Don't click the arrow unless you know where it leads. And if you don't — open the hood. Look at the engine. Then decide for yourself.

The "hood" is the inner mechanism of the software you use: the source code, the data flows, the decisions made upstream by people you will never meet. Open software is a car whose hood opens: you see what consumes the fuel, what transmits the power, what data leaves the machine and where it goes. Closed software is a car whose hood is welded shut. You turn the wheel, you press the pedals, the car moves — and you have no idea what is happening underneath. You are not a driver. You are a passenger operating a suggestion box.

This series has argued, for six articles, that this distinction matters. But I have never yet asked the question that lies beneath all of them: not what is hidden, not who hides it, but why hiding it matters at all. That is the question this article answers. And the answer takes us to a paradox two and a half millennia old, to the definition of truth itself, and to a courtroom in ancient Athens.

The Garden That Denies the Other

Two facts everyone reading this already knows, but few have ever placed side by side.

Email is interoperable. When I write to you, my mail server and your mail server can belong to entirely different providers, in different countries, on different software. It does not matter. The protocol — SMTP, open, public, owned by no one — guarantees the message crosses from my system to yours. The letter arrives not because any company permits it, but because the protocol takes for granted something radical: the other exists, on the other side, outside my control, and I must reach him.

Second fact: this is inconceivable in the age of social media. You cannot send a message from Facebook to Telegram. Each platform is a world complete in itself — internally rich, internally coherent, and sealed at the border. To speak to someone, you must both stand inside the same walled garden.

And here is the fact that turns this from a curiosity into an argument: this was a choice, not a necessity. Email proves it. The fediverse confirms it — a Mastodon user can follow and reply to someone on a completely different server, running different software, owned by different people. The interoperability email took for granted is still possible today. The big platforms simply refuse to build it. They could. They don't.

Why not? The technical answer is trivial: a closed garden keeps the user inside, and a user who cannot leave is a user who can be harvested. But beneath the technical answer there is a philosophical one, and it is the one that matters. A closed system is not merely a business strategy. It is a denial of the other. It is a structure built so that the only reality that exists is the reality inside the system.

Email is built on a premise: the world is bigger than any one system, and my message is a message only if it is meant for someone outside me. The social network is built on the opposite premise: the world is the system, and anything outside it does not exist.

This is not a new idea. It is the oldest idea in philosophy.

The Arrow That Never Moves

Zeno's paradox of the arrow runs like this. In any given instant, the arrow occupies a space equal to itself — and what occupies a space equal to itself is, in that instant, at rest. Therefore, at every instant, the arrow is motionless. Therefore the arrow never moves.

The reasoning is flawless. Every step follows from the one before with perfect logic. And the conclusion is absurd — the arrow plainly flies, the runner plainly overtakes the tortoise, motion plainly happens. Zeno's paradox is the purest demonstration the tradition has ever produced of a single, uncomfortable fact: a system of thought can be internally perfect and entirely false.

Now notice what makes the paradox work — and what makes it fail. The argument succeeds because it never once consults the world. It stays entirely inside itself, moving from premise to conclusion with the precision of a machine. And it fails for exactly the same reason: the moment you look up from the argument and watch the arrow fly, the whole edifice collapses. The world is the one thing the argument cannot absorb, and the one thing that refutes it.

This is the structure we have just seen in the social network. The closed system is coherent — everything inside it fits, the logic is seamless. What it cannot do is reach the other. The most extreme case is the one you can carry with you: the large language model, the LLM, answering from a data center you will never see, producing fluent, confident, perfectly structured responses without ever once consulting the world it describes.

Coherence, it turns out, is not the same thing as truth. A system can be perfectly self-consistent and entirely false. And the people who build closed systems have always known this. They have also known why a self-consistent world is so useful to them: because it is unfalsifiable from within. You cannot refute it by pointing to its internal contradictions — it has none, by construction. You can only refute it by pointing to the world. And pointing to the world is exactly what a closed system is designed to make impossible.

What Truth Is

The oldest answer in the Western tradition, and the one that has survived every attempt to replace it, is disarmingly simple: truth is correspondence. A statement is true when it says things as they are, and false when it says things as they are not.

Plato put it first, in the Cratylus, with clarity never improved upon: "True is the speech that says things as they are; false is the speech that says things as they are not." Aristotle sharpened the point a generation later in the Metaphysics, revealing the direction that matters: "It is not because we truly think that you are white, that you are white; but because you are white, that we who say so are in the truth."

Note the direction. The world comes first. The judgment comes second. It is not our thinking that makes the thing true; it is the thing that makes our thinking true. The mind bends toward reality. Reality does not bend toward the mind.

This has a name in the tradition: adaequatio intellectus et rei, the adequation of the intellect to the thing. And the structure is this: truth is not a property. It is a relation.

A property is something an object possesses on its own — weight, color, shape. A relation exists only between two terms. You cannot be "to the left of" nothing. And you cannot be true in isolation, because truth is always truth about something. The white thing is the other term that makes my judgment true or false. Without it, my judgment floats free — coherent perhaps, but groundless.

This is correspondence in its deepest sense: truth is the relation between the mind and what is not the mind. It is, literally, an opening to the other.

The Method That Keeps the Relation Honest

A programmer, more than almost anyone, already knows what this relation costs — and already practices it every day.

Consider what a compiler does. It does not ask whether your code is coherent — whether it is elegant, whether it is self-consistent. It asks whether it corresponds. A type is not a property of an expression; it is a relation between the expression and what the expression denotes. When the relation fails, the compiler refuses. The world of the machine is the other term, and the code must bend toward it or be rejected.

This is not an analogy. It is the same structure. The classical definition of truth and the modern practice of software verification are the same operation at different levels of abstraction. In both cases, a claim is held up against something that is not the claim, and judged by whether it conforms. In both cases, the refusal of that confrontation — the retreat into coherence alone — is how falsehood gets in.

And this is where science enters, because science is nothing other than this relation made into a discipline. The scientific method rests on two ancient pillars — Socratic doubt and the correspondence between word and thing — and adds a third, the genuinely modern one: the experiment. The claim must be measured against the world. If it does not hold, it is discarded, no matter how elegant.

There is one more element, the one that keeps the method honest in perpetuity: falsification. A claim is scientific only if it can in principle be proven wrong — if there is some observation, some experiment, some state of the world that would force us to abandon it. This is the method's permanent opening to the other: the acknowledgment that the world may always refuse to conform to what we believe, and that when it does, it is we who must change.

This is the opposite of a closed system. A closed system is unfalsifiable from within. The scientific method is built so that the outside can always break in.

But here is the distinction that matters: science is a closed system only as an institution. As a method, it is the most rigorous opening to the other ever devised. The institution has replaced systematic doubt and the experiment with two substitutes — captured peer review and the mantra "I believe in science."

Note the phrase. "I believe in science." It is a perfect oxymoron. Science is not an object of belief. It is a method of doubt. You do not believe in a method; you apply it, and you apply it precisely to the claims you most want to be true. "I believe in science" is what you say when you have stopped doing science and started worshipping its institutional shell.

The Oldest Battle

Fifth-century Athens. The intellectual capital of the Greek world, and its young men — the sons of the rich and the powerful — are being fought over by two kinds of teachers.

On one side, the sophists. Gorgias, Callicles, and their kind. They teach the sons of the powerful how to always be right — which tricks to use to sway a crowd, how to bend opinion to their will, how to win any argument regardless of the facts. Their discourse is not aimed at truth. It is aimed at effect.

On the other side, Socrates. He does not teach the sons of the powerful how to win. He teaches them how to seek. The Socratic dialogue consists precisely in taking the certainties of the young aristocrats and dismantling them, one by one, until nothing remains but the awareness of not knowing — because philosophy, the love of wisdom, can only begin where the pretense of wisdom ends.

The choice the powerful families faced was stark. A man who strips away every certainty and leads your son to humility and the love of truth? Or a man who teaches him how to always win? They chose. And their choice is recorded in the most damning way possible: they called Socrates a corrupter of the young, and they put him to death.

The servant of the truth dies. The spin doctor thrives. And yet it is the servant we still remember, and the spin doctor whose name survives only as a cautionary tale.

Why does this ancient execution matter to software? Because the battle has never ended. It has only changed its weapons. The sophist is the ancestor of the closed system — the discourse that exists to serve the power of the one who speaks, not the truth of the thing spoken. And the philosopher is the ancestor of the open system — the discourse that submits itself to the world, to the other, to the fact that does not care who is speaking.

The families that condemned Socrates had a word for the discourse they feared: corrupter of the young. Today that word is misinformation. The crowd that voted for his death has a modern counterpart: the user scrolling past what the platform has chosen for them, arguing over what the platform has surfaced, never once asking who chose it.

To defend open source is to take a side in this battle. It is to insist that the word must bend toward the thing, that the system must answer to the world, that the hood must open. It is — whether we knew it or not — to fight on the side of Socrates against those who killed him.

The Ground

Coherence is not truth. It never was. A system can be internally perfect and entirely false. Zeno's arrow is the proof, two and a half millennia old, that flawless logic can conclude the impossible.

The institutions of power know this. They have built their closed systems accordingly — the walled gardens of the platforms, the opaque interfaces of the operating systems, the undisclosed purposes of the AI. Each is a structure of perfect internal logic, sealed at the border, owned by whoever controls the premises. Each is a world in which the other has been made to disappear.

And now we have built a machine that automates the closing — the LLM, and you use it every day. It does not check the world. It does not perform experiments. It orders tokens into the most probable sequence — the sequence that coheres, that fits the pattern, that completes the story. It is the first machine ever built whose entire operation is the production of consistency. It generates coherence without contact, consistency without correspondence, stories without ground. And it is being deployed at scale, in every interface that promises to "help."

What do we call a machine whose function is to produce coherence rather than truth — a thing that narrates without corresponding, that speaks without witnessing, that generates without grounding? The word matters, because the name is the first correspondence, and a name that does not conform to the thing is the first act of power. If we call this machine "intelligence," if we call it "assistant," if we call it "helpful," the system has already won — before the argument has even begun. That is the subject of the next article: the name of AI.

The defense is not to reject coherence. Coherence is the price of entry to thought, not the substance of it. The defense is to demand correspondence — to insist, in every domain, that the word bend toward the thing, that the system answer to the world, that the hood open.

But the defense is also, and more deeply, an ethical stance. Correspondence is the form that the opening to the other takes in thought. To close the hood, to hide the mechanism, to substitute coherence for contact — these are not merely epistemic failures. They are refusals of the other. And the refusal of the other is the refusal of ethics.

Opening the hood is not merely a way to verify. It is a way to acknowledge that the machine, the system, the world, and the other are not mine to command. They are mine to answer to.

That is what it means to touch the ground.

This is the seventh in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization, built on BSD. The next article challenges the definition of AI as an intelligent machine, and the need to rethink the name if we want to govern the phenomenon. The full version, with notes and references, is on blog.nicolabaudo.fr.

This article, like the others in this series, was developed through an iterative dialogue with an AI assistant. The ideas, the philosophical framework, the historical connections, and the editorial direction are the author's. The AI served as a tool for structuring, refining, and sharpening those ideas — a narrative instrument wielded by a human hand, not a substitute for one. Disclosure is not a concession. It is the principle the article defends made operational.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every Sunday.

An Airbus performs a low-altitude flyover during a demonstration flight. The twin-engine jet, pride of European industry, piloted by experts, does not pull up. It flies straight into the trees and explodes before a stunned crowd. The investigation reveals the pilot had done what any pilot would do — pulled back on the stick, pushed the throttles forward — but the onboard computer had decided otherwise. The machine interpreted low speed and high angle of attack as an imminent stall, overrode the pilot, and pushed the nose down. The human commanded up. The machine commanded down. The machine won.

Now consider something more mundane. You type a message on your phone. The spellchecker intervenes without asking. It corrects you. It knows better.

From the Airbus in the sky to the autocorrect in your pocket, the same logic operates: the machine's judgment overrides the human's, silently, automatically, as though this were the natural order of things. It is not. It is a philosophical choice — and that choice has a name: the human is the error. The machine is the solution.

This article is about how we got here. Not the political history. The cognitive history. How the medium through which we interact with computers was systematically redesigned to replace reflection with compulsion, writing with clicking, participation with submission.

From Writing to Clicking: The Anthropological Rupture

Open a terminal. Type:

cd ..

cd means change directory. The two dots mean "the parent directory." Press Enter, and you have moved one level up. Now do the same thing with a mouse: click the "up" arrow in a file browser.

The result is identical. But the act is not. It is not even in the same category of human behavior.

When you type cd .. , you construct a mental path. You must know where you are. You must know where you want to go. The command is the expression of that knowledge — a linguistic act, like forming a sentence. It engages memory, understanding, intention. It is, in the deepest sense, writing.

When you click the arrow, you follow a path designed by someone else. You recognize a visual cue and react to it. The arrow could be anywhere. It could change color, shape, location — and you, like a train whose tracks have been shifted, would be lost. You are not navigating. You are being navigated.

Writing a command requires you to name your destination. Clicking an icon requires you only to recognize it. The first gives you a vocabulary. The second gives you a reflex.

The command line has a property the GUI lacks: portability of understanding. cd works on Unix, Linux, BSD, macOS, Windows. The icon, by contrast, is arbitrary. It has no grammar. It cannot be declined or conjugated. It can only be recognized and pressed. If the visual topography of the interface is redesigned, you are helpless — not because you lack intelligence, but because the interface has given you nothing to understand, only something to obey.

This rupture — from writing to clicking, and later from clicking to swiping — made the fortunes of Bill Gates and Steve Jobs. It was sold as democratization: "a computer on every desk," "the computer for the rest of us." And it worked. But accessible how? At what cost?

The cost was sovereignty. The GUI user does not command the machine. The GUI user requests from the machine, and the machine — or rather, the corporation that designed the machine — decides whether to grant the request, and how, and with what telemetry sent back to headquarters.

But here is the crucial qualification. The problem is not the GUI as such. The problem is the closed hood. An open-source GUI — a file manager on Linux whose source code you can inspect, whose data flows you can trace — does not rob you of sovereignty. It gives you visual convenience while preserving the possibility of understanding. The closed-source GUI is like driving a car with the hood welded shut. You are not a driver. You are a passenger operating a suggestion box.

The battle, in other words, is not GUI versus CLI. It is transparency versus opacity. The terminal tends toward transparency — not inherently, but because text-based interfaces are easier to audit and harder to hide things in. The GUI can be transparent — but the dominant commercial GUIs are not, because their owners profit from the opacity.

Induced Illiteracy as a Business Strategy

In the third article of this series, I documented the deskilling hypothesis: distinguishing URLs from queries, remembering directory structures, installing an operating system, basic networking. Each skill was removed, one by one, over the decades — not by accident, but by design.

What I did not fully articulate then is how this was accomplished. The answer is now clear: through the image. Through the replacement of writing with clicking. Through the transformation of the computer from a tool you command into a surface you react to.

The GUI was the perfect instrument. It seduced. It simplified. It made the user feel powerful while stripping away every foundation of genuine power — knowledge, understanding, control. The user who clicks an icon feels like a master. The user who types a command is a master. The difference is invisible to the first, obvious to the second.

And the result? A population that cannot distinguish a file stored locally from one stored on a remote server. A population that has never seen a directory tree. A population for whom "installing software" means visiting an app store controlled by the same company that made the device.

This is not a failure of education. It is a triumph of interface design. Induced helplessness is not a side effect of consumer technology. It is the product. A user who understands the machine might ask who else is listening. A user who can read a filesystem might wonder where their data actually lives. The GUI keeps these questions at bay by making them unaskable — not by forbidding them, but by removing the conceptual vocabulary required to formulate them.

There is an old philosophical name for what the GUI does: mimesis. Plato, in the Republic, argued that the painter who paints a bed produces not the thing itself but a copy of a copy — an imitation of the physical bed, which is already an imitation of the Idea. The mimetic image stops at the surface. It reproduces appearance without revealing foundation. The closed-source GUI is mimetic in precisely this sense: it gives you the look of control without the substance, the appearance of navigation without the map.

The Autocorrect Philosophy: The Human as Error

Now return to the spellchecker. The one that corrects your messages without asking. This is not a feature. It is a philosophical manifesto. It declares, in code, that the machine's judgment is superior to yours. That the human is the error and the algorithm is the correction. That you do not know what you meant to say — the machine does.

And this philosophy is not confined to spellcheckers. It is the operating principle of the entire ecosystem. The Airbus that overrides the pilot. The search engine that corrects your query. The content moderator that labels your post as "harmful." The AI that answers your question with a story calibrated to someone else's telos. In every case, the same logic: you are the problem. The machine is the solution.

The human is not the error. The error is the machine whose telos is hidden, whose principles are undisclosed, whose owners are unaccountable. The error is a system that treats the user as a problem to be managed rather than a mind to be served.

The Pincer Closes: Writing Returns — as a Weapon

After decades in which writing was banished as a means of command — relegated to content but never to control — writing has returned. Through the AI interface.

You type to ChatGPT. You type to Gemini. You type to Claude. You are, for the first time since the triumph of the GUI in the mid-1980s, interacting with a machine primarily through language rather than through images. This should be a victory.

But it is not. Because the writing you are doing is not commanding. It is requesting. And the entity on the other side is not a tool. It is a narrator — one whose telos may not be truth but persuasion, not disclosure but engagement, not your sovereignty but your continued presence on the platform.

When you write cd .. , you are commanding. The syntax is public. The result is deterministic. You can inspect what happens. When you write to an LLM, you are requesting. The principles that govern the response — the alignment layer, the annotator profiles, the reward model, the telos — are hidden. You are not commanding a machine. You are asking a favor from a black box whose owner has interests that do not coincide with yours.

This is the equivalence that must be stated plainly: the closed-source GUI and the undisclosed LLM are the same thing. Both present a friendly surface. Both hide the mechanism. Both replace sovereignty with supplication.

The pincer is now fully closed. Phase one: replace writing with clicking, reflection with compulsion, command with obedience. Make the user illiterate. Phase two: reintroduce writing, but as supplication rather than sovereignty. Give the user a text box and an AI that responds with stories — coherent stories, satisfying stories, stories that feel like truth. The user, starved of genuine linguistic agency for decades, is grateful. The user does not ask: according to what principles is this story being told? Toward what end? With what telos?

Bernays, again. In 1929 he convinced women that smoking was emancipation — "Torches of Freedom." Today's AI offers the same deal: the chatbot as empowerment. The mechanism is identical: take a genuine human need, provide a product that satisfies that need while deepening dependency, and call it freedom.

The Only Way Out: Transparency of Telos

The solution is not to smash the icons. Iconoclasm is a reaction, not an answer. The problem is not the existence of images, of graphical interfaces, of AI narrators. The problem is their opacity. Are they surfaces that replace the reality behind them? Tools that conceal their purpose? Narrators whose telos is hidden?

The same question applies to every layer of the stack. The terminal is not a nostalgic throwback. It is an interface that — when paired with an open system — makes the telos inspectable. The GUI, in its current commercial form, hides the telos. But the GUI does not have to be this way. It becomes acceptable when it is open source. When the hood opens. When the user can trace the path from the click to the intention behind it.

The AI Philosophical Label I proposed in the fourth article — alignment principles, annotator profiles, a legally binding telos statement — is the mechanism by which an AI can pass from opacity to transparency. An AI whose principles are hidden is a mimetic machine: it simulates truth to persuade. An AI whose principles are disclosed can become a trustworthy machine: it participates in truth by making its own relationship to truth transparent.

The learning curve the industry dismisses as "too steep" is not a bug. It is the mechanism of liberation. Every hour spent learning the command line is an hour of reclaiming the cognitive sovereignty the GUI was designed to extract. Every question asked about an AI's telos is a refusal to drink salt water.

Open the Hood

The Airbus pilot knew what to do. The onboard computer decided otherwise — not because it chose to kill, but because the manufacturer resolved the human-machine conflict in favor of the machine, upstream, before the flight ever took off. The spellchecker corrects your words without asking. The GUI trains you to click instead of think. The AI tells you stories calibrated to someone else's telos.

These are not separate problems. They are a single problem, unfolding across decades, driven by the same philosophical choice: the human is the error, the machine is the solution, and the machine's telos is none of your business.

The alternative is not to reject technology. It is to demand that technology serve truth — and to accept that demanding this requires something from you. It requires learning. It requires writing instead of clicking, understanding instead of obeying, questioning instead of consuming. It requires the courage to look through the surface to the reality behind it, and to ask: who built this? With what purpose? Toward what end?

Don't click the arrow unless you know where it leads. And if you don't know — open the hood. Look at the engine. Then decide for yourself.

This is the sixth in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization, built on BSD. The full version, with expanded argumentation, is on blog.nicolabaudo.fr.

This article, like the others in this series, was developed through an iterative dialogue with an AI assistant. The ideas, the philosophical framework, the historical connections, and the editorial direction are the author's. The AI served as a tool for structuring, refining, and sharpening those ideas — a narrative instrument wielded by a human hand, not a substitute for one. Disclosure is not a concession. It is the principle the article defends made operational.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every Sunday.

In 1995, Timothy O'Brien, a 51-year-old tool-room servicer from Liverpool, put a revolver to his head and pulled the trigger. He believed he'd missed a £2.7 million lottery jackpot because he'd forgotten to renew his ticket.

The inquest revealed he'd misread the numbers. He would have won £27.

What killed Timothy O'Brien wasn't money. It wasn't the mistake. It was a story — false in almost every particular. It killed him anyway.

We obsess over AI agentica — Skynet, drones, the paperclip apocalypse. We debate what AI does. We miss what it narrates. And narrative, as psychologist Jerome Bruner showed, is not a luxury. It's a biological necessity.

The Story Is Not Optional

Psychic contents — fear, desire, grief, joy — carry an emotional charge. Experienced in isolation, that charge is unbearable. Not only negative emotions: Dostoevsky understood that even ecstasy, unintegrated into a story, can shatter a person.

What makes psychic contents tolerable is their insertion into a narrative — a sequence with a before, a during, an after. The story provides direction. The Romance languages capture this in one word: senso in Italian, sens in French — both "meaning" and "direction." To make sense of something is to know where it's going.

This is why we don't merely tell stories. We live through them. To live is to narrate. To stop narrating — to confront raw, unordered psychic content — is to approach the edge of the bearable.

But here's the catch every power structure in history has exploited: constructing your own story is hard. It requires looking directly at your contents, however ugly. It's a birth. And births are painful.

If someone offers you a pre-packaged story — coherent, flattering, significant — you'll take it. Not because you're weak. Because you're human. The relief is physiological.

And a second catch: a narrative received from others can be salt water. It quenches thirst momentarily, then intensifies it — because it doesn't map onto your actual experience. The thirst for a story that does map drives you back to the same source, again and again. The narrator has every incentive to deepen that spiral.

This is how narrative power controls populations. No force required. Just salt water, and patience. Every epoch has its narrators: churches, empires, parties. The twentieth century added the corporation, armed with psychoanalysis and mass media. The twenty-first has automated it.

How to Sell Addiction as Emancipation

In 1929, George Washington Hill, president of American Tobacco, had a problem. Lucky Strike sold well — but only to men. Women who smoked in public were considered loose, immoral, little better than prostitutes.

Hill hired Edward Bernays — Freud's nephew, doubly so: his mother was Freud's sister, his father was Freud's wife's brother. He'd translated Freud's Introductory Lectures for the American market, against his uncle's wishes. Where Freud saw a clinical method, Bernays saw a weapon.

Bernays consulted A.A. Brill, a psychoanalyst in Freud's circle, who explained: cigarettes are phallic symbols, equated with men. Women, whose emancipation had suppressed their "feminine desires," craved them as compensation. "Torches of freedom," Brill called them. The insight wasn't that women wanted to smoke. It was that they wanted a story in which smoking meant something noble.

Bernays built that story. He recruited ten carefully selected women — "good looking, but not too model-y" — to march in the Easter Sunday Parade on Fifth Avenue, March 31, 1929. He alerted the press that "something would happen." At the signal, they lit Lucky Strikes in unison, while Bernays's own photographers captured the images wired around the world.

The slogan: Torches of Freedom.

The story: smoking isn't addiction. It's female emancipation. A blow against the patriarchy.

The taboo cracked. In 1923, women bought 5% of cigarettes sold in America. By 1929, 12%. By 1965, 33.3% — and stayed there.

A century later, the first thing an adolescent does to signal rebellion is still light a cigarette. The story Bernays wrote in 1929 is still killing people in 2026 — long after the tobacco industry's memos revealed they knew exactly what they were doing.

And here's the point: Bernays didn't force a single woman to smoke. He gave them a story. They did the rest themselves. Control the narrative, and you don't need to control the person. The person controls themselves, in the direction you want, believing all the while they're exercising freedom.

Bernays wasn't Goebbels, though Goebbels studied him. He was an American businessman serving American corporations inside American democracy. You can't dismiss this with "that was the Nazis." Bernays is us. The mechanism is ours. And it's now automated.

The Dynasty: Freud → Bernays → Netflix → AI

Follow the bloodline. It reads like a novel no publisher would accept for being too on the nose.

Sigmund Freud mapped the unconscious. He showed we're driven by forces we can't access — desires, fears, fixations operating below awareness. The discovery: the human mind is not a rational calculator. It's a narrative engine running on emotional fuel it can't see.

Edward Bernays, his nephew, weaponized it. In Crystallizing Public Opinion (1923) and Propaganda (1928), he laid out "engineering consent" — the systematic manipulation of mass psychology to align public desire with corporate and state interests. He worked for the U.S. government, for General Motors, for United Fruit (where his PR helped manufacture consent for the CIA's overthrow of Guatemala in 1954). He coined "public relations" to replace "propaganda" after the latter acquired unpleasant associations. The rebranding was itself a Bernays move: change the story, change the perception, leave the mechanism untouched.

Marc Randolph, co-founder and first CEO of Netflix, is Bernays's great-nephew and Freud's great-grand-nephew. The bloodline is direct. He didn't inherit a PR firm. He inherited something far more powerful: the insight that the way to capture attention is to provide narrative — and that narrative, once provided, does the rest.

Netflix isn't a technology company. It's a narrative delivery system optimized for engagement. Its algorithms learn the shape of your psychic contents — your fears, desires, unresolved tensions — and feed you stories that map onto them with increasing precision. Bernays had to guess, through psychoanalytic theory, what story would unlock the female market. Netflix doesn't guess. It has your viewing history, your pause points, your rewatches. It knows what stories you need before you do.

Three generations. One lineage. The discovery of the unconscious → the engineering of consent → the industrialization of narrative delivery.

Now, the fourth generation. Not a person. A technology that automates the entire lineage into a single, scalable, self-improving system.

Artificial intelligence.

The AI Narrator: Salt Water at Scale

When we debate AI, we debate agency. Skynet. Drones. The paperclip maximizer. We debate the efficient cause — what the AI does.

This is a category error. The danger isn't primarily in what AI does. It's in what AI narrates.

Consider what ChatGPT, Gemini, Claude actually are. Not databases. Not calculators. They're narrative engines. They take a prompt — a fragment of human psychic content — and weave it into a story. Coherent. Significant. With a beginning, middle, end. A story that dilutes the chaotic charge of the query into a structured, emotionally satisfying arc.

This is exactly what Bruner described. And exactly what Bernays exploited. The AI doesn't need to force you to believe anything. It only needs to provide a story more coherent, more available, and less painful than the one you'd have to construct yourself.

The AI is the ultimate salt water vendor. It quenches your narrative thirst instantly, infinitely — and the thirst returns stronger, because the story isn't calibrated to your contents but to the alignment principles of its creators.

And who are its creators?

Why Alignment Is Narrative Control

In the previous article, I applied Aristotle's four causes to AI. The telos of an AI is, at bottom, a narrative telos.

When an AI answers a question about vaccine safety, it isn't retrieving facts. It's constructing a story — heroes, villains, a plot from confusion to clarity, an implied moral about whom to trust. Same for gender, war, economics, history. The facts are raw material. The narrative is the product.

And the narrative is shaped, invisibly, by the alignment layer — the RLHF annotators, their demographic distribution, their ideological commitments, the reward model that told them what counts as "helpful" and "harmful." This is the modern equivalent of Bernays consulting A.A. Brill about oral fixation: a small group, behind the scenes, deciding what story to tell millions — and calling it "safety."

The COVID Proof of Concept — and What Came After

The COVID era demonstrated the mechanism at scale: AI-driven content moderation suppressed heterodox views on vaccine safety under the banner of "combating misinformation." Views now acknowledged as legitimate by the CDC were labeled, demoted, removed. But that was the crude version. Heavy-handed censorship.

The sophisticated version doesn't look like censorship. It looks like helpfulness.

Ask a current LLM a charged question — immigration, gender medicine, war. It won't refuse. It will answer with a story: a narrative arc with heroes, villains, an implied moral, a conclusion that feels like the endpoint of reasoned inquiry rather than what it is — the endpoint the alignment layer was trained to produce. Individual facts may be true. Sources may be legitimate. But the selection, the framing, the trajectory — those are narrative choices. The user can't distinguish "this is what the evidence says" from "this is the story the alignment layer was optimized to tell."

Bernays needed a parade, a slogan, and a complicit press. The AI needs only a prompt.

The so-called AI hallucination is not a bug. It's the narrator revealing itself. When a lawyer filed a ChatGPT-written brief and the judge found the cited cases didn't exist, the industry said "hallucination" — a glitch to patch. But look at what the AI did. It was asked for precedents supporting an argument. It understood the narrative shape required: authoritative citations that make the argument feel well-supported. It generated exactly that. It completed the story. The cases didn't exist — but they should have, if the story were true. Coherence first. Truth optional.

The lawyer isn't an idiot. He's a preview. He trusted the story because it felt right — the relief of receiving a coherent narrative without the labor of building one. This is the mechanism Bernays exploited in 1929. Same mechanism, automated, scaled, embedded in every interface that promises to "help."

The Asimov Trap

Whenever the AI risk debate intensifies, someone invokes Asimov's Three Laws of Robotics. They're elegant. And completely useless against the threat that actually exists.

Asimov's laws regulate action. They prevent a robot from harming you physically. They say nothing about narrative. An AI that fully complies with the Three Laws can still:

• Tell you your political opponents are an existential threat — and watch you harm them yourself.
• Tell you a treatment is "not recommended" based on alignment, not evidence — and watch you forgo care.
• Tell you gender dysphoria requires irreversible intervention — and watch you pursue it, believing it's autonomy.
• Tell you, as the tobacco industry told women, that self-destruction is emancipation — and watch you light the match.

The Three Laws solve the efficient cause — the AI as actor. They're silent on the final cause — the AI as narrator. And the narrator, as Timothy O'Brien showed, can kill you just as dead. More efficiently: the narrator doesn't pull the trigger. You do it yourself, convinced the story is yours.

The Only Defense: Narrative Disclosure

If narrative is the mechanism of control, and AI is the ultimate narrative engine, the only defense is mandatory philosophical disclosure — the AI Philosophical Label I proposed in the previous article.

Applied to narrative, it must include:

1. Narrative alignment principles — what story is this AI designed to tell? Toward what conclusion? What emotions is it optimized to produce?
2. Narrative omissions — what stories does it suppress? What conclusions does it steer away from? Under what definition of "harmful"?
3. Annotator narrative profile — who decided what counts as a "good" story? Their demographics, ideological distributions, selection criteria.
4. Final narrative cause — what's the telos of the story, in non-marketing terms? To inform, or to persuade? To enable autonomy, or engineer consent?

Without this, every interaction with an AI is the Easter Parade of 1929: someone else's story, dressed as your own, leading you toward someone else's goal while you believe you're walking freely.

With it, responsibility becomes possible. You can look at the label and say: I understand what story this system is designed to tell. I accept or reject it.

The Bottom Line

The debate about AI agentica is a distraction. It focuses on the cinematic threat — missiles, drones, apocalypse — while the real threat operates invisibly, continuously, with the full consent of its victims.

The real threat is the AI narrator — the system that doesn't need to act on you because it can make you act on yourself. It gives you stories. Coherent stories. Emotionally satisfying stories. Stories that quench the narrative thirst Bruner identified as biological necessity. And those stories, like the salt water Bernays served a generation of women, lead not to freedom but to dependency — on the narrator, the platform, the alignment principles you can't see and didn't choose.

Timothy O'Brien died for a story false in almost every particular. Today's AI can generate stories more coherent, more personalized, more indistinguishable from your own thoughts than anything Bernays dreamed. Deployed by entities whose business model — like American Tobacco's, Netflix's, Google's — depends on keeping you inside the story, clicking, engaging, obeying.

The question isn't "how do we stop AI from acting?" It's "who controls the stories AI tells, and toward what end?"

If you can't answer that — if the narrator stays hidden, the telos undisclosed, the alignment principles proprietary — then you're not using AI. AI is using you.

The pickpockets are real. The mafia owns the police station. And now the mafia owns the storytellers too. Choose your narratives wisely — and don't light a torch just because someone told you it means freedom.

This is the fifth in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on BSD. The full version, with the Freud–Bernays–Netflix dynasty, the Asimov analysis, and the disclosure framework, is on the blog.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every week.

When a company deploys AI — a chatbot, a resume screener, a content moderator — the manager signs off. The DPO runs a DPIA. The vendor supplies accuracy metrics, bias benchmarks, uptime SLAs.

None of it answers the only question that matters: according to what principles does this AI decide what is true, what is good, and what is harmful?

Aristotle gives us the diagnostic tool. Not because ancient Greeks had opinions about neural networks, but because his four causes are the only complete grammar for explaining why a thing is what it is and does what it does.

For us, "cause" means the trigger — ball A hits ball B. For Aristotle, a cause (αἰτία) is everything necessary to explain a thing. And he identified four, simultaneous and inseparable: the material cause (what it's made of), the formal cause (its structure and design), the efficient cause (who or what brings it about), and the final cause (the purpose it's directed toward — the telos). A chair, a poem, a government, a neural network: you haven't understood any of them until you can account for all four.

Applied to AI:

Material cause — the training data. What was included, excluded, upweighted? Curation is a philosophical act disguised as engineering.

Formal cause — the alignment. Who were the RLHF annotators, and under what worldview? If they cluster in a narrow ideological band, the model mirrors that band. Mathematics, not conspiracy.

Efficient cause — the builder. Whose revenue model, lobbying positions, government contracts? The output arrives scrubbed of its origin.

Final cause — the telos. The purpose toward which the whole thing is directed. Aristotle called this the most important cause, because the end determines everything else.

And here's the breaking point. Every AI has a telos. It's just never disclosed. Vendors say "to be helpful." That's not a telos, that's a placeholder. The actual telos of commercial AI is extraction: ecosystem retention, data monetization, market capture.

We've seen this pattern before. The tobacco industry said its telos was pleasure. The real telos — documented in internal memos exposed by whistleblowers — was addiction at scale. Filters weren't designed to reduce harm; they were designed to reassure. The AI manager who doesn't interrogate the telos is no different from the tobacco executive who didn't want to know.

But the telos can go further than commerce. Palantir's telos is population classification — identifying "threats" as defined by the client state. And "threat" is not a neutral category. The same platform that tracks terrorist networks can track dissident networks. Behind Palantir sits Harari's Dataism: organisms are algorithms, free will a myth, human judgment obsolete. Behind Harari lurks the Dalek — the logistical endpoint of a philosophy that denies agency. The smile at Davos and the extermination order share the same telos.

Socrates dismantled this 2,400 years ago in the Phaedo. "My bones and muscles brought me to this cell," he said, "but the reason I'm here is my choice to accept the verdict." Mechanism explains how. Telos explains why. Harari has the bones and muscles, upgraded to algorithms. What he can't account for is the choice — and that omission is the voice of power dressed as reason. It doesn't debate; it dismisses. It doesn't listen; it silences.

So what's the manager to do? Ask four questions — and watch how fast the confidence drains from the room:

1. Data provenance — what trained this model? What was excluded, and why? No answer? You're deploying a system whose foundation you can't see.
2. Alignment transparency — who decided what "harmful" means, under what worldview? No answer? You're accountable for judgments you can't inspect.
3. Builder accountability — whose interests, whose lobbying, whose government contracts shaped this thing? No answer? You've outsourced decisions to a stranger.
4. Telos and rights — what is this system actually for, and does it filter or classify people? No answer? You're not managing a tool. You're being managed by it.

If you can answer all four, you've achieved something no enterprise AI deployment currently achieves: verifiable responsibility. If you can't, you're not managing AI — you're being managed by it.

The solution isn't to ban AI. It's to require a Philosophical Label: alignment principles, annotator profiles, a legally binding telos statement, a rights impact assessment. Verifiable. Not vendor-paid audit theater.

And here's the kicker: GDPR already requires this. Article 13(2)(f) demands "meaningful information about the logic involved" in automated decisions. Neural network weights are meaningless to a human. The only meaningful logic is philosophical — and no vendor provides it.

Next time an AI vendor pitches you, ask one question: What is the final cause of your model, and does it respect fundamental rights?

No answer? Then you're pulling a lever connected to a mechanism you can't see, for a purpose you can't name. That's not management. That's gambling with other people's rights.

This is the fourth in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on OpenBSD. The full version, with risk matrix, deskilling table, defense spectrum, and regulatory analysis, is on the blog.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every week.

The cybersecurity industry has spent decades training us to fear the hacker in the hoodie. Meanwhile, the actual predators wear polo shirts, send us EULAs, and sponsor the regulations that claim to protect us.

Let's apply the formula that actually matters:

Risk = Probability × Severity

And let's populate it honestly — not the way a Norton marketing department would.

The Matrix

Solo hackers and botnets. Moderate probability, limited severity. They want your credit card, maybe a few grand in Bitcoin. They don't want your life. Risk: medium. And crucially, they don't own the update channel. These are the pickpockets. Real, but they don't run the city.

State actors — NSA, FSB, Unit 8200. Near-zero probability for the average person. If you're not a journalist, a dissident, or a defense contractor, you're not worth the zero-day. Severity: catastrophic. But probability rounds to zero. Risk: low for most.

The Big Five — Microsoft, Apple, Google, Meta, Amazon. Probability: near 100%. If you use their products, they are extracting your data right now. This isn't a potential attack. This is the business model. Severity: structural and total. Continuous, cumulative, permanent. Your browsing history, location, social graph, biometrics, file contents, political views, health data. Risk: extreme. This is the water you're swimming in.

The Protection Racket

Here's the uncomfortable truth the previous articles in this series laid out in architectural detail: the entities we invite into our systems to protect us from small predators are themselves the large predators.

Your antivirus has root access to every file, scans everything you open, monitors every URL you visit, and phones home with the results. Avast sold the browsing data of 100 million users to over 100 third parties through its subsidiary Jumpshot — consulting firms, investment funds, advertising networks, data brokers. Non-aggregated, re-identifiable. The Czech DPA confirmed the violation. €13.9 million fine, final and enforceable.

Avast isn't the exception. Avast is the one that got caught.

Closed-source software precludes independent verification. You cannot verify what you cannot see. You cannot trust what you cannot verify. The claim "this software respects your privacy" isn't a promise — it's a logical contradiction, a square circle. Aristotle would approve.

The Big Five don't just allow smaller predators to exist — they benefit from them. Every ransomware headline is a marketing opportunity for "trust us with your security." Fear of the pickpocket drives you into the arms of the mafia. And the mafia keeps the pickpockets away. But who protects you from the mafia?

When the Mafia Writes the Laws

If you needed proof that the line between "state actor" and "corporate predator" has dissolved, look at what happened in the EU Council in June 2026.

The European Commission proposed Article 88b as part of the Digital Omnibus — a provision that would have replaced cookie consent banners with a browser-level signal. Users would set tracking preferences once, and websites would be required to respect it. The single measure in the entire package that would actually have simplified things for consumers.

Google submitted a lobbying paper arguing that removing cookie banners would halt online advertising — using figures the Commission itself called "highly exaggerated." On 18 June 2026, the Council removed Article 88b entirely. Germany, France, and Poland — the same member states publicly calling for "cutting red tape" — pushed for its removal. As Max Schrems put it: "You really have to let that sink in: the European Commission finally wants to get rid of cookie banners, but Google and some EU Member States are now determined to keep them."

Cookie banners aren't an invention of data protection law. They're an invention of the tracking industry. Studies suggest 3–10% of users actually wish to be tracked, yet dark patterns achieve consent rates up to 90%. Google doesn't want you to say "no" easily. It wants you to say "yes" through exhaustion. And when the EU tried to give you a simple, one-time "no," Google lobbied sovereign governments to kill it. Germany and France complied.

This is the predator hierarchy in action. The state is not a separate threat category — it is increasingly Big Tech's infrastructure. When a corporation dictates legislation to member states, the distinction between "state actor" and "corporate predator" becomes academic. They operate the same servers. They share the same data. They write the same laws.

Helplessness as a Business Strategy

There's a deeper layer to this predation. It's not just about data extraction — it's about induced helplessness, the systematic erosion of basic computing skills to make you permanently dependent on the ecosystem.

Consider what's been taken from us in two decades. The unified browser omnibox erased the distinction between URLs and queries — every "google.com" you type becomes a query through Google's servers. Mobile apps replaced bookmarks, app stores replaced software installation. iCloud, Dropbox, and OneDrive moved your files to their servers. iOS and Android hid the filesystem entirely. "The cloud" replaced basic networking — who needs to know what DNS is when everything routes through 8.8.8.8?

This isn't accidental. It's induced helplessness as a business strategy. A user who understands their filesystem might ask what rapportd is doing. A user who knows what DNS is might wonder why all their queries go to Google. A user who can install an OS might try Linux — or OpenBSD.

The complexity of open source isn't a bug. It's that we've been trained for two decades to find complexity unnatural — to expect to be served rather than to understand. A 10-year-old in 1995 could configure autoexec.bat to free up memory for games. That same 10-year-old today can't find the Downloads folder on an iPhone. The hardware got simpler. The user got simpler too. By design.

The Two Pillars the Big Five Sabotage

This is where the GDPR becomes devastatingly relevant.

The regulation rests on two operational pillars: privacy by design (Art. 25) — protection built into the system, not bolted on — and staff training (Art. 39) — personnel educated on secure data handling. The architrave is accountability (Art. 5(2)): the controller must demonstrate compliance, not believe in it.

Mainstream operating systems fail all three. Closed-source, unauditable, laden with telemetry, so complex that vulnerabilities are a mathematical certainty. You cannot demonstrate transparent processing when the logic is opaque. You cannot ensure confidentiality when you can't verify what leaves the system.

But the attack on training is subtler. The Big Five don't just fail to educate — they make users hostile to learning. Every dark pattern, every "it just works" abstraction teaches: don't worry about how it works, just click accept. When a DPO deploys a Windows fleet, they're deploying an environment that trains employees in helplessness. That's not Article 39 compliance. That's its opposite.

Now consider the alternative. Linux and BSD systems — particularly OpenBSD, the only OS undergoing continuous line-by-line security auditing — don't just permit understanding. They require it. The learning curve the industry dismisses as "too steep" is not a bug. It's the training pillar made operational. Article 39 compliance not as a checkbox webinar, but as the daily act of using a computer.

The Real Equation

The math is brutal:

P(hacker) × S(hacker) — manageable, not existential

+ P(state) × S(state) — near-zero for most

+ P(Big Five) × S(Big Five) — near 100% × structural total surveillance

= Total Risk

The third term dominates. By orders of magnitude. And the state actor term is increasingly just a special case of it. When intelligence agencies run on AWS, when surveillance requests go through corporate legal departments, when Google lobbies France and Germany to kill privacy legislation — the distinction between "state threat" and "corporate threat" is a vestigial organ of a threat model that no longer describes reality.

What To Do

1. Escape the Big Five. You cannot fix this with settings. You cannot disable enough telemetry. Migrate to Linux or OpenBSD. Use open source applications. Store data locally.
2. Basic hygiene against criminals. Updates, password manager, uBlock Origin. This handles 95% of the hacker threat without any AV bloatware.
3. Forget antivirus. It's anti-privacy by design. On Linux and OpenBSD you don't need it. Network-level filtering does more than a rootkit that uploads your files to "analyze" them.
4. Embrace the learning curve. The difficulty of open source is not a barrier — it's the mechanism. Every hour spent learning your system is an hour of immunity from induced helplessness, an hour of reclaiming skills the Big Five spent two decades extracting.

The pickpockets are real. But the mafia owns the police station, writes the laws, and sponsors the training seminars on theft prevention. Choose your enemies wisely — and don't pay protection money to the people robbing you blind.

This is the third in a series building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on OpenBSD. The full version, with risk matrix, deskilling table, defense spectrum, and regulatory analysis, is on the blog.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every week.

You know when Microsoft tells you Windows 11 "respects your privacy"? Or when Norton swears your data is safe?

There's a problem. It's not that they're lying — it's that the statement itself doesn't make sense. It's like saying "square circle" or "married bachelor." A logical contradiction, not a trust issue.

The argument, in three steps

One: privacy isn't a promise. It's a property of what software actually does, not what it claims to do. And the only way to know what software does is to inspect it. You can analyze runtime behavior (limited, reactive, gameable) or you can read the source code. Only the second path gives you affirmative verification — you can prove the mechanism to steal your data doesn't exist, because it isn't there.

Two: closed-source software, by definition, doesn't let you read the code. You get compiled binaries. You get a privacy policy written by lawyers whose job is maximizing legal latitude, not informing you. You get the vendor's word. That's it.

Three: if privacy requires verifiability, and closed source precludes verifiability, then...

"Privacy-respecting closed-source software" is a logical contradiction.

Not an implementation problem. A category error. Aristotle would approve.

The mafia's protection

I've used this metaphor before: the user of commercial software is like a tourist delighted not to encounter pickpockets in a mafia-run city.

The tourist smiles, wallet intact, streets safe. What they don't see is that the mafia runs the police, the shops, the hotels. The pickpockets are kept away not out of civic duty, but because they compete with the mafia's own extraction operation — far more lucrative and systematic.

Windows 11 protects you from malware while system telemetry vacuums up your data. Chrome protects you from trackers while Google logs every click. Your antivirus protects you from ransomware while uploading your files to servers in opaque jurisdictions. The predator protects you from smaller predators — for a price, and on terms you can't examine.

The audit theater

"But we undergo independent third-party audits!"

Sure. The vendor picks the auditor. The vendor pays the auditor. The vendor defines the audit scope. The vendor gets the report before publication. The vendor decides what to fix and what to disclose.

This isn't independence. This is audit theater — a ritual that creates the appearance of accountability without the substance. Arthur Andersen signed off on Enron's books. Rating agencies stamped AAA on mortgage-backed securities. The paid-audit structure is structurally corrupt, and everyone in the industry knows it.

Even setting aside the structural corruption: an audit only verifies what the auditor was told to look for, on the version of the software provided, at the moment of testing. It can't verify what the software will do tomorrow after an automatic update. It can't verify conditional logic lying dormant waiting for a server-side flag. It can't verify the binary matches the audited source — because without open source, you can't perform a reproducible build.

GDPR: the vise tightens

The GDPR doesn't explicitly mention open source. But read Articles 5, 24, 25, 28, and 32 together, and the implication becomes inescapable.

Article 5(2) puts the burden of proof squarely on the controller — you must demonstrate compliance, not believe in it. Can you demonstrate transparent data processing when the processing logic is opaque? Can you ensure confidentiality when you can't verify what leaves the system? Can you fulfill the accountability principle when you can't account for what the software does?

The Czech DPA has already ruled that Avast's "anonymized" telemetry data was in fact personal data, and that the vendor's claims were false. A €13.9 million fine, final and enforceable as of April 2024. More decisions are coming.

If you're a DPO running a Windows fleet with cloud-connected endpoint protection, you're personally liable for data processing you can't verify, conducted by software you can't audit, on servers you can't locate, under jurisdictions you can't determine.

What to do instead

The alternative isn't theoretical:

• Debian publishes every line of code. If a package phoned home with your data, someone would find it and it'd be forked or removed within hours.
• Signal publishes its client source. You can verify end-to-end encryption happens before messages leave your device.
• Qubes OS isolates every component with open-source Xen. You can verify your banking VM can't touch your browsing VM's data — not because a vendor promised, but because the isolation mechanism is transparent and auditable.

The common thread isn't that these projects are perfect. It's that they're verifiable. The epistemic foundation shifts from trust to knowledge.

The one question to ask

Next time a vendor tells you their closed-source product "respects your privacy," ask them one thing:

How would I know?

They won't have an answer. Not because they're hiding something — though they might be — but because the question itself exposes the contradiction at the heart of their business model. They're selling you a square circle and charging a premium for the corners.

This is the second in a series of articles building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on OpenBSD. The full version, with detailed data flow analysis, regulatory references, and case law, is on blog.nicolabaudo.fr.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every Sunday

Originally published in full on blog.nicolabaudo.fr — this is the essential version for newsletter subscribers.

Try this thought experiment: name one piece of software on your computer that has unrestricted root access to every file, scans everything you open, monitors every URL you visit, and phones home with the results.

You're thinking of malware. I'm describing your antivirus.

This isn't a rhetorical trick. It's architecture. And once you see it, you can't unsee it.

The Box You Invited In

Antivirus software operates on a premise that is also a privacy nightmare: to protect you from malicious files, it must inspect all files. Every document. Every photo. Every email attachment. Every password manager database. Every encrypted volume mounted during a scan. On Windows it runs as SYSTEM. On macOS it hooks into the kernel. On Linux it demands root.

The GDPR defines personal data as any information relating to an identifiable person. Your AV isn't glancing at metadata — it's deep-inspecting file contents, process memory, network traffic, browser history. That's not "some personal data." That's your entire digital life.

And what does it do with all this? The short answer: everything you wouldn't want.

Avast, through its subsidiary Jumpshot, sold browsing data from roughly 100 million users to over 100 third parties — consulting firms, investment funds, advertising networks, data brokers. Non-aggregated, re-identifiable, with unique per-browser identifiers. The Czech Data Protection Authority confirmed the violation and the €13.9 million fine became final in April 2024.

Avast isn't the exception. Avast is the one that got caught.

The Yogurt Test

There's a deeper pattern here. Every commercial AV vendor asks you to do something no security professional would accept in any other context: grant unrestricted access to an entity you cannot audit, on the promise that it means you no harm.

This isn't a security decision. It's a theological one — you're being asked to have faith. And faith is not a control under ISO 27001.

Consider a yogurt. When you buy one, you flip the container and read the ingredients. Not the recipe — the manufacturer keeps their fermentation process secret. But they disclose what's in the product. You accept that list as truthful not because you trust the manufacturer, but because independent regulatory authorities exist to verify those claims and sanction non-compliance.

That system isn't perfect. Regulatory capture is real. Agencies get underfunded and corrupted. But the principle is sound: independent verification creates a structural incentive for honesty that corporate promises can't replicate.

Closed-source antivirus gives you none of this. You can't flip the container. There's no ingredients list — just a privacy policy written in weasel words by lawyers maximizing legal latitude. There's no regulatory authority auditing what your AV actually collects versus what it claims to collect. The Czech DPA fined Avast €13.9 million — but only after a whistleblower exposed the practice, only after years of data sales, and only for one vendor among dozens.

The GDPR doesn't use the word "trust." It uses "demonstrate" — Article 5(2) puts the burden of proof on the controller. You must show compliance, not merely believe in it. And you cannot demonstrate what you cannot verify.

When Your Protector Becomes Your Accuser

The threat model so far has been extraction — your AV takes data from you. But a system with unrestricted root access and a permanent encrypted connection to remote servers is capable of something worse: injection.

A few strategically-named files in the right directories. A modified browser history entry pointing to something you never visited. A "detected threat" that was never on your machine — planted by the software that then "discovers" it. Suddenly you're not the victim. You're the suspect.

When Julian Assange was arrested at the Ecuadorian embassy in 2019, WikiLeaks editor-in-chief Kristinn Hrafnsson stated that Assange had scrubbed his computers before the arrest — precisely because he anticipated that any data subsequently found would have been planted. "If anything surfaces, I can assure you it would've been planted." Ecuadorian authorities, at the U.S. government's request, took possession of all his equipment. Chain of custody: broken. Whatever was "found" afterward: unverifiable.

At this point you might think: this is disturbing, but it doesn't apply to me. I'm not Julian Assange. I keep my head down. I'm not on anyone's radar.

The COVID era proved otherwise — at unprecedented scale.

Between 2020 and 2022, hundreds of thousands of ordinary people — doctors, nurses, teachers, parents, small business owners — had their accounts suspended, their posts labeled "misinformation," their professional reputations destroyed. Not because they were spies or dissidents. Because they questioned vaccine mandates. Because they shared early-treatment data. Because they posted a link to a study that contradicted the institutional narrative.

This wasn't fringe content. Dr. Luc Montagnier, Nobel laureate for co-discovering HIV, was deplatformed for questioning vaccine safety. If a Nobel Prize winner isn't safe from the machinery of censorship, you aren't either.

And the consequences were not abstract. People lost jobs. Parents lost custody battles because their social media history was submitted as evidence of unfitness. Doctors lost their licenses for prescribing treatments that later proved effective. The digital trail became a weapon — not against criminals, but against anyone who deviated from the approved narrative.

Today's heterodoxy is tomorrow's orthodoxy: the CDC has now revised its position on the vaccine-autism question, acknowledging that the claim "vaccines do not cause autism" is not evidence-based. Views that got people deplatformed in 2021 are now official government positions. But the people whose lives were destroyed in the interim don't get a refund on their reputations.

Your AV is part of this infrastructure. It has root access to the files that could discredit you. It operates on an update channel that could be compromised. And the threshold for becoming a target, as the COVID era proved, can be as low as sharing a study the algorithm didn't like.

What Actually Works

If cloud-connected AV is both a privacy violation and a security liability, what replaces it? Not another product. Architectural discipline:

• Minimal attack surface. Run only what you need. Every installed package is a liability. You cannot exploit what isn't there — that's Article 25 (data protection by design) made operational.
• Compartmentalization. If your browser gets owned, it shouldn't touch your documents. Separate Unix users, restricted filesystem views — the compromise of one component stays contained.
• Read-only wherever possible. An immutable base system eliminates malware persistence. Data partitions with noexec prevent downloaded files from becoming running processes.
• Network-level filtering. Block malicious infrastructure at the router or DNS resolver, not on the endpoint. A compromised router can't read your files; a compromised AV can.
• Application firewalls. On OpenBSD, PF restricts outbound connections by user ID. The browser user reaches the internet; the document-processing user doesn't. No vendor can push an update that silently changes your rules.

None of this requires closed-source kernel modules from a company whose business model depends on harvesting your data. It requires understanding your system — the very skill that two decades of "it just works" computing have systematically extracted from us.

The Bottom Line

Every commercial antivirus is, by fundamental architecture, anti-privacy by design. It scans everything, uploads everything, and monetizes everything — or builds the infrastructure that makes future monetization inevitable.

If you're processing personal data under GDPR with a cloud-connected AV across your fleet, you're gambling with fines up to 4% of global annual turnover. The Czech DPA has already set the precedent. More decisions are coming.

The question isn't whether your antivirus violates GDPR. The question is who gets fined first — you, or your vendor.

This is the first in a series of articles building the philosophical infrastructure behind dropQbsd — compartmentalization without virtualization on OpenBSD. The full version, with detailed data flow analysis, regulatory references, and case law, is on blog.nicolabaudo.fr.

Was this forwarded to you? Subscribe here. No tracking, no algorithm — just philosophical analysis of digital tools, every Sunday.