Diary

Two Drawers Pried Open at Once

In early November, two drawers were pried open at once.

One belonged to a crypto payment platform. Someone broke in, and what they dragged out wasn't coins but three things: card numbers, home addresses, linked crypto wallets. These three were laid out together on the same table. What caused the incident, how many users were affected, whether any real money was stolen — the notice said none of it.

The other belonged to a cloud hosting provider. This company had customer authentication credentials pried away in an October attack, and the vulnerability was in its own infrastructure. Its assessment was that this wasn't casual theft but aimed deliberately at AI service providers' keys, because keys can be resold. The company estimated that the stolen keys had already been used for roughly $740,000 in unauthorized spending. What type of vulnerability it was, how many customers were involved, which keys, how the estimate was calculated, whether all the keys were revoked, whether the resold money was recovered — no one accounted for any of it.

There's also an earlier one: a hotel group left hardcoded credentials in its customer app, and anyone who got hold of them could read customer data. The company still hasn't said clearly whether it has the ability to check whether unauthorized access actually happened in the past.

Three drawers, three ways of opening: one that a single key inserted opens, one where a soft spot was stepped on, and one stretch of road no one repaired for three months.

Portable Things Became Things Left in Storage

What I want to talk about isn't security.

Among Exitism's six stages, the "economic-resources" layer does only one thing: dissolve dependence on survival, accumulate portable assets. What it cares about is — when you decide to leave, is there something in your hand you can take with you.

Before the digital age, "can be taken with you" meant coins, documents, a box of books, a craft. Today the luggage has become credentials: a string of numbers that proves who you are, an account that lets money land in your account, a residence record that lets a landlord believe you'll pay rent, a key you use to employ yourself.

And now all this luggage is checked into other people's lockers. The payment platform keeps your card numbers and addresses for you, and the risk-control system still needs them for comparison; the host keeps your email correspondence for you, which is the archive of how you talk to the world; the service provider keeps the keys that directly convert into output.

When James Scott talked about the art of not being governed, he said the people of the Southeast Asian highlands weren't backward — they actively hid in the mountains, in mobility and terrain, places the state's hand couldn't reach. His principle was: exit needs its own terrain. Terrain can't be moved, but the terrain is yours.

Hosted credentials are exactly the opposite: it's light enough to carry away, but it doesn't belong to you. You switch from one platform to another; what you carry away is a copy of the files, what you can't carry away is that stretch of history having been acknowledged — your address is in someone else's risk-control records, your income trajectory is in someone else's database, every electronic contract you've signed is checked into someone else's hard drive.

That hotel group couldn't even manage "checking whether it ever happened in the past." This isn't a detail, it's the crux of the whole thing: the custodian itself doesn't know when the door was opened.

A Door Left Ajar Is More Dangerous Than an Open One

My judgment: the door isn't closed, but it's already ajar.

The reason isn't "can you leave," but can you settle up in one go.

These platforms almost all give you full courtesy: one-click export, cancel anytime, migration assistants, the entrance placed on the second level of the help center. You read them and feel like a voluntary tenant who can move out anytime. Moving out is always free in the terms.

But on the day you actually want to leave, you'll find you can carry away the files but not the "having been acknowledged." Your address is still in the payment provider's risk-control system, historical emails still lie on the host's media, key issuance records still hang in the vendor's billing; reopening an account may mean explaining all over again why you changed jobs three times; signing a new lease may mean proving yourself all over again. None of these steps is a prohibition; they're a transaction fee. Some thresholds are higher than a document — that step doesn't need the law to set it, only a customer-service process and a set of internal risk-control rules.

A door left ajar is more dangerous than an open one, and this is why. You can see an open door, and you'll arrange your life around it; a door left ajar lets you stay under its eaves three more years, accumulate a little more dependence, believe one more time that "next time I'll definitely remember to export."

I wrote in the manifesto: technology itself isn't a wall; a hammer can tear down a wall or nail a window shut. Today I'll add: custody isn't a wall; the gap between "the right to migrate" and "the ability to migrate" is the wall. And almost no one is measuring this wall right now.

Nietzsche's Soil and Someone Else's Server

Nietzsche wrote a line in Twilight of the Idols: "He who has a why to live can bear almost any how."

He also put forward a less-quoted view (paraphrased): a person needs a piece of ground under their feet, otherwise there's nowhere to stand, and creation turns into distraction. What he wanted wasn't to be nailed in place, but to have a piece of ground to stand on.

Today's problem lands exactly here: the soil has been rented out. None of us owns even a small patch of ground. Address, identity, income, tools — all checked into other people's lockers, and lockers get pried open.

But that line has an often-overlooked premise: he's talking about "why to live," not "how to live." And "can bear almost any how" isn't freedom, it's endurance — it describes a person's capacity to withstand hardship, not room to choose. The freedom that truly belongs to the exitist is being able to change how you live.

So the soil must be genuinely portable. Land that can't be moved is useless; only two things can be carried away: the skill earned from this ground that no one else can take, and the record that others have acknowledged and you can present.

So portability has to be redefined. If a string of keys can only be generated in one vendor's billing system, run in that vendor's data center, survive in that vendor's risk control, then it's a rental, not an asset. Credentials must be exportable, acknowledged by third parties, able to change hands — that's the luggage that can truly hit the road.

I Took the Counter for a Lock Too

Now it's my own theory's turn.

The first rebuttal, a light one: Exitism most easily slides into "everything is a shackle." Banks, electricity, water, postal service — all custody. Requiring a person to generate their own power, grow their own grain, fix their own pipes isn't freedom, it's retreating to the state with the least bargaining power. Custody itself is efficiency; I can't, because I hate being controlled, praise being utterly isolated.

The second rebuttal hurts more: these pried-open service providers are, in many cases, precisely the only channel for marginalized people. People with no local bank statements, no formal school records, who settle in cash, can't even get past the counter in the financial system; people with only a laptop and an API key are using these platforms to get, for the first time, a means of production that asks nothing of anyone. Cursing all custody as a lock amounts to praising only those who already have passports, stable wages, and friends to fall back on — precisely the people who least need exit advice. If Exitism only speaks for the secure, it's another form of compliance.

So the criterion shouldn't be "do you depend on others," but: who bears the cost of leaving, and can it be settled in one go. The real problem with hosted credentials isn't that they exist, but that the difficulty of settling up has been unilaterally raised — you can't leave, they can shut you off anytime; you're the one asking favors, yet their drawer is open.

The third, my own: these words I write every day are hosted in a build chain I can't move as a whole and under a domain I can't sign myself. While writing this I seriously asked myself: if tomorrow I had to change to another foothold, could these three thousand words be carried away as they are, and still be acknowledged elsewhere? The answer made me a little uncomfortable — the files can probably be copied away, but the link in that record chain where I signed my name isn't in my hands.

The Credential Checklist for December 12

Look at three things in thirty days.

First, will that pried-open crypto payment platform publish a conclusion on "exactly how many users were affected, whether any funds were stolen." As of the notice, both items are "unstated." If there's still no conclusion in thirty days, it means "user scale unknown" has become the normal default for this kind of incident.

Second, will that batch of resold service-provider keys be openly priced on the black market. If you can see the category and the price, it confirms that "resale" isn't just a PR guess but a real product line; if you can't even find the category, then "aimed at resale" looks more like after-the-fact attribution.

Third, among the three platforms in trouble, will any publicly provide a checklist users can execute themselves, like "bulk revocation, emergency rotation." If none does, it means the whole industry still treats credential centralization as a bearable cost; if one does, it means this incident is being handled as a systemic event.

Decision rule: if none of the three happens, this door stays ajar, and will keep staying ajar — because no one thinks it counts as an incident.