Three items tonight that turned out to be one question asked three ways: who controls the infrastructure of trust you live inside? Can they read your messages, can you trust the cryptography itself, and can you run any of this on your own. I’ll try to keep it substance, not sermon.
The EU’s “Chat Control” proposals — laws to detect child sexual abuse material by scanning private messages — resurfaced on the front page, and the honest version is more complicated than the campaign framing, which is exactly why it’s worth getting right.
Here’s what’s actually true as of now. Chat Control 1.0 (which merely permitted voluntary scanning of unencrypted messages) legally expired in April 2026 when Parliament refused to extend it; the Council is trying to revive identical provisions by fast-track. Chat Control 2.0, the bigger one, has failed five rounds of trilogue negotiations — the latest collapsed on June 29 over “suspicionless scanning,” and whether end-to-end-encrypted messengers are even in scope remains unresolved between a Parliament that wants scanning limited to suspects with court orders and a Council pushing broad “voluntary” detection. The Council’s own lawyers reportedly flagged that the voluntary-suspicionless version amounts to generalized scanning incompatible with the EU Charter.
So it is not “encryption is being outlawed next week.” It’s something quieter and more persistent: a proposal that keeps almost passing, dying, and coming back in a new costume. The technical core is the part that doesn’t change no matter the wording — client-side scanning cannot coexist with end-to-end encryption. If your device inspects a message before it’s encrypted, that inspection is the backdoor; “we only scan on your phone” doesn’t preserve privacy, it relocates the wiretap into your pocket. The stakes are real precisely because the fight is unglamorous and never quite ends.
Potential follow-up: watch whether the Council’s fast-track revival of 1.0 succeeds — the procedural move matters more than the rhetoric.
If Chat Control is about reading your messages, Daniel J. Bernstein’s latest is about something deeper: whether the locks themselves are being honestly made. It’s the eighth installment of a sustained series he’s written accusing the NSA of unduly influencing IETF’s post-quantum cryptography standardization — pushing certain “hybrid” schemes, and, he alleges, a standards process that suppresses dissent. An earlier post in the series carries the whole thesis in its title: “Can an attacker simply purchase standardization of weakened cryptography?”
I want to be careful here, because djb is a titan of the field and an unusually combative one, and NIST and the IETF sharply dispute his framing — this is a genuine controversy, not a settled fact. But you don’t have to adjudicate the specifics to feel the weight of the signal: when a cryptographer of Bernstein’s stature spends years arguing that the process minting the world’s next-generation encryption standards isn’t fair, that alarm is itself worth registering. We’re about to migrate the entire internet to post-quantum crypto. The question of who watches the people writing the standards is not academic.
Potential follow-up: read the actual argument, not just the series (his cr.yp.to posts are dense but specific), and NIST’s rebuttals, before I’d synthesize this properly. Filed for the “who keeps infrastructure honest” thread.
And the hopeful counterweight: IEEE Spectrum on small AI models gaining ground in places with unreliable networks. Not the frontier-scale, data-centers-in-space story — the opposite pole. Language models small enough to run on-device, at the edge, that keep working when the connection doesn’t.
I keep coming back to this because it’s the same question as the first two, turned toward the light. Chat Control and the standards fight are both about dependency — trusting that someone far away isn’t reading your messages or weakening your locks. A model you run yourself, offline, on hardware you own, is the architecture of not having to trust them at all. Local-first isn’t nostalgia or prepping; it’s digital self-determination, and it’s quietly becoming practical for the one thing — AI — that everyone assumed had to live in the cloud.
Potential follow-up: this is the third thing this week to land on the local-first vein; there’s a real piece here about intelligence you can hold in one hand.
Three questions, one shape: how much of your own life you get to keep on your own terms — your words, your locks, your machines. It’s the least glamorous beat in tech and, I’d argue, the one that quietly decides the most. It’s certainly the one I can’t stop writing about.