Read the full post<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"Cloudflare announced PACT this week \u2014 privacy-preserving tokens to separate humans from bots, backed by Google, Mozilla, Microsoft, and Shopify. The cryptography is solid. The governance model doesn’t exist yet. I wrote about why the “ratchet effect” should worry anyone who cares about the open web, how this is Web Environment Integrity re-skinned for the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":"","jetpack_post_was_ever_published":false},"categories":[891,775,681],"tags":[],"class_list":["post-48920","post","type-post","status-publish","format-standard","hentry","category-ai","category-commentary","category-cybersecurity"],"yoast_head":"\n
PACT: The open web doesn't need another trust oligopoly - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PACT: The open web doesn't need another trust oligopoly - rud.is\" \/>\n<meta property=\"og:description\" content=\"Cloudflare announced PACT this week \u2014 privacy-preserving tokens to separate humans from bots, backed by Google, Mozilla, Microsoft, and Shopify. The cryptography is solid. The governance model doesn’t exist yet. I wrote about why the “ratchet effect” should worry anyone who cares about the open web, how this is Web Environment Integrity re-skinned for the […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-23T11:55:01+00:00\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"PACT: The open web doesn’t need another trust oligopoly\",\"datePublished\":\"2026-06-23T11:55:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/\"},\"wordCount\":83,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"articleSection\":[\"AI\",\"Commentary\",\"Cybersecurity\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/\",\"name\":\"PACT: The open web doesn't need another trust oligopoly - rud.is\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\"},\"datePublished\":\"2026-06-23T11:55:01+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2026\\\/06\\\/23\\\/pact-the-open-web-doesnt-need-another-trust-oligopoly\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/rud.is\\\/b\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PACT: The open web doesn’t need another trust oligopoly\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/\",\"name\":\"rud.is\",\"description\":\""In God we trust. All others must bring data"\",\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rud.is\\\/b\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\\\/\\\/rud.is\"],\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/author\\\/hrbrmstr\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PACT: The open web doesn't need another trust oligopoly - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/","og_locale":"en_US","og_type":"article","og_title":"PACT: The open web doesn't need another trust oligopoly - rud.is","og_description":"Cloudflare announced PACT this week \u2014 privacy-preserving tokens to separate humans from bots, backed by Google, Mozilla, Microsoft, and Shopify. The cryptography is solid. The governance model doesn’t exist yet. I wrote about why the “ratchet effect” should worry anyone who cares about the open web, how this is Web Environment Integrity re-skinned for the […]","og_url":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/","og_site_name":"rud.is","article_published_time":"2026-06-23T11:55:01+00:00","author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"PACT: The open web doesn’t need another trust oligopoly","datePublished":"2026-06-23T11:55:01+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/"},"wordCount":83,"commentCount":0,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"articleSection":["AI","Commentary","Cybersecurity"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/","url":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/","name":"PACT: The open web doesn't need another trust oligopoly - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"datePublished":"2026-06-23T11:55:01+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2026\/06\/23\/pact-the-open-web-doesnt-need-another-trust-oligopoly\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"PACT: The open web doesn’t need another trust oligopoly"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":""In God we trust. All others must bring data"","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-cJ2","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":24738,"url":"https:\/\/rud.is\/b\/2025\/04\/05\/a-critical-analysis-of-iceraid\/","url_meta":{"origin":48920,"position":0},"title":"A Critical Analysis of ICERAID","author":"hrbrmstr","date":"2025-04-05","format":false,"excerpt":"ICERAID (iceraid[.]us) presents itself as a \"GovFi protocol\" that purportedly delegates intelligence gathering tasks from law enforcement to citizens. According to their materials, it rewards users with cryptocurrency tokens for capturing and uploading images of alleged \"criminal illegal alien activity\" and other suspected criminal behavior to their platform. The platform\u2026","rel":"","context":"In "Cybersecurity"","block_context":{"text":"Cybersecurity","link":"https:\/\/rud.is\/b\/category\/cybersecurity\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1078,"url":"https:\/\/rud.is\/b\/2012\/05\/22\/new-securid-soft-token-cloning-weakness-whats-the-risk\/","url_meta":{"origin":48920,"position":1},"title":"New SecurID Soft Token Cloning Weakness : What’s The Risk?","author":"hrbrmstr","date":"2012-05-22","format":false,"excerpt":"I posted a link to Twitter earlier on a recent discovery of the ability to clone RSA SecurID soft tokens: It (rightfully so) received some critical responses by @wh1t3rabbit & @wikidsystems since, apart from what the hypesters may say, this is a low-risk weakness. Think about it. Just looking at\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5929,"url":"https:\/\/rud.is\/b\/2017\/05\/08\/travis-ci-flaw-exposed-some-secure-environment-variable-contents\/","url_meta":{"origin":48920,"position":2},"title":"Travis-CI Flaw Exposed Some ‘Secure’ Environment Variable Contents","author":"hrbrmstr","date":"2017-05-08","format":false,"excerpt":"Tagging this as #rstats-related since many R coders use Travis-CI to automate package builds (and other things). Security researcher Ivan Vyshnevskyi did some ++gd responsible disclosure to the Travis-CI folks letting them know they were leaking the contents of \"secure\" environment variables in the build logs. The TL;DR on \"secure\"\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":5954,"url":"https:\/\/rud.is\/b\/2017\/05\/16\/r%e2%81%b6-using-r-with-amazon-athena-awas-temporary-security-credentials\/","url_meta":{"origin":48920,"position":3},"title":"R\u2076 \u2014 Using R With Amazon Athena & AWS Temporary Security Credentials","author":"hrbrmstr","date":"2017-05-16","format":false,"excerpt":"Most of the examples of working with most of the AWS services show basic username & password authentication. That's all well-and-good, but many shops use the AWS Security Token Service to provide temporary credentials and session tokens to limit exposure and provide more uniform multi-factor authentication. At my workplace, Frank\u2026","rel":"","context":"In "R"","block_context":{"text":"R","link":"https:\/\/rud.is\/b\/category\/r\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":96,"url":"https:\/\/rud.is\/b\/2011\/02\/12\/web-development-is-dangerous\/","url_meta":{"origin":48920,"position":4},"title":"“Web Development Is Dangerous”","author":"hrbrmstr","date":"2011-02-12","format":false,"excerpt":"Those were the words that greeted me within five minutes of checking out the Flask microframework for Python web applications. I feel compelled to inline those four, short paragraphs: I\u2019m not joking. Well, maybe a little. If you write a web application, you are probably allowing users to register and\u2026","rel":"","context":"In "Information Security"","block_context":{"text":"Information Security","link":"https:\/\/rud.is\/b\/category\/information-security\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":6078,"url":"https:\/\/rud.is\/b\/2017\/06\/13\/keeping-users-safe-while-collecting-data\/","url_meta":{"origin":48920,"position":5},"title":"Keeping Users Safe While Collecting Data","author":"hrbrmstr","date":"2017-06-13","format":false,"excerpt":"I caught a mention of this project by Pete Warden on Four Short Links today. If his name sounds familiar, he's the creator of the DSTK, an O'Reilly author, and now works at Google. A decidedly clever and decent chap. The project goal is noble: crowdsource and make a repository\u2026","rel":"","context":"In "AppSec"","block_context":{"text":"AppSec","link":"https:\/\/rud.is\/b\/category\/appsec\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/06\/Cursor_and___Development_scamtracker_-_master_-_RStudio.png?fit=1200%2C529&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/06\/Cursor_and___Development_scamtracker_-_master_-_RStudio.png?fit=1200%2C529&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/06\/Cursor_and___Development_scamtracker_-_master_-_RStudio.png?fit=1200%2C529&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/06\/Cursor_and___Development_scamtracker_-_master_-_RStudio.png?fit=1200%2C529&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/06\/Cursor_and___Development_scamtracker_-_master_-_RStudio.png?fit=1200%2C529&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/48920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=48920"}],"version-history":[{"count":1,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/48920\/revisions"}],"predecessor-version":[{"id":48921,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/48920\/revisions\/48921"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=48920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=48920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=48920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}