Originally published at parity.fund/graypunk/ · 中文版 → parity.fund/zh/graypunk/
“Turn the whole world ninety degrees and people will discover a truth that is usually hard to say out loud: lying flat is the true way of standing, and those who stand are the ones crawling.” — the Lying Flat Manifesto
Lying Flat Is Nothing to Be Ashamed Of, and It Works
In recent years there have been two kinds of people around me: those who will remake themselves by any means necessary in order to close in on their ideals, and those who lie flat. People who lie flat, for whatever assortment of reasons, are seldom seen rousing themselves for any particular cause. They have lost the desire to act, above all the desire for political action, which in Hannah Arendt’s eyes is what most fully reveals what it is to be human, and so this group is not easy for those who act to reach. Meanwhile, the more capable of action a person is, the lonelier they tend to be. Much of the time they have already given up wasting their breath on people who lie flat, especially in the field of tool development, even though this runs against the very direction they set out in, which was to make the world better.
Oddly enough, though, both kinds of people are willing to keep company with me. Perhaps it is because I have knocked around inside governments and large organizations and can also live inside cooperatives and decentralized autonomous organizations. I can speak both languages. I have tried to wake friends who were lying flat with their eyes shut on purpose, and I have tried to persuade people who had gone too far out to slow down. Later I realized that this was, in Mencius’s phrase, climbing a tree to catch fish. Seen from another angle, lying flat may be the true way of standing; and if it is possible to close in on your ideals while lying down, that would bear out an old saying: one person can walk fast, but a hundred people can usually walk far.
Genuinely beneficial technology may owe its mass diffusion to the lazy many. As Kevin Kelly put it, echoing McLuhan, humans are the sex organs of technology. A technology without sex organs, without humans, cannot evolve, and however good a technology is, if it never gets the chance to reproduce it remains idle talk among the sex organs, which is to say among us. Groups, on the other hand, generate all sorts of synergies that no one could foresee at the outset: herd immunity in public health, collective security in international relations, emergent collective intelligence in complexity science.
I therefore hold that the technology best suited to lying flat is the technology best suited to reproducing. This essay dwells on the state of mind of lying flat while keeping your edge, and works out how it might push us toward the technological applications we actually need, above all in the cypherpunk domain, which of all fields most demands that you practice what you preach with your own body. In the cypherpunk world, the paragon in pursuit of perfection, the “complete person” that Confucian moral education holds up and almost no one becomes, must take up every sort of tool, habit and way of living in order to erase their own footprints and hide themselves properly. Being that kind of paragon is far too much work. Wage cattle (shachiku, as East Asian office workers have learned to call themselves: livestock kept by the company) really have no spare time for following paragons. Even in the most extreme political environments, with everyone jumping at shadows, the most that wage cattle can manage is Soviet-era kitchen talk: expressing themselves a little, after dinner, in the one space nobody is watching. And even when wage cattle get curious enough about the world of privacy and security to sign up for a talk, they forget everything the moment the talk ends.
The paragon, the forerunner and the prophet shine too brightly, and it is genuinely unclear whether that is a good thing or a bad one; long before the day of deliverance arrives, the prophet has already ascended. Better to be an ordinary person, a tree hidden in the forest. But today’s society rewards the people holding hammers, the entrepreneurs, developers, storytellers, influencers and public intellectuals, and the crowd loves watching them hammer nails everywhere, which is exactly what gives away their position. Like the Pied Piper, they pipe the rats everyone wants to beat out into the river, and the forest that hid the trees is stripped bare.
This produces a paradox in the cypherpunk world: the people hawking and evangelizing good privacy tools are the most conspicuous people in it. Even if they hold the finest invisibility cloak going, they have to take it off for a while. To carry out their “missionary” work and get more people wearing invisibility cloaks, they must temporarily switch off their own invisibility.
So this essay tries to work out how to be a lazy cypherpunk: how to find, somewhere between the paragon and the wage cattle, a state with room for both, and how, inside the “spiritual civilization” of collective lying flat (to borrow a phrase the Chinese state is fond of), to let the technologies that protect ourselves and our groups be built out slowly. Cypherpunk can still be cool, but perhaps the coolness can live in the lining rather than on the face, with a gray coat worn over the top. This we call GrayPunk.
Steady, low-key technological diffusion may be an important idea for anyone thinking about survival technology. What I care about, therefore, is how to make the general public secure enough, rather than how to forge an elite into paragons.
When Self-Censorship Becomes a Knee-Jerk Reflex
The previous section discussed those who lie flat and those who act. Both are natural responses of an individual under pressure from the collective, one response that splits into two entirely different directions. Set aside for the moment whether the reasons for that pressure are just, whether they accord with the spirit of the age, whether they violate human rights. Consider only the individual confronted by a force much larger than themselves, and borrow the language of the stress response: people produce the most basic biological reactions of fight, flight and freeze.
Those who act, fight. They stop at nothing, like a rose growing out of a crack in the concrete. Most of them fail, of course; the bird that sticks its head up gets hit. Those who lie flat neither fight nor have anywhere to run, and their condition is best compared to freezing, like a sheep playing dead, flopped in the road. Humans lie down too, inside the structures of society, lying flat through work, life and entertainment. Perhaps they have adapted; perhaps they have given up resisting. They have, in effect, stopped responding to the pressure at all. There is occasional discomfort, but on the whole they survive, and this state of mind is a common fixture in certain East Asian societies.
Let us go on to the culture of conformity in East Asian societies. By “East Asians” this essay means, specifically, people shaped by the Confucian cultural sphere. We are in the habit of not expressing ourselves in public; sometimes even raising a hand to speak feels like enormous pressure. “Being the same as everyone else” may be one of the great survival habits, and after years upon years of socialization, trying to be the same as everyone else has become a knee-jerk reflex. Reading the air, as the Japanese put it, not being a bother to other people, even managing your own body odor: these all belong to the same cluster of concepts, the etiquette of taking up as little space as possible.
A culture of conformity like this does not even need top-down oppression to produce a kind of endogenous self-censorship all by itself. Before we put forward an unorthodox opinion, we run once through the whole tangle: will this sound abrupt, will other people fail to understand it, will it become a burden to them? That is self-censorship in its most basic form. And the ruler we measure with comes from a collective consciousness we imagine for ourselves. Although we call it collective consciousness, it is in fact tucked away separately inside each of us, so it might be more precise to define it as “the collective consciousness each individual privately supposes to exist.”
But precisely when everyone holds such a collective imagining, collectivity emerges. Let that collectivity iterate through enough behavior, trial, error and correction, and a dynamic collective consciousness is thereupon born, which may well be the origin point of conforming behavior. This is not the happy outcome that Benedict Anderson’s “imagined communities” are supposed to bring. We can of course call it an aggregate of national or cultural character, but on the darker reading, when self-consciousness willingly gives itself over to the collective consciousness, conformity makes people feel safe, without actually guaranteeing it, and at the same time makes them banal.
Timur Kuran’s “preference falsification” and Elisabeth Noelle-Neumann’s “spiral of silence” complete the loop. People hide their private beliefs because they anticipate sanction or fear isolation; public space therefore overestimates support for the mainstream opinion, which reinforces the silence further. Jonathon Penney’s research on Wikipedia browsing likewise shows that after government surveillance was widely reported, views of certain sensitive articles fell: a chilling effect can reach even perfectly legal reading (Penney, 2016).
This means that anyone trying to make their way in society carries the neural circuitry of self-censorship built in at every moment. Think before you speak, think before you raise your hand, think before you act. And if that self-censorship appears in an authoritarian or even totalitarian political environment, where top-down oppression exists purely to maintain a hegemonic culture, then self-censorship and collective censorship really do become one thing. Over time, people who self-censor may even develop a tendency toward system justification, forming a strength-worshipping culture that takes pride in its own hegemon. Even when the individual is coerced by power, holding only duties and no rights without knowing it, this subtle state of mind still emerges.
How can we tell easily whether a culture of conformity contains oppression from above? Perhaps we can bring in the eyeball test proposed by the political philosopher Philip Pettit. When you face different people, a partner, a peer, a family member, a boss, a politician, a law-enforcement agency, do you avert your eyes and turn your head away? If you do, there is a good chance that the other party ranks above you in the abstract world of power, which may indicate that you are in a relationship of domination. Let us ask the question another way: if you look at yourself in the mirror while thinking about an issue difficult enough that you might have to censor it, will you avoid your own eyes?
So within the culture of conformity in East Asian societies, an atmosphere of surveillance is born in which collective censorship and self-censorship resonate and reinforce each other, and hundreds of millions of people live inside this panopticon. Inside the great ring is a small ring: the great ring is the watcher who seeps through every crack, the small ring is the self-restraint that, as the Buddhist saying goes, the mind gives birth to on its own. When censorship becomes ordinary, argot and irony arise to meet it, and the Sinophone world may well have built the most formidable civilization of argot anywhere on earth.
Huddling Together for Warmth Against Collective Surveillance
We often see puzzling posts on Chinese-language social platforms, posts that make you go around the loop twice before you understand what the author is trying to say. Or rather, who the author is trying to say it to, and who they are trying to keep it from. This is exactly the art of argot.
The first reason is that saying things straight carries a clear risk, which creates the demand for argot. Keyword filtering, for instance, is an extremely efficient digital literary inquisition. When a user’s post contains a keyword the powerful would rather not see, the post is taken down, the account is annihilated, or, more heart-stopping still, the user is “invited to tea,” the euphemism for a summons from state security. As top-down control and an internet culture of collective censorship gradually take shape, censorship dictionaries are slowly built up. Users, of course, gradually feel out the boundaries of the censorship tools, work out the forbidden phrases, and then naturally develop argot or irony so that plain keyword filtering cannot bite.
For the past decade or so, the common method of online text censorship was plain keyword filtering: if the keyword appeared in the post, the post came down. In the last few years, though, the arrival of large language models has brought a rapid leap in the ability to analyze context and intent, and combined with existing tools such as stylometry, the magic weapons for fishing out a particular user have leveled up enormously.
The second reason is that argot makes it easy to tell friend from foe. Whoever understands it belongs to your tribe; whoever does not is an outsider. Argot, or irony, has to accumulate through shared lived experience. It is not something a centralized standard dictionary, an authoritative university lecturer or a news editor can define. Every generation, every region, every community is likely to have its own, and in a public space where everyone is jumping at shadows, the point of having argot matters more still.
Words themselves are double: exactly the same sentence has entirely different readings in different contexts, and nothing has been encrypted at all. A simple piece of argot can strengthen someone’s trust in a stranger, because whoever can speak it shares at least one stretch of culture, a line from a cartoon, an anime, a film or a song, a political event of great weight, or a meme that simply emerged. All of these can be birthplaces of argot, and none of them can be planned in advance.
James C. Scott called the performance of deference in front of power the “public transcript,” and the critique preserved behind power’s back the “hidden transcript.” Argot is precisely the gray channel between the two: it lets the hidden transcript enter semi-public space while preserving room to deny and retreat (Scott, 1990). King, Pan and Roberts, studying Chinese internet censorship, found that censorship targets content with collective-action potential in particular; what argot preserves is therefore not only room for expression but the ability to recognize comrades and coordinate action (King, Pan & Roberts, 2013).
Because double-meaning argot is not encrypted, anyone who puts in a little effort can pass as an insider quite easily; learn a few phrases and you can slip into the community. That is argot’s risk. But it is also why argot and irony develop so fast, fast enough that before the public has worked out whether someone supports or opposes a given position, whether they are being ironic or actually mean it, the evolving tribal code may already have shifted along another notch. At which point plenty of people inevitably think: “if it is this chaotic, I may as well give up trying to tell.” So more and more people lie flat, which can harden into rational ignorance and lead in turn to informational withdrawal and political disengagement.
But this is not comfortable lying flat; lying flat is not supposed to be this tiring. This particular inner journey toward lying flat is saturated with self-censorship. In a society full of digital literary inquisitions, citizens must consciously avoid certain places in order to escape disaster, and so their mental maps naturally sprout patch after patch of forbidden territory. This is lying flat saturated with self-censorship. To lie flat in genuine comfort, you have to untie the knots in your heart, smooth the mental map flat, and consciously undo the neural circuitry of the knee-jerk reflex.
There are two remedies here, one individual and one collective. On the individual side, you need to build digital hygiene habits without giving up on thinking. This does not require overdoing it: just put to work the atmosphere of constant conformity we already live in. Do not fall too far behind the group, and do not get too far ahead of it either, the old counsel of the mean. You will of course also need sound views on information security and privacy, and to judge, according to actual risk (your threat model), how far you really need to go. This is the way of living I call GrayPunk. The collective remedy is to make good-enough security practices the group default, so that not everyone has to keep up a high state of alert alone. The rest of this essay proceeds from there.
GrayPunk derives from cypherpunk, and the word cypherpunk borrows its name from cyberpunk. Cyberpunk works tend to imagine technological capability growing without limit while remaining pessimistic about civilization and its power relations. The future they depict is a human-machine composite in which class problems still exist and an extractive economy goes on plundering people and the environment; technology serves humans, but only the population at the top counts as human.
Cypherpunk took over cyberpunk’s name and tried to answer the dystopia it depicted with cryptography. Cypherpunk’s supporters lean anarchist; put bluntly, they do not much believe that governments, corporations or international organizations can guarantee an individual’s security. Security should begin with your own practice, including privacy tools and self-contained systems of exchange: currency, culture, language, network infrastructure and so on.
Cypherpunks are a very particular subcultural group, made up mainly of cryptographers, hackers with a will to political action, and academic circles. Few in number though they are, they have already become indispensable figures in the history of digital civilization, because they have won many battles in litigation against states and in the development of open-source technology, in the East as much as in the West. But there are plural value systems among cypherpunks too, the classic libertarian and the more left-wing spirit of solidarity, and plenty of each.
GrayPunk as a New Punk
But the GrayPunk this essay proposes does not require that kind of fervor, or that you be clever and hard-working, in order to join; it is a lay practice, not a monastic order. We might try peeling cypherpunk away from the Whig history that insists the world must eventually progress, and season it instead with the slacking spirit of lying flat. Perhaps a path of technological development like that is what actually moves civilization forward; who knows.
The Gray Man is a common term in operational security (OPSEC) and prepper communities. It means making yourself look ordinary in a crowd, unremarkable, not worth special attention, a common, low-cost strategy for hedging risk and countering surveillance. If a person is armed to the teeth, wearing a full set of high-end tactical gear and carrying specialized equipment, they may feel very safe, but in practice they have raised their own identifiability. The Gray Man’s reasoning runs the other way: blend into the environment, keep a low profile, make it hard for an observer to remember you and give them no reason to keep watching.
GrayPunk’s core spirit is not to develop an invisibility cloak beyond the world’s tech tree, but simply not to stand out from the crowd: to dim your light and mingle with the dust, as Laozi advised. This idea suits East Asian societies, which have spent whole lifetimes cultivating the spirit of conformity, extremely well, because to blend into a crowd you must be able to read a crowd, and the trick of self-censorship we have honed can be put to full use here, simply pointed in another direction. We know how to wear what everyone else is wearing, to go out and to raise a hand to ask a question at the right moment; we know how to get what we want without coming into conflict with anybody.
And still we know we are cool. That coolness is emphatically not external; no punk haircut, tattoos or nose ring required. The coolness is in the inner posture. We have our own punk spirit, tucked away beneath a gray coat, and this kind of coolness can find companions, and must have them. And because it is so much less difficult than cypherpunk, it can more easily reach a larger base, and more easily spread outward, slowly, from the niche, hard-to-implement layers of subculture.
What is more, a jump of an order of magnitude in numbers is itself the true practice of the cypherpunk spirit, because anonymity loves company. If real lying flat is to be achieved, then beyond individual security and daily habits, collective security is the second important subject. It is hard for one individual to compel others to cooperate in order to reach collective security; but if a whole society, or a whole tribe, adopts a set of not-so-difficult operating principles at the same time, path dependence will keep that set of principles alive inside the group for a very long time.
Even a society that runs on involution (neijuan, the East Asian word for competition that grinds everyone down without moving anyone forward), everyone trampling everyone else, still has a path toward safe lying flat. All it takes is for individuals to be consciously a little bit safer than the next person. We are all wearing gray, but when the predator comes hunting Gray Men, we have a few extra layers of protection and are more likely to slip through. People who think this way act, and over time the whole Gray Man community slowly upgrades its methods of protection, rather than balling up like a shoal of sardines and waiting for the sailfish to come and feed. We need to build second-order thinking into the development of technology and of digital literacy. Collective security is dynamic, and the best outcome is that the whole gradually levels up. That said, the long-run solution to this game cannot simply be to push risk onto more fragile people; it has to raise the overall security baseline step by step.
The history of the VPN illustrates exactly this kind of collective evolution, the kind the old proverb describes: the Way grows a foot taller and the demon grows ten. The VPN began as a rather boring piece of corporate information security: it let users outside the office connect safely into the company’s internal network through an encrypted tunnel. By the 2000s, open-source tools such as OpenVPN had gradually spread, and setting up your own encrypted tunnel had become easier and easier. At the same time, when China’s Great Firewall began carving up the network through DNS poisoning, IP blocking and keyword filtering, these tools, which had carried no revolutionary coloring at all, were quite naturally picked up to break through the block. The VPN at that point was very likely just something internet users reached for out of convenience, not a grand political act.
But the Great Firewall learns too. As more and more people used the same VPN tools, the traffic itself became an identifiable signature, so anti-censorship technology changed in turn. Shadowsocks, V2Ray and Tor’s various obfuscated transports were developed one after another, and the technical problem began shifting from plain encryption toward obfuscating traffic. Teams studying the Great Firewall found that since at least 2019, China’s censorship system has first used features such as packet length and entropy to guess whether a stream of traffic is Shadowsocks, then dispatched active probes to connect to the suspect server and confirm. By 2021 the Firewall had even begun identifying “fully encrypted” traffic at scale, affecting Shadowsocks, VMess and obfs4 alike. At this point, people using advanced technology look like soldiers in full battle rattle: once the outward appearance of your traffic departs from what a normal protocol looks like, it is very easily treated as an outlier.
So the development of obfuscation technology turned toward the Gray Man mode. The better the blockers get at hunting outliers, the more incentive anti-censorship tools have to imitate the normal, and the two sides co-evolve through round after round of identification, blocking, disguise and re-identification. The fight has already spread from protocols to regulations, app stores and commercial services, but the core is the same: the blocker looks for anomalies, and the user finds a way to melt back into normal traffic. Finn Brunton and Helen Nissenbaum call this kind of practice obfuscation, deliberately adding noise, ambiguity or plausible signals to make data harder to classify and exploit (Brunton & Nissenbaum, 2015).
This is also where GrayPunk is genuinely easy to put into practice. The grand ideal of internet freedom does not end in a landscape where everyone has become a cryptographer; it may end with millions of people acquiring an utterly ordinary habit. When censorship levels up a little, the tools level up a little too; when the tools get too hard to use, somebody in the market finds a way to repackage them a little more simply. Every individual only needs to know a little more than they did yesterday. That is already pretty punk.
GrayPunk, then, is collective security, and collective security is hiding a tree in the forest. Across the long river of history we assume there is no natural predator of humans that will wipe out humanity in one go, only humans competing with each other, and so while there is no guarantee that every tree stays standing, the whole forest is hard to clear at a single stroke.
So when we discuss collective security we must take into account the art of non-resistance and the courage to coexist; after all, that is what life actually looks like. Conforming, self-censoring, living comfortably, being a little bit safer than the next person while also being a little bit cool: that spirit has lived in us for a long time already. In East Asian societies, cypherpunk is not necessarily a pure ideological ideal; it is a precondition for survival.
Why Cypherpunk Never Went Mainstream, and How It Might Turn
Look across the history of the internet and cypherpunk has plainly won a number of beautiful victories: private communication (E2EE), anonymous networking (Tor), digital signatures (PGP and its descendants), electronic money (Bitcoin, Ethereum, Monero, Zcash), ideas that have long since sunk deep into digital civilization. So why has cypherpunk remained stuck in a subcultural layer with few members and a very high barrier to entry?
More precisely, what struggles to go mainstream is cypherpunk as a self-aware political identity and way of life. The technologies cypherpunk created often do enter the mainstream, just wearing a different face. Once a tool truly spreads, people no longer need to understand its history, its ideology or its technical details; it takes off the punk leather jacket and becomes the default, by default. Users are protected by it every day without necessarily knowing where the protection came from. This may be exactly where cypherpunk is most successful and, at the same time, hardest to see.
What is cypherpunk, exactly? In “A Cypherpunk’s Manifesto,” published in 1993, Eric Hughes understood privacy as the power to selectively reveal oneself to the world. The individual cannot expect governments, corporations and other vast organizations to grant privacy out of goodwill, and so must build, together with others, systems capable of anonymous transactions and private communication. Cypherpunk’s best-known creed is the line “Cypherpunks write code”: a political position has to be realized as a technical tool, or it is just talk.
This gives cypherpunk the character of prefigurative politics. It does not merely make demands of existing institutions; it also tries to write a small part of the ideal order into the protocol in advance. Institutional design of this kind is in fact a rather left-wing imagining, because before the code, as before the law, everyone is equal. The approach replaces waiting for permission with building, and carries an egalitarian imagination; yet the formal equality the code provides can still be canceled out by inequalities of resources, capability and infrastructure, and so code, as an actor in a social movement, is caught in a dynamic loop. When petitions ask the powerful not to surveil the people, cypherpunk tries to make surveillance technically harder. When the law asks a government to respect freedom of speech, cypherpunk tries to build communication systems that no single government can easily shut down. When people ask a platform to treat its users well, cypherpunk tries to preserve the ability to export your data, start over elsewhere and leave the platform.
But the early cypherpunks sometimes also carried a strong technological inevitabilism. So long as cryptography kept developing and code kept spreading around the world, power, it seemed, would eventually be tamed by technology. That slides easily back into the Whig history criticized earlier in this essay, as though the tech tree had only one direction and every branch eventually led to freedom.
Reality is obviously messier. The same cryptography that protects dissidents also protects ransomware; the same distributed network that supports public collaboration can once again let a handful of nodes, exchanges and service providers monopolize it. Technology will not choose civilization’s direction for us on its own.
Technology clearly will not stop accelerating, then, but we can choose the direction of the acceleration. The decentralized accelerationism (d/acc) proposed by Vitalik Buterin can be read as an update to the cypherpunk spirit. The full sense of d/acc is “decentralized and democratic differential defensive acceleration,” where the d points at once to decentralization, democracy, differential and defensive. It acknowledges that technological development brings enormous benefits, and acknowledges too that technological stagnation can cause real harm, but accelerating technology should not be understood as flooring the pedal without a word of discussion. Different technologies shift the balance of power between attacker and defender, and so we must give priority to developing the technologies that make attack harder, recovery easier and power more distributed.
Defense here is not the same as waiting passively, nor the same as handing all power to a prophet who claims to be able to protect the public. What d/acc pursues is distributed defense: individuals, communities and local organizations each holding a degree of protective capability, so that when the system is attacked it does not collapse entirely because a single node has fallen, and ordinary people do not have to permanently surrender their data, their identity and their freedom of action in order to obtain security. A sovereign whose word cannot be trusted is, after all, the largest security hole of them all.
This kind of thinking pushes cypherpunk one step onward, from personal privacy to collective security and even to the defense of civilization. Encrypted communication protects a conversation between two people; information defense protects a whole society’s capacity for judgment. Multisig protects one person’s holdings; institutional checks, balances and resilience mechanisms protect an organization from single points of failure. What is being protected expands gradually from the hacker, the punk who, in Mencius’s phrase, looks after their own virtue alone, outward to communities, organizations, public health, the information environment and democratic institutions.
Seen this way, the truly important function of defensive technology is not necessarily to make the strongest people invulnerable. Its more important function is to reduce the fragility of ordinary people, so that after one upheaval and then another they still keep the chance to get up again. This connects precisely with what this essay calls lying flat while keeping your edge: the posture of security is not standing permanently on guard, but being able to lie flat with your mind at ease.
In 2026, the Ethereum Foundation, in its Mandate, organized the core principles it must uphold into CROPS: Censorship Resistance, Open Source, Privacy and Security. The Mandate places these principles above convenience in priority and treats them as non-negotiable. It goes on to propose that the way self-sovereignty is used must be able to resist extraction while also offering a seamless user experience.
“Seamless” matters especially. The cypherpunk community has long been prone to treating unusability as the price freedom must pay, but a self-sovereignty tool that only experts can operate safely offers no more than a formal choice. Ordinary people will end up handing their keys, data and judgment back to an intermediary anyway, because daily life has no room for a full-time ascetic practice of information security. Designers cannot ask users to endure a terrible interface forever in order to defend a principle. On the contrary, designers must work to make censorship resistance, open source, privacy and security ordinary enough that ordinary people can go on being protected without renewing their vows every day. Only then can ordinary people join the ranks of the Gray Men.
I once proposed the idea of a Defense Transformation Guide, an attempt to offer a set of everyday methods for moving toward self-sovereignty and collective solidarity. When we talk about digital transformation today, society seems to suffer from neophilia; it likes to reward the people who invent new things. People like new platforms, new protocols, new artificial intelligence, new governance models and new startups, and they like watching founders wander around with a hammer looking for nails. As for maintenance? That is an afterthought nobody cares about. But as d/acc puts it, the axis of technological development can in fact be steered collectively by a population, and so I have been looking, in the space between collective solidarity and individual self-sovereignty, for the cypherpunk-rooted technologies and the latent next-generation techniques that belong there.
In the course of gathering and classifying these technologies, I found that cypherpunk still is not mainstream. There are many reasons; let us take them one at a time.
i. If It Isn’t Radical, It Isn’t Cool
A subculture needs to be a minority, but security needs to be collective. A large part of what makes punk cool is its distance from mainstream society. Once everybody can do a thing, it struggles to go on serving as a badge of identity. This leaves cypherpunk with an internal contradiction: it wants more people using privacy tools, but as soon as the tools spread, the special identity that came with the tools loses its value.
Inside a subculture, difficult knowledge, rare tools, special language and a high cost of practice can all become a form of subcultural capital. In cypherpunk, someone who runs their own server, verifies software signatures, knows how to compile code and is fluent in anonymous network protocols is of course worth admiring. But when those same skills are also used to prove who is cooler, technical ability hardens into rank within the community.
Argot cuts both ways here too. In an oppressive environment, argot helps comrades recognize each other and dodge crude text censorship; once it enters a technical community, it can turn into a gatekeeping mechanism. A newcomer who does not know what a seed phrase, entropy, a key or obfuscation means will struggle to take part in the conversation. This is particularly dangerous for information security. Security requires people willing to admit they do not understand something, and willing to admit they have been scammed before. The identity boundary originally used to recognize comrades can also get in the way of genuine mutual aid.
Cypherpunk communities are also prone to disputes over orthodoxy, over who is the true ascetic. Using that operating system is not secure enough; keeping data on that cloud is not independent enough; not self-hosting a node is not decentralized enough; still using mainstream social platforms is not resistant enough. Each criticism looks reasonable on its own, but add them together and the only qualifying cypherpunks left are the handful of people who can pour in vast amounts of time, money and specialist knowledge.
When a tool requires the user to complete an identity conversion and accept an entire worldview before they qualify for basic protection, it will struggle to enter the daily life of wage cattle. This gives cypherpunk a perverse incentive: the community most readily rewards whoever is furthest out in front, and does not necessarily reward whoever makes existing technology more boring, more stable and easier to use. Inventing a new protocol is cool; writing the missing documentation for an old protocol is less cool. Proposing the most extreme threat model is cool; working out a good-enough configuration for ordinary people is less cool. Declaring every mainstream platform unusable is cool; designing a path that lets users migrate gradually is less cool. But technological diffusion usually depends on that second, less cool kind of work.
ii. Security Fatigue
The second reason cypherpunk cannot go mainstream is security fatigue. As the previous section said, ordinary people cannot become paragons. A perfect cypherpunk needs a password manager, hardware security keys, encrypted drives, anonymous networking, an independent email service, separate identities for separate purposes, end-to-end encrypted messaging, offline backups and self-hosted services. They have to update software regularly, audit permissions, verify downloaded files, rotate keys and rehearse their recovery procedure, and to watch at every moment for locations showing up in their photos, metadata left behind in their documents, and whether their browser has formed a unique fingerprint.
NIST describes security fatigue as the weariness and resistance people develop when facing computer security. When warnings, password rules and security decisions come too frequently, people easily feel powerless, and go on to ignore the warnings and adopt riskier behavior. The heart of this problem is not that users lack knowledge; many have simply been bombarded for years by security demands beyond their cognitive load.
The design emphasis of low-friction security, then, is not only on educating the user but on reducing the number of security decisions the user has to remember, judge and repeatedly carry out. Tactical Tech’s Holistic Security places digital, physical, organizational and psychosocial security inside a single framework. A security regime that exhausts the people practicing it cannot last.
iii. You Can’t Lie Flat Without Money
The third reason cypherpunk cannot become mainstream is that maintaining technology takes resources. Open source can be distributed for free, but continuous maintenance still has to be paid for, and a surprising number of open-source projects critical to the world are maintained by one or two volunteers. The world has now reached the era in which these volunteers of the networked world are withering away, one by one, for reasons of health. Once a maintainer burns out, falls ill or leaves, an entire ecosystem can be exposed to risk. Steven Jackson’s “broken world thinking” warns us that technological order continues mainly through repair, care and maintenance; this work is less conspicuous than inventing a new protocol, but it decides whether a system lives (Jackson, 2014).
Privacy tools also face a peculiar commercial predicament. A lot of free consumer technology profits by collecting user data, serving ads and predicting behavior, but a service that protects privacy would collide with its own mission if it adopted the same model. Signal has explained publicly that maintaining a global private-communication service requires enormous infrastructure and development spending, and that the surveillance business model has spent years leaving users with the mistaken impression that consumer technology ought naturally to be free. Commercialization is not inherently a betrayal. The real question is whether the source of revenue is aligned with the user’s security. Subscriptions, cooperatives, public procurement, foundation grants, paid technical support, cross-subsidy and public-goods funding could all be remedies.
And making security the default itself requires steady funding, maintenance and documentation work.
The security technologies that have genuinely gone mainstream in history have usually completed one act of de-ritualization.
The spread of HTTPS did not depend on every website administrator in the world becoming a cryptographer. Let’s Encrypt lowered the cost of deployment with a free, automated and open certificate service, and the ACME protocol made requesting and renewing certificates something that could be automated at scale. In 2020 Let’s Encrypt issued its billionth cumulative certificate, and it treated usability and automation directly as the essential foundations of that diffusion. End-to-end encrypted messaging entered ordinary life without billions of people first understanding key exchange. In 2016 WhatsApp made end-to-end encryption the default state for calls and messages; users did not have to switch encryption on, and did not even have to know encryption was happening.
Together these cases show that technology rarely enters the mainstream because everyone has accepted a complete political philosophy. It enters the mainstream because the cost fell, the operations vanished, and the setting became the default. Cypherpunk technology’s most successful moments are usually also the moments when it looks least like cypherpunk. Every day, our connections, conversations and devices are already protected by those ideas. The revolution is absorbed by the establishment, and that, perhaps, is what technology actually reproducing looks like.
iv. The Ant Cannot Shake the Tree
The fourth reason cypherpunk cannot become mainstream is the extreme asymmetry of power. One developer can invent a new anti-censorship protocol, but the state holds far more power at the same time. The VPN history recounted above has already shown that this is a co-evolution with no endgame. If what cypherpunk imagines is one beautiful technical counter-kill, reality will usually disappoint. States and large platforms can lose a round, but as the old saying goes, a hundred-legged centipede does not stiffen the moment it dies; they will not fall apart on their own any time soon.
But an ant does not necessarily have to push a tree over head-on, and a forest does not survive on any single tree. A forest’s resilience comes from the symbiotic relationships between different species. Part of what stands above ground may be felled while the root system below still holds the ability to grow back. The real goal of anti-censorship technology, therefore, is not necessarily to destroy the censor in one blow. It can be to keep raising the cost of total control, to preserve alternative channels, to slow the lock-in of power, and to make sure knowledge and relationships do not disappear along with any single tool.
A single tool is easy to target; an ecosystem can turn, change shape and regenerate. This is precisely why GrayPunk must emphasize collective security. No individual needs the capability to defeat a state, but the group as a whole needs to avoid betting all its hope on one prophet, one paragon.
These four reasons are in fact interlocked. Subcultural boundaries obstruct diffusion, excessive operating costs obstruct practice, a lack of resources obstructs maintenance, and asymmetry of power makes it hard for any single victory to become a permanent result. The remedy must therefore lower the cost of identity, the cost of operation, the cost of maintenance and the cost of confrontation all at once. Cypherpunk needs to shift gradually from a heroic narrative into daily life, from the extreme security of a few paragons to the proportionate security that most ordinary people can sustain over the long run.
GrayPunk as a Fashion
The most interesting thing about fashion is that people usually imitate first and understand afterward. Most people do not read a whole history of clothing, a course in textiles and a body of identity politics before deciding what to wear today. They watch the people around them, see that some practice looks convenient and good, and adopt it. Fashion is therefore a low-cost mechanism of group coordination. It does not require every participant to share a complete theory; it only requires that a practice have a low enough threshold for imitation.
This is exactly what lets us repurpose the conformity nerve of East Asian societies.
Conformity originally taught people to read the air, censor themselves and avoid standing out; GrayPunk tries to turn that same capability toward collective security. When the people around you all use a password manager, turn on a device passcode, update regularly, use encrypted messaging and cut back unnecessary permissions, the individual does not have to feel they are taking part in a revolution. They are only doing what everyone else is doing.
GrayPunk has no uniform. If a particular set of signs were required, that aesthetic would already have lost the gray coat’s function. GrayPunk can have a shared posture, but it should not fix that posture into something easily recognized. GrayPunk is fluid. It spreads more the way a habit spreads than the way a costume does. GrayPunk is therefore a subculture without a subcultural uniform. It keeps punk’s distrust of power, its insistence on autonomy and its imagination of alternative systems. Its coolness is hidden where you cannot see it at first glance.
Laziness, besides, is also a fashion. The laziness meant here is a long way from negligence. Negligence is knowing the risk and leaving the problem to your future self; lazy design demands that the system handle the repetitive, trivial and error-prone work in advance. GrayPunk therefore treats laziness as a formal engineering specification. Important choices should appear at the moments that genuinely carry meaning, and the rest of the work should be borne by tools, organizational norms and infrastructure. If security only holds when you are alert, have plenty of time and are running high on political passion, then it is not security fit for human society.
Cool is where you cannot see it at first glance.
GrayPunk’s coolness can be measured in a counterintuitive way. The less a security technology demands the user’s attention to itself, and the more it preserves the user’s autonomy at the same time, the closer it comes to GrayPunk. The best protection is usually like the fire piping inside a building: nobody photographs it or checks in beside it on an ordinary day, but when the fire comes it decides who gets out of the building alive.
GrayPunk nevertheless faces one supremely important ethical question: if you lower your identifiability, does that steer you back toward self-erasure? Would it dissolve a subcultural group’s agency to advocate at all? The question is especially sharp in East Asian societies. If all we are doing is repackaging silence, obedience and the loss of one’s edges as a gray-coat strategy, that is already proof that power has won. Self-censorship does not become liberation automatically just because it has put on a punk name.
The difference between the gray coat and self-erasure can be identified through three tests: choice, reversibility and reciprocity.
The first is choice. Who exactly decides that a person should keep a low profile? If the answer is a boss, a government, a family, community opinion or internalized fear, then it is closer to coerced self-censorship. If the individual can still decide to whom, when and how much to disclose, then low visibility becomes part of privacy. This returns us to Eric Hughes’s understanding of privacy: the core of privacy is keeping the choice of whether to reveal oneself.
The second is reversibility. The gray coat should be a coat you can put on and also take off. An individual keeping a low profile in a high-risk environment should still preserve their name, their memories, their views, their relationships and their capacity to act inside the spaces they trust. They can tell the truth in the kitchen, they can recognize and be recognized among comrades, they can leave testimony when the conditions are right, and they can walk back into public space when they must. A strategy of invisibility you can never exit is more wretched than the panopticon.
The third is reciprocity. Does the gray coat make the whole forest denser, or does it only get you behind somebody else? If an individual shifts risk onto people who are more conspicuous, poorer or less technically capable, that is still a competitive hedge. GrayPunk instead requires that an individual’s protection create a public spillover, making it easier for other people to get secure too. A real anonymity set cannot be built alone, and truly hiding a tree in the forest cannot mean hiding yourself while cutting down every tree around you.
This also echoes the eyeball test mentioned earlier. The gray coat does not ask people to keep their heads down forever; it asks them to preserve the ability to choose when to raise them. Real security is not making a person never dare to look power in the eye again; it is that when they decide to look, there is still a group behind them that will not vanish the instant they fall for a while. In Albert Hirschman’s language, the gray coat can be a limited exit: lowering exposure for now while preserving the capacity for voice later.
Nor does GrayPunk demand that everyone lying flat suddenly stand up. Those who lie flat can take part at low intensity. A person may be unwilling to become a public political activist, but they can live more safely; they can back up data, maintain documentation, fund infrastructure, and teach the people around them to use mature tools. This low-visibility maintenance work is itself part of collective security.
In Closing: How to Be a Lazy Cypherpunk
Having written this far: being a lazy cypherpunk does not actually require imagining yourself as the last member of the resistance, nor saving up for a bunker while you wait for the end of the world.
We should lie flat in order to win lying down.
Winning lying down, the gamer’s term for a victory your teammates carry you to, means stretching the confrontation into an endurance race. The opponent has to keep pouring resources into surveillance, identification, blocking and pursuit, while we fold security into ordinary life so that each evasion costs a little less and each recovery comes a little faster. When the controller’s cost of “stability maintenance,” to use the Chinese state’s own term, keeps rising, and the controlled need only preserve enough slack to avoid being fully controlled, lying flat can turn into an asymmetric advantage.
A warrior does not need full battle rattle to go and buy breakfast. Security should observe proportion too, and this can be called proportionate security. Strapping on every protective tool you can find will not necessarily make you safer, and may well give the game away, exposing your own peculiarity while producing psychological fatigue on top.
The lazy cypherpunk also needs a little security zen. Security zen means taking in new knowledge, practicing with tools that have already matured, and reviewing your own life regularly, without falling into panic over every piece of security news. Do not mistake anxiety for diligence, or complexity for security. A genuinely deep security practice often shows up as a handful of actions so ordinary they are disappointing.
This is also a game of being a little bit safer than the next person. In the short run, a bit more protection lowers your chance of being the easiest target to attack; over a longer horizon, the most stable strategy is still to raise the security baseline for more people together. Anonymity loves company: the fewer people using a given privacy tool, the more the act of using it becomes a fingerprint in itself, and only when there are enough users does it blend into the ordinary background. We can borrow the metaphor of k-anonymity here: when a person shares their visible features with enough other people, they are harder to single out. A single Gray Man cannot make a GrayPunk community.
So what we have to do is not to forge ourselves into tireless paragons. The GrayPunk sidesteps heroic martyrdom and also refuses numb surrender. They choose a way of living that can be kept up through being busy, being tired, being dumped, being laid off, being ill and living through a political winter. A genuinely reliable security habit has to still work on the days when a person has the least strength; a genuinely reliable collective has to keep running after one or two people have fallen.
The social-movement scholar Verta Taylor calls the state in which a movement preserves its organization, its relational networks and its collective identity through an ebb tide “abeyance,” which might be rendered as holding in latency (Taylor, 1989). Lying flat while keeping your edge can be read as this concept’s version for digital survival, or, going one step further, as a description of the state of mind of an indestructible, indolent activist.
Lying flat while keeping your edge is king, because only a sustainable life makes for a long resistance. Lie down comfortably, keep the system running, and stay in the same forest as your companions: that is the most sustainable posture available to a lazy cypherpunk.
GrayPunk is the first essay of Telescope Editions, Parity's essay grant. Text © 2026 Yen-Lin (mashbean) Huang, published under CC BY-SA 4.0.
