Protocols: Power Hides in Boring Places

By Mallory Knodel

I'm returning to HOPE (Hackers On Planet Earth), one of the longest-running hacker conferences in the world, organized by 2600: The Hacker Quarterly since 1994. It's community-run, volunteer-powered, and unapologetically political.

This is at least the fourth time HOPE has platformed a talk or panel about what's happening inside standards bodies like the IETF, W3C, ICANN, ITU, and the rest of the alphabet soup that governs how the internet really works. On Friday, I'm using my 50 minutes to walk through a set of specific examples of human rights considerations in technical standards to make the abstract idea of "internet governance" feel concrete. My HOPE is that more public interest advocates get involved in shaping standards. Here are just a couple of those:

robots.txt, thirty years and counting (our blessings).

In 1994 the Robots Exclusion Protocol was a polite, informal request expressed by website operators about bot behavior. This small but mighty text file stated a preference that web crawlers not scrape certain directories. It finally became an actual standard in 2022 IETF as RFC 9309. Then, almost immediately, it had to evolve again: the IETF working group that started as "ai-control" (still the mailing list name) became "AI Preferences" (AI Pref) between 2024 and 2025, trying to extend that same thirty-year-old convention to cover a wider array of AI bot behaviour from scrapers to agents and beyond.

This is about as boring and unglamorous as internet infrastructure gets, and it's exactly where the fight over who gets to use your content, and how, is actually happening.

RFC 9849 and the end of VPNs (amen).

When your browser opens a secure connection, it starts with a handshake: a quick exchange where your computer and the site agree on how to encrypt everything that follows. But the first message in that handshake named the site in plain text, because the contemporary web relies on the virtual and collocated hosting of many sites on the same server. So even over HTTPS, any intermediary with access to network traffic could see your IP address asking for a specific site, even if HTTPS protected the rest of your exchange. Encrypted Client Hello, or ECH, encrypts that first message too, so the site name doesn’t leak.

This is great for privacy and it’s great for circumvention: You can’t intercept what you can’t see.

The wide deployment of ECH would be done at the network hardware layer and the web hosting layer, meaning that this privacy gain is baked into the fundamentals of networking and it accomplishes what today’s VPNs do: hide who you are and who you’re talking to. It’s also better than a VPN because you don’t need to rely on a third-party intermediary to keep your communications private.

That's the theory of change working exactly as intended: instead of everyone individually buying their way into privacy, you fix the protocol once and the privacy comes as standard.

And here are just some of the things I've learned as a feminist activist engaged in global standard setting:

• Power hides in boring places.
• Low layer protocols can scale solutions to everyone using the internet.  
• Charters are mandates and agenda-setting is crucial.
• Coordinating mandates across groups and bodies is a higher layer of orchestration: power struggles among the powerful.
• Showing up once is advocacy. Showing up for ten years changes an institution. (But sustained engagement is really costly, too.)
• External norms, like laws or resolutions, are no replacement for sound implementations if you want sound technical specifications.
• For some issues like censorship and inclusion, there still exists a natural resistance to topics that directly challenge political power.
• Small protocol changes can redistribute power at scale, for everyone.
• If the same idea shows up in five different rooms, that's not popularity, that's forum shopping.
• A published standard is the beginning, not the end. Implementation shapes what the standard actually becomes in practice.
• Standardize the interoperable seams, not the whole product.
• Every decentralized identifier eventually realizes it is recreating the DNS.
• There is no cyberspace floating above geopolitics — eventually it all touches spectrum, territory, licensing, and states.
• We've always been moderating content below the content layer, in the stack itself. We are way beyond if or when: it's how.

Relaunch of Bluestockings

Also happening at HOPE (Hackers On Planet Earth), the relaunch of Bluestockings! For 26 years, Bluestockings was as queer, feminist, anti-racist activist bookstore on the Lower East Side of Manhattan.

The Bluestockings store closed in 2025, but a group of volunteers has kept the mission alive in a new form: an online shop and an event pop-up. The books on offer at HOPE are tech and social justice reads.

Every book, membership, subscription, and donation keeps the work going now and builds toward Bluestockings' long-term goal: reopening a permanent store in Lower Manhattan. You can help them achieve that goal in the coming weeks by buying books on their website bluestockings.com. While that is under construction, you can:

• Follow them on Instagram, Facebook, TikTok or X for updates about the website relaunch
• Buy books on their bookshop.org site https://bookshop.org/shop/bluestockings
• Become a member. You can become a friend for $10/month or a bestie for $25/month. Perks include, merch, discounts and more. withfriends.co/bluestockings/join 
• Subscribe to the book of the month. For $30/month, you get a hand-picked book delivered to your door, with options including queer romance, poetry, and kids' books. withfriends.co/bluestockings/join 
• Wear their merch. www.bonfire.com/bluestockings 
• Give a one time gift. withfriends.co/bluestockings/contribute

Want to appear here? Sponsor a newsletter.

This Week's Links

• Ranking Digital Rights, Breakpointing Bad, and the International Corporate Accountability Roundtable are gathering input from researchers, advocates, and technologists to shape a new methodology for assessing VPN providers. You can help them by filling in their survey: https://forms.superbloom.design/s/ynli8xjs2o5dp5l781n9z0q1