Open Weights Are Data

Open models are good enough for most things. That is not benchmark cosplay; it is the operational fact that makes the whole gatekeeping story collapse under its own weight. In June 2026 I wrote it flat, and I will not dress it up now: “Open models are good enough for most things.” Most things is the load-bearing phrase. Not every research frontier, not every vanity demo, but the work a person actually does with language, with code, and with a pile of their own notes. For that work the open file is enough, and “enough” is a revolution if you were told the only adult option was a rented endpoint with a content policy stapled to its forehead.

The fear industry needs the opposite premise. It needs you to believe that intelligence is a utility, that the utility is dangerous in unlicensed hands, and that the only safe architecture is a corporation sitting in the middle, taking a cut and keeping a log. The corporation is delighted to agree, because a log is a product, a refusal policy is a product, and your dependence is the product underneath both of them. Root Access and the API of the Sovereign Mind is the split they are trying so hard to muddy, the difference between outsourcing your judgment to the endpoint and delegating a draft to a tool you can still review. The endpoint wants those two to feel like the same button.

The File Is Not a Program

“The model is data, not code, you can’t build a backdoor into it, and the software you use to run the model is open source.” Let me say the careful version of my own sentence, because careful is not the same thing as timid. The weights are a file of numbers, and you do not sneak a branch into a pile of numbers the way you sneak a branch into a source tree. The runner is code. The sampler is code. The server that wraps the runner is code, and the app that phones a vendor and calls the reply “the model” is code too. The backdoors people actually ship live in those layers, or in the policy layer that deletes the answer after the model has already produced it, and that is exactly why the runner wants to be open source. A closed runner wrapped around an open file is a sealed box again, and you have been fooled by an adjective.

Data can still be poisoned; a training set is a supply chain, and I am not selling innocence. I am selling the correct layer. You audit a dataset the way you audit any other corpus, by being able to see it, resample it, and refuse it; you audit a runner by reading it; and you cannot audit a vibe at all. Zero-Trust does not ask the model to have a conscience. It asks the output to be checkable and the binary to be yours.

Self-Hosting Is Already Boring

“It’s already easy to self host a chat GPT and extend it however you want.” Easy is an insult to the people who want this to remain a priesthood, so of course easy is the word. A machine you control, a runner you can read, a file you can swap out on a Tuesday afternoon: extend it with your own notes, your own tools, and your own refusal to ship the conversation off to a stranger’s retention policy. I am not posting a hostname, a port, or a cluster diagram, because the absence of those details is the point of a public essay, while the presence of the practice is the point of a life. I Killed Windows is the operating system underneath the practice, and Crypto Is FOSS for Value is the older version of the same posture, from the days when the job was hashing instead of inference. Own the hardware. Aim it. Keep the off switch.

Boring is a feature. The moment self-hosting becomes a weekend project instead of a security clearance, the argument that ordinary people cannot be trusted with a model is revealed as a class argument, and class arguments love a complexity story, because the story keeps the admin necessary. Admins Who Think They Own the Users is that love applied to a country; applied to a chatbot, it is the same love in a smaller chair.

Where Regulation Actually Bites

A parliament cannot un-invent a file that has already been copied. It can hassle the copy: it can lean on the app store, the payment processor, the cloud account, and the company that still operates a public endpoint, and it can write a lawful-access duty that assumes the provider holds the conversation and can be told to produce it. Lawful Access Is a Backdoor is that duty in its current Canadian costume, a duty aimed at providers, which is precisely why the adult move is to stop being the provider’s customer for the conversations you cannot afford to deposit.

I am not going to invent an AI statute so this section can have a villain with a number. Bills die, bills return, titles change. The stable fact is the chokepoint: regulation bites wherever there is still a desk, and a file on a disk you own, executed by source you can read, has no desk. That is infuriating to anyone whose job is the desk, and it should be. Speech Is a Protocol, Not a Permission hit the same nerve, because a sentence that does not need a permit and a model that does not need an API key are the same offense: the user routed around the admin.

Running a Company of Agents is what you do with the file after the romance wears off. You define the scope, the agent executes, and you review. The weights do not get a vote about your life, and a regulator does not get a vote about the weights merely by calling the file a mind and then demanding a license for minds. Minds are not licensed. Tools are chosen, and I choose the tool I can turn off.

Good enough is the victory condition. Perfect is the story the vendor tells while it meters you. Run the file.