The slow way, made survivable Chapter 19 of 23 Svenska

The map · Part Two · The machine · Chapter 19 of 23

The phone problem

A decision is useless on a server in another country when the price moves. The last mile of the investing problem, and the shape built to cover it: the machine dials out, nothing dials in, and the front door asks who you are before anything behind it is reachable. About 9 minutes.

Everything so far produces a page on a rented server in a data centre. The owner is on a train in Sweden with a phone. The price of a name on the waiting list has just crossed its line. The page knows. The owner does not. This is not an infrastructure problem; it is the last step of the investing problem, and if it is not solved the rest was decoration.

The constraint that makes it hard

The page holds the whole book: every held name, every stop, every buy line, every value. Getting it to a phone means getting it off the machine, and every way of doing that opens something. The question is what to open, and the rules that govern the answer were written down as a ruling before it was built. Its shape: the page may leave the machine only through a gate that checks identity; the server that hands it over may listen only to the machine itself; no inbound port may be opened; the firewall stays as it was.11Ruling F1, limbs (a) and (b), 2026-09-13.

The shapes that were ruled out

The record does not list alternatives that were considered and rejected; it lists what is prohibited, and each prohibition is the shape of a tempting answer.

  • Open a door in the wall. Run a web server, open its port in the firewall, point a phone at it. Fast, and it turns a machine that accepts nothing from the internet into one that accepts connections from anyone who finds the address. The deployment notes: "Any change that opens a port, binds [every interface], or adds an Access Bypass policy reverses the intent of this deployment and must be ruled on, not merged."22deploy/TUNNEL-NOTES.md, first paragraph. During the build, the server did bind to every interface for three minutes, because a configuration line that looked like an address was a port. It was found and fixed the same morning, and it is the first of three bugs the notes record.
  • Put the address in plain public DNS without the gate. Reachable from anywhere, and it would route around the identity check entirely. The notes: "A DNS-only record would bypass Access entirely."
  • Add a rule that lets some traffic skip the identity check. The gate provider evaluates such rules first. One would make the book public "instantly and silently". It is prohibited by the ruling, in bold.

The shape that was built

The tunnel: one outbound arrow crossing the wallInside a box labelled the machine: a small server listening only to itself, and a tunnel client that dials out. A thick vertical wall labelled firewall, no inbound port opened. One thick arrow crosses the wall outward to a relay. Two dashed inbound arrows are crossed out at the wall. After the relay, a purple front door asks who are you, then the phone. the machinea small server, listeningonly to itselfthe pagethe tunnel clientdials OUT and holds the linefirewall: no inbound port openedoutanything dialling inis refused at the wallthe relayoutsidefront door:who are you?one address,one-time codethe phone
Nothing dials in. The machine opens one line outward and holds it. A reader arrives at a front door outside the machine, proves who they are, and only then is the page fetched back down the line the machine opened.

Follow the arrows. On the machine, a small web server holds the page and listens only to the machine itself: it is bound to the address that means "this computer and nothing else", so nothing outside can reach it directly, ever.33The server binds the loopback address only. The notes call that one line load-bearing: without it the server would bind every interface, publicly. Beside it runs a second small program, a tunnel client, which does one thing: it dials out to a relay service on the internet and keeps that connection open. The direction matters and is the whole design. The machine makes an outbound connection, the same kind a browser makes when it loads a web page. The firewall was not touched. The only thing the internet can reach on this machine is the remote login port that was already there.44deploy/TUNNEL-NOTES.md: the tunnel client 'makes an outbound connection... the firewall is unchanged', and the only public listener is the remote-login port that was already there.

Now the owner opens the page's address on a phone. The request goes to the relay, not to the machine. Before the relay does anything, a front door asks who is asking. The front door accepts exactly one email address. It sends a one-time code to that address and to no other; a different address does not even receive a code, because the policy refuses before a code is issued. With the code entered, the door opens for 24 hours. Only then does the relay pass the request down the connection the machine opened earlier, the machine's own server answers with the page, and the page travels back up the same line to the phone.55Cloudflare Access: one application, one policy allowing one email, one-time PIN as the only identity provider, 24-hour session. Verified 2026-09-13: two other addresses received no PIN at all.

The idea that access should depend on who you are and not on which network you are on has a name in the security literature and a history: it is the principle Google described in 2014 when it moved its internal tools onto the public internet behind identity checks, and it was given the label zero trust earlier by an industry analyst. This project did not invent the shape; it borrowed the smallest possible version of it.66Ward and Beyer, 'BeyondCorp: A New Approach to Enterprise Security', ;login: 39(6), 2014; Kindervag, Forrester Research, 2010. Neither text is quoted here; the attribution is a pointer, not a claim about their wording.

What this costs, from the ruling

The page passes through a company's infrastructure the owner does not control, and that company decrypts it at its edge. In the ruling's words: "The page is plaintext at their edge: holdings, states, gate results, MBPs and stops, readable by Cloudflare and by anyone who compels or breaches Cloudflare. This is not mitigable within this architecture. It is the price of reading the book on a phone from an arbitrary network, and I am paying it knowingly." The front door is single-factor: whoever controls the mailbox controls the page. And the tunnel client had to run as a system service with a credential the owner's own account cannot read, which means it cannot use the failure notifier from chapter 17. If the tunnel dies, the page stops loading and the phone stays silent. The nightly run and its own alerting do not depend on it.77Ruling F1: 'WHAT THIS COSTS' under limbs (a) and (b); deploy/TUNNEL-NOTES.md, 'Units — Option C'.

Decided
The page reaches the phone through an outbound tunnel to a relay, behind a front door that admits one address by one-time code. The server listens only to the machine itself. No port is opened.
Why
A decision that cannot reach the owner when the price moves was not worth making. Every inbound shape opens the machine; the outbound shape opens only a page, and only to one person.
Cost
The page is readable by the relay operator. The door is single-factor. The tunnel cannot page the phone when it dies. Each is written into the ruling as the price.

Sources for this chapter

  1. Ward and Beyer (2014), BeyondCorp: A New Approach to Enterprise Security, ;login:
    https://www.usenix.org/publications/login/dec14/ward
  2. Ruling F1 and the tunnel notes — read from this repository: reference/FRAMEWORK-EDITS.md F1; deploy/TUNNEL-NOTES.md; deploy/vss-tunnel.service; deploy/vss-overview.service

The slow way, made survivable. Built 2026-09-13 from the repository as it stood that day. NAME A and NAME B are fictional; no company, price or holding appears on this site. Not financial advice: one private investor's method, shared as it is.