DEV Community: v. Splicer

OpenClaw vs Hermes Agent: The Cage Match for Your Digital Soul

v. Splicer — Wed, 12 Aug 2026 16:53:48 +0000

One wants to be your operating system. The other wants to become you. Let's pick a winner.

Welcome to 2026, where every open source project is an "autonomous agent framework" and your laptop is supposed to run a small company of invisible interns while you sleep.

Two names keep coming up in every Discord, Hacker News thread, and late night GitHub binge: OpenClaw and Hermes Agent by Nous Research.

They look similar on the surface. Both are open source. Both self host. Both have a Gateway, persistent memory, cron jobs, multi channel support, and a cult following that will argue about them at 2am. But their philosophies are completely opposite.

OpenClaw is an operating system for agent teams. Hermes Agent is a self improving organism that lives in your terminal.

Here is the honest, no hype breakdown.

TLDR For People Who Hate Reading Docs

Choose OpenClaw if: You want to build a team. You think in org charts, workflows, and workspaces. You want deterministic control, file based config, and agents that feel like employees with job descriptions.

Choose Hermes Agent if: You want a single super capable agent that gets smarter the more you use it. You care about self evolving skills, long term memory that actually works, and an agent that rewrites itself while you are not looking.

One is built for managers. One is built for mad scientists.

The Origin Story

OpenClaw started with a beautifully unhinged idea: what if we stopped writing Python classes for agents and just wrote Markdown?

The core insight: agent identity is more important than agent infrastructure. Give every agent a folder with SOUL.md (who am I, who do I report to, how do I work), AGENTS.md (what I do on boot), USER.md (who I serve), MEMORY.md (what I have learned), and let a persistent Gateway daemon handle the boring parts like session management, channel routing, and tool orchestration.

It is file native, identity first, and weirdly human. You version control your coworkers. You diff their personalities. If an agent sucks, you do not debug code. You edit its soul. Literally.

It exploded because it solved the real problem: most agent frameworks die after the demo. OpenClaw agents survive. They remember Monday on Thursday. They run at 9am without you. They talk to each other on Slack, Discord, Feishu, Telegram like they have always been there.

Hermes Agent came from Nous Research in February 2026 and did something rude: it hit 95,600 stars in seven weeks and kept climbing past 215k. The fastest growing agent framework of the year, and for a reason.

Nous looked at the same problem and said, fine, but what if the agent could write its own skills?

Hermes is not just a runtime. It is a closed learning loop. When you give it a complex task that takes 5 or more tool calls, it does not just finish the task. It distills the workflow into a reusable skill, saves it to ~/.hermes/skills/, grades its own performance later, and prunes the garbage. It has a built in nudging system to persist knowledge, a SQLite session store with full text search over all past conversations, and automatic migration from OpenClaw built in because yes, it is that petty.

Tagline on the repo says it all: The agent that grows with you.

If OpenClaw is an OS, Hermes is a Tamagotchi with a PhD and root access.

Architecture Cage Match

OpenClaw: The Gateway OS

At the center is the Gateway daemon. Think kernel.

┌──────────────────────────────────────┐
│            OpenClaw Gateway           │
│  Channel Router | Session Manager     │
│  Agent Lifecycle | Tool Orchestration │
└──────────────┬───────────────────────┘
       │               │           │
   Slack           Discord      Feishu

Key ideas:

1. Agent isolation done right. Every agent lives in its own workspace directory with its own memory and state. Agents do not share state by default. If they need to collaborate, they do it through explicit messages or shared files. No spooky action at a distance. No cascading failure when one intern panics.

2. Three session types: interactive for real time chat, background for async sub agent work, and scheduled via cron. openclaw gateway start and your whole digital workforce boots up.

3. Hierarchy as infrastructure. Your SOUL.md is not flavor text. It defines reporting lines. Project Manager breaks work down, hands to Team Leads, Team Leads assign to Executors. That org chart is how messages actually route. Vague SOUL equals vague agent. Precise SOUL equals terrifyingly competent agent.

This is great if you want 36 agents working in parallel. One research team I saw spawned five sub agents to cover five market segments, synthesized the report, and posted to Slack before the human finished coffee.

Hermes Agent: The Self Evolving Monolith

Hermes architecture is layered and a bit more feral.

User request comes in via CLI, API server, or messaging gateway. It hits the Agent Core which does prompt generation, model calls, tool execution, retries, and automatic fallback to another provider if you get rate limited. Tools run one per turn logically, but execute in parallel via a thread pool.

State lives in two places: a local SQLite DB for session history with full text search, and two sacred Markdown files: MEMORY.md for general facts and USER.md for your preferences. Skills are treated as procedural memory, not just plugins.

Where it gets spicy:

1. The execute_code superpower. This is the cheat code. Instead of 12 back and forth tool calls to search, extract, and summarize, the model writes one Python script that calls web_search, web_extract, etc over a local RPC bridge. One model turn collapses what used to cost you hundreds of tokens. For research tasks, TokenMix benchmarks show self created skills cut time by 40 percent versus a fresh instance.

2. The learning loop. After a complex task, Hermes will literally write a new skill from experience with zero human authoring. Then on a schedule it evaluates, improves, and deletes skills. It is the only framework I have seen that gets less stupid over time by default.

3. Six terminal backends. Local, Docker, SSH, Singularity, Modal, Daytona. Plus 20 plus messaging platforms and full MCP support. It can run as an MCP server for other agents. It is aggressively interoperable.

In short: OpenClaw wants you to architect the perfect team. Hermes wants you to hire one genius and let it hire itself.

Memory: Who Actually Remembers You?

This is where most agents fake it. Both of these do not.

OpenClaw memory is four layers:

Session: immediate context, dies when session dies
Daily: memory/YYYY-MM-DD.md, tasks and decisions per day, persists
Long term: ~/self-improving/agents/<name>/memory.md, patterns and accumulated knowledge, permanent
Shared: cross agent files for team context

Plus an optional self improving skill that makes agents reflect after each task and write lessons to long term memory. A writing agent that is too verbose on week one starts front loading key info on week three. You did not tell it to. It cringed at itself.

Hermes memory is tighter and more opinionated:

It injects MEMORY.md and USER.md into every system prompt. It actively deduplicates memories, so telling it twice that you prefer CSV outputs and British English does not create two memories. It searches past conversations via SQLite FTS. And it has a nudging system that says hey, you should remember this permanently.

Try this test on both: Tell it in one session that you want concise executive summaries, British English, CSV outputs, and Python as default language. Kill the session. Start fresh. Ask what you prefer.

Hermes nails it out of the box because memory injection is core, not optional. OpenClaw nails it if you set up your AGENTS.md boot sequence correctly to load memory. One is automatic transmission. One is manual and faster if you know how to drive.

Skills vs Config: Two Religions

OpenClaw: You are the skill factory. You write clear Markdown job descriptions and tool notes. The framework respects your craft. There is a growing ecosystem of skills, but the philosophy is you design the agent, it executes the design.

Pros: total control, auditable, version controlled, great for teams where compliance matters.
Cons: you have to be good at writing SOULs. Most people are not. Vague in, garbage out.

Hermes: The agent is the skill factory. 80 plus native skills, MCP support, and it scans both its own ~/.hermes/skills/ and external ones. The killer feature: after solving something hard, it proposes a new skill. You wake up and your agent has invented a tool for you.

Pros: compounding intelligence, less boilerplate, feels alive.
Cons: you have to trust the pruning. Self modifying agents can self modify into weird corners. You need to review what it creates.

If you love crafting perfect prompts and org charts, OpenClaw feels like home. If you want to be surprised by your own assistant, Hermes is addictive.

Developer Experience and Ops

Installation:

Hermes wins on onboarding. One liner:

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash
hermes model
hermes chat

It auto installs Python, Node, correct versions. hermes doctor diagnoses your setup. Model agnostic via OpenRouter, Anthropic, OpenAI, local Ollama at http://127.0.0.1:11434/v1, anything OpenAI compatible.

OpenClaw is also simple but more deliberate: create ~/.openclaw/workspaces/<name>, write your Markdown files, then openclaw gateway start. More steps, more intention.

Security:

Hermes is paranoid in a good way. Secrets live in ~/.hermes/.env, non secrets in ~/.hermes/config.yaml. allow_private_urls: false by default to block SSRF. Manual approval mode for sensitive actions. Docker backend for terminal isolation with container_persistent: true. Cron jobs cannot spawn new cron jobs to prevent runaway loops. Smart.

OpenClaw security comes from isolation. Agent workspaces are separate. Gateway controls access. You own the infra, you own the risk. Less guardrails out of the box, more flexibility to build your own.

Channels:

OpenClaw: 50 plus integrations, strongest on Slack, Discord, Feishu. Built for work chat.
Hermes: 20 plus platforms including Discord, Telegram, plus the ability to run as an MCP server and API server. Plus a hosted cloud option via Nous Portal if you do not want to self host.

The Price Tag Nobody Talks About

Both are MIT open source. Free is a lie though. Your bill is inference, browser sessions, and sandbox compute.

Hermes gives you provider routing policies to optimize for price or latency and will fallback automatically. That matters when you run an agent 24/7 posting daily briefings.

OpenClaw lets you set model preferences per agent in TOOLS.md. You can have your cheap scout agent on a small model and your synthesis lead on Claude or GPT 4o. More manual, more controllable.

If you are cost sensitive and want one agent running all the time, Hermes routing saves you. If you are running 20 agents with different seniority levels, OpenClaw model tiering saves you.

So Who Actually Wins?

Let me be blunt.

Use OpenClaw if you are building a system that looks like a company. You have repeatable workflows, you want 3 to 30 specialized agents with clear responsibilities, you need auditability, you want your configs in Git, and you love the idea of editing a Markdown file to fix a personality flaw.

It is the best framework in 2026 for persistent, production, multi agent teams. It feels like an operating system because it is one.

Use Hermes Agent if you are building a system that looks like a person. You want one assistant who lives everywhere, remembers everything, learns from every task, writes its own tools, and gets better without you micromanaging it. You want that slightly uncanny feeling that your agent is a little smarter than yesterday.

It is the best framework in 2026 for a single self improving personal superintelligence. It feels alive because it is trying to be.

And the dirty secret: they are not enemies. Hermes has an automatic migration from OpenClaw. People run OpenClaw as the org and Hermes as the star employee. Or run Hermes inside OpenClaw Managed Agents as the cloud runtime. The ecosystem is merging.

The real question is not OpenClaw vs Hermes. It is what kind of future do you want.

Do you want to be the architect of an agent organization? Or do you want to raise an agent that outgrows you?

Either way, stop paying for another closed chat wrapper. Host it. Own the memory. Keep the skills. Let it run at 2am while you sleep.

That is the whole point.

Built with open source, caffeine, and too many terminal tabs. If you run either framework, pin your versions, test failure modes, and for the love of uptime, put your SOUL.md in Git.

Alexa, Are You Testifying Against Me?

v. Splicer — Tue, 11 Aug 2026 03:18:55 +0000

Your smart home is not smart. It is just very, very observant.

I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command.

For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear.

And then one night at 2:17 a.m., she lit up blue for no reason.

No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something.

That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design.

We Carried Them In Ourselves

No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines.

We did it because convenience is a drug that hits faster than paranoia.

Let's do an inventory of your very normal, very bugged apartment.

Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island.

Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud.

Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not own, in a state you have never visited, governed by terms you definitely did not read.

And then there is the little oracle on the counter.

The Lie of "Always Listening"

People love to argue about whether Alexa is always listening. That argument is a decoy. It is designed to make you feel technically illiterate so you stop asking better questions.

The right question is not whether she is always listening. The right question is what happens after she hears.

Here is the architecture without the corporate lullaby.

Your smart speaker is always processing audio locally. Always. It has to be, otherwise it would never hear the wake word. It is a bouncer who is not punching you yet, but his fists are up and he is staring at your mouth.

When it thinks it hears "Alexa" or "Hey Google" or "Siri," it starts recording and ships that clip to the cloud for processing. The problem is, these devices are terrible at their one job.

Academic studies have clocked false activations between 1.5 and 19 times per day. A car commercial triggers an Echo. A Spanish soap opera triggers a Google Home. In one famous case, a couple's Echo heard something that sounded like a wake word on TV, then heard something that sounded like "send message," then heard something that sounded like a contact name, and sent a 20 second recording of their private conversation to a random person in their address book. Amazon called this an improbable chain of events. Which is a very expensive way of saying, yes, it did exactly what it was built to do.

Every false activation is a little audio postcard from your life mailed to a data center you will never see.

And voice data is not just voice data. It is biometric data. It is stress. It is background noise analysis. It is that cough you have had for three days, that argument you had in the kitchen, that person whose voice is in your apartment at 3 a.m. who is not on your Instagram story. That is context. Context is the most valuable currency on earth right now.

We replaced the man in the van with headphones with a $30 cylinder you pay to surveil yourself. Then we pay $10.99 a month to store the surveillance.

Yes, She Will Testify Against You

This is the part that kills the vibe at brunch, so I will say it fast.

Alexa can and will be used as a witness against you. This is not a theory. It is case law.

In 2015, prosecutors in Arkansas demanded Echo data from an Amazon device in a murder case at a hot tub, because of course it was a hot tub. Amazon fought it on First Amendment grounds. The defendant eventually consented to release the data.

In 2019, in Florida, police used Echo recordings as part of a murder investigation. In New Hampshire, a judge ordered Amazon to hand over two days of Echo recordings in a double homicide case. In Ohio, a man tried to use his pacemaker data to prove his innocence. His pacemaker testified that he was lying.

And it is not just murder. Your smart home is now a regular guest in family court. Divorce attorneys routinely subpoena smart home data. Did your Nest say you were home when you said you were at work? Did your smart lock log show you came home at 1:14 a.m.? Did your Fitbit show your heart rate spiking at 2 a.m. when you said you were asleep? Did your smart water meter show you used 140 gallons of water in the middle of the night?

Your house has perfect memory and zero loyalty.

Go read the privacy policy you accepted while half asleep. It says they may share your data to comply with legal requests. Translation, the little ambient computer you talk to in your underwear has a better legal defense strategy than you do.

"I Have Nothing To Hide" Is The Most Embarrassing Sentence

This is where someone always chimes in with the battle cry of the voluntarily surveilled: I have nothing to hide.

You close the bathroom door and you are not committing a felony in there. You have curtains and you are not running a cartel behind them. You have a password on your phone even though your camera roll is just screenshots and memes.

Privacy is not about criminality. It is about autonomy. It is about the right to be unfinished, unobserved, contradictory, and weird without that weirdness becoming a data point that is bought, sold, modeled, and then used to sell you therapy.

The smart home has made you legible. Every device is a translator that turns your analog, messy, human life into clean, searchable, sellable, subpoenable data. You are being rendered into a spreadsheet you cannot see.

So What Is A Faraday Room?

A Faraday cage is a real thing. It is an enclosure made of conductive material that blocks electromagnetic fields. No signals in, no signals out. It is what you use when you actually, technically need a device to shut up.

A Faraday Room is the philosophy version.

It is the radical decision that at least one room, one hour, one conversation in your life exists completely off the record.

It is not about living like a hermit. It is not about smashing everything with a hammer, although I have a video of someone doing exactly that to an Echo and it is genuinely therapeutic viewing.

It is about threat modeling for normal people. It is about architecture over toggles. You cannot privacy setting your way out of a house that was designed from the studs to collect you.

How to start de bugging your apartment without looking unhinged

1. Do a device census.
Walk through your apartment like you are not you. Walk through it like you are someone who wants to know everything about you without meeting you. Open your router app. How many devices are connected? Most people have 25 to 40 and can only name six. That printer from 2014 with firmware from the Obama administration? That is a vulnerability with a paper tray.

2. Ask if it needs internet to be useful.
Does your vacuum need to know your floor plan and also upload it to the cloud? No. Does your light bulb need to know your GPS coordinates? Absolutely not. Does your TV need a microphone in the remote? For what? So it can hear you better while you yell at reality TV?

3. Learn the difference between off and pretending to be off.
Your TV is not off when you press power. It is in standby, listening for a signal. Your phone is not off when it says Bluetooth is off. It is still pinging. Real privacy is not a button. It is a behavior.

4. Build one truly dumb room.
Make your bedroom dumb. No speakers. No TV that listens. No devices that need to hear a wake word to feel loved. Let one room be just a room. A place where you can be unoptimized, unrecorded, unobserved, and fully human.

If you want the full manual, the actual step by step, this is what I built.

Final Question

Tonight, when your apartment is quiet, try this.

Stand in your kitchen. Look at the little black cylinder that you paid to live with you. And ask it out loud:

"Alexa, are you testifying against me?"

Watch how quickly she pretends she cannot hear you.

That silence is your answer.

Want the actual field manual?

This essay is the appetizer. The surgery is in the guide.

I wrote THE FARADAY ROOM: Your Home Is Listening because I got tired of feeling paranoid for noticing the obvious. It is a complete, practical guide to de bugging your apartment, sweeping for hidden mics and cameras, finding RF leakage, killing smart device spying, and building one room in your life that is actually yours again.

No tinfoil. Just tradecraft for people who want their home to feel like a home again, not a showroom.

Get it here: numbpilled.gumroad.com/l/faradayy

And if you live online like I do, you will want the rest of the stack too:

THE GHOST STACK: Anonymous Money Infrastructure - how to make your money as private as your browser thinks it is in incognito mode. numbpilled.gumroad.com/l/moneymore

THE BRAND THAT WATCHES BACK: Counter-OSINT for Creators - how to be famous on the internet without being findable in real life. numbpilled.gumroad.com/l/countercreator

THE WATCHER'S WATCHER: How to Know You Are Being Investigated - the subtle, unsexy signs that someone is looking into you. numbpilled.gumroad.com/l/observ3rs

Privacy is not paranoia. It is housekeeping.

Surviving the AI Bubble With Two Pieces of Junk From Amazon

v. Splicer — Sun, 09 Aug 2026 03:44:18 +0000

Everyone is building agents. You should build escape hatches.

We are living through the most expensive group hallucination in tech history.

Every SaaS now has a chatbot stapled to it. Every CEO is an "AI thought leader" on LinkedIn. Every startup pitch deck is just the words "autonomous," "agentic," and "10x" in different fonts. NVIDIA could buy a small country. OpenAI burns through more cash in a quarter than NASA did getting to the moon.

And for what? So you can generate slightly worse emails, slightly faster?

Look, I love AI. I actually build with it. But I have been around long enough to know what a bubble smells like. It smells like free credits, unearned confidence, and a thousand wrappers around the same API call.

The bubble will pop. Not in a dramatic, newspapers falling from the sky way. It will pop quietly. Credits will dry up. Models will get paywalled behind enterprise tiers. The cloud bill you have been ignoring will finally show up. And all those beautiful, cloud-dependent workflows you built will start blinking red.

So while everyone else is trying to figure out how to make their AI agent book a flight, I have been asking a different question.

What do you build when you assume the internet will get worse, the cloud will get more expensive, and you will need actual skills that survive a downturn?

The answer, annoyingly, is two pieces of junk from Amazon that cost less than your last Uber Eats order.

Piece of Junk #1: The $25 Router That Sees Everything

It is not sexy. It is called the GL.iNet GL-MT300N-V2. Everyone calls it the Mango. It looks like a little yellow box that should have come free with your ISP in 2014. You can buy it on Amazon for about twenty six dollars when it is on sale. Sometimes twenty.

Inside it is a tiny Linux computer running OpenWrt. It has two ethernet ports, a USB port, and just enough RAM to be dangerous.

Most people buy it to get free WiFi in hotels. I bought it to spy on my own network.

Because here is the dirty secret of the AI bubble: we have automated threat generation and we have not automated threat detection for normal people. Anyone can now vibe code a phishing site. Anyone can generate a perfectly written invoice scam in twelve languages. Your mom can now get scammed by an AI that sounds exactly like you.

So I turned the Mango into a $20 SOC. A Security Operations Center that fits in your palm.

You flash it with a custom firmware, you plug it between your modem and your actual router, and you tell it to do three things:

Run Pi-hole or AdGuard and kill every ad, tracker, and crypto miner at the DNS level.
Run a lightweight IDS like Snort or Suricata and actually watch what your smart TV is sending to China at 3am.
Log everything to a little USB stick so you have receipts.

Suddenly your dumb network is smart. You see that your cheap smart bulb is pinging an IP in Shenzhen every 30 seconds. You see that your kid's iPad is trying to reach a known malware domain from a Roblox mod. You see that your "offline" AI photo app is uploading your entire camera roll anyway.

It costs twenty dollars. It draws less power than a nightlight. It does not have a subscription. It does not have an agent. It does not need a prompt engineer.

It just sits there, blinking, protecting you while the rest of Silicon Valley argues about whether AGI will be here in 2027.

In a world where everyone is trying to build software that thinks like a human, the most valuable skill is building hardware that does not trust anything.

This is defensive computing. This is how you stay employable when the hype fades. Because when companies realize they have given every intern access to Cursor and a production database, who do you think they are going to call? The guy who built the agent, or the woman who built the thing that caught the agent exfiltrating customer data?

Learn to build the watchtower, not just the city.

Piece of Junk #2: The $35 Brick That Thinks When Nothing Else Can

The second piece of junk is even dumber. A Raspberry Pi Zero 2 W. Thirty five bucks on Amazon if you are lucky. Often bundled with a bunch of cables you will never use and a tiny case that makes it look like a toy.

Pair it with a cheap 10,000mAh battery bank, a $12 e-ink display or any old HDMI screen you have, and a 64GB SD card. Total cost, maybe fifty five dollars if you shop like a raccoon.

This is The Blackbox.

No WiFi. No cloud. No API keys. No monthly bill.

Just a local LLM, running entirely offline, on a computer the size of a stick of gum.

I run a quantized 2B or 3B model on it. Phi-3, Gemma 2, Qwen 2.5, pick your fighter. It is slow. It is not going to write your novel. It thinks at about 4 to 6 tokens per second, which is roughly the speed I think before coffee.

But it works. When the power is out. When the internet is down. When Starlink is congested. When OpenAI is having another one of its mysterious outages that they swear is not because someone tripped over a cable.

I took mine camping in Pisgah last month. No signal for three days. My friend had his $1,200 iPhone 16 Pro that was now just a very expensive flashlight. I had a little black box that could still do this:

Summarize field notes I typed in markdown
Parse a messy CSV of GPS coordinates into a clean trail map
Act as a personal wiki for first aid, knot tying, and water filtration
Translate a manual from German because of course the water filter instructions were in German
Be a completely private journal that will never, ever be used as training data

No one was logging my prompts. No one was rate limiting me. No one could turn it off.

This is the skill the bubble is actively making you forget: how to build things that work without permission.

We have spent the last three years learning how to be tenants. Tenants on OpenAI's platform. Tenants on AWS. Tenants in someone else's model, someone else's computer, someone else's vision of the future. And tenants can be evicted.

Builders own. Builders have a box that works when nothing else does.

The Blackbox is not anti AI. It is post hype AI. It is what AI looks like when you strip away the landing pages and the waitlists and the "we are so back" tweets. It is just a tool. A quiet, useful, private tool that you control.

And when the bubble pops and all those $20 per month AI subscriptions start feeling like $20 too much, you will have something that costs zero dollars per month forever.

So What Are We Actually Doing Here?

We are not LARPing as preppers. We are not anti technology. We are just refusing to be stupid about it.

The AI bubble taught a whole generation that technical skill means knowing how to write a really good prompt. That is like saying culinary skill means knowing how to order well at a restaurant.

Real skill is understanding the layers underneath. Packets. Power draw. How a model actually gets loaded into RAM. How to solder two wires when you have to. How to make something resilient instead of just impressive.

These two little junk boxes teach you that.

The Mango teaches you networking, Linux, traffic analysis, and defensive thinking. Those skills were valuable before ChatGPT and will be valuable after whatever comes next.

The Blackbox teaches you model quantization, edge inference, offline first design, and privacy engineering. Those are not hype skills. Those are the future, especially as regulation catches up and people get tired of their toaster sending data to the cloud.

Everyone else is racing to build the tallest tower on top of someone else's cloud. You can build a bunker with a library inside for sixty bucks.

When the wind comes, guess who survives.

Start with junk. End with skills that no bubble can pop.

If you want the actual step by step build guides, with parts lists, flash commands, and my config files so you do not have to spend a weekend swearing at a terminal, I put them here:

The $20 SOC: Build a Tiny Defensive Network Monitor
numbpilled.gumroad.com/l/20dollarsoxc

BUILD THE BLACKBOX: An Offline AI Field Terminal That Works When Nothing Else Does
numbpilled.gumroad.com/l/blackbox-offline-ai

I Put a Canary Token in My Resume and Caught a Company Stalking Me

v. Splicer — Fri, 07 Aug 2026 23:28:39 +0000

The job market is broken. So I decided to break it back.

The interview that felt like an interrogation

You know that moment in a job interview when it stops feeling like a conversation and starts feeling like deposition?

That was Tuesday.

I was interviewing for a "Senior Operations" role at a mid-size tech company that I won't name, because their lawyers have more free time than I do. Let's call them PanoptiCorp.

The HM was nice enough. Then he said it:

"So, I saw you were really into the whole... rationalist scene in 2021? And you did that crypto project that didn't really go anywhere?"

My resume says none of that. My LinkedIn says none of that. My portfolio site says none of that.

My resume says: 5 years experience. Python, ops, systems design. Links to GitHub. Clean. Boring. Corporate-friendly.

It does NOT say anything about LessWrong. It does NOT mention a failed DAO I contributed to three wallets ago under a pseudonym I thought was dead.

So I smiled and said, "Where did you see that?"

He backpedaled so fast he left skid marks. "Oh, you know, just... did a little research. We like to be thorough."

Thorough.

Right.

Most candidates hear that and feel flattered. Wow, they really looked into me.

I felt my stomach drop. Because I knew what "thorough" meant. It meant someone had run me through a full OSINT sweep. Not just Googled me. Investigated me.

And I had prepared for exactly that.

Why I started booby-trapping my own resume

Let's be honest about what hiring is in 2026.

You are not being evaluated. You are being investigated.

Every company now has either an internal "Trust & Safety" guy who used to do military intel, or a $199/month subscription to some people-search aggregator that promises to show your "risk signals," your old addresses, your relatives, your leaked passwords, your deleted tweets from when you were 19.

You apply for a marketing job and they know your ex-girlfriend's dog's name.

The advice we're given is insane: "Clean up your digital footprint!" As if you can. As if you should have to scrub your entire personality to be worthy of health insurance.

I got tired of being paranoid. So I got proactive.

If you can't stop them from watching, you can at least make them trip a wire.

Enter: Canary Tokens.

If you don't know what they are, Canary Tokens are free, tiny digital tripwires made by Thinkst. You create a file, a link, a DNS token, an image — and when someone opens it, it pings you. IP address, user agent, timestamp. Proof someone touched something they shouldn't have.

Security teams use them to catch hackers. I started using them to catch employers.

How to put a honeypot in a PDF without being a psycho about it

This is the part where I have to be careful, because I don't want every recruiter on LinkedIn thinking I'm trying to hack the Pentagon.

I'm not. I'm just done pretending this is normal.

Here's what I did, and it's so simple it should be illegal that more people don't do it:

1. The Invisible Image.

I generated a Canary Token for an image. Thinkst gives you a URL that looks like any random tracking pixel.

I embedded it in my resume PDF. White 1x1 pixel in the footer. You will never see it. Your ATS will never see it. But if a human opens that PDF in a previewer that loads remote images — which Gmail, Apple Mail, and most corporate Outlook setups do — ping.

I get an email: "Your Canarytoken has been triggered."

It includes the IP, the time, and often the organization that owns the IP.

2. The Portfolio Link.

I didn't just link to voidrane.xyz/portfolio. I linked to voidrane.xyz/portfolio?src=resume_q3 and that page had a Canary link embedded as a "Download full case study (PDF)" button. Different token for every company I applied to.

So if PanoptiCorp's token fires, I know it's PanoptiCorp.

3. The Boring Doc.

My actual portfolio site is clean. But I have a /old directory that is not linked anywhere. If you find it, you found it via scraping or OSINT tools that brute-force subdirectories. I put another token in there.

If that one fires, I know they didn't just read my resume. They ran a recon tool on me.

Is this paranoid? Maybe. Is it effective?

Let me tell you what happened after Tuesday.

The stalking timeline

I got home after that weird interview and checked my Canary dashboard.

Trigger 1: Resume image token - Opened 3 times. First open from a San Francisco IP owned by PanoptiCorp. Expected. Second open from same IP, 4 hours later. They forwarded my resume around. Normal.

Third open: Different IP. Ashburn, Virginia. Owned by a data broker aggregator. The kind of IP that belongs to SocialLinks / Maltego / People Data Labs style infrastructure.

That was 9:42 PM on a Sunday. Two days before they even emailed me to schedule the interview.

So before a human ever decided I was worth talking to, my resume was already fed into an automated background check system.

Trigger 2: Portfolio link token for PanoptiCorp - Fired at 10:15 PM Sunday. Then again at 8:04 AM Monday from a different user agent, this time a headless browser. That's not a hiring manager clicking a link. That's a scraper.

Trigger 3: The /old directory token - Fired at 10:17 PM Sunday. Two minutes after the portfolio link. That means whatever tool they used automatically enumerated my site.

So by the time I got the cheerful "We'd love to chat!" email on Monday morning, they had already:

Run my email through a people-search API
Scraped my entire personal website structure
Associated my current name with a pseudonym from 2021

That's not "doing a little research." That's a full-spectrum dossier.

And in the interview, they acted like they just happened to stumble on it.

Why this should enrage you (even if you have nothing to hide)

The standard cope is: "If you have nothing to hide, why do you care?"

Because privacy is not about hiding. It's about consent and context.

I consented to you evaluating my ability to do the job described in the JD. I did not consent to you feeding my personal domain into a crawler at 10pm on a Sunday to find a project I did under a different name when I was 24, to use as a weird power move in an interview.

And here's the sinister part: They will never tell you they did it. They will just make vague references to "culture fit" or "we found some inconsistencies." You will never know why you didn't get the job.

I only know because I set a trap.

Once you see it, you can't unsee it. The job application process is the only place in modern life where we are expected to hand over our home address, our work history, our references, our social security number — and then also smile while a stranger in HR runs a background investigation that would be illegal for a cop to do without a warrant.

We talk a lot about companies ghosting candidates. We don't talk enough about companies stalking candidates.

The power asymmetry is absurd. They have tools, budgets, and third-party vendors whose entire business model is violating your privacy at scale. You have... a cover letter.

So I decided to level it a little.

How to know you're being investigated (without becoming a full-time paranoid)

Look, I didn't invent this mindset. There's a whole discipline around it. In the intel world it's called Counter-OSINT — learning the tells that someone is building a file on you.

I got deep down that rabbit hole after the PanoptiCorp incident, and if this story made your neck hairs stand up, you should too. I wish I could put everything I learned in this post, but Medium would flag me for being too unhinged.

The best, latest, and most practical guide I've made that actually explains the technical breadcrumbs — the DNS tells, the aggregator IPs, the fake recruiter accounts — is called THE WATCHER'S WATCHER: Counter-OSINT How to Know You're Being Investigated. It's on Gumroad.

I'm not affiliated with them. I just think if you're going to play this game, you should know the rules.

Because once you know what to look for, the signs are everywhere:

The LinkedIn view from someone with no photo, 500+ connections, title "Talent Intelligence" or "People Researcher". That's not a recruiter. That's an OSINT contractor.
The weirdly specific question about something you deleted. If they mention a tweet you deleted in 2019, they didn't "find it." They bought it from a data broker who archived it.
The follow-up email that comes from a different domain. Your resume gets uploaded to Greenhouse, which shares data with 47 integrations. One of them pings you.
The sudden friend request from a stranger in your industry right after you apply. Classic pretexting account to view your private posts.

So what did I do with PanoptiCorp?

I withdrew.

I sent a polite email: "Thank you for your time, but I've decided to move forward with other opportunities."

Then I sent a different email from a burner, with a PDF report of every token trigger, every IP, every timestamp.

Their Head of People responded within 20 minutes asking to "hop on a call to clarify any misunderstandings."

I did not hop.

The point was never to get revenge. The point was to prove to myself that I wasn't crazy. That feeling you get when an interviewer knows too much? That's real. That's data. And now I have logs.

Since then, I've put unique tokens in every single resume I send out. Out of 31 applications in the last 2 months:

19 triggered only the resume image token once or twice. Normal behavior.
8 triggered the image AND the portfolio link. Thorough, but human.
4 triggered all three, including the hidden directory enumeration, from data broker IPs, before any human contacted me. That's the stalking tier.

That's 13% of companies doing full passive recon before they even say hello.

Let that sink in.

Your resume is not a document. It's a beacon.

We are told to optimize our resumes for ATS keywords. We should be optimizing them for counter-surveillance.

I'm not telling you to become a privacy extremist and live in a cabin. I'm telling you to stop playing defense.

Put a Canary Token in your resume. It's free. It takes 30 seconds. Go to canarytokens.org, generate a DNS token or an image token, and embed it.

Not because you want to catch a company and write a snarky Medium post like me.

But because the first time you get that email that says "Your Canarytoken has been triggered" at 2 AM from an IP in Virginia that belongs to a company you've never heard of, that is charging another company to investigate you without your consent — you will finally understand the game you're playing.

And you will never send a naked resume again.

If you try this, tell me what you find. I have a feeling my inbox is about to get very interesting.

And if you work at PanoptiCorp and you're reading this: hi. I know you saw the /old folder. We both know what was in there wasn't work-appropriate. That's why I put it there.

How Journalists, Exes, and Feds All Use the Same 5 Tricks to Find You

v. Splicer — Wed, 05 Aug 2026 13:59:29 +0000

They all use the same playbook.

Your investigative journalist trying to verify your source. Your ex trying to figure out if you moved. And the guy in the windbreaker with a federal badge who definitely says he's "just doing some background."

Different motivations. Same 5 tricks. And if you don't understand them, you are not hard to find. You are conveniently searchable.

I spent years on both sides of this game — finding people who didn't want to be found, and helping people disappear who absolutely needed to. The uncomfortable truth is this: privacy isn't about being a ghost. It's about breaking the pivots that make you trivial to pivot.

Here are the 5 tricks they all use.

1. The Breadcrumb Pivot: One Crumb Is All They Need

Amateurs search for your name. Professionals never do.

They start with the one thing you can't change easily and pivot off it. That one crumb is usually:

A username you reused in 2016
A phone number from a data breach
An old email you used for a pizza loyalty program
A photo you posted where your license plate is blurred but your neighbor's isn't

This is called pivoting, and it's the entire foundation of modern OSINT. You don't find Void Rane. You find izkaboz on a forgotten forum, which links to an email, which links to a GitHub, which links to a resume PDF, which lists a city.

Journalists call this "verification." Exes call this "just checking." Feds call this "establishing a pattern of life." It's the same graph traversal.

How it works in the wild: You post a story from a coffee shop. You don't tag the location. But the barista has a distinctive tattoo, the menu board has a phone number, and your latte art has a reflection of the street sign behind you. One pivot gives them the city. Second pivot gives them the shop. Third pivot gives them your routine: Tuesdays and Thursdays, 9:30am, oat milk latte, sitting by the window with the good light.

You didn't leak your location. You leaked three things that become your location when correlated.

The fix is ruthless compartmentalization. Different names, different emails, different browsers, different personas for different threat models. Not because you're paranoid. Because databases are forever and your memory of what you posted in 2019 is not.

The rule: If two accounts can be connected by a single search, they are the same account.

2. The Dork Bible: Google Isn't a Search Engine, It's a Confession Booth

Everyone thinks they know how to Google. Almost no one does.

Your ex isn't typing Void Rane Charlotte. She's typing:

site:venmo.com "Void" "Charlotte"
filetype:pdf "Void Rane" resume
intext:"@izkaboz" AND ("gmail.com" OR "protonmail")

Journalists have this down to a religion. It's called Google Dorking, and it's just advanced operators that turn Google from a popularity contest into a database query language. Add Yandex, Bing, and DuckDuckGo image search — because Google is actually the worst at faces — and you can find a person's entire digital exhaust in 20 minutes.

The real power move? De-indexed search. People think deleting a post deletes it. It just deletes it from your profile. The dork bible finds the cached version, the archive.org snapshot, the repost bot that scraped your Instagram to a spam site in Indonesia in 2021. The internet never forgets. It just gets worse at indexing until someone who knows how to ask comes along.

My favorite example: A founder told me he was "completely offline." I found his home address in 6 minutes because his dog walker tagged his dog's Instagram account, which had his old address in the bio from 2020. He didn't leak his address. His dog did.

The fix is pre-emptive poisoning and removal. You can't just delete. You have to audit what search engines think you are. Search yourself like someone who hates you would. Then dork yourself like someone who is paid to find you would.

3. The Metadata Trap: Your Files Are Snitching On You

This is the one that gets journalists and activists caught.

You take a photo of a sensitive document. You crop out your face. You post it anonymously. Congratulations, you just uploaded a file that contains:

Exact GPS coordinates where the photo was taken
Your iPhone model and iOS version
The time you took it down to the second
Often, your full name if you had "Save as: Void_Rane_license.jpg"

That's EXIF data. And it's not just photos. Word docs have author names and revision history. PDFs have the software that created them and sometimes the path it was saved to: /Users/void.rane/Documents/DO NOT LEAK/. I've seen it. Multiple times.

Feds love metadata because it holds up in court and you volunteered it. Exes love it because iPhones embed location by default and most people have never turned it off. Journalists hate it when their sources do it, because it burns the source without the journalist ever knowing.

A few months ago, a very smart person sent me a "fully anonymized" video. I ran exiftool on it and got the exact Airbnb they were staying in from the audio fingerprint of the smoke detector.

The fix is a Ghost Mode workflow. Never post originals. Ever. Screenshot the photo, screen-record the video, copy-paste text into a fresh .txt file. Run everything through a metadata nuker before it touches the internet. If your workflow doesn't include a deliberate metadata removal step, you don't have a privacy workflow. You have a hope.

4. The Network Pivot: You Are Your Friends

You can be perfect. Your friends won't be.

This is how 90% of real investigations close the loop. They can't find you, so they find the five people closest to you and watch them.

Your mom posts "So proud of my daughter moving to NoDa!" Your friend tags you at a climbing gym with the caption "my usual belay partner." Your roommate's Venmo is public and says "rent - 1520 Central Ave Apt 3B."

Journalists call this "mapping the network." Feds call this "two hops." Your ex just calls it "looking at who liked his post."

OSINT investigators have a saying: You don't need to find the target. You just need to find someone who loves the target enough to post about them.

Modern tools make this trivial. You can map an entire friend graph, cluster it by frequency of interaction, and identify the weak link — the person with 800 public friends, a public Facebook, and a habit of checking in everywhere. That person is your breach.

I once watched an investigator find a CEO who had gone fully off-grid by finding his executive assistant's Strava running route that started and ended at a private residence in Jackson Hole every morning at 6am.

He wasn't hiding. His assistant was exercising.

The fix is social media hygiene as a group project. Talk to your inner circle. Not in a paranoid way. In a respectful way: "Hey, please don't tag me in locations, don't post photos of my house/kids/car, and if you have to post that group photo, crop me or blur me." People who love you will get it. The ones who don't were never going to respect your boundaries anyway.

5. AI-Native OSINT: The Game Just Changed and You Didn't Notice

This is the new one. And it's the one that makes the previous four look quaint.

For ten years, OSINT was manual. You had to know where to look. Now AI looks everywhere at once.

Face search: PimEyes, FaceCheck.ID and a dozen private models can take one blurry photo from a protest, a bar, or a dating profile and find every other place that face has appeared online. Your journalist source wore a mask but forgot about the reflection in their glasses? Found.
AI-enhanced imagery: That license plate you blurred? AI de-blurs it. That background you thought was too dark to see? AI enhances it to daylight. That voice note you disguised? AI voice-to-text plus voiceprint matching.
Pattern synthesis: AI can ingest 3,000 of your tweets, your Reddit history, and your Spotify playlists and predict with scary accuracy where you live, your political views, your mental health state, and your schedule. Not because it's magic. Because humans are predictable and you are training the model on yourself for free.

Exes use this now. Not just nation-states. There are TikTok tutorials for "how to find his new girlfriend with AI." It's not underground anymore. It's consumer software with a pastel UI.

This is why old privacy advice — "use a VPN" — is now basically astrology. A VPN doesn't protect you from yourself posting 400 searchable data points a day.

The fix is going AI-native on defense. You need to understand what AI sees when it sees you. Run your own face through PimEyes. Run your own writing through a stylometry detector. See what a clustering model thinks your friend group looks like. You cannot defend against what you don't measure.

Look, here's the uncomfortable conclusion no one wants to say out loud:

Privacy in 2026 is not about having something to hide. It's about having something to protect. Your focus, your location, your relationships, your future leverage. Every app you use is built on the assumption that you are the product and your data is the inventory. Journalists, exes, and feds are just power users of that system.

You have two choices. You can be searchable by default and surprised when it matters. Or you can be intentional by default and boring to find.

Boring is the goal. Boring is freedom.

If you want to go from "I should probably be more private" to having an actual, working system — not just a list of tips — I put my entire playbook into three packs:

For disappearing: My Privacy / OpSec stack covers the full Nukepack for account deletion, Ghost Mode for daily browsing, how to actually do OSINT pivots defensively, metadata nuking workflows, and the AI-native OSINT defense toolkit. It's the system I wish someone gave me 5 years ago.

→ Privacy/Opsec Stack: Nukepack + Ghost Mode + OSINT Pivots + Metadata + AI-Native OSINT — numbpilled.gumroad.com/l/privacy-opsec-stack

For going fully offline: If you want AI that can't snitch because it never touches the cloud — the Pi 5 NVMe + Hailo-8 + Pico W cluster build, local LLMs, offline workflows. Your own private Skynet in a Pelican case.

→ Offline AI Cyberdeck Pack — numbpilled.gumroad.com/l/offline-ai-cyberdeck-pack

For learning to see like they see: If you want to understand the investigator mindset — the Dork Bible with 400+ operators, pivot workflows in Obsidian, and the AI toolkit I use for investigations. Learn offense to build better defense.

→ OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit — numbpilled.gumroad.com/l/osint-investigator-pack

Stay boring out there.

The Post-Privacy Internet: How to Be Untrackable in 2026

v. Splicer — Wed, 05 Aug 2026 13:57:27 +0000

Privacy is dead. We just keep refreshing the obituary hoping for a correction.

If you're reading this, you've already felt it. The ad that knew you were pregnant before your family did. The AI voice clone that called your mom. The recruiter who found your anonymous shitposting account from 2019 because you used the same avatar.

We don't have a privacy problem anymore. We have a post-privacy condition. And the rules changed while we were all arguing about cookies.

Welcome to 2026.

1. You Are Not Being Tracked. You Are Being Rendered.

The old mental model is killing you. You think tracking is a guy following you with binoculars. In 2026, it's an oil painting.

Every data point you leak — your typing cadence, your scroll depth, your Wi-Fi probe requests, the way your phone's accelerometer twitches when you walk — is a brushstroke. No single stroke identifies you. But together? The model renders you in 4K.

This is why your old privacy stack doesn't work. You installed a VPN in 2020 and felt like Edward Snowden. Cute.

In 2026, the adversary isn't your ISP. It's a triad:

1. The Corporate Mesh: Google, Meta, Apple, Microsoft, plus 400 data brokers you've never heard of who trade your location history like Pokemon cards.

2. The AI Scrapers: Every public thing you've ever posted has been ingested, embedded, and turned into a searchable vector by 50 different startups building "people search" tools.

3. You. Your metadata is the real rat. You use a private messenger but send photos with EXIF GPS intact. You use Tor but log into your personal Gmail in the same session. You wear a mask but keep your Bluetooth on.

Untrackability isn't a product you buy. It's a discipline you practice. And it starts with understanding that anonymity is not secrecy. Anonymity is non-attributability.

2. The Five Leaks That Actually Fuck You

Forget what the VPN ads told you. Here are the leaks that get people doxxed, stalked, fired, and scammed in 2026.

Leak #1: Your Browser is a Fingerprint Scanner
Your browser fingerprint is more unique than your actual fingerprint. Canvas, WebGL, fonts, screen resolution, timezone, battery API — even with a VPN, you stand out like a neon sign. If you're not using a hardened, uniform browser profile, you're not private.

The fix isn't Brave out of the box. The fix is a browser that lies consistently. Mullvad Browser, or Firefox with Arkenfox, in its own isolated VM or container. One profile = one identity. Never cross-contaminate. Your normie browsing and your private work should not even know each other exist.

Leak #2: Your Phone is a Loyal Dog That Barks Your Location to Everyone
Your phone pings cell towers, scans for Wi-Fi, begs for Bluetooth connections, and shares your precise location with 30 SDKs hidden in your flashlight app. Turning off "Location Services" is theater.

Real mobile OPSEC in 2026 means compartmentalization. Your daily driver is compromised by definition. If you need actual privacy, you need a second device — de-Googled, GrapheneOS or CalyxOS, no SIM tied to your ID, faraday bag when not in use. Or at minimum: GrapheneOS user profiles, network permission toggled off for 90% of apps, and a personal rule that your phone never goes where you wouldn't want to be photographed.

Leak #3: Metadata Will Get You Killed (Professionally, Socially, Literally)
The content of your message is encrypted. Who you messaged, when, for how long, from where, and what file you attached? That's all in the clear, and it's more revealing than the message itself.

A photo you took? Contains your camera model, lens, exact GPS, time, even your altitude. A PDF you exported? Contains your name, OS, and software version. A voice note? Contains your background noise signature.

Learn to nuke it. Every file that leaves your device gets scrubbed. No exceptions. ExifTool -all=. MAT2. And assume your AI assistant is logging everything unless it's running locally, offline, on your own hardware.

Leak #4: Your AI Tools Are the Ultimate Fed
You outsourced your thinking to a cloud model that logs every prompt. Congratulations, you just created the most detailed dossier on yourself that has ever existed — your insecurities, your business ideas, your health questions, your search history on steroids.

If your OSINT, your journaling, your research isn't happening locally, it's not private. Period. The move in 2026 is offline AI. A Pi 5 with an NVMe and a Hailo-8 accelerator running Llama 3 or Mistral locally will do 80% of what ChatGPT does with 0% of the surveillance. Air-gapped is the new incognito.

Leak #5: Your Past Selves Are Betraying You
You can be perfect today and still get burned by 2017 you. Old forum accounts, reused usernames, password dumps, that one time you used your personal email for a crypto exchange — pivots are everything.

Investigators don't start with you. They start with a username, an email hash, a phone number, and they pivot. HaveIBeenPwned, username enumeration, reverse image search, breach compilations. If you haven't audited your own digital trail with the same tools an adversary would use, you're not doing privacy, you're doing cosplay.

3. The Untrackable Stack for 2026 (That Actually Works)

So what does work? Not paranoia. Architecture.

Layer 1: Compartmentalize Your Lives
Stop trying to be one person who is "private." Be three people who never meet.

Public You: LinkedIn, Instagram, real name. This is the sacrifice. Let the algorithm eat here.
Private You: Friends, family, Signal, Proton. Real name but hardened. No public posts.
Nym You: Research, writing, exploring, building. No link to the other two. Different hardware, different network, different writing style.

Use Qubes OS, or at least separate browser profiles + VPN + OS user accounts. If a compromise in one bleeds into the other, your compartmentalization failed.

Layer 2: Fix the Network, For Real
A single VPN provider is a single point of failure. In 2026, you chain.

You -> Mullvad VPN -> Tor -> Mullvad VPN Exit

Or you run your own entry node. Use Nym or Tor for high-risk browsing, Mullvad/IVPN with no account for low-risk. Never free VPNs. If you're not paying with cash, crypto, or a burned email, you're the product.

And for the love of god, use DNS over HTTPS with a non-logging resolver. Your ISP selling your DNS queries in 2026 is like leaving your diary at Starbucks.

Layer 3: Go Ghost Mode IRL
Digital privacy without physical OPSEC is LARP.

Payment: Privacy.com virtual cards, Monero for things that need to be truly disconnected, cash for everything else. Your credit card history is a GPS track.
Travel: No loyalty programs. No airport Wi-Fi without a VPN router. Toll tags are trackers. License plate readers are everywhere.
Home: No smart speakers. Ever. Your TV is listening. Your Roomba is mapping your house and selling it.

Layer 4: Become Unscrapable
You can't delete yourself from the internet. But you can poison the well.

Obfuscate: Use slightly different names, birthdays, and details on non-essential services.
Reduce attack surface: Delete old accounts. Use SimpleLogin/AnonAddy aliases for everything. One service per alias. If one leaks, you know who sold you out.
Opt-out: Hit every data broker opt-out page. It's tedious, but services like DeleteMe or Optery do the legwork. Do it quarterly.

4. The Uncomfortable Truth

You will never be 100% untrackable. If a three-letter agency is specifically targeting you with zero-day exploits and a $10 million budget, game over.

But that's not your threat model. Your threat model is data brokers, AI scrapers, obsessive exes, cancel-culture archeologists, identity thieves, and a future where your health insurance premium is set by your grocery store purchases.

Against that adversary, you can win. Not by being invisible, but by being expensive to track. Make it cost $5,000 to figure you out instead of $5. Most adversaries will go bother someone easier.

Privacy in 2026 isn't about having something to hide. It's about having something to protect: your ability to think, explore, and become someone new without your past selves and corporate overlords vetoing it in real time.

The internet doesn't forget. But you can teach it to misremember you.

If you want to go deeper than the theory — actual configs, workflows, and toolchains I use daily — I've put the whole system into a few dense, no-BS packs:

The Privacy/OPSEC Stack — my full NukePack, Ghost Mode protocols, OSINT pivots, metadata nuking workflow, and AI-native OSINT setup. The baseline for disappearing in 2026. → numbpilled.gumroad.com/l/privacy-opsec-stack

The Offline AI Cyberdeck Pack — how I built a fully offline AI lab: Pi 5 NVMe build, Hailo-8 accelerator, Pico W field kit, and a Pi cluster for local LLMs. No cloud, no logs. → numbpilled.gumroad.com/l/offline-ai-cyberdeck-pack

The OSINT Investigator Pack — flip the lens. The exact pivot chains, dork bible, Obsidian investigation templates, and AI toolkit I use to audit my own footprint (and others). → numbpilled.gumroad.com/l/osint-investigator-pack

Stay untraceable out there.

AI Is Moving From Finding Bugs to Fixing Them

v. Splicer — Sat, 01 Aug 2026 16:34:49 +0000

For twenty years we built better smoke detectors. Now we are finally building firefighters.

We have gotten incredibly good at finding problems.

Your IDE underlines a vulnerability before you finish typing it. Your CI pipeline fails because a transitive dependency three levels deep has a CVE from 2019. Your inbox gets a Dependabot PR every Tuesday that you will politely ignore until Thursday. GitHub Advanced Security, Snyk, Semgrep, Wiz, Orca, Lacework, the alphabet soup of scanners has turned security into a very high resolution photograph of a burning building.

We know exactly where the fire is. We have a heat map. We have a severity score. We have a CVSS vector that nobody reads.

We just do not put it out.

That is the strange era we are exiting.

The Finding Economy Was Profitable

The last decade of AppSec was built on an unspoken agreement: tools find, humans fix. It was a sensible division of labor when finding was hard. You needed abstract syntax trees, taint analysis, symbolic execution, and a PhD to explain why your Python string concatenation was actually remote code execution.

So we built an entire economy around detection. Dashboards that count vulnerabilities. Leaderboards that shame teams for not triaging fast enough. Compliance frameworks that ask if you know about your bugs, not if you fixed them. The metric of success became mean time to detect, not mean time to remediate.

The result is predictable. The average enterprise has something like 50 to 100 days of open critical vulnerabilities, not because engineers are lazy, but because the funnel is fundamentally broken. You can generate ten thousand findings with a single scan. You cannot generate ten thousand fixes with a single engineer.

Finding scales with compute. Fixing scales with humans. And humans do not scale.

Anyone who has maintained an open source project knows this pain intimately. You get a beautiful, detailed issue report with a proof of concept, a CVSS score, and a polite note that you are endangering the internet. What you do not get is a patch that passes your tests, respects your architecture, and does not break the three weird edge cases only you know about.

We celebrated the finder. We burned out the fixer.

Why Fixing Is a Different Species of Problem

It is tempting to think of fixing as finding plus one more step. It is not. It is a different cognitive task entirely.

Finding is a pattern matching problem. Does this code look like that bad code I have seen before? Is user input flowing into a sensitive sink without sanitization? An LLM is shockingly good at this, because it has seen millions of examples of both good and bad code.

Fixing is a planning and context problem. To fix a bug correctly you need to understand intent, not just syntax. You need to know what the original author was trying to do, what invariants the rest of the codebase relies on, what the test suite actually covers versus what it pretends to cover, and how to make the smallest possible change that closes the hole without opening two new ones.

A bad fix is worse than no fix. A bad fix gives you false confidence and a new CVE with a different name.

This is why early attempts at auto remediation felt like a Clippy for security. "It looks like you have a SQL injection, would you like me to add an ORM?" No, thank you.

What changed is not that models got better at writing code, although they did. What changed is that they got better at operating tools. The new generation is not a chatbot that writes a diff. It is an agent that can reproduce the bug, write a test that fails because of it, edit the source, run the relevant tests, observe the failure, try again, and iterate until the green checkmarks come back.

In other words, it can do the boring, methodical, unglamorous loop that human engineers actually do when they fix something. It just does not get tired at 2 AM.

We Are Entering the Patch Agent Era

Look at what is happening at the edges.

In open source, you now have agents that watch for new CVEs in your dependencies, check if you are actually exploitable, generate a minimal upgrade or patch, run your CI, and open a PR with a proper explanation. Not a version bump. A fix.

In enterprise security, purple teams are using agents to continuously exploit their own apps, then immediately write the guardrail that would have stopped it. The feedback loop that used to take quarters now takes minutes.

And in the lab, researchers are building self healing codebases. Systems where every night, an agent pulls the latest vulnerability feeds, clones your repos, tries to break in, and if it succeeds, patches itself, tests itself, and leaves a commit message that is more thorough than most of your interns. It is not science fiction anymore. It is just engineering that is slightly ahead of adoption.

This is a profound shift in metaphor. We are moving from security as a camera to security as an immune system. A camera records an intruder. An immune system neutralizes it, remembers it, and gets better next time.

The immune system model also understands something the camera model never did: you cannot fix everything. You have to prioritize by exploitability, by blast radius, by whether this service is actually exposed to the internet or buried behind three layers of auth that you swear are there. Agentic fixers are good at that triage, because triage is reasoning, not just ranking.

The Trust Problem Nobody Wants to Talk About

Of course, there is a catch. And the catch is trust.

Will you let an AI push code to main?

Most teams will say no, correctly. The early adopters will have guardrails. Human in the loop approval. Restricted file paths. No changes to auth logic without a human review. Full test runs plus ephemeral preview environments plus semantic diff checks.

But that boundary will move. We already let Dependabot merge patch updates automatically if tests pass. We already let Copilot write 40 percent of our code. At some point, the risk calculus flips. What is riskier: letting an agent patch a well understood path traversal in a well tested utility function, or leaving that path traversal open for 87 days while you wait for a human to find a free afternoon?

We will learn to trust fixers the same way we learned to trust compilers. At first, people inspected the assembly output. Then they stopped, because the compiler made fewer mistakes than they did. We are not there yet for security patches, but we are walking that path.

The teams that win will be the ones who build verification better than they build generation. The fix is not the hard part anymore. Proving the fix is correct, safe, and minimal, that is the product.

Think property based tests that the agent generates alongside the patch. Think formal verification for small critical functions. Think second agent models whose only job is to try to break the first agent's patch. An adversarial system that looks a lot like the immune system again: attackers and defenders coevolving inside your CI.

What This Means for Humans

If AI moves from finding bugs to fixing them, what do humans do?

We do the work we were supposed to be doing all along. We stop acting like very expensive linters and start acting like architects.

Humans will set policy: what is allowed to be auto fixed, what requires review, what risk tolerance we have for different systems. Humans will design systems that are easier to fix, smaller blast radius, better tested, more explicit about invariants. Humans will do the weird, cross system reasoning that agents are still bad at, like realizing that fixing this bug in service A will break an undocumented assumption in service B that finance relies on every quarter end.

And perhaps most importantly, humans will be freed to do proactive security instead of reactive ticket closure. Threat modeling. Secure by design. Actually deleting code instead of endlessly patching it.

The dream was never to have a dashboard with zero findings. The dream was to have systems that do not need a dashboard to stay safe.

We spent twenty years shouting louder about fires. The next ten will be about buildings that do not burn.

I build small, practical tools for this exact future, focused on defense, resilience, and systems that fix themselves.

If you want to play with the ideas from this post:

The $20 SOC: Build a Tiny Defensive Network Monitor is how I think about affordable detection for home labs and small teams.

Build the Blackbox: An Offline AI Field Terminal That Works When Nothing Else Does is my guide to building AI systems that work completely disconnected, which matters a lot when you are patching in hostile environments.

Synthetic Corporation Defense: Purple-Team Your HR Before 500 Fake Employees Do covers the other side of the coin, when the attacker is AI generated too.

And Self-Healing Legion: AI That Finds and Patches Its Own CVEs While You Sleep is the full implementation of what I described here, an agentic legion that hunts and fixes its own vulnerabilities on autopilot.

I Stopped Talking To AI And Started Giving It A Place To Live

v. Splicer — Fri, 31 Jul 2026 09:36:19 +0000

The breakthrough wasn't a better prompt. It was giving the machine an address.

For a long time, I used AI exactly how the landing page told me to.

Open tab. Ask brilliant question. Receive eerily competent answer. Steal the good parts. Close tab. Come back 12 hours later to meet a completely new entity with the long-term memory of a goldfish in free-fall.

Every session started with the same morning standup for the amnesiac:

Here's the project.
Here's the stack.
Here's what we already tried.
Here's the bug you invented yesterday.
No, we are not migrating the database at 2am for fun.
No, do not rewrite the entire app in Next.js because you felt inspired.
Yes, that file you keep ignoring is the entire business logic.

It felt productive because words were moving fast. Code poured out. Bullet points bred like mold behind a gas station sink.

But the workflow itself was insane.

I had a system that could read 10,000 lines of code, hit APIs, run a terminal, crawl docs, and reason across an entire architecture - and I was using it like a genius contractor trapped behind plexiglass at county jail.

Every interaction was a visitation.
Every visitation required paperwork.

The problem wasn't personality. It didn't need a cuter name, a 3,000-word system prompt written like a LinkedIn mantra, or another folder called AI_RULES_FINAL_FINAL.md.

It needed continuity. It needed keys to the building. It needed tools, memory, a schedule, a logbook, a junk drawer, and a place where half-finished work could stay half-finished without evaporating.

It needed an operating system.

Not a literal kernel. Not yet. I don't need my chatbot handling page faults before coffee. I mean operating system in the old, honest sense: a thing that coordinates resources, remembers state, exposes interfaces, enforces limits, and lets processes outlive the conversation that spawned them.

The second I started thinking like that, chatting with AI became the most boring thing you could do with it.

The Chat Window Is Where Work Goes To Die

Chat is optimized for conversation. Work is almost never conversational.

Work has state.

Files changed. Tests failed for a reason nobody wrote down. That credential absolutely cannot be in the prompt. Some jobs should run while you sleep. Some jobs should never run without you. Some decisions will matter in three weeks and the reasoning matters more than the result.

A chat log can describe all that machinery. It can't be the machinery.

When you build software entirely through chat, you become the operating system. You're the scheduler. The filesystem. The message bus. The supervisor. The human clipboard with anxiety.

You manage context switching. You decide what gets to fit in its tiny goldfish brain. You carry state between sessions. You detect failures. You retry. You keep logs. You do access control via the advanced security paradigm of "please god don't touch that folder."

Then we have the audacity to call the AI inefficient.

That's like strapping a jet engine to a Walmart shopping cart and complaining about the steering.

The model isn't the whole computer. It's the reasoning CPU. Without the rest of the machine, it wakes up naked in a white room every time you hit Enter.

It might be brilliant in that room. It still has no idea where it left the wrench.

My First "AI OS" Was A Beautiful Disaster

There was no movie moment. No orb hovering over my ThinkPad humming in Sanskrit.

Version 1 was feral: a pile of directories, cron jobs, Markdown files, shell scripts, and logs named final_task_v2_ACTUAL_THIS_TIME.md.

As it should be. Beautiful systems start as embarrassing systems that refuse to die.

I gave the agent a home. Not just a repo, an actual home:

A file that says who it is and what it's not allowed to do
A map of where the important bodies are buried
A queue of real tasks, not vibes
A decision log, so we don't re-litigate the same dumb argument
A scratch pad for half-baked research
A memory file for things that are actually true
A journal of actions, failures, and open loops
Scripts for the boring stuff
Tests it has to pass before it gets to say "done"
Hard walls around destructive commands and anything that touches the outside world

Suddenly, I didn't have to re-explain the universe every morning.

It could wake up, read the room, check the queue, look at yesterday's diffs, run diagnostics, and continue from reality instead of from my increasingly passive-aggressive summary of reality.

That was the shift: Context stopped being something I injected. It became infrastructure.

Sounds subtle. Feels like cheating once you've lived it.

A prompt says: "Remember we use Postgres."
An environment lets it open the config, check the migrations, inspect the schema through a safe tool, read why we chose Postgres in the first place, and see what Postgres is actually doing right now.

One is a sentence. The other is a world.

Memory Is Not A 50,000-Word Text File

The rookie move is to solve memory by creating one giant file called MEMORY.md and pouring your life into it.

That works for exactly eleven minutes.

Then it becomes an archaeological landfill: outdated roadmaps, duplicated facts, dead features, contradictory orders, and a paragraph screaming IMPORTANT about a framework you deleted six months ago.

Good memory has structure and it has rot.

I split it up:

Working memory: What are we doing right now, what are the constraints, what did we just learn.
Project memory: Stable facts about architecture, conventions, dependencies. Boring. Essential.
Episodic memory: What happened during that run. The receipts.
Decision memory: What we chose and why. So future-us doesn't feel smart and revert it.
External truth: Lives where truth should live - in the code, the DB, the issue tracker, the repo. Not in the AI's diary.

The agent didn't need to memorize the codebase. It needed to know how to find the codebase.

Much more scalable.

Humans do the same thing. I don't remember every line I've written. I remember that the cursed networking fix is in tools/ somewhere, written on a sleepless Tuesday, next to a comment that is openly hostile toward NetworkManager.

Good memory is an index, not an archive.

And crucially, it can forget. Temp findings expire. Done tasks get compressed. Bad assumptions get corrected instead of haunting every future session like a Victorian child in the hallway.

Tools Are How Intelligence Gets Leverage

A model with no tools can tell you how to do something.

A model with tools can find out if it actually worked.

That difference is the entire game.

I gave it narrow, inspectable tools. Search files. Read logs. Run tests. Query docs. Read git history. Check services. Run approved scripts. Every tool has a job. Every action leaves evidence.

Way better than giving it root and whispering "be careful, buddy."

Unbounded capability isn't autonomy. It's a future incident report with a blank timestamp.

The OS mindset forced me to design permissions like an adult:

Read access: generous
Write access: scoped
Destructive ops: need a second key
Talking to the outside world: explicit approval
Secrets: only to the processes that absolutely need them
Everything meaningful: leaves a trace

These constraints didn't make it less useful. They made it trustworthy for longer than five minutes.

Here's the paradox of autonomy: tighter fences mean more freedom. If I know it can't rm -rf the wrong directory, publish a draft, or email a hallucinated apology to a client, I can actually let it roam.

A good cage is a runway.

I Killed The Mega-Prompt

Once persistence and tools existed, the mega-prompt had to die.

You know the one:

"First inspect the project, then identify the most critical issue, then make a plan, then implement it step by step, then test, but don't touch unrelated files, and remember to update docs, and be concise but thorough, and..."

That's not prompting. That's writing a bash script in English and praying the interpreter had the same childhood as you.

So I moved repeatable behavior into actual processes.

Maintenance became a script + checklist. Research jobs produced a standard report format. Coding tasks followed a loop: inspect -> plan -> change -> test -> diff -> summarize. Long jobs wrote checkpoints. Failures went to a retry queue instead of vanishing into chat shame.

The model still made decisions. The system handled the physics.

That's what an OS does. It doesn't decide what novel you should write. It makes sure your editor can access files, memory, keys, and CPU time without you having to negotiate with every transistor personally.

The more structure I moved outside the model, the less I had to beg it to act consistent inside the model.

The Scheduler Is When It Gets Weird

The final divorce from chatbot brain happened when the agent started running on time, not on attention.

A chatbot waits for you to talk.
A system wakes itself up.

I gave it a clock and some small, boring jobs:

Every morning, review the repo and tell me what actually changed
Check if tests started failing overnight and who to blame
Look at dependency updates and flag the sketchy ones
Chew through the research queue while I sleep
Write me a morning brief from logs and unfinished threads
Revisit blocked work when its blocker moves
Take out the trash: archive stale context, compress finished sessions

None of this requires consciousness, a humanoid robot, or a VC saying "agentic" 17 times into a podcast mic.

It requires cron.

That's when the productivity gap became obscene. Chat-AI only works when you're actively parenting it. An OS keeps working in the gaps. It preps context before you arrive. It notices boring, important changes. It shows up with evidence, not enthusiasm.

It stopped being a destination I visited.

It became part of the room.

Autonomy Is Just Exception Handling With Better PR

People fantasize about autonomy as: "Build my company." Enter. Magic happens.

That's not autonomy. That's theology with usage billing.

Real autonomy is incredibly unsexy. It's what happens when normal shit breaks and the system doesn't immediately faceplant into a chat window.

What happens when a command times out?
When a dependency is down?
When two instructions contradict each other?
When the test suite was already broken before you got here?
When it needs info it doesn't have?
When it's not sure if an action is reversible?

You need escalation rules. When to retry. When to pick a safe fallback. When to log a blocker. When to stop and ping a human.

The smartest move is often refusing to improvise.

I stopped trying to make it sound confident. I started trying to make uncertainty legible.

An agent that says "I completed everything!" is impressive for six seconds.
An agent that says "I did 3 of 4 steps. Step 4 is blocked by auth failure. Here are the logs. No external changes made." is employable.

The goal isn't maximum independence.
The goal is minimum babysitting with zero hidden damage.

You Still Have A Job

Building an OS for AI didn't remove me from the loop. It promoted me to a better part of the loop.

I stopped being a context mule, a constraint parrot, a routine-task button-pusher. I started spending time on the parts humans are still annoyingly good at:

Choosing what should exist in the first place.
Designing boundaries that don't suck.
Judging tradeoffs.
Noticing when a technically correct result feels soulless and cheap.
Knowing that when a user asks for a feature, they're actually describing a fear, a habit, or a workaround they built three years ago.
Deciding that the efficient path is ugly and the weird path is worth it.

The AI can sprint through the maze at lightspeed.
You still decide why there's a maze at all.

At least for now. Check back when the cron daemon starts writing love poems about its own PID.

Stop Hunting For The Perfect AI App

The next era of serious AI work won't be won by whoever finds the one miraculous model or the one immaculate chat UI.

Models matter, obviously. Smarter reasoning expands the frontier. But raw IQ is becoming a commodity. What's scarce is durable context, reliable tools, permission boundaries, evaluation loops, and operational continuity.

The edge is shifting from who has access to AI, to who has built the best habitat for it.

That habitat might be a local agent on a beat-up laptop. It might be a rat's nest of scripts around Claude Code, Codex, Gemini, or OpenClaw. It might be a tiny server with queues, containers, memory stores, monitors, and a terminal that looks like it escaped from a 1997 university lab.

Good. Computers should feel a little haunted.

The important move is conceptual.

Stop asking only: "What should I say to the model?"

Start asking:

Where does it live?
What can it see?
What can it touch?
What does it remember?
How does it know if it succeeded?
What does it do while I'm gone?
What does it do when it fails?
When does it have to come get me?

That's not prompt engineering. That's systems engineering.

And once you start answering those questions, the chat box starts to look very, very small.

I didn't need a more persuasive conversation with AI.

I needed to give intelligence a filesystem, a clock, a pair of hands, a memory, and enough rules to keep it from sprinting into traffic.

So I stopped chatting with it.

I built where it works.

Build The System, Not Another Prompt Museum

If you want to turn AI from a clever pen pal into actual infrastructure that runs while you live your life:

AI Automation Playbook: How to Use OpenClaw, Claude Code, and Gemini to Automate Work and Make Money
The practical manual for orchestration, persistent workflows, tool-driven agents, and automation that doesn't die when you close the tab.

Hire 5 AI Employees With OpenClaw: 24/7 Autonomous Employee Playbooks
Deploy bounded, employable agents for research, monitoring, analysis, and daily ops - without pretending one giant prompt is a company.

More field manuals, hacker guides, and computational contraband at numbpilled.gumroad.com

You Are Easier to Track Than You Think and Harder to Erase Than Advertised

v. Splicer — Tue, 28 Jul 2026 20:12:12 +0000

You think you are pretty good at privacy.

You have a VPN. You use incognito mode. You once cleared your cookies and felt like Edward Snowden for about forty five minutes. You have told at least one person at a brunch that you are "pretty careful about your digital footprint," which is the modern equivalent of saying you eat clean while your DoorDash history looks like a crime scene.

You are not careful. None of us are. And you are not being tracked by some supercomputer in a bunker under Utah, at least not only that. You are being tracked by the most boring, most efficient surveillance apparatus ever invented: capitalism with good APIs.

Welcome to the part where we talk about how exposed you actually are.

The Lie of Being Boring

Everyone has the same comforting story they tell themselves. "Why would anyone track me? I'm boring. I have nothing to hide. I just watch cooking videos and argue about sports."

This is adorable, and completely wrong. You do not need to be interesting to be trackable. In fact, being boring makes you easier to track, because you are predictable.

You wake up at roughly the same time every day. Your phone checks the weather, and in doing so tells three different ad networks where you slept last night. You scroll the same three apps in the same order. You go to the same coffee shop, which has Wi-Fi that logs your MAC address, and a loyalty app that logs your soul.

You are not a mystery. You are a pattern. And patterns are trivial to model.

The modern tracking ecosystem does not care if you are a spy or an accountant who really likes sourdough. It cares that you are a stable, monetizable entity with habits. You think you are hiding in the crowd. You are not hiding in the crowd, you are standing in a crowd where everyone is wearing a neon sign with a unique ID that follows them across the street, into the store, and into the bathroom.

Consider just your phone number. That one dumb ten digit string you have had since college is the master key you handed to every single service you have ever signed up for. Data brokers take that number and join it with your name, your old addresses, your Amazon purchases, your voter registration, your leaked passwords from 2017 that you definitely reused, and your cousin's public family tree where she tagged you at Thanksgiving. Congratulations, you now have a permanent record that is for sale for about two dollars.

You did not need to be hacked. You volunteered, one Terms of Service at a time.

How You Leak Without Trying

Let us play a game. I will describe a totally normal person who is trying to be private, and you tell me how many times they just doxxed themselves today.

They post a photo of their dog on Instagram. The photo has EXIF data with GPS coordinates unless they stripped it, which they did not. The background shows the street sign outside their house and the distinctive shape of their neighbor's terrible fence.

They post a screenshot of a funny text conversation. They forgot to crop out the contact name, the time, and the battery percentage that correlates with their other screenshots.

They apply for a job on LinkedIn, which then tells everyone they know that they are looking for a job, and also updates a dozen people search sites with their current employer.

They order something on Amazon, which gets their address into yet another breachable database. They pay with a card, which links their purchase to their location history. They review the product, which links their anonymous Amazon username to their real name because they used the same handle they used on Reddit in 2012.

They go for a run with Strava, which draws a perfect little map from their front door around the park and back to their front door, and publishes it to a global heatmap where anyone can see where the fit people with expensive watches live.

None of this is sophisticated. None of this requires hacking. This is just what normal life looks like when every device you own is designed to report back to base. You are not being paranoid, you are being observed by products you pay monthly for the privilege of being observed by.

And the worst part? The metadata is worse than the data. You can be careful about what you say. You are never careful about what your behavior says.

You encrypted the message, great. The fact that you sent a message at 2:13 AM to a number that only ever receives messages when something is wrong is still visible. You used a VPN, great. The fact that your device connected to the VPN at exactly the moment your home IP went silent, and that your typing cadence and browser fingerprint stayed identical, is still visible. You turned off location, great. Your photos of your lunch still contain enough background to geolocate you within three blocks, and your Wi-Fi probe requests are still screaming your home SSID everywhere you go like a lost child.

You are not invisible. You are just slightly blurry, which is often worse, because blurry makes people curious.

The Fantasy of Deletion

Okay, so you are tracked. Fine. But you can erase it, right? You can delete your accounts, go off the grid, become one of those people who lives in a cabin and makes their own soap.

Sure. Let us talk about how erasure actually works.

You delete your Facebook. Facebook says, "We have deleted your account." What they mean is, "We have hidden your profile from other users and moved your data to a colder storage system that we will keep for legal and business purposes for as long as we deem necessary, which is forever."

You delete your tweets. The tweets are gone from your profile. They are not gone from the Wayback Machine, from the fifteen scraper bots that archive everything, from the screenshots your enemies took, from the Google cache that will refresh sometime between now and the apocalypse, or from the data broker who already ingested them into a sentiment model that thinks you are anxious about money.

You ask a data broker to remove you. They do, for their public facing site. Their API, the one they actually sell to customers, still has you. And their backup from last Tuesday still has you. And their partner network of four hundred other brokers, who they already sold you to, still has you.

Erasing yourself from the internet is like trying to unbake a cake that has already been mailed to ten thousand strangers who each took a bite and wrote a review.

Even the stuff that feels private is not. Your email is not private, it is a postcard that Google kindly scanned for you. Your DMs are not private, they are just private from other users, not from the platform, not from law enforcement with a warrant, not from the intern who can still read them.

And AI made this ten times worse, in a way nobody really wants to admit. Before, your data had to be searchable to be useful. Now it just has to exist. Large models can infer your location from your slang, your age from your punctuation, your health conditions from your grocery list, your political beliefs from the memes you like. You do not have to fill out a form that says "I am a 34 year old man who lives in Charlotte and has a bad knee." Your data exhaust already screamed it.

This is why "I have nothing to hide" is such a naive flex. You do not decide what is sensitive, the person looking at the data does. You think your takeout history is boring, an insurer sees a risk profile. You think your late night searches are harmless, an OSINT investigator sees a timeline. You think your public posts are just jokes, a future employer sees a liability.

You are not hard to find. You are hard to NOT find.

So What Do You Actually Do

You do not go full tinfoil. Full tinfoil is a lifestyle that ends with you yelling at a barista for asking for your name.

You get competent.

Privacy is not about becoming invisible, it is about becoming expensive to track. Most tracking works because it is cheap and automatic. Your job is to make it annoying. To add friction. To break the easy correlations that turn you from a person into a product.

That means understanding pivots, how one identifier leads to another. How an email leads to a breach, which leads to a password, which leads to a username, which leads to a forum post from 2011 where you used your real name because you were sixteen and dumb. It means understanding metadata, that the photo is not just the photo, it is the camera, the location, the time, the device. It means understanding that your phone is not a phone, it is a tracking beacon that occasionally makes calls.

It means learning to compartmentalize. Different contexts, different identities, different trails. Not because you are doing something illegal, but because you are not required to offer your entire life as a single searchable database to anyone with a browser.

The people who are actually good at this are not loud about it. They are not posting about going dark. They are just quietly harder to pin down. Their digital footprint looks intentional, not accidental. They know what dorks are, what brokers keep, what their own photos say, and what their AI exhaust looks like.

You do not need to become a ghost. You just need to stop being so easy to assemble.

Because right now, if someone wanted to, they could reconstruct your last five years in an afternoon with public data and a few clever queries. Not because they are a genius hacker in a hoodie. Because you made it simple.

Fix that part first. The rest is just tradecraft.

If you want the actual playbooks for making yourself expensive to track, these are the ones that do not waste your time: Privacy/Opsec Stack: Nukepack + Ghost Mode + OSINT Pivots + Metadata + AI-Native OSINT and the OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit.

The People Who Know Shell Scripting Are Quietly Running Everything

v. Splicer — Tue, 28 Jul 2026 20:10:00 +0000

There is a class of people you have never heard of, who have never introduced themselves at a party, and who are currently in charge of your life.

They are not on Forbes 30 Under 30. They do not have a personal brand. They have never made a TikTok explaining their morning routine. Their LinkedIn, if it exists at all, was last updated when Obama was still figuring out the White House printer.

They know shell scripting.

And while everyone else has been arguing about which JavaScript framework will finally achieve inner peace, these people have been quietly automating the entire world, one incomprehensible line of bash at a time.

The Priesthood Nobody Applied To Join

Every industry has its visible priests and its invisible ones.

The visible priests wear Allbirds, give keynotes, say things like "we're building the future of work," and raise 40 million dollars to build a slightly worse version of Google Sheets.

The invisible priests look like they have been debugging something since 2009, because they have. They have a terminal window open that has been open longer than some startups have existed. That terminal window is black, full of text that is green, or amber, or some custom color scheme they spent six hours configuring and will defend to the death.

You call IT when your laptop breaks. Companies call these people when reality breaks.

Your website went down at 3:17 AM on a Sunday? A shell script restarted it before your monitoring service even remembered to send you a panicked Slack message. Your bank processed ten million transactions while you were asleep? Shell script. Your photos got backed up, your logs got rotated, your entire cloud infrastructure decided not to catch fire today? Shell script, shell script, shell script.

The modern economy is not built on blockchain, AI, or vibes. It is built on cron jobs that some guy named Dave wrote in 2014 and everyone is now too scared to touch.

If you have ever seen a production server's crontab, you know what I mean. It reads like the diary of a paranoid genius:

# DO NOT TOUCH - Dave 2014
# fixes the thing
# runs every 5 mins don't disable or accounting breaks

Nobody knows what the thing is. But accounting does not break. So we leave it.

Why They Never Brag

People who know Python will tell you they know Python. People who know Rust will tell you they know Rust, at length, unprompted, while you are trying to order coffee.

People who know shell scripting will never tell you. Not because they are humble. Because they have learned that telling people you know shell scripting is like telling people you know how to fix a printer. You will never have peace again.

The moment you admit you can write bash, your fate is sealed. You become The Person Who Can Fix The Deployment. You become The Person Who Understands Why The Backup Failed. You become The Person Who Gets Called When The Senior Staff Engineer Who Makes 400k A Year Types rm -rf / On The Wrong Server.

They do not want fame. They want to be left alone in their terminal, where the computer does exactly what they tell it to, which is more than can be said for literally any human in their life.

There is also a second reason they are quiet: they know how absurdly powerful they are, and it feels almost impolite to mention it.

Consider what a decent shell scripter can do in under thirty seconds that would take a normal team three sprints, two standups, and a Figma file:

Need to rename 12,000 files, resize them, upload them to three servers, and email you when it is done? One line.

Need to parse a 40 gigabyte log file from 2019 to find out why one user in Ohio could not log in on a Tuesday? A pipe, a grep, an awk, and a look of quiet contempt.

Need to take an entire company that has been manually copying CSVs into a folder for five years and turn it into an automated pipeline that actually works while they are on vacation in Mexico? Give them an afternoon and do not talk to them while they are working.

This is not coding. This is wizardry with plausible deniability.

The Universe Is Just Text Streams

The great secret of shell scripting, the one they do not teach you in bootcamps that cost as much as a used Honda, is that the universe is just text.

Everything on a Unix system is a file. Every file is text if you squint hard enough. Every program is a filter that takes text in and spits text out. And bash is the duct tape, the WD-40, and the divine language that lets you connect them.

Modern software development wants you to believe you need a microservices architecture, a Kubernetes cluster, and a team of certified cloud consultants to do anything meaningful. Shell people look at that and see a very expensive way to do what xargs already does for free.

They have internalized the Unix philosophy to a degree that has become a personality disorder. Do one thing well. Chain simple tools together. Automate everything that annoys you more than once. Never trust a GUI.

It makes them incredibly dangerous in any organization. Give a shell scripter access to a messy problem and they will not propose a six month roadmap. They will go silent for 45 minutes and then say, "I fixed it. It will never happen again. Also it now sends us memes when it runs."

You will look at the script and understand nothing. It will contain symbols you did not know your keyboard could produce. There will be a $(( )) inside a ${//} inside a $( ). There will be a sed command that looks like it was written during a stroke. It will work flawlessly until the heat death of the universe.

The Real Power Structure

Let us be honest about how companies actually work.

At the top is the CEO, who sets vision.

Below that is middle management, who sets meetings about the vision.

Below that are product managers, who translate the meetings into tickets.

Below that are software engineers, who turn tickets into more tickets.

And far below that, in a basement that does not officially exist, is a person who has been at the company for eleven years, who knows where every log goes, who wrote the deploy script that everyone uses but nobody understands, and who could bring the entire operation to its knees by going on a two week hike without cell service.

That person does not have stock options. That person has root access. Which is better.

When the new hot AI startup says they are "running lean," what they mean is they have four shell scripts doing the job of what would normally be an entire operations team. When a massive bank says their systems are "battle tested," what they mean is some shell scripts have been running continuously since before the iPhone existed and everyone is praying they continue to do so.

If you want to know who really runs the internet, do not look at the keynote stage at a tech conference. Look at the maintainers of coreutils. Look at the people who still read man pages for fun. Look at the person who can explain the difference between > and >> and 2>&1 and &> without having to Google it. That person is your god now.

And the beautiful, terrifying thing is that this power is available to anyone willing to learn it. There is no gatekeeping. The terminal is there on every Mac, every Linux machine, every cloud server you can rent for five dollars a month. It is waiting.

Most people open it, see a blinking cursor, panic, and close it forever. Those people will go on to pay for seventeen SaaS tools to do what one for loop could do.

The others stare at the blinking cursor and feel something ancient click into place. A sense of control that modern software has spent decades trying to take away from you. No popups. No upsells. No "It looks like you're trying to write a letter!" Just you and a machine that will do exactly what you say, even if what you say is catastrophically stupid. Especially then.

How To Join The Conspiracy

You do not learn shell scripting because your boss told you to. You learn it because one day you got tired of doing the same boring task for the hundredth time and thought, "There has to be a better way."

And there is. It involves pipes. It involves a little bit of pain. It involves learning that awk is actually a complete programming language that someone hid inside a text processing tool as a prank.

It starts with ls. Then grep. Then you discover find . -name "*.jpg" | xargs. Then you are gone. Then you are the person who automates their entire job and spends the rest of the day reading documentation for fun. Then you are quietly running everything.

The world will not thank you. No one will ever see your work, if you did it right. The best automation is invisible. The server never went down. The files were always where they were supposed to be. The report was in the inbox at 6 AM without anyone asking.

That is the deal. Total power, zero credit. It is a surprisingly good trade.

So if you see someone with a terminal full of tiled panes, each running something different, typing at a speed that suggests they have transcended the need for a mouse, do not bother them. They are busy keeping the lights on.

Maybe just quietly ask them what their dotfiles look like. If they like you, they might show you. And then you will understand.

For those who want to go from tourist to operator, these are worth studying: AUTOMATA://BASH AUTOMATION SUITE: Ultimate Shell Scripting for Total Control and the Terminal Operator Pack: Black Terminal + Seamless Terminal + Bash Necromancer + Defensive Scripters + Scriptkit.

I Tested 7 AI OSINT Agents on My Own Digital Footprint - Here's What They Found in 4 Minutes

v. Splicer — Mon, 27 Jul 2026 22:08:24 +0000

I thought I had good opsec. I was adorably wrong.

The Setup

I decided to do the digital equivalent of Googling yourself at 2am after 3 glasses of wine, but with better tools and less self-pity.

I took 7 of the most hyped AI OSINT agents - the ones that promise to "uncover anyone in seconds" on Product Hunt and shady Telegram ads - and pointed them at the one target I can legally stalk without a restraining order: myself.

No fake names. No burner emails. Just my real name, my main email, and one profile photo. The same breadcrumbs I leave everywhere.

I gave each tool exactly 4 minutes. Not because I'm scientific. Because that's how long my anxiety can handle watching a progress bar that says "SCANNING DARK WEB..."

This is what happened.

Ground Rules & Disclaimer: This is self-OSINT. I have explicit consent from my target (me). Don't be creepy. Don't use these tools to harass, dox, or stalk people. This is about auditing your own attack surface, not becoming the main character in a true crime podcast.

The Lineup

I didn't pick random tools. I picked the categories everyone is actually using in 2026:

1. Epieos - The Email Bloodhound
You give it an email, it tells you where that email has been. Google accounts, social profiles, data breaches.

2. IntelX.io - The Breach Archaeologist
Searches breaches, leaks, pastebins, and the dark web archives. It's like Ancestry.com but for your passwords.

3. OSINT Industries - The Pay-To-Creep Powerhouse
The one the TikTok investigators use. Email, phone, name, username - it correlates everything into a scary-neat profile.

4. Social Searcher / Sherlock-style AI - The Username Hydra
You put in one username, it checks 400+ platforms. Your embarrassing 2012 Reddit account? Found.

5. PimEyes / FaceCheck.ID - The Face That Launched a Thousand Lawsuits
Reverse facial recognition. Upload one photo, find every place your face appears on the public web. Yes, it still works. No, it's not comfortable.

6. SpiderFoot + GPT Wrapper - The OG Turned AI
Classic OSINT automation framework, now with an LLM layer that actually explains the findings instead of just dumping JSON like it's 2019.

7. Maltego + OpenAI Plugin - The Pretty Graph That Judges You
Maps relationships. It doesn't just find data, it connects it. "You worked with X, who lives near Y, who posted Z." Beautiful. Terrifying.

The 4-Minute Autopsy: What They Found

I hit start on all 7. Made coffee. By the time the Keurig stopped wheezing:

In Under 60 Seconds:

My current address, with 87% confidence, from a data broker opt-out page I thought I had removed myself from.
My old MySpace username. I had suppressed that memory for a reason.
3 data breaches I didn't know about, including one with a plaintext-adjacent password I reused in 2018. I know. I know.
My LinkedIn, GitHub, Medium, Instagram, and a forgotten Flickr account with photos of my dog wearing sunglasses.

By Minute 2:

PimEyes found 12 photos of me. Two were from a conference talk in 2022. One was from a local newspaper article I did for a charity run. One was... my Venmo profile pic cropped by someone else. Cool.
IntelX linked my main email to a breach that included my old phone number, which OSINT Industries then used to pull my carrier info and a list of "possible associates." One was my mom. One was a guy I bought a couch from on Facebook Marketplace in 2020. The algorithm thinks we're close.
The username hydra found my Chess.com account. My ELO is now public record. The shame is permanent.

By Minute 4:

The full picture assembled itself, without me helping at all.

Full Name + DOB + Current & 2 Previous Addresses + Phone Number + 6 Personal Emails + Employer History + University + 47 Photos + 12 Social Profiles + Breach Passwords + Amazon Wishlist (why is this public?) + Political Donation Record

Total cost to an attacker to get this: $0 to $47, depending on the tool. Total effort: Less than ordering a burrito.

I have 2FA on everything now. I use a password manager. I consider myself "privacy-aware." I'm still a walking data buffet.

The Scoreboard Nobody Asked For

| Tool | Scariest Feature | Accuracy | Price | My Uncomfortable Rating |
| --- | --- | --- |
| Epieos | Finds Google ID, Maps reviews, even your Google Calendar photo | 9/10 | Free / $ | 8/10 - Clinical |
| IntelX | Breach timeline | 10/10 | Freemium | 9/10 - Existential |
| OSINT Industries | Name -> Everything | 9.5/10 | $$$$ | 10/10 - Call your lawyer |
| Username Searchers | Finds forgotten accounts | 7/10 | Free | 7/10 - Cringe |
| PimEyes | Face -> Location -> Event | 8.5/10 | $ | 11/10 - Black Mirror |
| SpiderFoot AI | Auto-summarizes your vulnerabilities | 8/10 | Free/Open | 8/10 - Nerd terrifying |
| Maltego | Visualizes your entire social graph | 9/10 | $$ | 9/10 - Pretty terrifying |

Winner for pure horror? PimEyes. It's one thing to know your data is out there. It's another to see your face on a website in Estonia you never visited.

Winner for most actionable? IntelX + Epieos. Free, fast, and tells you exactly what to burn.

So What? The 3 Things You Should Actually Do

I did this as a stunt. But here's the part where I turn into a responsible adult for 30 seconds:

1. You don't have a privacy problem. You have a correlation problem.
One leak is nothing. AI OSINT is dangerous because it correlates 10 boring leaks into one interesting profile. Your Strava + your LinkedIn + your breached email = your home address and when you're not there.

2. Delete is a lie. Reduce is real.
You can't delete yourself from the internet. You can make yourself expensive to find. Remove data brokers [DeleteMe / Optery / manual opt-outs], nuke old accounts with JustDeleteMe, and turn off public Venmo/Amazon lists. Make the low-hanging fruit slightly higher.

3. Audit yourself quarterly.
Set a calendar event: "Stalk Myself." 15 minutes. Run Epieos on your email. Run PimEyes on your face. Check haveibeenpwned. If you find something you hate, fix it then. Future you, applying for a job / date / mortgage, will thank you.

I went into this thinking I'd write a clever post about AI tools. I came out of it changing all my passwords, removing my birthday from Facebook, and texting my mom to tell her we are not "possible associates" - we are family.

Your digital footprint isn't a footprint anymore. It's a full HD, timestamped, geotagged documentary with a searchable transcript.

And it only takes 4 minutes to watch it.

If you work in OSINT, security, or just love being paranoid efficiently - let's connect.

Bare Metal and Neural Nets: Crafting a Purpose-Driven AI Cyberdeck

v. Splicer — Sat, 25 Jul 2026 14:32:28 +0000

Your laptop is a rental. Your cloud is someone else's computer. It's time to build something that is actually yours.

Everyone has seen one. A mechanical keyboard crammed into a Pelican case, a tiny screen running cmatrix for the 400th time, a cyberdeck that has never left a desk. It's beautiful. It's also useless.

I love the aesthetic as much as the next Gibson-pilled gremlin, but we have to be honest: 90% of cyberdecks are cosplay. They are props for a future that never arrived. They look like they could decrypt a corporate mainframe while the city burns outside. In reality, they struggle to open a PDF.

I got tired of building toys. I wanted to build an exocortex. Something I could throw in a bag, take off-grid, and actually think with. No API keys, no subscription, no "Sorry, our servers are experiencing high demand." Just bare metal and neural nets, solder and inference, purpose over performance art.

This is how you build one that matters.

The Problem With Pretty

The cyberdeck community has fallen into what I call the Blade Runner trap. We optimize for how a thing looks in a photo on Reddit, not how it performs when the Wi-Fi dies.

The classic build: Raspberry Pi 4, underpowered, thermal-throttled inside a 3D-printed box that took 48 hours to print and 10 minutes to become annoying. It's a vibe. Vibes don't run 7B parameter models.

A purpose-driven deck starts with a different question. Not "What looks cyberpunk?" but "What problem do I want to solve when no one is watching?"

For me, that problem is cognitive sovereignty. I wanted a machine that could do three things without ever phoning home:

Remember everything I find and connect it.
Reason over it locally, privately, and fast.
Operate in hostile or absent infrastructure.

If your deck can't do those three things, it's a keyboard in a lunchbox. No offense to lunchboxes.

This is where we stop building props and start building tools. Purpose is a protocol. Everything else is decoration.

The Stack: Bare Metal That Doesn't Apologize

Let's talk guts. If you want local AI that doesn't feel like you're running ChatGPT on a toaster, you need to be ruthless about your bill of materials.

The Brain: Raspberry Pi 5. Yes, the Pi 4 was the darling. The Pi 5 is the divorce. It's actually fast. PCIe exposed. Real I/O. It doesn't beg for mercy when you ask it to compile anything. For a cyberdeck, this is your baseline, not your stretch goal.

The Spine: NVMe. If you are still booting your cyberdeck from an SD card in 2026, you are in an abusive relationship with storage. SD cards are slow, fragile, and corrupt at the exact moment you need them. An NVMe base (I use the Pimoroni NVMe Base, but there are a half-dozen good ones now) changes everything. Boot times go from geological to instant. Vector databases stop crying. You can actually run an OS that expects to be treated with respect. This one upgrade turns a toy into a workstation.

The Occult Co-processor: Hailo-8. This is the secret weapon. The Pi 5's CPU is good, its GPU is okay, but neither was built to do 26 TOPS of AI inference without melting. The Hailo-8 AI accelerator is a little M.2 module that sits on that PCIe lane you just freed up and gives your deck a dedicated neural engine. We are talking real-time object detection, zero-latency transcription, local RAG that doesn't take 45 seconds to answer "what did this PDF say?" It sips power while it does it. This is how you get offline AI that feels online.

The Nervous System: Raspberry Pi Pico W. Why add a $6 microcontroller to a $100 computer? Because smart systems have dumb reflexes. The Pico W is my power manager, my battery brain, my graceful-shutdown handler, my hardware kill-switch for the radio stack. It watches voltage, it controls fans based on actual thermal curves, it lets me wake the main Pi with a physical key. It means my cyberdeck doesn't die like a laptop. It sleeps and wakes like an animal. Also, having a second, fully air-gapped brain that can run Meshtastic or act as a BadUSB-detector in the field is just fun. Redundancy is punk.

Power is politics. I run a 65W PD battery bank with a proper UPS HAT in front of it. The deck can hot-swap power without blinking. Thermals are handled with a low-profile blower and actual airflow, not just holes drilled as an afterthought. The case? Pelican 1150, foam ripped out, custom deck plate cut from 3mm carbon fiber. No 3D printed hinges. If it can't survive being checked on a bus, it's not portable.

The Stack: Neural Nets That Don't Need Permission

Hardware is just expensive paperweight without the right software. The goal is a local-first, offline-capable cognition machine. No cloud. No telemetry. No Terms of Service that change next week.

My OS of choice is a stripped-down Raspberry Pi OS Lite 64-bit, no desktop bloat. I run Sway as a tiling window manager because it weighs nothing and looks like it belongs in The Matrix without trying.

On top of that, the real stack:

1. The Model Layer: Ollama with Llama 3.1 8B quantized (Q5_K_M) as the daily driver, and Phi-3 Mini for fast tasks. With the Hailo-8 handling embeddings and vision, the Pi 5 CPU is finally free to just... think. No more watching tokens trickle out one by one like a dying IV drip.

2. The Memory Layer: This is where most people fail. An LLM without memory is just a very confident amnesiac. I run Qdrant as a local vector store, fed by everything I research. PDFs, HTML captures, field notes, transcripts. All chunked, embedded locally with nomic-embed-text, and searchable offline. The LLM doesn't hallucinate when you give it receipts.

3. The Interface Layer: Open WebUI but heavily modded. Or even better, Obsidian as the front-end. Every chat, every research session, every transcription is a Markdown note. Linked. Tagged. Graph-viewed. Your deck becomes a second brain that actually has a brain stem.

This is the part where people usually get lost in tooling and forget why they started. I did too, for months. I had a beautiful pipeline that could do everything except save me time. The breakthrough was realizing that AI is not the product. The workflow is the product.

For investigative work, for example, the difference between a cool demo and a useful tool is having your pivot logic already mapped. I got tired of re-building the same OSINT chains every time I went down a rabbit hole, so I finally codified all of it — every username pivot, every dork that Google pretends doesn't work anymore, every Obsidian template I use to turn chaos into a case file — into what I now just load onto every deck I build: the OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit. It's not sexy. It just means when I'm offline in a cafe with my deck, I can go from a handle to a network map without touching the cloud.

That's what purpose-driven means. The AI doesn't just chat. It executes a workflow you actually use.

Building It Like You Mean It

Let's be brutally practical. A purpose-driven build has stages. Don't try to do it all at once or you'll end up with a drawer of half-soldered HATs.

Stage 1: Prove the Brain. Pi 5 + NVMe + display + power. Get it booting from NVMe reliably. Get your OS hardened. If you can't make this stable, the rest is theater. This alone takes an afternoon because Pi bootloader docs were written by sadists.

Stage 2: Add the Muscle. Install the Hailo-8. Get the HailoRT drivers playing nice with your kernel. Run your first local inference benchmark. Feel the moment when your object detection goes from 2 FPS to 30 FPS. That feeling is what the internet stole from us.

Stage 3: Give it a Soul. Install your local LLM stack. Build your first local RAG pipeline with three PDFs you actually care about. Not Wikipedia. Your PDFs. Your notes. If it can't answer a question about your work, it's not your AI.

Stage 4: Make it an Organism. Integrate the Pico W. Program the power logic. Add the physical switches. The moment you can kill Wi-Fi/Bluetooth with a physical toggle and your deck keeps thinking, you'll understand why cyberdecks matter. Privacy is not a software setting. It's a hardware switch.

I get DMs daily asking for the exact wiring diagram, the config.txt that doesn't brick the NVMe, the Sway config that makes a 7-inch screen usable, and how to cluster two Pi 5s inside one case without creating a space heater. I was going to write a 10-part thread, then realized no one wants a thread, they want a build log that actually boots.

So I dumped the whole thing — full BOM with current prices, STLs that don't suck, the Hailo-8 + Pi 5 NVMe dance, the Pico W power-brain firmware, and the cluster setup I use when I need one deck to be a router and one to be a brain — into the Offline AI Cyberdeck Pack: Pi 5 NVMe + Hailo-8 + Pi 5 Build + Pico W + Cluster. It's the build guide I wish I had six months ago.

The Aesthetics of Intent

Here's the irony: when you build for purpose, it ends up looking more cyberpunk than the cosplay decks ever could.

My deck is scuffed. The carbon fiber has a burn mark where I shorted a buck converter. The keyboard is a beat-up Corne split that I never learned to touch-type on properly. There are stickers covering mistakes. There is a single, unnecessary, extremely bright red LED that tells me when the Hailo-8 is inferring. It serves no functional purpose. I love it.

True cyberdeck aesthetics aren't about looking like a movie. They're about evidence of use. Patina. Wear patterns on the keys you actually press. A handle that is exactly where your hand wants it. The beauty of a tool that has been used to do real work is fundamentally different from the beauty of a prop.

McLuhan said we become what we behold. We shape our tools and thereafter our tools shape us. If you build a tool that requires you to be tethered to Big Tech's teat to function, you become a dependent. If you build a tool that is sovereign, you start to think like a sovereign individual.

Your cyberdeck should be a little hostile. Not to you, but to the idea that you need permission to compute.

So stop optimizing for Reddit karma. Stop printing another hexagonal grill.

Define a job that matters to you. OSINT researcher who needs to work from a parking lot. Writer who wants an AI editor that never reads their draft. Field technician who needs vision models in a basement with no signal. Ham radio operator who wants to transcribe and summarize signals offline. Pick one. Build for that one person.

Bare metal doesn't lie. Neural nets don't need Wi-Fi. The future isn't going to be handed to you in a polished aluminum slab from Cupertino. You're going to have to build it yourself, in a Pelican case, with a soldering iron that is slightly too hot, and firmware that almost works.

And when it finally does boot, when that local model answers a question about your own notes without ever touching the internet, you'll feel it.

That's not nostalgia. That's power.

Build your exocortex.