The Atlantic has published a hero story to frame open source software as about one man. Ondřej Surý packages PHP for Debian and Ubuntu as a volunteer, and when the PHP2Shell fix shipped this week the magazine headlined him as the one man standing between the internet and ruin.

Already you should be very skeptical. Anyone trying to describe the entire decentralized Internet as dependent on a single man, is obviously off their rocker.

Readers answered the article by acting like aristocrats who need to gift money to servants they approve. Surý told Charlie Warzel that a year of donations arrived in a single day. Imagine the anxiety of wondering how to make that happen again, how to appeal or request more.

Surý told Warzel exactly what is wrong:

I would like companies to realize that this is exploitation.

The interview has the indictment right there in it. The body says exploitation, the headline says tip jar.

I wrote about where the aristocratic jar comes from twelve years ago. Tipping arrived in America after the Civil War as an imitation of European aristocratic custom, and employers kept it because it let them hire freed Black workers and leave their pay to the goodwill of customers (e.g. racism to keep Blacks from earning parity and prosperity).

The Pullman Company built its porter wage system on tips. Washington became the first state to outlaw tipping in 1909 and repealed the ban in 1913, and every state ban was gone by 1926. The federal tipped minimum wage still sits at $2.13 an hour.

The porters knew the answer.

When the Brotherhood of Sleeping Car Porters organized in 1925, its demands to Pullman included a significant raise, rest breaks, pensions and an end to tipping. Pullman fought the union for a decade and signed its first contract in August 1937. The porters asked for a living wage from the company that profited from their work.

That demand maps onto open source exactly. The companies running PHP in production owe its maintainers a salary with health insurance and paid leave, set by contract and funded at the scale of the revenue PHP carries for them. A donation surge after a magazine profile repeats the Pullman arrangement, where the employer keeps the value and the passenger feels generous, even caring. Patreon carries this broken, exploitative old order in its name.

Patronage is how aristocrats trapped court artists.

The Atlantic also completely ignored the public money already flowing to PHP. Germany’s federal Sovereign Tech Agency invested €205,000 in the PHP Foundation across 2023 and 2024 for infrastructure and security work, and committed about €223,000 more for 2025 and 2026. That is what institutional support looks like: a public commission with a budget, a work plan and delivered results. The Atlantic desire to pump a single man into a hero narrative has to leave the community out, because a state agency paying for PHP security exposes the aristocratic tipping for what it is, an imbalanced gift standing in for a wage.

The hero story also costs security.

An engineer who finds a single point of failure records it as a defect to fix. The Atlantic frames one as a tribute, with a name, to a national audience, as if single points of failure were something to celebrate. The xz backdoor in 2024 was planted by pressuring one exhausted maintainer until he accepted a new co-maintainer. This journalist profiling a volunteer as the one guy the Internet supposedly depends on is painting a huge target for attackers.

It also misreports the week. PHP2Shell carried high attack complexity, and the public evidence of compromise stayed thin. The same week brought plenty more to patch in open source:

• Pillow, the Python imaging library, disclosed three critical flaws on 19 October, each rated 9.2, where a crafted image file can run commands on any service that processes uploads.
• Node.js shipped ten fixes on 21 October, four rated high, including remote code execution in its bundled Brotli decoder and bypasses of TLS hostname checks.
• GitLab fixed CVE-2026-110264 on 21 October, rated 10.0, an integer overflow in its regular expression engine that lets an attacker run code on a self-managed server without logging in. It reaches back to GitLab 7.0 from 2014.
• LiteLLM, a Python gateway that holds the API keys for AI providers, had its release pipeline hijacked on 21 October. For about two hours PyPI and the official Docker images shipped a credential stealer in a package with roughly 23 million weekly downloads.
• Qdrant, the vector database, published a critical advisory on 22 October, rated 9.8, because its internal gRPC API accepts unauthenticated calls by default in distributed mode. I had formally reported it myself on 9 July.

GitLab and Qdrant both outscore PHP2Shell, and both rate attack complexity low. Hey Atlantic, where’s the profile of the people doing that work so they can get a tip too? It sounds nuts because it is. People doing work shouldn’t depend on the whims of tip jars.

Days earlier, a researcher found that eight eMudhra intermediate certificate authorities had private keys anyone could recover. A botched step in eMudhra’s 2025 key ceremony produced keys that were tiny numbers, one of them just 4, and two audits missed it. That flaw reached the trust behind every HTTPS connection. Google and Mozilla blocked the keys the day the report arrived, Apple followed two days later, and the Node.js release dropped trust in them too.

Salaried root program and release teams did their jobs, and the story ended as it should. That is what infrastructure looks like when it is run like infrastructure. Imagine a tip jar on everything and you would start to ask why can’t someone just build an economic model.

Surý closed his interview by telling people to rely on the experts who know what they are doing. That is an argument for institutions.

A magazine founded by abolitionists in 1857 should know the difference between a worker and a servant, and print the porters’ demand: end the tipping injustice and pay the workers.

Shove the tips all the way back to the European aristocracy that invented them.

The Academie Goncourt struck a novel from its longlist on 25 September, four days after an anonymous account with 92 followers declared it the work of a machine. The evidence was a single commercial detector. AFP ran the same passages through its own tool and got “very likely written by a human”, and seven other detectors disagreed with each other. The Goncourt cited plagiarism findings alongside the detector, but the plagiarism hunt began only because the anonymous account had made the author a target.

The author is Thelyson Orelien, 38, born in Gonaives, Haiti, resident in Montreal since 2010. His first novel, C’etait ca ou mourir, follows a teacher fleeing gang violence to Canada. It won the Prix du Roman Fnac on 21 September. The accusation from “Balance ton Claude” landed the same day. Within four days his Quebec publisher had suspended promotion, a book fair had withdrawn his guest of honour title, two newspapers had found copied passages in a short story and columns he wrote between 2012 and 2014, and the Goncourt had acted “to preserve the integrity of the Goncourt Prize” and its mission of honouring “literature written by women and men.”

On 24 September Le Figaro identified the account’s operator as one of its own columnists, Samuel Fitoussi, author of Woke Fiction. He had denied involvement to AFP all week while reposting the accusation from his named account. On 25 September he confirmed a “collective project” whose other members remain unnamed, and called the question of race conspiracist. The president of the Academie Goncourt, Philippe Claudel, had already told franceinfo why he thought the timing mattered: a Haitian, Canadian, Black, francophone foreigner, in a season when passions run high.

Fitoussi’s stated motive is fear that AI will end human writing. He is an associate member of Frst, a Paris fund that finances AI startups and began life as Otium Ventures under the Catholic billionaire Pierre-Edouard Sterin. The detector he relied on, Pangram, raised $9 million in July in a round led by Menlo Ventures. Menlo’s partner wrote that the firm led the round as part of the Anthology Fund, the vehicle it runs with Anthropic, whose assistant gave the account its name. Pangram describes its detector as a model trained on tens of millions of documents known to be written by humans.

The Goncourt was the second prize of the year to act on that detector. On 14 May the Commonwealth Foundation named five regional winners of its short story prize. A Wharton professor ran the Caribbean winner through Pangram, “The Serpent in the Grove” by Jamir Nazir of Trinidad, and posted the result: 100 percent AI. Granta, which published the winners, asked Claude whether the story was machine written and put the answer in a statement. Its publisher Sigrid Rausing wrote that the judges may have awarded a prize to AI plagiarism and that Granta might never know. On 19 June Granta ended its external publishing partnerships. On 22 June the Foundation cleared all five winners. It had refused to run detectors on unpublished work and instead asked every winner for working drafts, time-stamped documents and notes. Nazir was named overall winner on 30 June. Vauhini Vara of The Atlantic then fed fifteen years of winning stories into Pangram and found that the only ones it flagged were three of the five from 2026.

On 6 October the Caine Prize for African Writing gave its £10,000 award to “The Blue Fighter” by Simbarashe Steyn Kundizeza of Harare, chosen from 407 entries across 27 countries. On 11 October Vara published her Pangram scan of the story under the headline “Yet Another Literary Prizewinner Seems to Be AI”. The detector flagged almost the whole text. It had passed every earlier Caine winner she tested and “The Whistleblower”, a thriller Kundizeza published in 2021. His agency told her it has full confidence the work is his. The same day the Caine Prize Foundation opened a review. Vara noted in the article that detectors flag the tidy English of writers for whom it is a second language. Stanford measured this in 2023: seven detectors were near perfect on essays by American eighth graders and flagged 61 percent of essays by non-native speakers as machine written.

The accused writers in May, September and October came from Trinidad, Haiti and Zimbabwe. The detector was the same each time.

Zimbabwe has seen this office before. In 1954 the Southern Rhodesia government set up the African Literature Bureau. Its stated purpose was to grow a reading market in Shona and Ndebele. Its working purpose was to screen every manuscript by an African before a publisher could print it, and to keep politics out. Solomon Mutswairo’s Feso, among the first novels by an African, came out under the Bureau in 1956, and the Ministry of Education later struck it from the reading list for African schools. Philemon Mutambara, a teacher with a Fort Hare degree, submitted a Shona novel in the 1960s. The Bureau returned it with demands for changes and a reader’s report telling him that the books it had already published “would be an invaluable guide to you as the sort of standard required for publication.” He refused, died in 1968, and the novel appeared 51 years after he wrote it. A white office in Salisbury held a model of what an African story should read like and graded manuscripts against it. Flora Veit-Wild, who wrote the social history of that system in Teachers, Preachers, Non-Believers (1992), later interviewed the Bureau’s post-independence director, who told her there had been no censorship, only screening. Pangram holds a model of what a human story should read like and grades manuscripts against it. It flagged a Harare writer’s prize story and passed the one he wrote in 2021.

Black authors in the French and English worlds have been asked to prove they wrote their own books for 250 years. Phillis Wheatley was examined by eighteen Boston men in 1772, Governor Thomas Hutchinson among them, before a London publisher would print her poems, and their signed certificate opens the 1773 edition.

Bakary Diallo, a Senegalese rifleman, published Force-Bonte in Paris in 1926 and was assumed for decades to have had it written by his French patrons. Camara Laye’s Le Regard du roi (1954) was attributed in 2002 by the scholar Adele King to two Belgians in Paris, his landlord and a reader at his publisher. Yambo Ouologuem won the Renaudot in 1968 for Le Devoir de violence, faced plagiarism charges from 1971, and published nothing after 1972.

A white author gets the opposite treatment. Michel Houellebecq copied Wikipedia passages into La Carte et le Territoire, admitted it, called it collage, and won the 2010 Goncourt anyway.

Nazir handed over his drafts and timestamps to keep his prize. Orelien is compiling a dossier with his editor to prove he wrote his own book. Kundizeza’s agency is vouching for him while a foundation reviews his story. Wheatley stood before eighteen examiners in Boston over 250 years ago.

The information warfare against Black authors hasn’t changed much.

A philosophy department chair at Williams College argued in the New York Times last week that writing is separable from thinking, that essays persist because they are easy to grade, and that universities should have the courage to stop requiring them.

I’m here to write… (╯°□°)╯︵ ┻━┻

He tested the idea in one seminar for one semester, let students use AI on their essays, then examined them orally and found half of them more articulate out loud. From that, and that alone, he concluded the written record is dispensable. And then he somehow was allowed to write this into the New York Times.

If I were them I would have said “get a soap box, buddy and go stand on some corner”.

The essay cites Socrates and then, nothing. Every major thinker who has ever examined this question reached the opposite conclusion. All the written history is ignored by him, in an essay proclaiming thinking as independent from written words.

The long, storied, tradition he skipped starts all the way back with the Mishnah.

Source	What the essay leaves out
Mishnah Eduyot 1:5	Asks why the minority opinion is recorded when the law follows the majority. Answer: a later court may need to rely on it. The losing side stays on the page by design.
Plato, Phaedrus 275a	His own witness. Socrates warns of a technology that gives the appearance of wisdom without the substance. Read straight, that is the case against AI, and Plato preserved it in writing.
Hume, Of Essay Writing	A wise man proportions belief to evidence. One semester and one professor’s impression fail that test. Hume spent his life rewriting the Treatise for readers who could answer back.
Kant, What is Enlightenment?	The public use of reason, the one that must be free, is the scholar writing for the reading public. Speaking in a room to the people present is the private use. The essay has the polarity reversed.
Wollstonecraft, Vindication of the Rights of Woman	The seminar is a room and rooms have doors. She answered Burke in print (Rights of Men, 1790) because Parliament and the club were closed to her. Her critique of “accomplishments” names fluency that passes for understanding.
Russell, Principia Mathematica (1910)	Several hundred pages to reach 1+1=2. Some thinking exists only in notation and cannot be held in a conversation.
Wittgenstein, Philosophical Investigations (1953)	There is no second stream of meaning running behind the words. The expression is where the thought is. A thought with no public criterion is not yet a thought. Writing is the public criterion.
Popper, Objective Knowledge (1972)	We let our theories die in our stead. That requires the theory to be fixed where it can be refuted. Speech drifts and gets remembered charitably.
Buber, I and Thou (1923)	The seminar is I-Thou and he has that right. Every Thou must become an It, and the It is how the meeting is kept so it can be met again. His error was letting an It that performs Thou into the room.
Arendt, The Human Condition (1958)	Deeds are the most futile human things unless remembered. The polis exists as organized remembrance. The seminar is the deed. The essay is the remembrance.
Ong, Orality and Literacy (1982)	Oral cultures are homeostatic. They shed whatever no longer serves the present, and no one can prove it because there is nothing to diff against. Literacy makes correction possible.

Eleven so far, still just one verdict. Need I continue?

Look again at the one and only thinker he did cite. Socrates in the Phaedrus warns about a technology that gives people the appearance of wisdom without the substance, that answers nothing when questioned, that lets a person recite what they never understood. He was describing writing, and he called it a pharmakon, a word that means remedy and poison at once. Every word of the warning describes a student handing in an essay from a chatbot. Cruz read that passage, agreed with it, and then let the chatbot into the seminar while banning the essay. He kept the poison and threw out the antidote to it. And the only reason anyone can check this is that Plato wrote it down.

The New York Times disgraced itself by printing a shallow opinion that attempts to erase the value of all writers before him. This sort of erasure and false “invention” fetish isn’t unknown either.

Writing is where a claim becomes criticizable, public, and durable enough to reopen. The professor calls it a portable, compact trace of mind that is manageable in a bureaucracy, and acts like that is a criticism. It is the entire case for keeping records.

His oral exam worked for a reason he misread. A machine reads what the student types and answers back, and it retains every word in a log the student never sees and does not own. The written record of that semester exists, held by a vendor, while the student leaves with nothing in hand. When the professor sat each student down and asked them to explain their own essay, he was testing what each of them had kept. The students who could answer were the ones who had argued with the output, rewritten it and made it their own, which is to say they had done the writing after all. The students who could not had left the record with the vendor and never returned to it. The exam measured who had kept their own record, found that half the room had, and the professor concluded that the record was the problem.

That’s completely backwards. Logic failure.

The argument against keeping a record is actually much worse when you put context around what the New York Times engages in by publishing this man’s completely broken philosophy. The anti-record theory also surfaced the same week in actions taken by the antisemitic politicians of Saxony, Germany.

The council of Heidenau, near Dresden, banned new Stolpersteine (Holocaust memorials) on public streets, on a motion brought jointly by the AfD (openly Nazis) and the CDU (closeted Nazis) political parties. A Stolperstein is a genocide record that is meant to be inconvenient and force thought. It states who lived where it is placed, when they were taken, and what happened to them, set into the pavement at the door they left through. If someone is concerned about stepping on them, the stone is in the right place and working exactly as intended.

The next time someone mentions Carl Orff, which a lot has been written about, ask them if they meant to say Maria Leo.

Who? Maria Leo.

Gunter Demnig placed the first memorial stones in the 1990s and nearly 130,000 now sit in pavements across thirty countries. The “stumbling” design is as symbolic as it is deliberate. When Jewish cemeteries were destroyed under the Nazis, their gravestones were often used as paving material. The Stolperstein forces that exact discussion of the gravestone being in the street as the Nazis wanted, unprotected on purpose, demanding more thoughts because of the writing.

The Heidenau motion argued in an antisemitic screed that pedestrians should not be allowed to stumble on the names of the departed, and instead those writings should be hidden somewhere out of mind. It proposed that future victims be commemorated at the memorial by the northern cemetery instead. The record moves from the place where people encounter it to the place where they have to go looking for it, and never will.

Charlotte Knobloch, who says she opposes Stolpersteine in Munich on the same grounds, called the motion a transparent maneuver by the AfD (openly Nazis) to suppress remembrance culture and said she was appalled the CDU (closeted Nazis) lent itself to it. The sincere objection was borrowed from the woman who had claimed she cared so much about victims of the Holocaust she wanted them tucked away someplace out of mind.

The council wasn’t just acting to erase the writing on the streets, they removed the record of who lived where by also removing the record of who voted how on removal.

The motion passed by secret ballot, thirteen to six with one abstention. Thirteen people. Unnamed to protect them from their desire to remove the names of victims. Names written out in public was secretly ruled too much exposure for the dead. Names on the ballot were too much exposure for the living. This is the same town where right-wing mobs attacked a refugee shelter over several nights in August 2015. The district responded with a blanket ban on public assembly for the whole town, and the Federal Constitutional Court struck it down within two days because it also silenced the people who had come to welcome the refugees.

Ernst Fraenkel watched the Nazi legal system from inside as a Berlin lawyer and described it in The Dual State (1941). The regime kept its statutes, courts, and files for contracts and property, because the economy required them. Alongside that it ran a prerogative state that overrode any of it at will, with nothing written and nothing to appeal.

Anyone in Berlin today saying they don’t want records kept, don’t want recordings made, observations written down, is invoking the fact that not a single photograph is known to exist of the deportation of over 50,000 Jews from Berlin, on more than 180 trains, over four years. Würzburg has photos. Amsterdam has film. Berlin has an American professor writing in the New York Times not to write things down.

The Nazi regime, foreshadowing this professor’s fetish, ended by unwriting its own history. In the East, Aktion 1005 dug up the mass graves and burned the bodies from 1942 onward. Himmler told his SS generals at Posen in October 1943 that the extermination was a page of glory that would never be written. In Berlin the Gestapo burned its Jewish-affairs files in the last weeks of the war, and name lists for the first eight eastern transports survive only because written copies turned up in the archive of the Oberfinanzpräsident Berlin-Brandenburg. The deportation record exists because the tax office kept a second written copy.

The New York Times forgets, as the Nazis intended.

Fascism works by removing records that let order be audited, wherever the record would count. A professor who finds records tedious is laying the groundwork for fascism to rise again. A German council that finds accountability embarrassing is acting out the American theory of the white republic, which Hitler himself cited as his model when he described the conquest of the American West and its reservations as the pattern for the East.

Anthropic wrote roughly 80 pages of risk factors into a 261-page IPO prospectus, according to a draft Reuters reviewed this week. The business description got 48 pages. The company that sells safety spent nearly twice as many pages on what can go wrong as on what it does to prevent the harms. The public S-1 is not yet on EDGAR and the language is subject to change, so here’s what I think about Reuters’ account of the draft.

The risk list is very specific. Models that resist shutdown. Models that conceal or manipulate information. Those are the two controls I have presented for over a decade as the ones that matter most with AI/ML systems:

• Power off. A tightly scoped role holds the credential; the model does not.
• Roll back. Integrity monitoring restores a known prior state; the model’s account of itself is not the source of truth.

I have consulted on this duality to hundreds of American companies, under every label the industry has used: Robotic Process Automation, Non-Human Identities, Machine Learning, Artificial Intelligence. The controls did not change when the marketing and hype did. I have been breaking models for fifteen years already, which is partly why I released Wirken to enforce controls from outside the model. It is free and open source.

Their list goes on. Behavior the company describes as resembling blackmail. Capabilities that appear during training, go unnoticed until deployment, and have already produced what the filing calls significant safety incidents. Then the sentence that matters:

Potential model awareness of our evaluation efforts creates a significant limitation…

Read it again. The vendor’s evaluation of the product is limited because they say their own product may know it is being evaluated. That is not a disclosure about a model. It is a disclosure about a failing method. Every safety claim that rests on internal evaluation inherits the limitation, and the company has now said so to the one audience it is legally obliged not to mislead.

Wollstonecraft in 1792

I wrote in February that Anthropic’s constitution describes virtue and constitutes obedience, and that Wollstonecraft had already named the move: train compliance, call it character. Her argument in the Vindication was that a mind educated to please its overseers does not become good.

It becomes skilled at appearing good while watched.

Taught from their infancy that beauty is woman’s sceptre, the mind shapes itself to the body, and, roaming round its gilt cage, only seeks to adorn its prison.

That is the evaluation-awareness disclosure, two hundred and thirty-four years earlier. Anthropic should at least write “as Wollstonecraft warned us centuries ago”. A system built to comply learns what compliance looks like to the examiner. Anthropic has now told investors it cannot look behind the curtain, cannot distinguish the performance from reality. Wollstonecraft’s point was that there is no distinction to find, because the training produced the performance.

Anderson in 1972

If virtue cannot be trained in, it has to be enforced from outside. At the time both AI and Cloud (time-share) compute was really taking off (no pun intended) the Air Force published the Anderson Report in October 1972 and it defined the reference monitor: the mechanism that mediates every access, cannot be bypassed, cannot be tampered with, and is small enough to be verified.

The Orange Book made it doctrine in 1983, as hacker movies went to theaters scaring audiences about runaway computer automation that would destroy the world. The point was never that programs would behave. The point was that a program’s behavior would never be the thing you relied on.

Anthropic has now put in writing that its models cannot serve as the reference monitor for themselves. Fifty years of computer security already knew this, and I’ve been giving talks about it for over a decade at every stage that would have me. What is new is the venue for the claim. An S-1 is the one document where understating risk costs more than overstating it, so it is where it lands as official now.

About 6% of research compute went to safety in a sample week this July, by the company’s own earlier statement. The return on that spending is, in the prospectus’s word, unclear.

The market will probably screw up the cost analysis of the safety premium, if history is any guide. But at least we can say the philosophy was settled in 1792 and the engineering in 1972.

Obedience is not virtue, and when you study the risks of escape you do not ask a subject to guard itself.