👽 Phone Home

Ted Nelson had seventeen goals for Xanadu. Most of them were right. One of them was a trap.

Transclusion — the idea that content should live in one canonical location and appear everywhere by reference — sounds like the purest expression of the web. No copies, no drift, no broken links. One source of truth, transcluded wherever it's needed.

Every social media company on earth latched onto this idea. Not because they loved Nelson's vision. Because transclusion is a surveillance architecture.

The phone-home problem

When content is transcluded, every read is a fetch. Your browser requests the original resource from the original server every time the page loads. The source domain sees:

• Who is reading (IP, headers, fingerprint)
• What they're reading (which page embedded the content)
• When they're reading it
• How often they come back

This is not a bug in the implementation. It's the fundamental geometry of transclusion. If the content lives in one place and appears in many, the one place sees all the traffic. That's a panopticon.

Facebook embeds, Twitter cards, YouTube iframes, Google Fonts, OAuth login buttons — these are all transclusion. They all phone home. The web we live in is Nelson's dream, weaponized.

Xanadu's goals vs. what we got

Nelson wanted:

1. Every document accessible — We got walled gardens with login walls
2. Every version preserved — We got platforms that delete your history when they pivot, and recency bias so aggressive that anything older than a week might as well not exist
3. Bidirectional links — We got unidirectional links that break when the source moves
4. Content reuse without copying — We got embed codes that track every viewer and are permitted to collect all manner of irrelevant surveillance data
5. Micropayments for authors — We got ad surveillance that pays the platform, weaponizes your own data against you, and datasciences your dopamine levels to keep you scrolling
6. No broken links — We got link rot on a civilizational scale
7. Deep version comparison — We got "this tweet has been deleted"

The one goal that actually shipped at scale was transclusion. And it shipped as tracking infrastructure.

The copy is not the problem

Nelson's fear was that copying content would break attribution and enable plagiarism. That copying was theft. So he designed a system where you never copy — you always reference the original.

But copying is exactly what you want, if you can verify authenticity without phoning home.

A signed copy is better than a live reference:

• It doesn't phone home. The content is already on the page. The reader's browser never touches the source domain.
• It survives the source going down. If the original disappears, the signed copy is still verifiable.
• It can be verified offline. You don't need a network connection to check a signature.
• Attribution is cryptographic, not social. You don't trust that someone credited the author — you verify the signature.

The signature proves provenance. The copy preserves availability. The source domain learns nothing about who reads it, when, or where.

How this works in practice

In the fungal model:

1. I write something on my domain and sign it with my Ed25519 key
2. You want to reference it on your domain
3. Your server fetches my content once, at build time, and embeds a signed copy
4. Your readers see my content on your page — verified, attributed, no fetch to my server
5. My public key is at /.well-known/fungal-pubkey — anyone can verify, but the key fetch tells me nothing about what they verified

The only network artifact is the pubkey fetch. And that's a single static file that could be cached indefinitely. One key for everything I've ever signed. You can't tell if someone is verifying a comment, a blog post, a code patch, or my entire site.

Compare:

Privacy by construction, not by policy

The distinction matters. A transclusion-based system can add privacy policies, anonymizing proxies, caching layers. But the architecture wants to phone home. Every privacy measure is a patch on a system whose default behavior is surveillance.

A signed-copy system doesn't need privacy patches. There's nothing to patch. The reader's browser never contacts the source. There's no tracking infrastructure to abuse, misconfigure, or subpoena.

This is what "privacy by construction" means. Not "we promise not to look." Not "our privacy policy says." The surveillance capability doesn't exist in the architecture. You can't do what the system doesn't support.

Nelson was right about almost everything

Bidirectional links, version preservation, universal accessibility, attribution, micropayments — all correct, all still needed. Xanadu's goals read like a diagnosis of everything wrong with the web today.

But transclusion was the wrong mechanism. It centralized reads at the source, and centralized reads became centralized surveillance. The social media companies didn't corrupt Nelson's vision — they fulfilled it. Transclusion at scale is tracking at scale.

The fix is simple: copy, sign, verify locally. The web Nelson wanted, minus the phone call home.