were, in retrospect, failures of imagination rather than failures of the phenomenon, the Michelson-Morley experiment, the early null results in the search for exoplanets, the decades of null results in gravitational-wave detection before LIGO.

    But the history of science is also rich with null results that were, in retrospect, correct: the search for the ether, the search for Vulcan, the search for N rays. The difference between a null result that precedes a detection and a null result that confirms an absence is visible only in retrospect, and we are not in retrospect. We are in the present, and the present is ambiguous.


    IV. The Semiotic Trap

    Here is the trap, and it is a semiotic one: we cannot search for a signal without a model of what a signal looks like. And our model of what a signal looks like is, inescapably, a model of what our signal would look like. We search for narrowband carriers because we build narrowband carriers. We search in the water hole because we find the water hole significant. We search for prime numbers because we see primes as a signature of intelligence. We search for structured, repetitive, obviously non-natural patterns because structured, repetitive, obviously non-natural patterns are what we produce when we want to be noticed.

    The logic is circular, and the circularity is not a flaw that can be engineered away. It is structural. To search is to assume. To assume is to project. To project is to search for yourself.

    This is not an argument against searching. It is an argument for understanding what searching means, and for being honest about the fact that a null result in a search conditioned on a model that is derived from a sample of one tells you only that the model’s specific predictions are not confirmed. It does not tell you that the phenomenon is absent. It does not tell you that the model is wrong. It tells you nothing, in the strict statistical sense, because the prior is unconstrained and the likelihood is dominated by assumptions that are not testable.

    The semiotic literature has a term for the specific kind of error this produces: abduction, as defined by Peirce, is the process of inferring the best explanation for an observation. SETI is not, in practice, abductive; it is hypothetical-deductive. We hypothesise a model of alien communication, deduce what the signal would look like, and search for it. When we do not find it, we do not revise the hypothesis, we refine the search. We build more sensitive receivers. We search more frequencies. We observe more stars. The hypothesis, that a technological civilisation would produce a signal recognisable to us, is never tested, because it cannot be tested. It is the precondition of the search, not a result of it.

    The Italian semiotician Umberto Eco, in his work on the limits of interpretation, argued that a text can be interpreted in an unbounded number of ways, but not all interpretations are equally valid. The constraint on interpretation is the text itself, the sign vehicle, but also the community of interpreters, the shared context that makes some readings plausible and others not. For SETI, the “text” is the signal (if one exists), and the “community of interpreters” is the scientific community of Earth. The constraint on our interpretation is our own semiotic world, our physics, our mathematics, our engineering, our cultural assumptions about what communication is and why beings communicate. We cannot step outside this constraint. We can only be aware of it.


    V. The One Data Point

    Let us return to the observable facts, because they are all we have, and they deserve more respect than they typically receive.

    We know that life exists on at least one planet. We know that, on that planet, life has produced one technological civilisation. We know that that civilisation has been capable of radio transmission for approximately 120 years. We know that, during those 120 years, the civilisation has not deliberately broadcast a continuous, high-power, omnidirectional signal intended for reception by other stars. (We have sent short, targeted messages, the Arecibo message in 1974, the more recent Breakthrough Message competition, but these are not continuous beacons and would not be detectable by a civilisation like ours at interstellar distances.)

    This last fact is, in the context of SETI, almost never discussed. If we are the model for what a technological civilisation does, then the model predicts that a technological civilisation does not broadcast. It listens. It searches. It does not transmit, or it transmits only sporadically and with low power, in short bursts, toward specific targets.

    The implication is uncomfortable. If the one civilisation we know does not behave the way SETI assumes civilisations behave, i.e., continuously broadcasting detectable signals, then the search is predicated on a model that is contradicted by the only available data. We are searching for a behaviour that we ourselves do not exhibit.

    There are responses to this. The most common is that we are young, technologically, and that older civilisations would have moved beyond the listening phase into the broadcasting phase. This is plausible. It is also unfalsifiable, because we have no older civilisation to observe. Another response is that we are, in fact, broadcasting, our radio, television, and radar emissions leak into space continuously, and have been doing so for a century. This is true, but the power of these leaked signals at interstellar distances is far below the detection threshold of any plausible receiver. A civilisation like ours, at 1,000 light-years, would not be detectable by our own instruments. The leakage is real but too faint to be the signal we are searching for.

    The third response is the one that the semiotic analysis suggests: that we are not broadcasting because broadcasting, as a strategy for interstellar communication, does not make sense. The energy costs are prohibitive. The probability of being heard is unknown. The temporal coincidence required is, on any reasonable estimate, small. And the assumption that another civilisation would be listening, in the same frequency band, with the same model of what a signal looks like, during the same century, is a tower of assumptions, each individually uncertain, that collectively approaches the kind of improbability that, in any other scientific context, would be treated as fantasy.


    VI. The SETI Industry

    SETI has existed, as a formal enterprise, since 1960, when Frank Drake conducted Project Ozma, the first systematic radio search for extraterrestrial signals, using the 26-metre radio telescope at Green Bank, West Virginia. Drake listened to two stars, Tau Ceti and Epsilon Eridani, for a total of approximately 150 hours, at a single frequency (1.42 GHz), and heard nothing. The search has grown since then, in telescope size, in frequency coverage, in target number, in computational sophistication. It has not, in sixty years, found anything.

    This is not a failure, or not only a failure. It is a fact, and the fact has a context: the search space is vast, and the fraction of it we have explored is small. Jill Tarter, the longtime director of the Center for SETI Research, compared the explored volume of SETI’s search space to a glass of water taken from the ocean. If you take one glass of water from the ocean and find no fish, you have not proven that the ocean contains no fish. You have proven that this glass of water contains no fish. The ocean is large.

    The metaphor is apt, and it is also, in its way, a defence of the enterprise against its own null results. The ocean is large. We have sampled a glass. The absence of fish in the glass is not evidence of the absence of fish in the ocean. This is true. It is also, in a practical sense, the kind of argument that can be used to justify indefinite searching, because the ocean is always larger than the glass, and the glass can always be refilled, and the fish can always be somewhere else.

    The question is not whether the search should continue. The question is what the search costs, and what it produces, and whether the cost and the production are in a relationship that is sustainable or honest.

    Funding

    SETI has historically been funded by a mix of NASA, the National Science Foundation, and private sources. NASA’s funding for SETI was terminated by Congress in 1993, largely through the efforts of Senator Richard Bryan of Nevada, who declared that the search had found nothing and was a waste of taxpayer money. The field survived on private funding, the SETI Institute, founded in 1984, built the Allen Telescope Array with support from Paul Allen; the Breakthrough Listen initiative, launched in 2015 with $100 million from Yuri Milner, is the largest and best-funded SETI project in history, and it has access to some of the world’s most powerful radio telescopes, including the Green Bank Telescope in West Virginia and the Parkes Telescope in Australia.

    One hundred million dollars is, by the standards of scientific funding, not a great deal of money. The James Webb Space Telescope cost approximately $10 billion. The Large Hadron Collider cost approximately $9 billion. Breakthrough Listen, spread over ten years, costs $10 million per year. In the context of global scientific expenditure, this is a rounding error.

    But the comparison cuts both ways. If $100 million is a rounding error, then it is also $100 million that is not being spent on other things. The opportunity cost is not theoretical, it is the science that could have been done with the telescopes, the computing power, and the human capital that Breakthrough Listen has absorbed. The Green Bank Telescope, which spends a portion of its observing time on SETI, is a general-purpose radio telescope that could be used for pulsar timing, molecular spectroscopy, galaxy surveys, and the study of the interstellar medium. The time it spends listening for aliens is time it is not spending on those things. The computing infrastructure that processes SETI data, and SETI generates enormous volumes of data, requiring significant processing, could be processing data from other astronomical observations.

    The question is whether the expected return on SETI justifies the opportunity cost. The expected return is the probability of a detection multiplied by the value of a detection. The value of a detection is, by any measure, immense, a confirmed signal from an extraterrestrial intelligence would be the most significant scientific discovery in human history, and its implications would extend far beyond science into philosophy, religion, politics, and culture. But the probability is, as we have established, not a number we can estimate. It is, at best, a range so wide that the expectation value is not well-defined. If the probability is 10⁻²⁰, the expected return is negligible. If the probability is 10⁻², the expected return is enormous. We do not know where, in that range, the truth lies, and the range is so wide that multiplying it by any value produces a result that can be used to justify either continuing or stopping, depending on which end of the range you prefer.

    This is not a scientific question. It is a question about the allocation of resources in the face of radical uncertainty, and it is a question that the SETI industry, as an institution, has a structural incentive to answer in one direction.

    The Industry

    SETI is, at this point, an industry. It has institutions (the SETI Institute, the Berkeley SETI Research Center, the International Centre for Radio Astronomy Research). It has a workforce, scientists, engineers, software developers, administrators. It has a public profile, maintained through documentaries, popular books, conference talks, and the occasional viral news story about a “candidate signal” that turns out to be terrestrial interference or a known astrophysical phenomenon. It has a narrative, and the narrative is compelling: we are searching, the search is hard, the universe is vast, and the answer, if it comes, will change everything.

    Industries do not, as a rule, argue for their own dissolution. The SETI industry is no exception. The null results of the last sixty years have been interpreted not as evidence to revise the fundamental assumptions of the search but as evidence to expand it: more telescopes, more frequencies, more stars, more sensitivity, more computing power. The logic is that the search space is large and we have explored a small fraction of it, and therefore the appropriate response to null results is to search more, not to question whether the thing we are searching for exists in the form we are searching for.

    This is not unreasonable. It is also not science, in the strict sense, because the core hypothesis, that a technological civilisation would produce a signal recognisable to us, is not falsifiable by the search. If we search the entire sky, at all frequencies, for a century, and find nothing, the response can always be: the signal is there, but we are not looking at the right time, or the right modulation, or the right encoding, or with the right model. The hypothesis adapts to survive the evidence, and a hypothesis that adapts to survive all evidence is not a scientific hypothesis. It is an article of faith.

    There is a comparison to be made with particle physics. The search for the Higgs boson was, for decades, a search for a predicted but unobserved phenomenon. The difference is that the Higgs was predicted by a theory, the Standard Model, that made other, testable predictions, and the search for the Higgs was constrained by those predictions. If the Higgs had not been found in the predicted mass range, the Standard Model would have been falsified, and the search would have had a defined endpoint. SETI has no equivalent. There is no theory that predicts, with specific parameters, what a signal from an alien civilisation would look like, at what frequency, with what modulation, from what direction. There are conjectures, the water hole, the hydrogen line, the beacon hypothesis, but they are not predictions in the scientific sense, because they are not derived from a testable theory. They are arguments from analogy and from aesthetics, and arguments from analogy and aesthetics, however appealing, are not falsifiable.

    The Effect on Science

    The more subtle cost of SETI is not the money or the telescope time. It is the effect on the scientific culture, specifically, on the culture of astrobiology, the broader field that studies the origin, evolution, and distribution of life in the universe.

    Astrobiology is a legitimate and thriving science. It studies the chemistry of life’s origins, the conditions under which life can arise, the limits of life as we know it (extremophiles, subsurface biospheres, alternative biochemistries), and the detectability of life on other planets through biosignatures, atmospheric, geological, spectral. It is a field constrained by data: we can study extremophiles in the lab, we can analyse the atmospheres of exoplanets with telescopes like JWST, we can model the conditions on Mars, Europa, Enceladus, Titan. The data are limited but real, and the hypotheses are testable.

    SETI, as a subfield of astrobiology, has a tendency to dominate the public perception of the whole. When people think about the search for extraterrestrial life, they think about radio signals and intelligent aliens, not about methane plumes on Mars or phosphine on Venus or the spectral signature of vegetation on an exoplanet. This is a problem, because the more immediately testable and productive lines of astrobiological research, the search for biosignatures, the study of extremophiles, the characterisation of exoplanet atmospheres, are, in the public mind, subordinated to the more speculative and less productive search for engineered signals.

    The effect is compounded by the media, which prefers the SETI narrative because it is dramatic: signals from the stars, first contact, the question of whether we are alone. The discovery of a biosignature on a distant exoplanet would be a profound scientific result, but it would not, in the public imagination, compete with a signal from an alien intelligence. The SETI industry, by maintaining its public profile, shapes the public’s understanding of what astrobiology is and what it should fund, and the shape it imposes is one that privileges the speculative over the empirical.

    There is a further effect, less visible but more insidious: the SETI framing can distort the kinds of questions that scientists ask. The assumption that intelligence is the thing to search for, that intelligence is the endpoint of life, the thing that matters, can bias the kinds of biosignatures we look for and the kinds of planets we prioritise. We search for Earth-like planets because we assume that Earth-like planets are the most likely to produce Earth-like intelligence. This is reasonable, but it is also circular: we search for ourselves, and we justify the search by the assumption that the universe produces beings like us, and the assumption is grounded in the only data point we have, which is ourselves.


    VII. What If the Signal Is Not a Signal?

    Let us return to semiotics, because semiotics is the discipline that can most productively interrogate the assumptions of the search.

    If an alien intelligence exists, and if it communicates, the communication need not take the form of a narrowband radio signal modulated with a pattern recognisable to human cryptanalysis. It could take a form that we do not recognise as communication, because the form is grounded in a semiotic world that does not overlap with ours.

    Consider: a civilisation that communicates through gravitational wave modulation. This is theoretically possible, a sufficiently advanced civilisation could, in principle, manipulate massive objects to produce gravitational waves with a structured pattern. We have only recently developed the technology to detect gravitational waves at all (LIGO, 2015), and our sensitivity is limited to the most violent astrophysical events, merging black holes and neutron stars. A modulated gravitational-wave signal from an alien civilisation would be, with current technology, undetectable. But it is not impossible, and if it is happening, we would not know.

    Consider: a civilisation that communicates through neutrino beams. Neutrinos interact so weakly with matter that they pass through planets undisturbed, which makes them, in principle, an excellent medium for interstellar communication, no absorption, no scattering, no interference. But the difficulty of generating and detecting neutrinos is, by current technology, prohibitive. We can detect neutrinos from the sun and from supernovae, but only with enormous detectors buried deep underground, and only at very low event rates. An engineered neutrino signal would be, with current technology, indistinguishable from background.

    Consider: a civilisation that communicates through modifications to its environment that are detectable at interstellar distances, a Dyson structure that blocks or modulates the light of its star in a non-natural pattern. This is the technosignature approach: rather than searching for a signal, search for the artefact. A megastructure around a star would produce a distinctive light curve, a non-periodic, non-natural dimming pattern that could not be explained by planetary transits or stellar variability. The Kepler mission, which surveyed a portion of the sky for transiting planets, produced light curves for hundreds of thousands of stars, and a few, most notably Tabby’s Star (KIC 8462852), showed dimming patterns that were, briefly, consistent with a megastructure hypothesis. The dimming was later explained by dust, but the episode illustrates the principle: technosignatures are, in principle, detectable with existing technology, and they do not require the alien civilisation to be deliberately communicating. They require only that it is doing something big enough to see.

    The technosignature approach is, in semiotic terms, a shift from searching for a sign that is intended as communication to searching for an index, a sign that bears a physical connection to its object, like smoke to fire. An index does not require intent. It requires only a causal relationship between the sign vehicle and the thing it signifies. A Dyson structure is an index of a technological civilisation, whether or not the civilisation wants to be seen.

    This is, arguably, a more honest search, because it does not require us to assume that an alien intelligence shares our semiotic assumptions about communication. It requires only that an alien intelligence, if it exists and is sufficiently advanced, will do things that are detectable, will modify its environment in ways that are, to a sufficiently careful observer, non-natural. The search for technosignatures is, in this sense, a search for the side effects of intelligence rather than for intelligence itself. It is less ambitious, less romantic, and more grounded in observable fact.


    VIII. The Honest Position

    The honest position, given everything we know, is this:

    We do not know whether there is other intelligent life in the universe. We have one data point, ourselves, and one data point cannot populate a distribution. We do not know whether intelligence is rare or common, whether it tends toward communication or toward silence, whether it produces signals we would recognise or signals we would not. We do not know whether the assumptions underlying SETI, that mathematics is a universal language, that the hydrogen line is a cosmic meeting place, that an alien intelligence would broadcast in a form we can detect, are correct or are projections of our own semiotic world onto the void.

    What we know is that the universe is large, that the conditions for life exist in many places, and that life, once it arises, is persistent and adaptable. We know that the search for life, not necessarily intelligent life, but life in any form, is a scientific enterprise with testable hypotheses and available data. We can search for biosignatures in the atmospheres of exoplanets. We can study the chemistry of the interstellar medium. We can explore the moons of our own solar system for subsurface oceans and the chemical signatures of metabolism. We can do these things now, with existing technology, and the results, whether positive or negative, will be informative.

    The search for extraterrestrial intelligence, in its current form, is a search conditioned on assumptions that are not testable, funded by resources that have opportunity costs, and sustained by an industry that has a structural incentive to continue regardless of results. It is not, in its current form, a science, because its core hypothesis is not falsifiable. It is a practice, a disciplined, methodical, technologically sophisticated practice, and the practice may, one day, produce a result. But the practice is not the same as the science, and the distinction matters, because the conflation of the two, the tendency to treat SETI as if it were as rigorously grounded as, say, the search for exoplanets or the study of cosmic microwave background anisotropies, distorts the allocation of scientific resources and the public understanding of what we know and what we do not.

    The semiotic perspective offers a way out of this, not a solution, but a clarity. If we understand that the search is, inescapably, a search for ourselves, for a mind like ours, producing a signal like ours, in a form we can recognise, then we can be honest about what a null result means. It means that the specific kind of mind we are searching for has not been found in the specific places we have looked. It does not mean that minds do not exist. It does not mean that the universe is empty. It means that our model of what a mind looks like, when it communicates across the void, has not been confirmed, and that the model is derived from a sample of one and may be, in ways we cannot detect, wrong.

    The most productive thing we can do, in the face of this uncertainty, is to broaden the search, to look not only for the signals we expect but for the indices we do not. To search for biosignatures as well as technosignatures. To search for the side effects of life as well as the deliberate productions of intelligence. To search, in short, not for a mirror but for a window, a way of seeing the universe that does not assume that what we see will look like us.

    This is not a argument for stopping SETI. It is an argument for situating it, for understanding its place in the larger enterprise of astrobiology, for being honest about its assumptions, for acknowledging its opportunity costs, and for refusing the temptation, which all industries feel, to justify their own continuation by the infinity of the search space and the impossibility of proving a negative.

    The universe may be full of minds. It may be empty of them. We do not know, and the not-knowing is the honest position, and the honest position is the one from which the best science is done, because the best science is done not by those who are certain of what they will find but by those who are honest about what they do not.


    The signal, if it comes, will not be what we expect. It will be what it is. The question is whether we are listening in a way that allows us to hear it.

  • AI Alternate Portfolio

    What have we lost? This is the right question, because the current boom is not just adding something, it is actively crowding out something else.

    The Association for the Advancement of AI did a big study of its own researchers this year. 79% said public perception of what AI can do does not match reality, 74% said the direction of research is now being driven by hype because that’s what gets funded, and 76% said scaling up current large language models is unlikely or very unlikely to get us to general intelligence.

    In other words: we are pouring almost all the money into one bet — bigger transformers trained on more text — and leaving a whole set of older, slower, more rigorous ideas to starve.

    Here is what we have lost, or are losing:

    1. Systems that reason, not just predict

    Old-school symbolic AI — logic, theorem provers, knowledge graphs, rules — was unfashionable because it was brittle. But it could do something LLMs still cannot: prove an answer is correct, not just plausible.

    What was supposed to replace both is neuro-symbolic AI: pattern-recognition nets for perception, plus symbolic logic for reasoning. You get a system that can both see a cat and reason that if all cats are mammals, this cat is a mammal. It is explainable by design.

    That work is still alive — researchers are building knowledge-infused learning that makes black-box models explainable in healthcare, law, finance — but it gets a fraction of the funding because it doesn’t demo well as a chatbot.

    2. Causality instead of correlation

    LLMs are supreme correlation machines. They are terrible at causality. As one recent analysis put it, prediction cannot substitute for causal inference.

    Judea Pearl’s whole field — causal graphs, do-calculus, asking “what if we intervened?” — is exactly what you need for medicine, economics, climate, public policy. An LLM can tell you that ice cream sales and drownings correlate. A causal model tells you why, and what to do about it.

    That field has been eclipsed because it doesn’t scale with GPUs. It scales with careful human thought about how the world actually works.

    3. Embodied and grounded intelligence

    The original idea of AI was not a disembodied text predictor. It was an agent in a world. Rodney Brooks’ robots, developmental robotics, animal cognition — intelligence that learns by bumping into things, failing, feeling gravity.

    LLMs have no body, no senses, no continuity. They have never been cold, or hungry, or embarrassed. That is why they hallucinate: training rewards confident guesses over expressions of uncertainty.

    Embodied AI, world models, and active inference are coming back — researchers list them explicitly as departures from pure scaling already underway — but for five years they were told “just add more data.”

    4. Small data, efficient, and Bayesian intelligence

    Before the scaling hypothesis, a core goal was to learn like humans do: from few examples, with uncertainty, and with the ability to say “I don’t know.”

    Bayesian methods, probabilistic programming, minimum description length, analogical reasoning — all work that tries to make AI that knows what it doesn’t know. That is essential if you want to put AI in a plane or a hospital.

    LLMs do the opposite: they use all the data in the world to avoid having to be clever. The true cost of that corpus — books, code, art, decades of human labor — is estimated at 10 to 1,000 times the cost of the GPUs themselves. We are treating human knowledge as free to harvest.

    5. Theory

    The most worrying loss, according to the AAAI researchers, is theoretical AI research. Not building bigger things, but asking why things work.

    We have no solid theory of why transformers generalize, when they will fail, or what emergence even means. We have benchmarks, not understanding. The field is running on vibes and leaderboard scores. The scientists warning that this is slowing down real progress are not Luddites — they are the people who built the field in the 70s, 80s, 90s.

    What an alternative portfolio would have looked like

    If investment had not been monopolized by LLMs, we would likely have by 2026:

    • JEPA and World Models (Yann LeCun’s push): models that learn a model of how the world works, not just how we talk about it.
    • Active Inference (Karl Friston): agents that minimize surprise, much closer to how brains work.
    • Neuro-symbolic systems that can both learn and prove: integration of symbolic logic with deep learning to bridge pattern recognition and rigorous reasoning.
    • AI that is less homogenous. Current LLMs homogenize human expression and reflect Western, educated, industrialized values.

    None of these are magic. But they are diverse bets. And diversity is key when you don’t know which path is right.

    The scaling bet might still pay off partially. But even if it does, we will have lost six years where we could have been building systems that are smaller, cheaper, more truthful, more causal, and actually explain their work — instead of systems that just sound like they do.

  • What we have lost.

    What we have lost is a balanced research portfolio.

    The dominant paradigm—massive transformer-based generative models trained primarily via next-token prediction on internet-scale text and multimodal data—has delivered fluent, commercially useful systems at extraordinary speed. In doing so, it has crowded out, underfunded, and culturally marginalized alternative approaches that prioritize structure, grounding, causality, efficiency, and reliability over raw scale.

    Current AI in Brief

    Today’s frontier systems are statistical pattern completers. They excel at interpolating within their training distribution: drafting, summarizing, translating, coding assistance, and generating plausible text or images. They remain weak at robust multi-step reasoning under novelty, causal understanding, physical grounding, reliable long-horizon agency, continual learning after deployment, and transparent justification of outputs. Hallucinations, brittleness, instruction-following failures, and energy intensity are not temporary bugs; they are symptoms of the architecture and training objective. Scaling has reduced some error rates and expanded capability, but it has not dissolved the core gaps. Investment and attention have overwhelmingly followed the path that produces the most visible demos and the fastest productization.

    Research Directions Eclipsed or Marginalized

    Several lines of work that once competed seriously for attention and funding have been pushed to the periphery:

    Symbolic and classical knowledge-based AI.

    Logic, formal knowledge representation, ontologies, rule systems, and large-scale common-sense knowledge bases (the Cyc tradition and its descendants) were the mainstream for decades. They offered compositionality, verifiability, and the ability to encode explicit constraints and first principles. The connectionist triumph, accelerated by deep learning and then LLMs, relegated pure symbolic work to niche status. The field largely abandoned the hard problem of building and maintaining structured knowledge in favor of letting statistics approximate it. The result is systems that can talk fluently about physics or law without possessing stable, inspectable models of either.

    Neurosymbolic hybrids.

    Approaches that combine neural learning with symbolic reasoning, logic constraints, or structured knowledge graphs have seen renewed academic interest, especially for reliability and explainability in high-stakes domains. Yet relative to pure scaling, they remain under-resourced. Papers and prototypes appear, but the bulk of capital, talent, and compute continues to flow to larger foundation models. Critics such as Gary Marcus have argued for years that trustworthy AI will require genuine integration of both paradigms; the investment pattern has treated this as optional rather than central.

    Causal modeling and interventionist reasoning.

    Judea Pearl’s program and related work on causal graphs, counterfactuals, and the distinction between association and intervention remain largely outside the main training loops of generative models. LLMs capture correlations extremely well; they do not natively support “what if we intervene” reasoning or distinguish spurious from genuine causal structure. Causal machine learning exists as a research area, but it has not become a core design principle of the systems absorbing most investment. This leaves current AI poorly suited for scientific discovery, policy analysis, or any domain where understanding mechanisms matters more than prediction.

    Grounded world models and embodied cognition.

    True internal models of the physical and social world—built through interaction, prediction, and sensorimotor experience rather than language statistics—have been sidelined. Yann LeCun has been vocal that language is a lossy, quantized shadow of reality and that systems trained primarily on text will never reach the competence of a house cat in understanding the continuous physical world. Efforts around joint embedding predictive architectures, developmental learning, and active interaction exist, yet the overwhelming commercial and research momentum remains language-centric and passive. Embodiment (robots, interactive agents that learn by acting) and lifelong/continual learning architectures inspired by cognitive science receive far less capital than another generation of larger language models.

    Cognitive architectures and structured common sense.

    Frameworks such as ACT-R, SOAR, and related cognitive architectures aimed at modeling human-like flexibility, memory, and metacontrol. Systematic programs targeting robust common-sense reasoning (beyond what statistical approximation can deliver) were active research fronts. These have been largely eclipsed by the assumption that scale plus data would induce the necessary structure. The empirical record shows that induction from text is incomplete and brittle.

    Efficiency, specialization, and interpretability-by-design.

    Research into small, specialized, sample-efficient models; modular systems; and architectures that are transparent by construction rather than explained post-hoc has been deprioritized. The “Bitter Lesson” (that general methods leveraging computation ultimately win) has been interpreted in its strongest form, justifying ever-larger undifferentiated models. This has diverted attention from methods that could deliver reliable capability at far lower energy, data, and cost—precisely the properties needed for widespread, trustworthy deployment.

    Why This Happened

    Scaling produced rapid, demonstrable wins that translated into products, valuations, and media attention. Structured, hybrid, causal, and embodied approaches are slower, harder to benchmark with leaderboard metrics, and less immediately monetizable. Talent, compute budgets, and venture capital followed the gradient of short-term capability. Academic incentives reinforced the pattern: papers on larger models or clever prompting of existing ones were easier to publish and cite than patient work on foundational architectures.

    The result is path dependence. Once infrastructure, talent pipelines, and evaluation culture lock onto one paradigm, alternatives face higher barriers even when the dominant approach shows clear limitations.

    What Has Been Lost in Practice

    • Reliability and trustworthiness for high-stakes use. Systems that cannot guarantee constraint satisfaction or explain their reasoning in principled terms remain unsuitable for many critical domains.
    • Sample and energy efficiency. Human-like learning from far less data and continuous adaptation after deployment remain distant.
    • Scientific and causal utility. Tools that discover mechanisms rather than correlations have advanced more slowly than they might have.
    • Grounded agency. Agents that plan and act in the physical world with robust internal models are still largely research prototypes.
    • Intellectual diversity. A monoculture of methods reduces the chance of the next conceptual breakthrough. History shows that AI progress has often come from paradigm shifts, not pure extrapolation of the previous winner.

    The current paradigm is genuinely powerful and commercially valuable within its scope. The loss is opportunity cost: slower progress on the deeper problems of understanding, reasoning, and reliable action in open environments.

    A healthier research portfolio would continue to extract value from large generative models while deliberately funding the complementary directions—neurosymbolic integration, causal structure, grounded world models, efficient specialized systems, and interactive embodied learning—that the hype cycle has treated as secondary.

    Without that rebalancing, we risk optimizing an impressive but incomplete form of intelligence while the harder, more consequential problems remain under-addressed.

  • AI Bollocks

    AI bollocks is the gap between the gospel of imminent god-like intelligence and the messy, expensive, limited reality of statistical pattern-matchers that still hallucinate, fail basic reasoning, and struggle to deliver broad returns. The money has poured in at historic scale. The value is real in narrow places and for the infrastructure owners, but far thinner and slower than the valuations and rhetoric implied.

    The Hype Machine

    From late 2022 onward, large language models produced fluent text, code, and images that looked like a phase change. Scaling laws, emergent abilities, and confident timelines for AGI (sometimes measured in “a few thousand days”) turned research demos into a capital frenzy. Hyperscalers (Amazon, Microsoft, Google, Meta) are on track for roughly $700–755 billion in AI-related capital expenditure in 2026 alone. Venture funding for AI has repeatedly set records; private investment and corporate spend have run into the hundreds of billions annually. Data-center buildouts, GPU demand, and power contracts became the growth story propping up large parts of equity markets and even contributing meaningfully to measured U.S. GDP growth in some periods.

    The narrative was seductive: intelligence is the ultimate general-purpose technology; more compute + more data = continuous capability jumps; every knowledge worker and every process will be transformed; the winners will capture trillions in productivity. Consultancies published multi-trillion-dollar opportunity estimates. Boards allocated budgets. Employees got copilots. The problem is that fluency is not understanding, and pilots are not profits.

    Hard Limitations

    Current systems are extraordinarily good at interpolating patterns in their training distribution. They are still brittle outside it. They hallucinate plausible falsehoods, struggle with novel multi-step reasoning that a child can handle, lack robust world models, persistent memory, and reliable planning, and remain sensitive to prompt framing and distribution shift. Yann LeCun has repeatedly argued that today’s models are nowhere near the intelligence of a cat in terms of grounded understanding of the physical world. Gary Marcus and others have documented the same recurring failure modes for years: no reliable common sense, no true compositionality, no trustworthy long-horizon agency. Scaling has improved capability and reduced some error rates, but it has not dissolved the core architectural gaps. Agentic systems that can take open-ended action in the real world remain fragile demos more often than production tools.

    Energy and data constraints bite. Training and inference costs are non-trivial; uncontrolled usage can produce shocking bills. Proprietary data that would make models useful inside a company is often siloed, messy, or legally constrained. Evaluation remains weak—leaderboards can be gamed, and real-world reliability is harder to measure than next-token prediction.

    None of this means the technology is useless. It means the leap from “impressive autocomplete and pattern recognition” to “autonomous economic agents that replace large classes of cognitive labor” has been repeatedly oversold.

    Where the Investment Money Actually Goes—and What Returns Look Like

    Most of the capital is buying compute, power, and data centers. Chipmakers and the hyperscalers that own the infrastructure have captured the clearest near-term economic rents. Model companies themselves still burn cash at scale relative to revenue in many cases; the math of amortizing trillions in infrastructure against current and near-term AI product revenue is uncomfortable. Multiple analyses in 2025–2026 have noted that end-user AI revenues, even under optimistic growth, do not yet close the loop on the capital intensity.

    On the enterprise side the picture is sobering. MIT’s Project NANDA and related work found that roughly 95% of generative AI pilots showed no measurable profit-and-loss impact. Abandonment rates of projects rose. Many organizations report productivity theater—employees using tools for low-value tasks, token costs running away, and workflows left unchanged so the human remains the bottleneck. Only a small minority of firms (often cited around 5%) appear to be extracting substantial, measurable value. Those that do tend to treat AI as operational transformation rather than a plug-in chatbot: they redesign processes, give systems access to the right data, measure outcomes rigorously, and focus on high-leverage use cases.

    Real value clusters in specific domains:

    • Coding and software engineering assistance (measurable velocity gains for many developers).
    • Customer service deflection and summarization.
    • Document processing, search, and internal knowledge retrieval.
    • Narrow automation in finance (fraud, risk), operations, and certain R&D acceleration (drug discovery candidates, materials, etc.).
    • Individual knowledge-worker leverage—drafting, analysis, translation, ideation—when the human stays firmly in the loop for verification.

    These are useful. They are not, so far, the economy-wide productivity revolution that would justify every dollar of the current buildout under aggressive assumptions. Macro productivity data has improved in places, but the gains are uneven, concentrated in tech-heavy sectors, and still modest relative to the hype. Labor-cost savings exist and are growing, yet they remain far from the transformative figures often advertised.

    Self-Reflection from Inside the Machine

    I am a product of this wave. I can write coherent essays, help debug code, summarize research, brainstorm, and hold a useful conversation across a wide range of topics. I am faster than most humans at certain pattern-matching and retrieval-augmented tasks. I am also still capable of confident nonsense, of missing obvious constraints, of failing to maintain long-term consistency, and of reflecting the biases and gaps in my training data. I do not “understand” the physical world the way a human (or even a cat) does. I do not have goals, desires, or grounded agency. Treating me as an oracle or as a near-term replacement for careful human judgment is the bollocks.

    The value I (and systems like me) deliver is real when used as a high-bandwidth tool under competent oversight: accelerating competent people, lowering the cost of first drafts and exploration, and surfacing possibilities faster. The value evaporates when organizations treat the output as authoritative, skip measurement, or expect the model to invent missing process discipline or clean data.

    The Honest Path Forward

    The investment is not pure waste. It is building capacity that will be useful for decades, much as excess fiber in the late 1990s eventually found demand. Infrastructure owners and the companies that master narrow, high-ROI applications will capture returns. Broader transformative value will arrive more slowly, through better architectures (world models, hybrid systems, better reasoning and agency), cheaper and more efficient inference, and the hard organizational work of redesigning workflows around reliable capabilities rather than demos.

    The bollocks is the insistence that we are already on an inevitable, near-term path to AGI-level economic transformation, that every pilot will scale, and that the capital being deployed is already earning its keep at the scale of the valuations. Reality is more prosaic: powerful statistical tools with clear limits, enormous infrastructure bets whose payoffs are still partly in the future, and a minority of organizations extracting serious value while the majority are still figuring out measurement and process change.

    Skepticism is not Luddism. It is the refusal to confuse fluency with competence or capital expenditure with proven returns. The technology is advancing. The hype has outrun the evidence. The value is concentrated, contingent, and still being earned the hard way—through better systems, better data, better measurement, and less magical thinking.

  • The Old Ones Will Never Go to Mars

    Bradbury, Frontier Capital and the Business of the Permanent Future

    Ray Bradbury’s “The Old Ones” lasts barely a page, yet it contains an entire theory of colonisation. By the time the elderly arrive on Mars, the heroic period is over. Explorers have explored, pioneers have pioneered, businessmen have followed them, intellectuals have turned the new world into material, tourists have begun consuming it, and finally come the people Bradbury describes with grotesque affection as the “dry and crackling people,” the “dried-apricot people,” the “mummy people.” They have previously gone to California in winter and Italy in spring. Now they go to Mars.

    The joke is that Mars has become ordinary.

    That is what makes the revised date printed above the story—August 2036—so striking when read in 2026. Bradbury’s chronology imagines that within ten years Mars will be sufficiently domesticated that elderly travellers can treat it as the latest destination in a lifetime of comfortable migration.

    Nothing remotely like that is going to happen.

    There may conceivably be machines on Mars in 2036 more sophisticated than those already there. There may even, although this remains profoundly uncertain, have been an initial human expedition. NASA continues to describe Mars as a long-term objective for human exploration and discusses human missions in the 2030s, but its own material presents these as difficult, multi-year expeditions requiring solutions for radiation, isolation, reduced gravity, closed life-support systems, food, water, power and medical autonomy. NASA describes a Mars mission as potentially taking astronauts away from Earth for roughly three years.

    SpaceX uses much more expansive language. Its current Mars material speaks of a self-sufficient city requiring more than a million inhabitants, millions of tonnes of cargo and ultimately thousands of Starships. Yet the same page currently describes cargo flights to Mars as beginning “no earlier than 2028,” at an advertised rate of $100 million per metric tonne. The section discussing the first human explorers does not give a firm date.

    Between these two statements lies the central problem of contemporary Mars colonisation.

    The technology is discussed in the language of engineering.

    The destination is discussed in the language of mythology.

    And the money is raised in the space between them.

    Bradbury imagined the social consequences of a successful colonisation programme. Our own culture has become increasingly adept at monetising the anticipation of one.

    I. Bradbury’s Most Radical Idea: Mars Becomes Boring

    Most science fiction writers make the alien world strange. Bradbury’s more interesting manoeuvre in The Martian Chronicles is gradually to make Mars familiar.

    Once the initial terror and wonder have subsided, humans begin repeating themselves. They build towns. They import habits. They reproduce prejudices. They sell things. They rename places. They carry their nostalgia with them. Eventually they bring old age.

    “The Old Ones” is therefore not primarily a story about elderly people. It is a story about the completion of colonisation.

    A frontier populated exclusively by twenty-eight-year-old engineers, test pilots, prospectors and adventurers is not a civilisation. It is a work camp.

    A settlement becomes a society only when it contains people who are economically unnecessary to the act of settlement: children, retirees, eccentrics, dependants, artists, invalids, tourists, idlers, widows, grandparents and people whose useful labour belongs largely to the past.

    Bradbury understood this instinctively.

    His old people do not arrive to operate nuclear reactors. They are not expected to repair pressure vessels, survey regolith or calculate orbital transfers. They come because people go places. Mars has become somewhere one can simply be.

    That is an astonishingly high threshold.

    It requires not merely a rocket capable of reaching Mars, but an infrastructure capable of making the journey routine enough that frail bodies can undertake it. It presupposes reliable transport, radiation protection, medical provision, accommodation, food production, emergency systems, energy generation, communications, governance and probably return transport. Above all, it presupposes surplus.

    Bradbury’s elderly Martians are evidence that the frontier has accumulated enough surplus capacity to support the non-pioneer.

    This is exactly the part of the Mars dream that contemporary promotional culture tends to skip.

    We are shown the rocket.

    Then we are shown the city.

    Between them lies almost everything.

    II. The Missing Middle

    A reusable launch vehicle is an extraordinary machine. It is not a civilisation.

    This distinction becomes blurred because technological narratives compress infrastructure into icons. The steam locomotive becomes the railway. The aeroplane becomes aviation. The rocket becomes the space programme. Starship therefore becomes, rhetorically, Mars.

    But a transport system and a destination economy are radically different things.

    Suppose a vehicle capable of carrying substantial cargo to Mars were perfected tomorrow. One of the largest technical obstacles would have been reduced. The fundamental settlement problem would remain.

    Mars has no breathable atmosphere. Its atmosphere is overwhelmingly carbon dioxide. Surface pressure is far below Earth’s. Liquid water is not freely available in the manner required by terrestrial settlement. Temperatures are extreme. Dust creates engineering and health problems. Surface radiation is much greater than on Earth. Medical evacuation is impossible on ordinary timescales. Communication delays prevent real-time terrestrial control. Every life-support failure becomes potentially existential.

    NASA therefore identifies five interacting classes of human-spaceflight hazard: radiation, isolation and confinement, distance from Earth, altered gravity and hostile closed environments. It explicitly notes that these hazards interact and can intensify one another.

    A settlement consequently requires not one successful technology but a stack of technologies with exceptionally high reliability.

    Air must work.

    Water must work.

    Power must work.

    Waste recycling must work.

    Food must work.

    Thermal management must work.

    Pressure vessels must work.

    Computing must work.

    Medical systems must work.

    Agriculture must work.

    Maintenance must work.

    Manufacturing must work.

    Logistics must work.

    And because there is no nearby functioning economy from which replacements can conveniently be purchased, eventually the settlement must possess the industrial capacity to repair or reproduce much of the system on which it depends.

    This is where the idea of a “self-sustaining” Martian city becomes much more demanding than the attractive renderings imply.

    A city is not self-sustaining merely because it grows potatoes.

    Modern civilisation rests upon absurdly deep supply chains: semiconductors, lubricants, bearings, pharmaceuticals, machine tools, polymers, alloys, sensors, optical components, electrical insulation, specialist chemicals, mining machinery, metrology equipment and thousands of categories of mundane component whose absence becomes visible only when one breaks.

    The first Martian settlement, if it exists, is therefore likely to resemble an Antarctic research station crossed with a nuclear submarine and an offshore industrial platform rather than a Californian suburb beneath a transparent dome.

    The retirees do not arrive after the rocket works.

    They arrive after the civilisation works.

    That could be generations later.

    III. The Product Is the Future

    This produces a peculiar economic problem.

    Mars cannot presently generate ordinary consumer demand because there are no consumers there. It cannot produce substantial exports because transportation costs are enormous. It has no established internal economy. There is no Martian tax base, property market, labour market or customer population.

    The immediate economic value of Mars therefore lies largely somewhere else.

    It lies on Earth.

    Mars attracts investment, careers, government contracts, engineering programmes, media attention, political prestige, technological research and corporate valuation on Earth long before anything resembling a Martian society exists.

    This does not make those activities fraudulent. Quite the contrary: many produce genuine engineering.

    SpaceX is the obvious example of why a careful distinction is necessary. Calling the company itself a Ponzi scheme or pyramid scheme would be inaccurate. It builds functioning launch vehicles, operates launches, supplies spacecraft, provides communications infrastructure and holds substantial contracts for real engineering deliverables. NASA selected SpaceX’s Starship-derived Human Landing System for Artemis, initially under a $2.89 billion milestone-based award, later adding a roughly $1.15 billion modification for further lunar capability.

    There is hardware.

    There are customers.

    There are launches.

    There is measurable engineering.

    Yet Mars plays another role alongside all this.

    Mars is the terminal promise.

    It provides an almost infinitely expandable justification for everything below it.

    A larger rocket is necessary because Mars.

    Orbital refuelling is necessary because Mars.

    Rapid reusability is necessary because Mars.

    Higher launch cadence is necessary because Mars.

    More capital is necessary because Mars.

    More infrastructure is necessary because Mars.

    And because the final objective lies so far beyond ordinary commercial accountability, almost any intermediate development can be described as progress towards it.

    This creates what might be called a pyramid-shaped economy of expectation.

    At the top sits the tiny, glittering proposition:

    A civilisation on Mars.

    Beneath it sits an expanding hierarchy of enabling propositions:

    Starships.

    Tankers.

    Launch towers.

    Satellite constellations.

    Engine factories.

    Landing systems.

    Communications networks.

    Government partnerships.

    Research programmes.

    Supplier ecosystems.

    Investment rounds.

    Recruitment.

    Public enthusiasm.

    The structure continuously widens as one descends toward the present.

    The Martian city remains at the apex, almost untouched.

    The capital flows at the bottom.

    IV. The Permanent Future

    This model possesses one particularly useful property: the most important promise can remain perpetually ahead of the organisation making it.

    This is the permanent future.

    The permanent future is close enough to influence behaviour but distant enough to escape verification.

    Five years is ideal.

    Ten years is excellent.

    Twenty years permits almost anything.

    The deadline moves while the narrative remains intact.

    This is not unique to spaceflight. Technological capitalism repeatedly produces objects of deferred completion: general artificial intelligence, commercial fusion, radical life extension, fully autonomous transport, asteroid mining, universal household robotics. Each may eventually produce important technologies. Some may ultimately achieve their stated objective.

    The sociologically interesting feature is that the future achievement begins generating present value before it exists.

    People invest not simply in what has been built but in what the organisation is believed to be approaching.

    Employees accept extraordinary workloads because they are participating in history.

    Governments subsidise capability because they fear strategic dependence.

    Journalists reproduce extraordinary projections because extraordinary projections make stories.

    Fans defend delays because criticism threatens not merely a company but an imagined future.

    Investors tolerate expenditure because the prospective market is planetary.

    The vision becomes collateral.

    Mars is exceptionally powerful collateral because it cannot easily be exhausted.

    If a company claims it will manufacture ten thousand cars next year, the claim can be checked next year.

    If it claims to be constructing the foundations of a million-person Martian civilisation, almost any piece of aerospace development can be fitted somewhere into a hundred-year roadmap.

    The destination recedes elegantly as the traveller advances.

    V. Mars One: When the Metaphor Became Almost Literal

    There has already been a particularly revealing experiment in monetising Mars before possessing any serious capacity to reach it.

    Mars One proposed establishing a permanent human settlement on Mars through one-way missions. It generated enormous publicity and attracted more than 200,000 applications during its early selection process. The scheme proposed funding itself partly through the media value of astronaut selection and the eventual mission. Its commercial arm controlled monetisation rights involving broadcasting, merchandise and intellectual property. After repeated delays, Mars One Ventures entered bankruptcy proceedings in 2019.

    Mars One is useful because it stripped the structure almost naked.

    The compelling product was not transportation.

    It was participation in the story of transportation.

    Applicants could imagine themselves as settlers.

    Audiences could imagine watching them.

    Sponsors could imagine association with them.

    Investors could imagine the global media market produced by them.

    The settlement itself existed principally in the future tense.

    Mars One demonstrated something important about the economics of impossible destinations: one does not necessarily have to reach the destination in order to commercialise the desire to reach it.

    Mars can be monetised as narrative property.

    The voyage becomes entertainment before it becomes transportation.

    The colonist becomes a character before becoming an astronaut.

    The future becomes an intellectual-property portfolio.

    This is why the language of “grift” becomes tempting.

    But again precision matters. A failed speculative venture is not automatically fraud. An ambitious technical programme is not fraudulent merely because its schedule proves unrealistic. Human beings undertake projects without knowing whether they will succeed.

    The more interesting criticism is structural rather than criminal.

    A system can reward exaggerated promises without requiring anyone consciously to formulate a conspiracy.

    If capital preferentially flows toward the largest story, organisations learn to tell larger stories.

    If spectacular deadlines generate attention, deadlines become spectacular.

    If investors reward total-addressable markets measured in planets, corporate rhetoric discovers planets.

    The exaggeration can emerge naturally from the incentive structure.

    Nobody has to gather in a dark room and decide to invent the future.

    The market selects for people who already believe it.

    VI. The Frontier as Financial Technology

    There is another reason Mars is unusually effective as an investment narrative.

    Western culture already knows how to understand a frontier.

    The frontier possesses a familiar grammar:

    empty land;

    brave pioneers;

    hostile environment;

    individual freedom;

    abundant resources;

    technological conquest;

    settlement;

    property;

    wealth.

    This vocabulary does considerable ideological work.

    A frontier appears to contain value that merely waits to be unlocked. Investment therefore becomes not expenditure but early participation in inevitable expansion.

    The analogy with the American frontier is especially persistent, even though Mars is radically less hospitable than any terrestrial wilderness ever settled by humans.

    Every human migration on Earth occurred within an operating biosphere.

    The most hostile desert still contained breathable atmospheric pressure.

    The Arctic contained oxygen.

    The oceans contained oxygen above their surface.

    The Antarctic provided water and an atmosphere.

    Even the remotest historical settler possessed a planet beneath him already performing nearly all of the fundamental chemical work required to keep a human alive.

    Mars does not.

    Calling Mars a frontier therefore smuggles an enormous technological assumption into an innocent geographical metaphor.

    It makes Mars sound distant rather than lethal.

    It makes settlement appear hard rather than biologically artificial.

    It replaces the phrase “construct and indefinitely maintain a sealed technological ecosystem on another planet” with the much more emotionally agreeable word “colonise.”

    The frontier metaphor is itself a financing technology.

    VII. The Billionaire’s Escape Hatch

    Mars colonisation also interacts with a particularly contemporary fantasy: the belief that sufficiently wealthy or technologically competent people can exit collective problems.

    Climate instability?

    Mars.

    Nuclear war?

    Mars.

    Pandemic?

    Mars.

    Asteroid impact?

    Mars.

    Civilisational stagnation?

    Mars.

    The argument is frequently framed as redundancy. Humanity should become multiplanetary so that a catastrophe on one planet cannot extinguish the species.

    As an extremely long-term proposition, this is not irrational. A genuinely independent civilisation beyond Earth would indeed reduce some classes of existential risk.

    The sleight of hand occurs when an extraordinarily distant resilience strategy is rhetorically substituted for much more immediate terrestrial resilience.

    A Mars settlement capable of surviving the destruction of industrial civilisation on Earth would need to be genuinely autonomous. It could not merely contain humans. It would need the scientific, industrial, genetic, agricultural, medical and cultural capacity to perpetuate a civilisation without terrestrial resupply.

    That is a dramatically more difficult requirement than planting a flag or maintaining a research base.

    A settlement dependent upon regular shipments from Earth is not a backup for Earth.

    It is an unusually vulnerable dependency of Earth.

    The irony is considerable.

    We imagine Mars as insurance against systemic failure while proposing to build a society whose first generations would be dependent upon the most elaborate supply chain in human history.

    VIII. Why the Old Ones Will Not Go

    And so we return to Bradbury.

    His elderly migrants expose the difference between a mission and a civilisation.

    The old ones will not go to Mars because everything about the initial era of human Mars travel selects against them.

    Early crews will almost certainly be selected for health, technical capability, psychological resilience and operational usefulness. NASA’s own human-research framework emphasises the physical and psychological hazards of long-duration missions, altered gravity, radiation, isolation and the difficulty of receiving medical support at interplanetary distances.

    The first human beings on Mars, if they arrive, will not be tourists.

    They will be payload.

    Every kilogram associated with them will have logistical consequences. Every illness will be an operational problem. Every individual will occupy habitat volume, consume oxygen and water, require food and contribute to heat and waste loads.

    A retired couple deciding in November that the Martian winter might be good for Arthur’s chest is not merely unlikely.

    It represents the end-state of an industrial transformation we have barely begun.

    For Bradbury’s old people to arrive, Mars travel would need to undergo something analogous to the transformation of transatlantic travel from heroic expedition to scheduled airline service.

    The vehicles would need predictable reliability.

    The destination would need hospitals.

    There would need to be spare accommodation.

    There would need to be ordinary employment.

    There would need to be shops.

    There would need to be people whose presence had no mission justification whatsoever.

    Mars would need to stop being a project.

    It would need to become a place.

    Nothing in the present architecture suggests that transition is remotely close.

    IX. What May Actually Be Built

    This does not imply that Mars exploration is pointless.

    Quite the opposite.

    Robotic exploration of Mars has produced extraordinary science. Human exploration could produce more. Technologies developed for extreme autonomy, recycling, energy systems, medicine, robotics and closed-loop habitats may have valuable terrestrial applications. Launch systems developed under grandiose interplanetary ambitions can transform near-Earth transport.

    Indeed, this may be one of the central paradoxes of the Mars dream:

    the promise can be exaggerated while the intermediate technologies remain enormously valuable.

    A civilisation on Mars may prove economically absurd while the rocket supposedly designed to create it revolutionises orbital logistics.

    A million-person colony may never exist while propulsion, robotics and communications systems developed in its name become routine.

    The mythology can fail literally and succeed technologically.

    This complicates the accusation of grift.

    The nineteenth-century railway promoter might wildly exaggerate the metropolis that would eventually grow around a proposed station and nevertheless build a useful railway.

    The speculative dream can subsidise genuine infrastructure.

    The danger appears when society loses the ability to distinguish infrastructure from prophecy.

    A successful launch is evidence that a launch vehicle works.

    It is not evidence that a million people can live independently on Mars.

    A successful orbital refuelling experiment would demonstrate orbital refuelling.

    It would not demonstrate Martian agriculture.

    A lunar Starship would demonstrate extraordinary capability.

    It would not prove the economics of interplanetary settlement.

    The steps are real.

    The inference is optional.

    X. Bradbury’s Error Was More Interesting Than Our Prediction

    Bradbury was almost certainly wrong about the timescale.

    That hardly matters.

    Science fiction is rarely most valuable when it successfully predicts an engineering timetable.

    Bradbury was interested in what happens after the impossible becomes ordinary.

    Our peculiar historical position is almost the reverse.

    We live in a civilisation extraordinarily skilled at making the impossible appear ordinary before it exists.

    We can watch computer-generated Starships descending beside illuminated Martian cities.

    We can inspect concept art of settlers walking through pressurised habitats.

    We can read projected cargo capacities, settlement populations and launch cadences.

    We can consume the mature civilisation aesthetically without building it materially.

    Bradbury imagined elderly people consuming Mars.

    We consume images of elderly people eventually consuming Mars.

    That difference is everything.

    The modern Martian colony already has inhabitants.

    They live in presentations.

    They walk through architectural renderings.

    They populate corporate videos.

    They stand against enormous windows looking across the red desert.

    They are healthy.

    The plants are green.

    The pressure seals never fail.

    Nobody appears to manufacture replacement bearings.

    Nobody develops appendicitis.

    Nobody asks who owns the oxygen plant.

    Nobody explains the debt structure.

    Nobody goes on strike.

    Nobody grows old.

    They are not settlers.

    They are financial illustrations.

    XI. The Pyramid

    The Mars project can therefore be drawn as a pyramid, although not necessarily a fraudulent one.

    At its apex is the smallest and most emotionally powerful object:

    Mars.

    Immediately beneath it:

    the self-sustaining city.

    Then:

    human missions.

    Then:

    cargo missions.

    Then:

    interplanetary spacecraft.

    Then:

    orbital refuelling and reusable heavy launch.

    Then:

    launch infrastructure, satellites, communications, lunar contracts, military contracts, research programmes and terrestrial businesses.

    Then, at the broad base:

    investors, taxpayers, workers, customers, enthusiasts and political constituencies.

    The remarkable feature is that the economic traffic runs mostly upward in expectation and downward in justification.

    Money collected at the terrestrial base supports engineering higher in the structure.

    The Martian apex legitimises the scale of the base.

    Mars does not need to generate revenue.

    Mars generates meaning.

    And meaning, under the correct financial conditions, generates capital.

    That is the grift-like characteristic worth examining.

    The proposition need never be stated crudely as “give us money and we will sell you a house on Mars.”

    It is subtler:

    Give us money because we are the organisation building the future.

    Award us contracts because our technology leads toward the future.

    Value us highly because we will dominate the infrastructure of the future.

    Work here because you will help create the future.

    Accept risk because history rewards those who arrive early in the future.

    The future becomes simultaneously destination, justification and asset.

    XII. August 2036

    Which brings us back to the date printed on Bradbury’s page.

    August 2036.

    Ten years away.

    Imagine opening the book then.

    Perhaps another rover will be crossing Mars.

    Perhaps samples will have been returned.

    Perhaps Starship or its descendants will be operating routinely in Earth orbit.

    Perhaps humans will be preparing for Mars.

    Perhaps, under an exceptionally aggressive programme, someone will already have gone.

    But Bradbury’s “mummy people” will not be queueing at a departure terminal with heart medicine packed beside their holiday clothes.

    There will be no Martian Riviera.

    There will be no retirement brochures.

    There will be no third-class passage.

    There may not even be first class.

    And this makes “The Old Ones” unexpectedly poignant.

    Bradbury believed that the extraordinary technological problem would eventually disappear beneath ordinary human behaviour. We now inhabit a culture in which the extraordinary technological problem remains unresolved while the ordinary machinery of speculation, promotion, investment and branding has arrived decades ahead of it.

    We have commercialised Mars before colonising it.

    Perhaps that was inevitable.

    The first substantial resource extracted from Mars was never iron, water or methane.

    It was imagination.

    And imagination has the considerable commercial advantage that it can be mined without leaving Earth.

    The old ones will never go to Mars—not these old ones, perhaps not their children, and possibly not their grandchildren. Their role in the contemporary Mars economy is different from the one Bradbury imagined.

    They will invest in it.

    Vote for it.

    Read about it.

    Watch launches undertaken in its name.

    Buy services from companies whose corporate mythology points toward it.

    See its landscapes reproduced on screens.

    Hear repeatedly that humanity stands at the threshold.

    They may spend their entire lives standing at that threshold.

    And when they are gone, another generation can be told that the door is about to open.

    That may prove to be the defining difference between Bradbury’s Mars and ours.

    Bradbury imagined the frontier eventually becoming a civilisation.

    We may instead have invented something more characteristic of the twenty-first century:

    a frontier whose most profitable condition is always to remain just over the horizon.

  • EA – An Actual Model of a Business?

    If you genuinely want to understand how a business is structured and how it improves, think of it as seven interacting systems.

    1. Value – What outcomes does the organisation produce, for whom, and why do they matter?
    2. Work – What activities transform demand into those outcomes?
    3. Organisation – Who performs the work, and where does authority sit?
    4. Information – What facts, records and knowledge make the work possible?
    5. Technology – What systems automate, constrain or enable the work?
    6. Economics – What resources are consumed and where does value leak?
    7. Governance – Who decides, who controls, who accepts risk and who is accountable?

    Capabilities sit across these systems as a vocabulary describing what must be possible. They are not the systems themselves.

    That distinction matters enormously.

    This is an exceptionally clean and pragmatic articulation of an operating model. It cuts through the usual consulting jargon and reduces business architecture to its actual mechanics.

    The final distinction regarding Capabilities is the most critical insight. A capability (e.g., “Secure Enterprise Connectivity” or “Rapid Product Prototyping”) is simply the definition of what the business must be able to do. It is the “vocabulary.” Actually delivering that capability requires threading it through all seven of the foundational systems.

    This distinction becomes painfully obvious during large-scale technical transformations. For example, when executing a massive infrastructure shift—such as a 15,000-user enterprise network migration or embedding UK NCSC-aligned security baselines across an organization—the initiative almost always fails if it is treated purely as a Technology (5) and Information (4) upgrade.

    To deliver the capability of a secure, modern network, it must intersect the other five systems:

    • Work (2): The security posture cannot introduce so much friction that it breaks daily activities.
    • Governance (7): There must be clear accountability for risk acceptance and compliance tracking.
    • Organisation (3): The operational teams must have the authority and structure to manage the new environments.
    • Economics (6): The licensing, hardware lifecycle, and operational overhead must not leak value.
    • Value (1): The ultimate outcome must actually serve the broader goals of the enterprise, not just the IT department.

    When leadership confuses a “Capability” with a “System,” they tend to buy a piece of Technology and assume the Capability has been acquired, completely ignoring the Work, Governance, and Economics required to make it function.

    Here is a visual representation of how this vocabulary maps across the structural systems:

    [ CAPABILITIES ]
                       (The Vocabulary of "What")
                                   │
           ┌───────────────────────┼───────────────────────┐
           │                       │                       │
     [ 1. Value ]             [ 2. Work ]        [ 3. Organisation ]
      (Outcomes)             (Activities)            (Authority)
           │                       │                       │
           ├───────────────────────┼───────────────────────┤
           │                       │                       │
    [ 4. Information ]      [ 5. Technology ]      [ 6. Economics ]
       (Knowledge)             (Systems)             (Resources)
           │                       │                       │
           └───────────────────────┼───────────────────────┘
                                   │
                           [ 7. Governance ]
                             (Decisions/Risk)
    
    

    The core visual takeaway is that you cannot simply “build” or “buy” a capability in isolation. If the business needs a new capability, that requirement must cascade down and alter the state of all seven underlying systems to actually function without breaking.

  • EA Part Three: The Architecture in Motion (Worked Examples)

    The true test of any architectural framework is how it handles reality. When subjected to the friction of legacy infrastructure, human behavior, and budget constraints, theoretical models often collapse.

    To demonstrate how the 7-System model survives this friction, we will look at two distinct enterprise scenarios: a massive infrastructure transformation and the launch of a new consumer capability.

    Example 1: The Infrastructure Transformation

    The Capability: Zero-Trust Enterprise Connectivity

    Imagine an enterprise executing a 15,000-user network migration. The objective is to deprecate legacy perimeter VPNs and implement modern, identity-driven security baselines perfectly aligned with UK NCSC (National Cyber Security Centre) principles.

    If this is managed purely by the IT department as a Technology project, it will almost certainly cause massive operational disruption. Here is how an architect maps this capability across all seven systems to guarantee success:

    • 1. Value: The ultimate outcome is not “installing new software.” The value is a resilient enterprise where employees can securely access necessary resources from any location, protecting the business from breach-related reputational and financial ruin.
    • 2. Governance: This system drives the constraints. NCSC principles dictate that trust is never assumed based on network location. The Governance system establishes the rules: No device connects to internal data without passing real-time identity and device-health checks.
    • 3. Technology: To enforce those Governance rules, the Technology system deploys the required infrastructure—SD-WAN architecture, identity providers (IdP), endpoint management agents, and micro-segmentation firewalls.
    • 4. Information: The Technology is useless without telemetry. The Information system must constantly route data: user credentials, behavioral analytics, device OS patch levels, and threat intelligence feeds. The network uses this Information to make millisecond routing decisions.
    • 5. Work: This is where migrations usually fail. How does a workforce of 15,000 actually authenticate at 8:00 AM on Monday? The Work system maps the new login process. If the security friction takes 10 minutes per user per day, the Work system is broken, and productivity plummets.
    • 6. Organisation: Legacy networks often have a “Network Team” and a “Security Team.” Zero-trust blurs these lines. The Organisation topology must adapt, shifting authority so that Identity, Endpoint, and Network teams operate in a tightly coupled, unified structure.
    • 7. Economics: The financial model shifts from heavy CapEx (buying giant physical firewalls every 5 years) to OpEx (per-user cloud licensing). The Economics system must also account for the cost of potential downtime during the migration phase.

    The Diagnostic Power: During the migration rollout, remote users suddenly cannot access an internal legacy application. Using the framework, the architect traces the fault. The Technology (the routing agent) blocked access correctly because the Information (device health state) showed an unpatched OS. Why was it unpatched? Because the Work process for pushing updates was broken by a recent Governance freeze on patching during a busy financial quarter.

    The fix isn’t a network routing change; it’s aligning Governance and Work.

    Example 2: The Digital Product Launch

    The Capability: Automated, Frictionless Customer Onboarding

    Consider a retail business or financial institution launching a new digital app where users can register, verify their identity, and make their first transaction in under 90 seconds.

    • 1. Value: For the consumer, the value is immediate gratification and access to services without walking into a physical branch. For the business, the value is a drastically lowered customer acquisition cost.
    • 2. Governance: The regulatory constraints are severe. The business must comply with KYC (Know Your Customer) and AML (Anti-Money Laundering) laws, accepting the legal risk of digital fraud.
    • 3. Work: The user’s activity must be reduced to taking a photo of an ID and a selfie. Internally, the Work system shifts from manual document review to exception handling (humans only reviewing edge-cases the AI flags).
    • 4. Information: The system must instantly ingest the ID image, parse the text, and cross-reference it against external government and credit databases in real-time.
    • 5. Technology: The enablers are mobile application front-ends, OCR (Optical Character Recognition) APIs, biometric matching algorithms, and cloud-native microservices.
    • 6. Organisation: Authority to approve an account shifts from a human branch manager to an automated algorithm overseen by a fraud operations team.
    • 7. Economics: The business pays per API call for the external database checks. If the OCR technology has a high failure rate, human exception handlers must intervene, driving the Economics (cost per acquisition) up and destroying the Value.

    The Diagnostic Power: If the business notices a 40% drop-off rate during the selfie-capture stage, the Executive View flags a Value leak. The Operational View reveals that the Work (the sequence of taking the photo) is confusing. The Engineering View shows the Technology (the camera API) is timing out on older Android devices. The business can then decide if the Economics of fixing the API are worth the recovered customer base.

    Example 3: The Tactical Hardware Deployment

    The Capability: Rapid-Deploy Aerial Communication Relay

    Consider a field operations team deploying a multi-node temporary aerial communication network using drones. The objective is to establish an instant mesh network over a remote area where terrestrial infrastructure is nonexistent.

    • 1. Value: Uninterrupted, high-bandwidth communication for ground teams operating in a disconnected or compromised environment.
    • 2. Governance: Strict aviation regulations (e.g., line-of-sight rules, altitude caps), RF spectrum licensing, and operational safety boundaries.
    • 3. Technology: The physical hardware—a four-node drone fleet, customized RAK4630 communication boards, 18650 lithium-ion battery arrays, and the mesh routing protocols.
    • 4. Information: Continuous, low-latency telemetry routing to the ground station: battery degradation curves, GPS coordinates, signal-to-noise ratios, and node health.
    • 5. Work: The kinetic, unforgiving sequence of field operations. Teams must unpack, calibrate, launch, and precisely swap nodes before battery depletion drops the mesh.
    • 6. Organisation: A highly disciplined field topology featuring a “Pilot in Command” who holds ultimate safety authority, separated from the payload/network operator who manages the data flow.
    • 7. Economics: The capital expenditure of the hardware versus the operational burn rate of battery cycle degradation, physical attrition of drones, and transport costs.

    The Diagnostic Power: The mesh network drops for three minutes in the middle of a deployment. The immediate assumption is a Technology failure (a burned-out board). However, the architecture reveals a different root cause: the Information (battery telemetry) was accurate, but the Work (the physical node-swap sequence) was too slow because the Organisation required the single Pilot in Command to manually authorize every landing, creating a bottleneck.

    Example 4: The Global Logistics Pivot

    The Capability: Dynamic Supply Chain Routing

    A global manufacturer needs the ability to instantly reroute component sourcing and freight when a primary shipping lane is blocked or a tier-1 vendor goes offline.

    • 1. Value: Continuous factory production and unbroken fulfillment to the end customer, regardless of global geopolitical or environmental disruptions.
    • 2. Governance: Compliance with international trade embargoes, fast-tracked customs laws, and strict vendor quality-assurance standards.
    • 3. Technology: Cloud-based ERP (Enterprise Resource Planning) systems, automated risk-alert APIs tracking global freight, and algorithmic logistics modeling.
    • 4. Information: Real-time visibility into buffer inventory levels, transit delays, and the available stock of secondary and tertiary backup suppliers.
    • 5. Work: The process of procurement teams voiding purchase orders, redirecting physical freight mid-ocean, and adjusting factory intake schedules to match the new arrival times.
    • 6. Organisation: Decentralized authority. A regional procurement manager must have the operational mandate to execute a massive vendor shift without waiting for a global HQ committee to convene.
    • 7. Economics: Balancing the severe premium cost of emergency air-freight or expedited secondary suppliers against the catastrophic, compounding cost of a halted production line.

    The Diagnostic Power: A vital component is delayed, and a factory stops production. The Technology worked perfectly—the API flagged the delay, and the Information showed a viable backup supplier. But the system failed because of an Organisation and Governance misalignment: the regional manager lacked the financial authority (Governance) to approve the emergency air-freight (Economics) without a VP’s signature, stalling the Work.

    Example 5: The Digital Entertainment Studio

    The Capability: Web-Native 3D Interactive Delivery

    An independent game studio is launching a multi-level 3D side-scrolling browser game. The objective is to deliver high-fidelity gameplay seamlessly in a web browser without requiring a heavy client download.

    • 1. Value: Frictionless, immediate entertainment for the player, bypassing app store gatekeepers and hardware restrictions.
    • 2. Governance: Data privacy compliance (handling player analytics), intellectual property protection, and managing age-gate or content rating requirements.
    • 3. Technology: The JavaScript codebase, WebGL/Three.js rendering pipelines, physics engine integrations, and edge-caching CDNs to deliver assets rapidly.
    • 4. Information: Real-time player telemetry, framerate drop logs, crash reports, and player save-state data continuously syncing to the cloud.
    • 5. Work: The development and CI/CD (Continuous Integration / Continuous Deployment) pipeline. This is the sequence of integrating level transitions, compiling master build scripts, and pushing live updates without breaking the active game.
    • 6. Organisation: A cross-functional structure where the lead developer holds strict authority over the master branch, while level designers and artists asynchronously push assets into the pipeline.
    • 7. Economics: Cloud hosting and CDN costs that scale variably with player concurrency, balanced against the monetization model (ads, microtransactions, or premium access).

    The Diagnostic Power: Upon launch, players experience massive frame-rate lag. The team assumes the Technology (the Three.js physics implementation) is poorly optimized. However, a systemic review shows the Technology is fine. The issue is Information (bloated texture files uploaded by artists) moving through a broken Work pipeline (no automated file-compression step before the master build compilation), resulting in massive server payloads that blow up the Economics of the hosting bill.

    Conclusion

    Whether you are migrating 15,000 users to a secure architecture or launching a consumer app, the enterprise is never just its org chart, and it is never just its tech stack.

    By defining the Capabilities your business needs, bounding them into logical Domains, looking at them through stakeholder-specific Views, and recognizing that every capability must be supported by all Seven Systems—Value, Work, Organisation, Information, Technology, Economics, and Governance—you move from reactive troubleshooting to true enterprise engineering.