ozdc.us

First look at an unknown file, safely

ozdc@ozdc.us (Can Ozdemir) — Fri, 16 Oct 2026 00:00:00 +0000

Someone sends you a file and asks "what is this?". The first ten minutes are about learning as much as possible without running it. This post is a checklist for that static triage.

Rule zero: where you work

Work in a virtual machine with no shared folders and no clipboard sharing, and take a snapshot first so you can roll back.
Turn off networking, or use a host-only network, unless you deliberately want to see what the file talks to.
Never double-click. Don't open documents in a normal office suite either: macros and exploits are the point of many malicious files.
Keep samples zipped with a password (infected is the common convention) when moving them around, so nothing opens them by accident.

None of the steps below execute the file. They only read it.

1. Fingerprint it

sha256sum sample.bin

The hash identifies the file exactly. Write it in your notes. Searching for the hash (not uploading the file) on public threat-intelligence sites often tells you instantly whether it's known. Uploading a file can reveal to its author that someone is looking, so think before you do that.

2. What type is it really?

file sample.bin

file ignores the extension and looks at the content, mostly the first bytes. Common signatures are worth knowing by sight:

7f 45 4c 46 (.ELF): Linux executable or library
4d 5a (MZ): Windows executable (PE)
50 4b 03 04 (PK): ZIP, which includes .docx, .xlsx, .jar and .apk
25 50 44 46 (%PDF): PDF
23 21 (#!): a script with an interpreter line

A file called invoice.pdf that starts with MZ has told you most of what you need.

3. Strings

strings -n 6 sample.bin | less
strings -n 6 -e l sample.bin | less     # UTF-16LE, common in Windows programs

Look for URLs, IP addresses, file paths, registry keys, error messages, user agents, and names of libraries or functions. Strings are cheap clues, but treat them as hints: they can be planted to mislead, and important ones are often encrypted.

The Strings tab on this site does the same thing for each page: press s.

4. Structure

For ELF files:

readelf -h sample.bin        # header: 32/64-bit, CPU, entry point
readelf -l sample.bin        # segments and their permissions
readelf -d sample.bin        # needed libraries
readelf -Ws --dyn-syms sample.bin   # imported and exported symbols

For PE files, tools like pefile (Python), PE-bear or Detect It Easy show the same things: sections, imports, timestamps and resources.

Imports are especially telling. A program that imports networking, process-creation and registry functions can do those things; one that imports almost nothing may be packed and resolve its functions at run time.

5. Entropy: is it packed?

Compressed or encrypted data looks random. A section with entropy close to 8 bits per byte, a tiny import table and few readable strings usually means the real code is packed and unpacked in memory. binwalk -E sample.bin plots entropy across the file, and Detect It Easy reports it per section and often names the packer.

6. Write it down

Before moving on to disassembly or a sandbox, write a short summary: hash, real type, architecture, notable strings, imports, packed or not, and your best guess about what it is. It forces you to separate what you know from what you suspect, and it's the note you'll want in six months.

Next steps

Only after this do you open it in a disassembler (IDA, Ghidra, Binary Ninja, radare2) or run it in an isolated sandbox to watch its behaviour. Static triage tells you where to look, so those steps go much faster.

From C to x86-64: reading a compiled loop

ozdc@ozdc.us (Can Ozdemir) — Thu, 15 Oct 2026 00:00:00 +0000

The fastest way to get comfortable reading disassembly is to compile code you already understand and compare the two. Here is a function that adds up an array of integers:

int sum(const int *a, int n)
{
    int s = 0;
    for (int i = 0; i < n; i++)
        s += a[i];
    return s;
}

All the listings below are real objdump -d -M intel output from GCC 13 on Linux.

The calling convention

On Linux and macOS, x86-64 uses the System V ABI:

integer and pointer arguments arrive in rdi, rsi, rdx, rcx, r8, r9, in that order
the return value goes in rax (or its low 32 bits, eax, for an int)
rbx, rbp and r12 to r15 must be preserved by the function; the others may be overwritten freely

So for sum: a is in rdi, n is in esi (the low half of rsi, because int is 32 bits), and the answer ends up in eax. Windows uses a different convention (rcx, rdx, r8, r9), so always check the platform first.

-O0: everything on the stack

0000:  endbr64
0004:  push   rbp
0005:  mov    rbp, rsp
0008:  mov    QWORD PTR [rbp-0x18], rdi    ; save a
000c:  mov    DWORD PTR [rbp-0x1c], esi    ; save n
000f:  mov    DWORD PTR [rbp-0x8], 0x0     ; s = 0
0016:  mov    DWORD PTR [rbp-0x4], 0x0     ; i = 0
001d:  jmp    003c                         ; jump to the loop test
001f:  mov    eax, DWORD PTR [rbp-0x4]     ; eax = i
0022:  cdqe                                ; sign-extend i to 64 bits
0024:  lea    rdx, [rax*4+0x0]             ; rdx = i * sizeof(int)
002c:  mov    rax, QWORD PTR [rbp-0x18]    ; rax = a
0030:  add    rax, rdx                     ; rax = &a[i]
0033:  mov    eax, DWORD PTR [rax]         ; eax = a[i]
0035:  add    DWORD PTR [rbp-0x8], eax     ; s += a[i]
0038:  add    DWORD PTR [rbp-0x4], 0x1     ; i++
003c:  mov    eax, DWORD PTR [rbp-0x4]
003f:  cmp    eax, DWORD PTR [rbp-0x1c]    ; i < n ?
0042:  jl     001f                         ; yes: loop again
0044:  mov    eax, DWORD PTR [rbp-0x8]     ; return s
0047:  pop    rbp
0048:  ret

Things to notice:

push rbp / mov rbp, rsp is the classic prologue. It sets up rbp as a fixed reference point, so every local variable has a fixed offset from it.
Each C variable has a home on the stack: a at rbp-0x18, n at rbp-0x1c, s at rbp-0x8, i at rbp-0x4. Naming these slots is the first thing to do in any -O0 function.
The loop is compiled "upside down": a jump straight to the test at the bottom, the body above it, and a backwards conditional jump (jl). A backwards jump is almost always a loop.
jl is a signed comparison ("jump if less"), which tells you i and n are signed ints. Unsigned code would use jb.
endbr64 is a marker for Intel CET (control-flow protection), not part of the logic.

-O1: registers and a pointer walk

0000:  endbr64
0004:  test   esi, esi                     ; n <= 0 ?
0006:  jle    0025                         ; then return 0
0008:  mov    rax, rdi                     ; p = a
000b:  movsxd rsi, esi                     ; n as 64-bit
000e:  lea    rcx, [rdi+rsi*4]             ; end = a + n
0012:  mov    edx, 0x0                     ; s = 0
0017:  add    edx, DWORD PTR [rax]         ; s += *p
0019:  add    rax, 0x4                     ; p++
001d:  cmp    rax, rcx                     ; p != end ?
0020:  jne    0017
0022:  mov    eax, edx                     ; return s
0024:  ret
0025:  mov    edx, 0x0
002a:  jmp    0022

The optimiser rewrote the loop. There is no i any more: it walks a pointer from a to a + n and stops when they meet. It also moved the n <= 0 check out front, so the loop body is just four instructions. The stack frame is gone, because nothing needs to live in memory.

This is what real-world binaries look like. The trick is to recognise the shape: one register that steps by 4 each time and is compared with an end pointer is "iterate over an int array", whatever the source code said.

Habits that help

Find the arguments first (rdi, rsi, …), then the return value (eax just before ret).
Name every stack slot and register as soon as you know what it holds. IDA and Ghidra both let you rename (n in IDA).
Backwards jumps are loops. Look at the compare just before them to find the condition.
Watch for signed vs unsigned jumps: jl/jg vs jb/ja.

Do it yourself

gcc -O0 -c sum.c && objdump -d -M intel sum.o
gcc -O2 -c sum.c && objdump -d -M intel sum.o

At -O2 GCC may vectorise the loop with SSE instructions (paddd, movdqu). Comparing the three levels side by side is one of the best ways to learn what compilers do.

The ELF header, byte by byte

ozdc@ozdc.us (Can Ozdemir) — Wed, 14 Oct 2026 00:00:00 +0000

Every Linux executable, shared library and object file starts with an ELF header. On 64-bit systems it's exactly 64 bytes. It says what kind of file this is, which CPU it is for, where execution starts, and where the rest of the file's tables are. Let's decode a real one: /bin/ls from Ubuntu 24.04.

The bytes

xxd -l 64 /bin/ls

00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  03 00 3e 00 01 00 00 00  30 6d 00 00 00 00 00 00  |..>.....0m......|
00000020  40 00 00 00 00 00 00 00  28 24 02 00 00 00 00 00  |@.......($......|
00000030  00 00 00 00 40 00 38 00  0d 00 40 00 1f 00 1e 00  |....@.8...@.....|

Everything after the first 16 bytes is little-endian. If that's new, read the hexdump post first.

Bytes 0x00 to 0x0f: e_ident

The first 16 bytes identify the file and say how to read the rest.

7f 45 4c 46: the magic number, 0x7f followed by ELF. The file command checks exactly this.
02: class. 1 = 32-bit, 2 = 64-bit.
01: data encoding. 1 = little-endian, 2 = big-endian.
01: ELF version, always 1.
00: OS/ABI, 0 = System V (the usual value on Linux).
The rest are the ABI version and padding.

Bytes 0x10 to 0x3f: the fields

Each field below is read little-endian.

0x10 e_type, 2 bytes: 03 00 = 3 = ET_DYN. That's a shared object, which is also what a position-independent executable (PIE) is. A non-PIE executable would be 2 (ET_EXEC), and an object file .o is 1 (ET_REL).
0x12 e_machine, 2 bytes: 3e 00 = 0x3e = 62 = x86-64. You'd see 0xb7 for AArch64 and 0x03 for 32-bit x86.
0x14 e_version, 4 bytes: 01 00 00 00 = 1.
0x18 e_entry, 8 bytes: 30 6d 00 … = 0x6d30. The address where execution starts. In a PIE it's relative, because the loader picks the real base address at run time.
0x20 e_phoff, 8 bytes: 0x40 = 64. The program headers start right after this header.
0x28 e_shoff, 8 bytes: 28 24 02 00 … = 0x22428 = 140328. The section headers are near the end of the file.
0x30 e_flags, 4 bytes: 0, unused on x86-64.
0x34 e_ehsize: 40 00 = 64, the size of this header.
0x36 e_phentsize: 38 00 = 56 bytes per program header, and 0x38 e_phnum: 0d 00 = 13 of them.
0x3a e_shentsize: 40 00 = 64 bytes per section header, and 0x3c e_shnum: 1f 00 = 31 of them.
0x3e e_shstrndx: 1e 00 = 30. The section that holds the section names.

Check it

readelf -h /bin/ls

readelf agrees with every value: Type DYN, Machine X86-64, Entry point 0x6d30, program headers at 64 with 13 entries of 56 bytes, section headers at 140328 with 31 entries of 64 bytes, string table index 30.

Program headers vs. section headers

The header points to two tables, and it's worth knowing why there are two:

Program headers (segments) are what the loader uses. They say which byte ranges of the file to map into memory, at what address, and with which permissions (read, write, execute).
Section headers (.text, .rodata, .data, .bss, …) are for linkers and tools. A program runs fine without them; strip removes symbols, and some packers damage section headers on purpose to confuse analysis tools.

That second point is the practical lesson: when a tool chokes on a binary, check the header and the program headers by hand. They are what the kernel actually trusts.

Try it

readelf -l /bin/ls: list the segments and their permissions
readelf -S /bin/ls: list the sections
xxd -s 0x40 -l 56 /bin/ls: the first program header, raw

Reading a hexdump

ozdc@ozdc.us (Can Ozdemir) — Tue, 13 Oct 2026 00:00:00 +0000

Every file is just a row of bytes. A hexdump prints them in a form a human can scan. Once you can read one fluently, file formats, network captures and memory dumps stop being opaque. This post walks through one 16-byte example line by line.

Tip: every page on this site has a Hex View tab (press x) and a Strings tab (press s). Try them on this post as you read.

One line of a hexdump

This is a 16-byte file, printed with hexdump -C sample.bin (on Linux, xxd sample.bin or od -A x -t x1z sample.bin show the same thing):

00000000  48 69 21 0a 01 02 ff 00  34 12 00 00 ef be ad de  |Hi!.....4.......|

It has three columns:

Offset (00000000): where in the file this line starts, in hex. The next line would start at 00000010, which is 16.
Bytes: sixteen bytes, each as two hex digits. One hex digit is 4 bits, so two digits are exactly one byte (0 to 255, written 00 to ff). The extra gap after the eighth byte is only there to help your eyes.
ASCII: the same bytes shown as text. Printable characters appear as themselves, everything else as a dot.

Text is just numbers

The first three bytes are 48 69 21. In ASCII, 0x48 is H, 0x69 is i, and 0x21 is !. That's why the ASCII column starts with Hi!. The fourth byte, 0a, is a newline. It isn't printable, so it shows as a dot.

A few values are worth memorising, because you'll see them everywhere:

20 space, 0a newline, 0d carriage return (Windows line endings are 0d 0a)
30 to 39 are the digits 0 to 9
41 to 5a are A to Z, and 61 to 7a are a to z; lower case is upper case plus 0x20
00 is the NUL byte: C strings end with it, and long runs of it are usually padding

Numbers wider than one byte

Look at bytes 8 to 11: 34 12 00 00. If a program stored a 32-bit integer there, what is its value?

On x86 and most ARM systems, multi-byte numbers are stored little-endian: the least significant byte comes first. To read the number, reverse the bytes: 00 00 12 34, which is 0x1234 = 4660.

The last four bytes, ef be ad de, work the same way. Reversed, they read de ad be ef: 0xDEADBEEF, a classic marker value that programmers use precisely because it's easy to spot in a dump.

Big-endian is the other order: most significant byte first, the way we write numbers. Network protocols use it ("network byte order"), so the same value can appear in both orders within one capture.

Exercise

Go back to the line above and answer, without a calculator:

Which byte is the NUL that ends the first "string"?
If bytes 4 and 5 (01 02) were a 16-bit little-endian number, what would it be?
Why does ff show as a dot?

Answers: the 00 at offset 7; 0x0201 = 513; and 0xff is above 0x7e, outside printable ASCII.

Tools

xxd file or hexdump -C file: dump a file
xxd -l 64 file: only the first 64 bytes
xxd -s 0x100 -l 32 file: 32 bytes starting at offset 0x100
xxd -r: turn an edited dump back into a binary, a cheap way to patch a byte

Next: the ELF header, byte by byte, where this skill pays off immediately.

Evolution, illustrated

ozdc@ozdc.us (Can Ozdemir) — Tue, 28 Jul 2026 00:00:00 +0000

How does a process with no designer, plan or goal produce eyes, wings and brains? The answer is an algorithm short enough to state in one line: copy with small errors, test the copies against the world, keep what works, repeat for a very long time. Biology gives us both the source code (genomes) and a partial version history (fossils), and the two agree. Darwin's revolution appears in The revolutions of our time. This post is the illustrated tour.

+--------------------+   +--------------------+   +--------------------+
|     VARIATION      |   |    INHERITANCE     |   |     SELECTION      |
|  offspring differ  |   |traits are passed on|   |some variants leave |
| (mutation, mixing  |-->|   (genes, copied   |-->|  more descendants  |
| of parental genes) |   | with small errors) |   |in this environment |
+---------+----------+   +--------------------+   +---------+----------+
          ^                                                 |
          |                                                 |
          +-------------------------------------------------+
               TIME: repeat for thousands to billions of generations

Four ingredients

If a population has variation, if that variation is inherited, and if some variants leave more descendants than others (selection), then given enough time the population changes. Nothing else is needed: no foresight, no goal. Richard Lewontin spelled out these conditions in 1970. Darwin knew nothing of genes, and the logic worked without them.

Selection is not magic. It acts only on variation that already exists, and only in the environment where it happens. Even a modest edge compounds quickly:

  generation   share of the population  (# dark morph, . pale morph)

       0       |####....................................| 10.0%
       5       |############............................| 29.2%
      10       |########################................| 60.5%
      15       |##################################......| 85.0%
      20       |######################################..| 95.5%
      30       |########################################| 99.7%

  assumed: dark moths leave 1.3 times as many offspring as pale
  ones. Illustrative numbers: one gene, no mutation, no drift.

Notice the shape: a slow start while the variant is rare, a fast middle, a slow finish. Real populations are messier. Environments change, so yesterday's winner can become tomorrow's loser, and most traits carry trade-offs.

Darwin, Wallace and the long wait

Charles Darwin sailed on HMS Beagle (1831-36), had the core idea by 1838 after reading Malthus on population, and then held it back for twenty years while he gathered evidence. In June 1858 an essay arrived from Alfred Russel Wallace, who was collecting specimens in the Malay Archipelago and had reached the same mechanism independently. Friends arranged a joint presentation at the Linnean Society on 1 July 1858, and On the Origin of Species followed on 24 November 1859. The phrase "survival of the fittest" came from the philosopher Herbert Spencer (1864), and Darwin adopted it in later editions.

The missing piece was inheritance. Mendel's pea experiments (1866) went unnoticed until 1900. The modern synthesis of the 1930s and 1940s (Fisher, Haldane, Wright, Dobzhansky, Mayr) joined Darwin to genetics, and Watson and Crick (1953) supplied the molecule. An influential story, associated with Ernst Mayr, says Darwin replaced fixed "essences", the kind discussed in What is existence? A short tour of ontology, with "population thinking". Some historians think that story oversimplifies, but the shift of attention from the ideal type to the varying population is real.

More than selection

Mutation creates new variants. A human child carries on the order of seventy new mutations that neither parent had.
Genetic drift is change by chance, strongest in small populations. In Motoo Kimura's neutral theory (1968), most molecular differences between species are neutral and spread by drift.
Gene flow moves genes between populations. It can spread a useful variant or blur differences.
Sexual selection, which Darwin developed in 1871, favours traits that win mates, even costly ones like a peacock's tail.

Biologists still argue about how much weight each force deserves, and whether development and non-genetic inheritance need a larger role in theory. Those are debates about how evolution works, not whether it happened.

The evidence

Several independent lines point the same way.

Fossils that fit predictions. Searching 375-million-year-old rocks on Ellesmere Island in Arctic Canada, where fish-to-land-animal transition sediments were expected, Neil Shubin's team found Tiktaalik in 2004. Fossil series also trace whales back to four-legged land mammals, and DNA places their closest living relatives among hippos.
Shared code and dead code. A bat wing, a whale flipper and a human arm contain the same bones. In genomes, humans, other apes and monkeys carry a broken copy of GULO, a gene that makes vitamin C in most other mammals. Human chromosome 2 is a fusion of two chromosomes that stay separate in other apes, with telomere remnants in the middle. A reverse engineer knows the logic: two programs with the same odd bug share ancestry. Life is full of shared bugs.
Molecular clocks. DNA differences accumulate roughly steadily (Zuckerkandl and Pauling, 1960s). Calibrated against fossils, they date splits, such as human and chimp lineages at about 6-7 million years ago. Rates vary with generation time, so the dates are ranges.
Evolution you can watch. Penicillin-resistant bacteria appeared within a few years of its mass use in the 1940s, and Fleming warned of it in 1945. A 2019 estimate attributes over a million deaths a year directly to resistant bacterial infections. Richard Lenski's E. coli lines have evolved since 1988 through more than 75,000 generations, and one lineage learned to use citrate around generation 31,000. On the Galapagos island of Daphne Major, Peter and Rosemary Grant saw finch beaks deepen after the 1977 drought.
Our own past. Ancient DNA shows that modern humans and Neanderthals interbred. People whose ancestors lived outside Africa carry roughly one to two percent Neanderthal DNA, a result by Svante Pääbo's group that earned the 2022 Nobel Prize.

Peppered moths deserve a caveat. The dark form was rare before 1848, then dominated near industrial cities, then declined after clean-air laws. Bernard Kettlewell's 1950s experiments were criticised for design flaws, such as moths placed on tree trunks by day, and textbooks later told the story too neatly. But a six-year repeat by Michael Majerus, published in 2012, still supports bird predation as the main driver, and in 2016 the dark form was traced to a mobile genetic element inserted in a single gene.

Deep time

The fourth ingredient is the hardest to feel. Squeeze the age of the Earth into one day and the picture below appears. Dates are approximate and revised often, but their order is robust.

     clock*     years ago          event
  /|                                                            |\
  || 23:59:59.9 5,000 years ago    writing                      ||
  ||============================================================||
  || 23:59:54   300,000 years ago  Homo sapiens                 ||
  ||============================================================||
  || 23:57:56   6.5 million        human and chimp lines split  ||
  ||============================================================||
  || 23:39      66 million         non-bird dinosaurs end       ||
  ||============================================================||
  || 22:01      375 million        Tiktaalik, a fish with limbs ||
  ||============================================================||
  || 20:50      600 million        first animals                ||
  ||============================================================||
  || 14:29      1.8 billion        complex (eukaryotic) cells   ||
  ||============================================================||
  || 11:19      2.4 billion        oxygen builds up in the air  ||
  ||============================================================||
  || 05:30      3.5 billion        oldest accepted fossils      ||
  ||============================================================||
  || 00:00      4.54 billion       Earth forms                  ||
  ||                                                            ||

  * Earth's 4.54 billion years squeezed into one day; top = now

The tree of life

In 1837 Darwin sketched a branching tree in a notebook and wrote "I think" above it. The Origin's only illustration is a branching diagram. Carl Woese's ribosomal RNA work (1977) showed that Archaea are a third major group beside Bacteria and Eukarya. Many recent analyses nest the eukaryotes inside the Archaea, which would make two domains. Microbes also swap genes sideways, so the deepest roots look more like a web than a tree. Mitochondria descend from engulfed bacteria (Lynn Margulis, 1967). At the root of the sample below sits LUCA, the last universal common ancestor, a population that lived somewhere around 3.5 to 4 billion years ago; estimates vary.

older   (branching order only)             tips: all alive today
LUCA -+------------------------------------- Bacteria
      +--+---------------------------------- Archaea
         +--+------------------------------- Plants and algae
            +--+---------------------------- Fungi
               +--+------------------------- Insects, snails, worms
                  +--+---------------------- Ray-finned fish
                     +--+------------------- Amphibians
                        +--+---------------- Reptiles and birds
                           +--+------------- Dogs, whales, bats
                              +--+---------- Old World monkeys
                                 +-+-------- Orangutan
                                   +-+------ Gorilla
                                     +-+---- Chimps and bonobos
                                       +---- Humans

Some surprises sit in the branching order. Fungi are closer kin to animals than plants are. Birds are dinosaurs. Whales are even-toed ungulates, with hippos as their nearest living relatives. The drawing follows our own lineage as a spine, which tempts you to read it as a ladder toward us. All tips are alive today, and none is further along than the others. Redraw it with a mushroom as the spine and it looks just as sensible.

Misconceptions

+--------------------------+-------------------------------------------+
| MYTH                     | WHAT THE EVIDENCE SAYS                    |
+--------------------------+-------------------------------------------+
| Survival of the          | Fitness means leaving more surviving      |
| strongest                | offspring in a given environment. Winners |
|                          | can be small, shy, cooperative, or lucky. |
+--------------------------+-------------------------------------------+
| We descended from chimps | Humans and chimps share an ancestor from  |
|                          | some 6-7 million years ago. Neither is    |
|                          | the ancestor of the other.                |
+--------------------------+-------------------------------------------+
| Evolution climbs a       | It is a branching bush with no goal. By   |
| ladder to humans         | count, microbes still dominate life.      |
+--------------------------+-------------------------------------------+
| It is just a theory      | In science a theory is a broad, tested    |
|                          | explanation, like germ theory or the      |
|                          | theory of gravity.                        |
+--------------------------+-------------------------------------------+
| Individuals evolve       | An individual develops; a population      |
|                          | evolves over generations as gene          |
|                          | frequencies shift.                        |
+--------------------------+-------------------------------------------+
| It is all random chance  | Mutation is random with respect to need.  |
|                          | Selection is not random. Together they    |
|                          | are not blind luck.                       |
+--------------------------+-------------------------------------------+

Two limits are worth stating. Evolution explains how life diversified, not how it began; that is a separate research question. And it is a theory about biology, not a guide to values. Many scientists who are religious accept evolution, and how it bears on questions of meaning is a conversation biology does not settle.

Closing

Reading a genome is reverse engineering with a version history attached. The result has no author, yet it shows the marks of legacy code. A giraffe's laryngeal nerve runs down the neck, around a blood vessel and back up, a detour of several metres where centimetres would do, because evolution edits what exists and cannot restart from scratch.

Nature as engineer: what nature teaches us

ozdc@ozdc.us (Can Ozdemir) — Tue, 16 Jun 2026 00:00:00 +0000

Evolution has run a research and development programme for about 3.5 billion years. On the calendar in The universe in one year: a cosmic calendar that is about three months, most of it spent on microbes, and it started from the poorly understood beginning described in Life's origin: what we know and what we don't. The designs that survived are good enough to be worth studying. Biomimicry (a word popularised by Janine Benyus in her 1997 book) means learning a principle from a living thing and using it in engineering.

The stress is on principle. Almost every successful case copies a mechanism, not a shape, and nature is not an optimiser. Evolution, the idea at the heart of Five ideas that built modern science, produces what is good enough with the materials and the history at hand, and engineers have steel, concrete and electricity as well. Here are eight cases, with the hype checked.

1. Burdock and Velcro (1941, 1955)

In 1941 the Swiss engineer George de Mestral came back from a hunting trip in the Swiss mountains with burrs of burdock stuck to his clothes and his dog's fur. Under a microscope he saw tiny hooks catching loops. Turning that into a product took years: cotton versions frayed, so he switched to nylon, worked with a weaver in Lyon and found that infrared light could set the hooks. The Swiss patent was filed in 1951 and granted in 1955. The name joins velours (velvet) and crochet (hook).

BEFORE                              PRESSED TOGETHER
=== loop tape ========
 ()  ()  ()  ()  ()                 ======================
                                     (J) (J) (J) (J) (J)
 J   J   J   J   J                  ======================
=== hook tape ========              each loop is caught by a hook

SHEAR (pull sideways): every hook holds its loop, so it is very strong.
PEEL (lift one edge): hooks let go one row at a time, which is easy.
That is the "rrrip" you hear.

Burdock burr (nature): hooked bracts catch the loops in cloth or fur.
Velcro (1941 idea, 1955 patent): nylon hooks and nylon loops.

2. The lotus leaf: surfaces that clean themselves

Lotus leaves stay clean in muddy water. Wilhelm Barthlott and Christoph Neinhuis studied why with the electron microscope and published their 1997 paper on the sacred lotus's "escape from contamination". The leaf has a double structure: bumps (papillae) 10 to 20 micrometres high, covered in wax crystals. Water cannot enter the gaps, so the drop rests on air and on a few percent of the surface.

SMOOTH WAX LEAF                       LOTUS LEAF
contact angle about 105 degrees       contact angle about 160 degrees

        .-""""-.                                .-""""-.
     .'        '.                            .'        '.
    /            \                          /            \
   |              |                        |              |
   |              |                         \            /
    \            /                           `-.        .-'
     `-.______.-'                                `-.__.-'
----------------------------          /\/\/\/\/\/\/\/\/\/\/\/\/\/\
flat wax: the drop sags and           papillae 10-20 um high, covered
spreads, wide contact area            in wax: air stays trapped between
                                      the tips, under the drop

Cassie-Baxter: cos(angle) = f x (cos(wax angle) + 1) - 1
   f = share of the drop that touches solid = 5%, wax angle = 105 deg
   cos(angle) = 0.05 x (-0.259 + 1) - 1 = -0.963 -> angle = 164 deg

SELF-CLEANING   (tilt the leaf a few degrees; o = dirt grain)
     .-"-.
    ( oo )-->       o     o  o   o
     `-._.-'
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
grains stick to the drop more than to the leaf, so they leave with it

The calculation shows why texture matters: a wax surface alone gives about 105 degrees, but touching only 5% of the solid pushes the angle to about 164. Paints and coatings based on it appeared around 1999. The limits are real. The effect works for water, not oils or solvents, and the delicate texture wears off.

3. Gecko feet: glue-free grip

A gecko climbs glass without glue, suction or sticky liquid. Kellar Autumn's group showed in 2000 that one hair (a seta) pulls with about 200 micronewtons, and in 2002 that the force is the weak van der Waals attraction between molecules, because geckos grip water-loving and water-hating surfaces equally well.

1. TOE PAD (about 1 cm wide)
   =========  =========  =========  =========  =========rows of ridges
                                                        (lamellae)
                              |
                              v  zoom x100

2. SETAE (hairs ~100 um long, ~5 um thick, ~14,000 per mm^2)
   \   \   \   \   \   \   \   \   \   \   \   \   \  angled hairs:
    \   \   \   \   \   \   \   \   \   \   \   \   \ grip when pulled,
                                                      let go when peeled
                              |
                              v  zoom x50

3. ONE SETA branches at its tip
                       \ | /            about 200 uN of pull
                        \|/             from one hair
                         |              (Autumn et al., 2000)
                  ,-.   ,-.   ,-.   ,-.
                              |
                              v  zoom x100

4. SPATULAE: ~1000 flat tips per seta, each ~200 nm wide
     _____  _____  _____  _____  _____  _____  _____
     =============================================  wall

Between tip and wall (gap under 1 nm) molecules attract each other
weakly (van der Waals force). Billions of tips add up to a strong grip.

Check the arithmetic: about 6.5 million setae times 194 micronewtons is 1,260 newtons, enough to hold roughly 130 kg if every hair gripped at once. No gecko uses them all, and the hairs release by changing their angle, which is why the animal can peel a foot off in a few hundredths of a second. In 2003 Andre Geim's group at Manchester made an early "gecko tape" from polymer hairs. Synthetic versions now exist as grippers and climbing-robot feet, but they collect dust and wear out far sooner than a real foot, which cleans itself as it walks.

4. The kingfisher and the 500 series

Early bullet trains had a problem. A train entering a tunnel at speed pushes the air ahead like a piston, and that compression leaves the far mouth as a loud boom. Making trains faster made the boom worse. Eiji Nakatsu, an engineer at JR West and a bird-watcher, noticed that a kingfisher dives from thin air into dense water with hardly a splash, thanks to its long tapered beak. The 500 series (service from March 1997, 300 km/h) has a nose about 15 m long.

A. BLUNT NOSE (bullet shape)
the cross-section grows fast

       ###############################      air is pushed aside at once:
    ##################################      a steep pressure step forms;
   ###################################      in a tunnel: a boom
  ####################################
   ###################################
    ##################################
       ###############################

B. LONG TAPERED NOSE (500 series)
a nose about 15 m long

                                ######      air parts gradually: the
                     #################      pressure rises gently, so
           ###########################      the tunnel boom is weaker
  ####################################
           ###########################
                     #################
                                ######

C. KINGFISHER HEAD AND BEAK
a dagger beak, then the wider head

                                    ##      diving from thin air into
                            ##########      dense water with little
                    ############o#####      splash needs the same ramp
  ####################################
                    ##################
                            ##########
                                    ##

The physics is sound: the more gradually the cross-section grows, the more gently the air pressure rises. Reported results are about 10% higher speed and 15% lower energy use compared with the older design, but sources differ on details. Wind-tunnel tests and computer simulation shaped the final nose, with the bird as inspiration, and the same team reportedly gave the pantograph owl-like serrations to cut noise.

5. Termites and the Eastgate Centre (a cautionary case)

The Eastgate Centre in Harare, Zimbabwe (1996, architect Mick Pearce with the engineers at Arup) is often said to copy a termite mound. It has no conventional air conditioning. Concrete slabs and ducts are chilled by night air, daytime air passes over the cold mass, and warm air rises through an atrium and chimneys. Reported energy use is around a third of comparable buildings, and some sources claim far less.

                           ^    ^    ^    ^    ^
                       warm air leaves by the chimneys
                           | |  | |  | |  | |
                           | |  | |  | |  | |
  +----------------------+ | |  | |  | |  | | +----------------------+
  |                  ->         ATRIUM         <-                    |
  |  OFFICES             |                    |      OFFICES         |
  |                      |  air rises (stack  |                      |
  |======================|  effect) from the  |======================|
  |                      |  warm offices      |                      |
  |     ^     ^     ^    |                    |    ^     ^     ^     |
  |                      |                    |                      |
  |======================|                    |======================|
  |                      |                    |                      |
  |     ^     ^     ^    |                    |    ^     ^     ^     |
  |                      |                    |                      |
  |======================|                    |======================|
  | ->                   |                    |                 <-   |
  | fans                 |                    |                fans  |
  +------------------------------------------------------------------+
= concrete slabs and ducts: thermal mass
NIGHT: cool outside air is pushed through them and chills the concrete.
DAY: incoming air passes the cold concrete, warms up in the offices,
and rises out through the atrium and chimneys. No big cooling plant.

Here the biology needs a caveat. Termite expert Scott Turner describes the mounds of Macrotermes as something closer to a lung than an air conditioner, and field studies by Mahadevan's group found that airflow in mounds reverses twice a day, driven by daily temperature swings. Eastgate also uses heavy concrete and powered fans, which termites do not. So it is best called termite-inspired: sound physics (night flushing), only loosely termite biology. The building works either way.

6. Shark skin

Shark skin is covered in tiny ridged scales. Grooves (riblets) a few tens of micrometres wide and aligned with the flow stop the small swirls in the boundary layer from touching the surface at full strength, which cuts friction drag by up to about 5 to 10% in lab tests. NASA research led to riblet film that 3M made, tested on racing yachts and on an Airbus A320. Today a film called AeroSHARK flies on Lufthansa Group long-haul jets with a claimed saving of about 1% of fuel. That sounds modest, but friction is only about half of an airliner's drag and the film covers part of the aircraft. The "shark-skin" swimsuits of 2000 are a warning: studies suggested their benefit came mostly from compression and slippery fabric, and the polyurethane suits that followed were banned in 2010.

7. Spider silk

Dragline silk is about 1.1 gigapascals strong at a density of 1.3 g/cm3. High-strength steel, say 1.5 GPa at 7.85 g/cm3, is stronger in absolute terms, but weight for weight silk is about four times better. Its toughness, the energy absorbed before breaking, is around 160 megajoules per cubic metre against roughly 50 for Kevlar and 6 for steel (measurements from the 1990s by Gosline and colleagues). A spider makes it at room temperature from a water-based protein solution, which then solidifies as it flows through a narrow duct. Spiders cannot be farmed, as they eat each other, so companies make silk-like proteins by fermentation with bacteria or yeast. Matching the natural fibre at industrial scale is still hard, especially the spinning step.

8. Ants and swarms

Ants find short routes without a leader. In the double-bridge experiments of Goss and Deneubourg (1989 and 1990) Argentine ants chose between a short and a long branch to food, and most ended up using the short one. The mechanism: each ant lays a chemical trail, the short path is completed sooner so its trail strengthens first, more ants follow, and the long trail evaporates.

t = 0   no trail yet: ants pick a path at random
   .................................................................
   .                                                               .
   .                long path: more steps per trip                 .
+------+                                                        +------+
| NEST |........................................................| FOOD |
+------+                                                        +------+
                    short path: fewer steps per trip

t = 1   short-path ants return sooner, so its trail grows first
   .................................................................
   .                                                               .
   .                long path: more steps per trip                 .
+------+                                                        +------+
| NEST |========================================================| FOOD |
+------+                                                        +------+
                    short path: fewer steps per trip

t = 2   more ants follow the strong trail, which makes it stronger
   . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
   .                                                               .
   .                long path: more steps per trip                 .
+------+                                                        +------+
| NEST |########################################################| FOOD |
+------+                                                        +------+
                    short path: fewer steps per trip

#  strong trail    =  medium    .  weak, evaporating
ACO rule: p(step) ~ trail^a x closeness^b ; each round:
trail <- (1 - r) x trail + Q / route length   (evaporate, then deposit)

Marco Dorigo turned this into ant colony optimisation in 1992, used since for vehicle routing, scheduling and network routing. On static travelling-salesman benchmarks specialised solvers do better, but ant methods suit problems where the map keeps changing. In robotics, Harvard's 2014 Kilobot swarm of 1,024 tiny robots, each costing about 14 dollars in parts, formed shapes using only neighbour-to-neighbour rules, and termite-inspired robots built simple structures.

What to take away

Copy the principle, not the shape. Velcro uses nylon, Eastgate uses concrete. What carries over is hook-and-loop, night flushing, the slow ramp.
Check the story. The kingfisher and the termites are widely told, but the numbers vary by source and the termite model is disputed. Lotus coatings and gecko tapes wear out.
Nature is a library, not an oracle. Evolution satisfies; engineers can combine its tricks with materials and power sources it never had.

And it goes both ways. Biologists now use engineering to ask whether a feature is really optimal, and engineers have borrowed evolution itself, in the form of the directed evolution of enzymes. The most useful lesson may be the plainest one: look closely at the thing in front of you, as a man with a hunting dog and a microscope once did.

Black holes, simply

ozdc@ozdc.us (Can Ozdemir) — Tue, 26 May 2026 00:00:00 +0000

A black hole is the ultimate black box: an interface through which things go in and nothing comes out. Anyone who spends time with programs whose insides they cannot see will find the idea familiar. Yet black holes are also among the simplest objects in physics. Once one has settled down, three numbers describe it completely: its mass, its spin and its electric charge. Classically, everything else about what fell in is forgotten. This post builds the idea from one school-level formula.

Start with a thrown ball

Throw a ball upward and gravity brings it back. Throw it harder and it goes higher. There is a speed beyond which it never returns, the escape velocity: v = sqrt(2GM/R), where M is the mass of the planet or star, R the distance from its centre and G the gravitational constant. For Earth's surface it is 11.2 km/s, for the Moon 2.4 km/s, and for the Sun's surface 618 km/s. Light travels at 299,792 km/s.

In 1783 John Michell, and in 1796 Pierre-Simon Laplace, asked the obvious question: what if a star were so massive and compact that its escape velocity exceeded the speed of light? Light would never get out. Set v equal to c and solve for R:

R = 2GM / c^2

This is the Schwarzschild radius. Karl Schwarzschild found the same number in 1916 as an exact solution of Einstein's equations of general relativity, only weeks after they were published, while serving in the German army in the First World War. The Newtonian route gets the number right partly by luck; its real meaning comes from general relativity.

Worked example

Python does the arithmetic:

import math
G, c = 6.674e-11, 2.998e8                  # SI units
hbar, kB = 1.0546e-34, 1.3807e-23
M_sun, M_earth = 1.989e30, 5.972e24

def r_s(M):
    return 2 * G * M / c**2                # Schwarzschild radius, metres

def T_hawking(M):
    return hbar * c**3 / (8 * math.pi * G * kB * M)

print(f"Sun   r_s = {r_s(M_sun)/1000:.2f} km")
print(f"Earth r_s = {r_s(M_earth)*1000:.2f} mm")
print(f"you   r_s = {r_s(70):.1e} m  (70 kg)")
print(f"Sun mean density at r_s = {M_sun/(4/3*math.pi*r_s(M_sun)**3):.1e} kg/m3")
print(f"Hawking T of a solar-mass hole = {T_hawking(M_sun):.1e} K")

Sun   r_s = 2.95 km
Earth r_s = 8.87 mm
you   r_s = 1.0e-25 m  (70 kg)
Sun mean density at r_s = 1.8e+19 kg/m3
Hawking T of a solar-mass hole = 6.2e-08 K

So the Sun would have to be squeezed into a ball of 2.95 km radius, and Earth into one of 8.9 mm, the size of a pea. A good rule of thumb: about 3 km per solar mass. For you, it comes to 10^-25 m, billions of times smaller than a proton.

Object	Mass	Schwarzschild radius
Moon	7.3 x 10^22 kg	0.11 mm
Earth	6.0 x 10^24 kg	8.9 mm
Sun	1 solar mass	2.95 km
Merger remnant of GW150914	62 solar masses	183 km
Sagittarius A*	about 4 million solar masses	about 12 million km (0.08 AU)
M87*	about 6.5 billion solar masses	about 19 billion km (128 AU)

The radius grows with the mass, but the volume grows with its cube, so bigger black holes are less dense. The Sun squeezed into 2.95 km would have 1.8 x 10^19 kg/m3, some 80 times the density of an atomic nucleus. The average density inside M87*'s horizon is only about 0.4 kg/m3, a third of the density of air.

Warped space and the horizon

In general relativity, mass tells space-time how to curve, and curved space-time tells things how to move. The old picture is a rubber sheet with balls on it. It is a cartoon, but a useful one:

______
      \_______________________           /________                /_____
                              \_      /__         \___          /_
                                \_  /_                \        /
                                  \_                   \      /
                                                        \    |
                                                         |   |
                         walls keep steepening ->        |   |
                                                         |   |
                                                         |  |
                                                          | |
                                                          | |
                                                          | |
                                                          |_
      planet                   star                  black hole

A planet makes a shallow dent, a star a deeper one. A black hole is a dent so deep that, within the event horizon at the Schwarzschild radius, every possible path leads inward. The horizon is not a surface made of matter. It is a boundary: events inside cannot send any signal to the outside. At its centre, classical general relativity predicts a singularity of infinite density. Most physicists read that as the theory breaking down and expect a quantum theory of gravity to replace it.

                                    ^
  o  event horizon (1 rs)           |    #  inner disk edge (3 rs)
  :  photon sphere (1.5 rs)         |    =- hot, glowing gas
  *  singularity (?)                |    |  jet along the spin axis
                                    |
                      ............................
               ......------------------------------......
          .....----------======================----------.....
       .....-------==========##############==========-------.....
     .....------=======###### :::oooooo::: ######=======------.....
    ....-------======####     : oo    oo :     ####======-------....
    ....------======####      : o   *  oo::     ####======------....
    ....-------======####     : oo    oo :     ####======-------....
     .....------=======###### :::oooooo::: ######=======------.....
       .....-------==========##############==========-------.....
          .....----------======================----------.....
               ......------------------------------......
                      ............................
                                    |
 to scale in radius:                |
 1 rs = 4 columns                   |
                                    |
                                    v

Two myths deserve correcting. First, black holes do not "suck". Replace the Sun with a black hole of the same mass and Earth keeps orbiting exactly as before, only in the dark and the cold. Gravity is extreme only near the horizon. Second, falling in is not equally deadly everywhere. Across your own height (2 m), the difference in pull at the horizon of a 10-solar-mass hole would be about 20 million times Earth's gravity: you would be torn apart before arriving. At Sagittarius A* it would be about 1/10,000 of Earth's gravity, and at M87* negligible, so you would cross without noticing, with no way back. Seen from outside, you would appear to slow down and fade, never quite reaching the horizon.

Where black holes come from

A massive star ends its life when its core can no longer hold itself up. If the remaining core exceeds roughly two to three solar masses, no known force stops the collapse and a stellar black hole forms. The Sun will not make one; it will end as a white dwarf, billions of years from now. The progenitor stars must be much heavier, very roughly 20 solar masses or more (the exact threshold is uncertain). Stellar black holes weigh from a few to some tens of solar masses; in 2020, gravitational waves revealed one of about 140 solar masses, described as the first clear "intermediate" case. At the centres of most large galaxies sit supermassive black holes, millions to billions of solar masses. How they grew so big so early is an open problem, since the James Webb telescope keeps finding massive ones in the young universe.

The best evidence for the one at the heart of our Milky Way came from tracking a star called S2. It circles an invisible point in 16 years and passes it at about 7,650 km/s, 2.5 percent of the speed of light. Kepler's laws turn that orbit into a mass of about 4 million Suns packed within the 120 AU of S2's closest approach. Reinhard Genzel and Andrea Ghez shared the 2020 Nobel Prize in Physics for this, together with Roger Penrose, who showed that black hole formation is a robust prediction of general relativity.

2015: the ripples

On 14 September 2015 the two LIGO detectors in the United States, each with arms 4 km long, recorded a signal later named GW150914. Two black holes of about 36 and 29 solar masses had spiralled together and merged, 1.3 billion light-years away. About 3 solar masses of mass were turned into gravitational waves in a fraction of a second. By the time they reached Earth they changed the length of each arm by about 4 x 10^-18 m, roughly 1/200 of a proton's radius.

                                                    *
                                                *  **
                                          **   **  **
    ***        ***       ***      ***    ***   *** **  *
    * **       * **      * **    ** *    * *   * * ** **
   *   **     **  **    **  *    *  **   * *   * * ** * * **
   *----*----**----*----*---**---*---*--*---*-**-*-*-**-***************
         *   *     **  **    *  **   *  *   * *  * * ** **  *
         ** **      * **     ** *    ** *   * *  * * ** **
          ***       ***       ***     ***   ***  * * **
                                      **     **  **  **
                                                  *  *

           inspiral: faster, louder                 merger
                                                         ringdown
Schematic. GW150914: ~0.2 s long, rising from 35 to 250 Hz.

The signal climbed from 35 to 250 Hz in 0.2 seconds, which in a loudspeaker sounds like a chirp. Announced on 11 February 2016, it was the first direct detection of gravitational waves and the first observation of a binary black hole. The 2017 Nobel Prize went to Rainer Weiss, Barry Barish and Kip Thorne. Since then the detectors have logged well over a hundred merger candidates, and the catalogue keeps growing.

2019 and 2022: portraits

The Event Horizon Telescope links radio dishes across the Earth into one virtual telescope observing at 1.3 mm wavelength. On 10 April 2019 it released the first image of a black hole, M87*, 55 million light-years away. On 12 May 2022 it followed with Sagittarius A*, 26,000 light-years away. Each shows a bright, lopsided ring around a dark centre. The rings measure about 42 and 52 micro-arcseconds across, the angle of an orange on the Moon (43 micro-arcseconds). The two look alike in size even though M87* is 1,600 times heavier, because it is also about 2,000 times farther away.

The ring is hot gas whose light is bent by gravity; the dark centre is the shadow, about 2.6 times the horizon's radius, because light passing too close is captured. So the picture is not a photo of the horizon itself. What matters is that the measured size agrees with general relativity's prediction for the known mass.

A. Sgr A* (about 4 million Suns): 1 column = 0.0065 AU
0.0           0.1             0.2            0.3             0.4  AU
##############-+---------------+--------------+-------------M-+---------
#### horizon radius, 0.08 AU           M Mercury's orbit, 0.39 AU

B. M87* (about 6.5 billion Suns): 1 column = 2 AU
0        20        40        60        80        100       120      AU
###############N#################################################-------
#### horizon radius, 128 AU        N Neptune's orbit, 30 AU
The Solar System out to the Kuiper belt (50 AU) fits inside it.

Hawking radiation, a theory

In 1974 Stephen Hawking showed that quantum effects near a horizon should make a black hole glow very faintly, as if it had a temperature, T = hbar c^3 / (8 pi G M k). For a solar-mass hole that is 6 x 10^-8 K, far colder than the 2.7 K microwave background, so every real black hole today absorbs more than it emits. A solar-mass hole would need some 2 x 10^67 years to evaporate, against a universe 1.4 x 10^10 years old. Only tiny hypothetical relics, below about 10^11 to 10^12 kg, could be finishing their evaporation now. None has been seen.

So Hawking radiation is a prediction, trusted because it links gravity, quantum theory and thermodynamics so neatly, but never observed. It also leads to the information paradox: if a black hole evaporates, what happens to what fell in? That is still unresolved.

Try it

Compute the Schwarzschild radius of a mountain with the snippet above. The same general relativity runs the whole cosmos in How we know the universe is expanding. Black holes in our galaxy can also be found by the wobble they cause in a companion star, as in Exoplanets: how we find other worlds, and A tour of the solar system gives a feel for what "128 AU" means.

Life's origin: what we know and what we don't

ozdc@ozdc.us (Can Ozdemir) — Mon, 20 Apr 2026 00:00:00 +0000

How did chemistry become biology? This is one of the few big questions where honest scientists answer "we do not know". But that answer hides a lot of structure. Some parts are known (measured, repeated), some are hypotheses (coherent stories with partial support) and some are unknown. In this post every claim carries one of those three labels.

In The universe in one year: a cosmic calendar the Earth forms on 2 September and clear traces of life exist by 30 September. That is about 28 calendar days, or a billion years. This post zooms into that month.

What needs explaining

A common working definition, used by NASA, is that life is a self-sustaining chemical system capable of Darwinian evolution. Every living cell has three parts: a boundary (a membrane), a metabolism (energy flowing through chemistry) and heredity (information that can be copied). Evolution, as described in Five ideas that built modern science, starts to work once heredity exists. The origin of life is the earlier question of how those three parts came together. Pasteur's flask experiments of the 1860s showed that life today comes only from life, so the first cell was a one-off event in the deep past.

The earliest evidence

Ga = billions of years ago.  * planet  # life, firm  ? life, disputed
   4.6     4.4     4.2     4.0     3.8     3.6     3.4     3.2     3.0
    +-------+-------+-------+-------+-------+-------+-------+-------+
      * Earth forms (4.54)  :               :               :
        * Moon-forming impact (about 4.5)   :               :
            * oldest zircons: liquid water? (4.4)           :
            :           ? carbon flake in zircon (4.1)      :
            :               :       ? carbon isotopes, Isua (3.8)
            :               :           ? Isua stromatolite claim (3.7)
            :      Dresser stromatolites (3.48)  #          :
            :  Strelley Pool stromatolites (3.43)  #        :
               [========] LUCA, one model estimate (4.2)

            <----------------------------------->
            time available for life to begin: up to 900 million years

Known. The Earth formed 4.54 billion years ago. Tiny zircon crystals from Jack Hills in Western Australia are up to 4.4 billion years old, and their oxygen isotopes suggest they formed in contact with liquid water (an interpretation that is still debated).

Known, with debate. The firmest traces of life are stromatolites, layered mounds built by microbial mats, in the Pilbara of Western Australia: the Dresser Formation (about 3.48 billion years) and Strelley Pool (3.43). Most specialists accept them, though layered rock can form without life, and the 1993 claim of 3.46-billion-year-old "microfossils" in the Apex chert was later challenged as mineral artefacts.

Contested. Carbon with a life-like isotope signature and structures claimed to be stromatolites in Isua, Greenland (3.7 to 3.8 billion years; the structures were disputed in 2018), and a carbon flake inside a 4.1-billion-year-old zircon (2015) that may be contamination or not biological.

So: life by about 3.5 billion years ago is solid, 3.7 to 3.8 is possible, and anything older is speculation. The window between the first likely oceans and firm evidence is up to 900 million years, but it says nothing about how long the origin itself took. It could have been quick.

Miller and Urey: building blocks are easy

              +------------------------------+
              | SPARK CHAMBER (5 L flask)    |
              | CH4 + NH3 + H2 + steam       |-------+
              | ** sparks = "lightning" **   |       |  gas + steam
              +------------------------------+       |
                    ^                                v
                    | steam rises             +--------------------+
                    |                         | CONDENSER          |
                    |                         | cold water jacket  |
      +----------------------------+          +--------------------+
      | BOILING WATER              |                 |
      | the "ocean", heated        |                 |  cooled: falls
      +----------------------------+                 |  back as "rain"
                             ^                       v
                             |          +------------------------+
                             +----------< TRAP: products collect |
                                        +------------------------+

 Run for one week in 1952: the water turned red-brown, and the
 flask and trap contained amino acids (glycine, alanine and more).

In 1952 a 22-year-old graduate student, Stanley Miller, worked with Harold Urey at the University of Chicago to test an idea from Oparin and Haldane in the 1920s: that sunlight and lightning on a primitive atmosphere could make the molecules of life. Water, methane, ammonia and hydrogen went in; sparks stood for lightning. After a week the water was red-brown and held amino acids (the paper appeared in Science on 15 May 1953). In 2008, a reanalysis of samples Miller had stored from a 1958 version of the experiment, run with hydrogen sulfide, found more than 20.

Known: organic molecules central to life form easily from simple ingredients plus energy. Revised: the early atmosphere was probably less rich in methane and ammonia (more carbon dioxide and nitrogen) than Miller assumed, which lowers yields, so his exact recipe is doubtful. The conclusion survives because nature makes them elsewhere. The Murchison meteorite, which fell in Australia in 1969, holds more than 70 amino acids. Samples from the asteroids Ryugu and Bennu, returned to Earth in 2020 and 2023, contain amino acids and nucleobases, the "letters" of RNA and DNA; the 2025 Bennu results report 14 of the 20 protein amino acids and all five bases.

Unknown: why life uses only left-handed amino acids. Laboratory syntheses make a 50-50 mix, and some meteorites show only a small excess of one hand. And building blocks are not life: a heap of bricks is not a cathedral.

The RNA world

+--------------------------------+
| simple molecules: HCN, H2S,    |
| formaldehyde, phosphate        |   KNOWN: labs, meteorites
+--------------------------------+
                 v
+--------------------------------+
| nucleotides, the RNA letters   |   PARTLY: Sutherland 2009+
+--------------------------------+
                 v
+--------------------------------+
| short RNA strands form         |   PARTLY: short chains only
+--------------------------------+
                 v
+--------------------------------+
| an RNA enzyme copies RNA       |
| (a replicase)                  |   OPEN: no full self-copy yet
+--------------------------------+
                 v
+--------------------------------+
| strands inside a fatty-acid    |
| bubble (protocell)             |   PARTLY: bubbles form easily
+--------------------------------+
                 v
+--------------------------------+
| copying errors + selection     |
| = Darwinian evolution          |   KNOWN for RNA in test tubes
+--------------------------------+
                 v
+--------------------------------+
| RNA + peptides, then           |
| DNA + proteins (to LUCA)       |   OPEN: origin of the code
+--------------------------------+

The problem. In cells, DNA stores instructions and proteins do the work, but copying DNA needs proteins and making proteins needs DNA. Which came first? RNA can do both jobs. In the early 1980s Thomas Cech and Sidney Altman found RNA molecules that act as enzymes (Nobel Prize 1989), and the core of the ribosome, the machine that builds every protein, turned out to be RNA (structures solved around 2000, Nobel Prize 2009). Walter Gilbert named the idea the RNA world in 1986.

Hypothesis, with real pieces of support. In 2009 John Sutherland's group made the activated building blocks of RNA from simple compounds by a route that avoids older dead ends, and in 2015 a network driven by ultraviolet light produced precursors of RNA, proteins and fats together. Evolved ribozymes can copy short stretches of RNA and, in a 2009 experiment by Lincoln and Joyce, a pair of them assembled each other from ready-made pieces. But none has copied itself from single letters.

Problems. RNA is fragile in water, strands stick to their copies, and copying errors pile up. On the compartment side, Jack Szostak's group showed that bubbles of fatty acids grow and divide by themselves, and that RNA trapped inside can be copied a little without enzymes. Alternatives treat metabolism first (energy-releasing chemistry, perhaps on mineral surfaces, before genes) or compartments first, and many researchers expect the truth to be a mixture.

Vents or ponds?

In 1871 Darwin wrote to the botanist Joseph Hooker about a "warm little pond" with ammonia, phosphates, light, heat and electricity in which a protein might form. Ocean-floor vents offered a rival after 1977, when scientists found life thriving around them, and in 1979 hot "black smokers" at about 350 degrees Celsius.

+--------------+-----------------+--------------------+----------------+
| SCENARIO     | ENERGY          | FOR                | AGAINST        |
+--------------+-----------------+--------------------+----------------+
| Alkaline     | H2 and CO2      | resembles the core | very dilute;   |
| vent (Lost   | chemistry;      | metabolism of      | RNA letters    |
| City type)   | natural proton  | cells; warm and    | not shown to   |
|              | gradient across | stable             | form; long     |
|              | thin walls      |                    | chains hard in |
|              |                 |                    | water          |
+--------------+-----------------+--------------------+----------------+
| Hot black    | 350 C fluid,    | rich in metals and | too hot:       |
| smoker       | acidic          | sulfur             | breaks organic |
|              |                 |                    | molecules      |
|              |                 |                    | apart          |
+--------------+-----------------+--------------------+----------------+
| Warm pond or | sunlight (UV),  | cycles concentrate | needs dry land |
| hot spring   | lightning, wet- | and join           | at about 4 Ga; |
|              | dry cycles      | molecules; UV      | rain dilutes;  |
|              |                 | drives RNA-        | UV also        |
|              |                 | precursor          | destroys       |
|              |                 | chemistry          |                |
+--------------+-----------------+--------------------+----------------+
| Ice          | freezing        | RNA copying works  | cold slows     |
|              | squeezes        | better in ice in   | reactions;     |
|              | solutes         | the lab            | little energy  |
|              | together        |                    |                |
+--------------+-----------------+--------------------+----------------+
| Delivery     | impacts         | meteorites carry   | supplies parts |
| from space   |                 | amino acids and    | only; moves    |
|              |                 | bases              | the question   |
|              |                 |                    | elsewhere      |
+--------------+-----------------+--------------------+----------------+

The vent case rests on Lost City, found in 2000 near the Mid-Atlantic Ridge: warm, alkaline towers up to 60 m tall, powered by water reacting with mantle rock (the ridge machinery of Plate tectonics: the moving ground). Hydrogen and methane flow through porous walls, creating a natural chemical gradient that is strikingly like the one cells use to make energy. The pond case rests on wet-dry cycles that concentrate and join molecules, and on ultraviolet chemistry that makes RNA precursors. Both are hypotheses; neither has produced anything alive. Which is more likely is unknown, and a mixture of sites is possible.

LUCA

LUCA is the Last Universal Common Ancestor: the population from which all living cells descend. It is not the first life. Its relatives left no descendants. We infer it because every cell shares the same genetic code, the same ribosome and the same energy currency. In 2016 Madeline Weiss and colleagues traced 355 gene families back to it and pictured a microbe living on hydrogen and carbon dioxide without oxygen, possibly near vents. In 2024 Edmund Moody and colleagues, using molecular clocks, put LUCA at about 4.2 billion years ago, with roughly 2,600 proteins and even a primitive immune system. This is a hypothesis and many experts doubt it, as it would mean a complex cell only some 300 million years after the Moon formed. Estimates of this kind carry wide error bars.

The ledger

Known (with some debate): liquid water probably existed by 4.4 billion years ago; life existed by 3.5; amino acids and RNA bases form readily and arrive on meteorites; RNA can store information and catalyse; RNA evolves in test tubes; all cells share one ancestor.
Hypothesis: an RNA world, or metabolism first, or a mixture; vents, ponds or both; LUCA's age and size.
Unknown: how RNA letters formed and joined in a real place; how the first copier arose; how the genetic code arose; how long it took; why life uses one handedness; whether it happened once or many times; whether it is common in the universe.

That last question is limited by having only one example. Every living thing we know shares one ancestor. If we find a second origin, on Mars, under the ice of Europa or Enceladus, or in a lab, the problem changes completely. Until then, the best summary is an honest one. The parts list is largely known, the assembly instructions are not, and the next 3.5 billion years, which produced everything in Nature as engineer: what nature teaches us, are the easy part by comparison.

The revolutions of our time

ozdc@ozdc.us (Can Ozdemir) — Thu, 09 Apr 2026 00:00:00 +0000

Every few years someone announces that everything has changed. Sometimes they are right. In 1543 a book moved the Earth out of the centre of the universe. In 2012 a paper showed how to cut DNA at a chosen spot. In late 2022 a chatbot became a household word. This post asks what makes a revolution, tours the big ones, and ends with a checklist for the next announcement. I am writing in spring 2026, so the last part is a snapshot, not a verdict.

------------+-----------+------------+-----------+------------+---------
year       1600        1700         1800        1900         2000

    o 1543 Copernicus: the Earth moves
                      o 1687 Newton: Principia
             1859 Darwin: natural selection o
           1905 Einstein: relativity (1905, 1915) o
                   1925 Quantum mechanics (1900-27) o
                                  1953 DNA double helix o
                    1971 Microprocessor (transistor 1947) o
                                    2012 CRISPR, deep learning o
                                                   2022 ChatGPT o
------------+-----------+------------+-----------+------------+---------
(a handpicked list. Gaps look shorter near the present partly because
 recent history is better documented and not yet sorted out)

Kuhn's picture

The physicist and historian Thomas Kuhn gave the best-known account in The Structure of Scientific Revolutions (1962). Most of the time, he said, scientists do normal science: solving puzzles inside a shared paradigm, meaning accepted theories, methods and standard examples. It is like writing code against a stable ABI. Sometimes a result does not fit. Most such anomalies are set aside as errors or puzzles to solve later. If enough pile up, confidence erodes into a crisis, a rival paradigm appears, and over time it wins and becomes the new normal.

+----------------------+                        +----------------------+
|    NORMAL SCIENCE    |    most are set aside  |      ANOMALIES       |
|  solving puzzles in  |----------------------->| results the paradigm |
|  a shared paradigm   |                        |    cannot explain    |
+----------------------+                        +----------+-----------+
           ^                             too many pile up  |
           |  textbooks are rewritten                      |
           |                                               v
+----------+-----------+                        +----------------------+
|     NEW PARADIGM     |                        |        CRISIS        |
| a new way of seeing  |                        |  confidence erodes,  |
|   and new puzzles    |                        |    rivals appear     |
+----------------------+                        +----------+-----------+
           ^                                               |
           |  the winner becomes                           |
           |  the new normal           a rival paradigm    |
+----------+-----------+               gains followers     |
|      REVOLUTION      |                                   |
|   rival paradigms    |<----------------------------------+
|       compete        |
+----------------------+

Kuhn's most debated idea is incommensurability: rival paradigms can disagree about what counts as a problem or a good answer, so no neutral referee settles the matter by logic alone. Critics were many. Karl Popper thought good scientists test theories critically all the time, not only in crises. Imre Lakatos offered "research programmes" instead. Some read Kuhn as making science irrational, which he denied, listing values such as accuracy, consistency, scope, simplicity and fruitfulness. Historians add that real transitions are slower and messier than the cycle suggests. Treat it as a lens, not a law.

By Kuhn's standard, a revolution is more than something new. It changes which questions are asked, which answers count, and what the textbooks teach. "Paradigm shift" is now applied to every product launch, but most of those fail the test.

A tour of seven revolutions

Copernican (1543). Nicolaus Copernicus put the Sun at the centre. He was not the first to suggest it (Aristarchus of Samos did, in the 3rd century BCE), and his model still used circles and was no more accurate than Ptolemy's. It won over decades, helped by Kepler's ellipses (1609) and Galileo's telescope (1610).
Newtonian (1687). Newton's Principia gave one set of laws for falling apples and orbiting moons. Its predictions were bold: the return of Halley's comet in 1758, and the planet Neptune, found in 1846 from its pull on Uranus. The anomaly that eventually undid it was tiny: Mercury's orbit drifts by 43 arcseconds per century more than Newton predicts, which Einstein's general relativity explained in 1915.
Darwinian (1859). Natural selection, announced with Wallace in 1858, explained the diversity of life without a design plan. The mechanics of inheritance only caught up in the 20th century. The details are in Evolution, illustrated.
Relativity and quantum (1900-1927). Planck (1900), Einstein (1905, 1915), Heisenberg (1925) and Schrödinger (1926) rebuilt physics. GPS satellites need relativistic clock corrections of about 38 millionths of a second per day, and quantum theory underlies transistors and lasers. The two theories still do not fit together into one, and puzzles such as dark matter are anomalies whose outcome is not yet clear.
Genetic (1953-2023). Watson and Crick published the double helix in 1953, building on X-ray images made by Rosalind Franklin and Raymond Gosling. The Human Genome Project declared its work done in 2003, and a gap-free genome followed in 2022. CRISPR as an editing tool (Doudna and Charpentier, 2012; Nobel Prize 2020) led to the first approved therapy, for sickle cell disease, in 2023.
Digital (1936-2007). Turing's computability paper (1936), the transistor (1947), Shannon's information theory (1948), the integrated circuit (1958), the microprocessor (1971), the web (1989-91) and the smartphone (2007). It also changed science itself: simulation and data analysis became a third way to do research, beside theory and experiment.
AI (2012-now). Neural networks date from the 1950s. What changed was data, computing power and architecture: an image-recognition breakthrough in 2012, the transformer in 2017, ChatGPT in November 2022. The 2024 Nobel Prizes honoured work behind neural networks (Physics: Hopfield and Hinton) and protein prediction and design (Chemistry: Hassabis, Jumper and Baker).

Not all revolutions are the same kind

Kuhn's cycle describes changes in explanation. The digital and AI revolutions are mostly changes in capability, and their effects land on society. Telling the layers apart avoids a lot of confusion.

+------------------+      +------------------+      +------------------+
|     EXPLAINS     |      |     ENABLES      |      |   REORGANISES    |
|   a new theory   |----->|    a new tool    |----->| work, money, war |
+------------------+      +------------------+      +------------------+

 quantum theory      --->  transistor          --->  computers, phones
 DNA structure       --->  sequencing, CRISPR  --->  medicine, farming
 Maxwell's equations --->  radio, radar        --->  telecom, navigation

Kuhn's cycle describes the first column. The lag between columns is
often decades, and it can run backwards: the telescope and the steam
engine came before the theories that explained them.

Real change versus hype

Roy Amara's rule of thumb says we overestimate a technology's effect in the short run and underestimate it in the long run. Analysts popularised a schematic "hype cycle" in the 1990s. Both fit the dot-com episode: the Nasdaq index fell by roughly three-quarters between 2000 and 2002, yet the web went on to change nearly everything. Economists also noticed that computers did not show up in productivity statistics for years (Robert Solow's remark of 1987). The historian Paul David pointed out that electric motors took decades to pay off, until factories were redesigned around them.

effect |          (1)                                  (4)
on the |           ***                                         ooooo
world  |          *   *                                  oooooo
       |         *     *                              ooo
       |        *                                  ooo
       |                *                        oo
       |       *         *                     oo
       |      *                              oo
       |     *            *                oo                     **
       |    *              **     (2)    oo             **********
       |  **                 **       ooo    ***********
       |**                     ****###*******
       |                        ooo
       |                oooooooo        (3)
       |oooooooooooooooo
       +------------------------------------------------------------
                                                            time ->

  *  what people expect          o  what actually changes
  (1) a striking demo; everyone extrapolates it in a straight line
  (2) the failures show up; the story turns to disappointment
  (3) slow work: new tools, standards, habits, rebuilt institutions
  (4) late on, the effects exceed what anyone was claiming
  (schematic, not data; # = the two curves cross)

Why do smart people misjudge this? Because demos are cheap and deployment is expensive. A demo is like a proof-of-concept exploit that works on the author's machine: it proves that something is possible, not that it is reliable, affordable or safe at scale. The gap is filled with standards, training, regulation and habit, and that work is slow.

So how do we judge a claim in the moment? Here is a checklist.

Is there a mechanism, or just a demo? A result you cannot explain is an anomaly, not yet a theory.
Has it been measured independently? Cold fusion (1989) is the classic non-replication.
Does it predict something new that came true? Halley's comet, Neptune, the bending of starlight in 1919 (the original data are messier than the legend, but later measurements confirm the effect) and gravitational waves (2015) all passed.
Does it survive hostile testing? Ask people who want it to fail.
What are the base rates? Most announced revolutions fade.
Who profits from belief? Theranos is the cautionary tale.
What would change my mind? If nothing could, it is not an assessment.

Benefits and risks, fairly

Every revolution above cut both ways. Physics gave medical imaging, nuclear power and, after fission was found in 1938, the bomb. Darwin's theory was abused as "social Darwinism" and eugenics, though a description of how populations change says nothing about what we should value. Genetics offers a cure for a painful blood disease and the temptation of "designer babies"; in 2018 He Jiankui's germline-edited children were condemned worldwide. The digital age brought open knowledge and also surveillance and misinformation.

AI is the live case. Protein structures, translation and coding help are real gains. Open problems include confident errors, energy use, who benefits, bias, misuse and concentrated power. Serious experts disagree widely, from "another useful tool" to "the most consequential technology yet", and some warn of severe long-term risks while others think attention should stay on present harms. I do not think anyone knows the trajectory, and I distrust anyone who sounds certain either way.

Closing

For a reverse engineer, Kuhn is practical advice. Your tools and assumptions are your paradigm. The anomalies you set aside, a checksum that never matches or a field you called padding, are where the next finding hides. Hold the framework loosely enough to notice what it cannot explain, and tightly enough to get work done.

Five ideas that built modern science

ozdc@ozdc.us (Can Ozdemir) — Sun, 29 Mar 2026 00:00:00 +0000

Science is a huge pile of results, but a few ideas carry most of the weight. This is my list of five: a personal choice, not a ranking, built on Newton's mechanics and mathematics as the foundation. For each idea I give the claim, the evidence, the people and what it made possible.

They are not separate; the map shows how they hold each other up. The dating in The universe in one year: a cosmic calendar rests on atoms and energy, and Plate tectonics: the moving ground shows how slowly even a good idea can win.

        +-- quantum theory explains atoms, bonds and light ----+
        v                                                      |
+---------------+ heat is  +---------------+ E = mc^2, +---------------+
| 1 ATOMS       | atoms in | 4 ENERGY      | energy in | 5 FIELDS      |
| matter comes  |<-------->| it is kept,   |<--------->| space is made |
| in particles  | motion   | it degrades   | fields    | of fields     |
+---------------+          +---------------+           +---------------+
        | DNA is a                 | the Sun's age:            |
        | molecule                 | Kelvin v Darwin           |
        v                          v                           |
+---------------+ genes =  +---------------+                   |
| 2 CELLS+GENES | heredity | 3 EVOLUTION   |                   |
| life: units   |<-------->| variation and |                   |
| and a code    |          | selection     |                   |
+---------------+          +---------------+                   |
        ^                                                      |
        |                                                      |
        |                                                      |
        +---- X-rays, microscopes: fields reveal the cell -----+

1. Atoms: matter comes in lumps

The idea. Everything is built from a small set of kinds of atoms, which combine in fixed patterns into molecules.

The evidence. Greek thinkers such as Leucippus and Democritus guessed at atoms in the 5th century BCE, but evidence began with chemistry. John Dalton (1803, published 1808) noticed that elements combine in small whole-number ratios by weight: 12 g of carbon takes either 16 g of oxygen (carbon monoxide) or 32 g (carbon dioxide), a ratio of 1 to 2, just what lumps would do. In 1869 Dmitri Mendeleev arranged the elements in a table with gaps and predicted the missing ones; gallium (1875) and germanium (1886) turned up with the predicted properties.

Doubters remained: around 1900 Ernst Mach still treated atoms as bookkeeping. The turning point was the jiggling of pollen grains in water, seen by Robert Brown in 1827. Einstein showed in 1905 that unseen molecules bumping a grain would produce exactly that motion, with a testable formula. Jean Perrin tested it in 1908, and the leading sceptic Wilhelm Ostwald conceded the next year. Then the atom was opened: J. J. Thomson found the electron (1897) and Ernest Rutherford's team the nucleus (1909 to 1911), which is roughly a hundred-thousandth of the atom's width.

Made possible. Chemistry and materials, semiconductors, nuclear power, medicine. In 1989 IBM researchers pushed 35 xenon atoms into place, one by one, to spell their company's name.

2. Cells and genes: life has units and a code

The idea. Living things are made of cells, and cells come only from cells. Heredity travels in discrete units, genes, made of DNA and read out as a four-letter code.

The evidence. Robert Hooke coined "cell" in 1665 looking at cork. Schleiden and Schwann (1838-39) extended it to all plants and animals, and Rudolf Virchow put it in a sentence in 1855: every cell comes from a cell. Heredity needed counting. Gregor Mendel crossed pea plants in the 1850s and 1860s and found that traits do not blend: they come in units that reshuffle in fixed proportions.

              parent 2 passes on:
                  A           a
            +-----------+-----------+
            |           |           |   A = round seed (dominant)
parent 1  A |    AA     |    Aa     |   a = wrinkled seed (recessive)
passes on:  +-----------+-----------+
          a |    Aa     |    aa     |   3 round : 1 wrinkled
            +-----------+-----------+   Mendel counted 5,474 : 1,850
                                        = 2.96 : 1

His second-generation counts, 5,474 round to 1,850 wrinkled seeds, give 2.96 to 1. Nobody took notice until 1900. Thomas Hunt Morgan's fruit flies tied genes to chromosomes; in 1944 Avery, MacLeod and McCarty showed that DNA carries them; in 1953 Watson and Crick built the double helix, drawing on X-ray images by Rosalind Franklin and Raymond Gosling. The code was broken by the mid-1960s, and the first gapless human genome appeared in 2022.

Made possible. Insulin made by bacteria, DNA testing, gene editing with CRISPR (Doudna and Charpentier, 2012) and mRNA vaccines. The human genome has about 3.1 billion letters: at two bits each, roughly 775 megabytes, small enough for a memory stick.

3. Evolution: variation, inheritance, selection

The idea. Species descend with modification from common ancestors, mainly through natural selection: individuals vary, some variation is inherited, more are born than survive, and the variants that fit their surroundings leave more descendants.

The evidence. Charles Darwin and Alfred Russel Wallace reached the idea independently; their joint paper was read to the Linnean Society on 1 July 1858 and Darwin's On the Origin of Species appeared on 24 November 1859. Since then the evidence has come from every direction. Fossils appear in a sensible order; in 2004 a team searched 375-million-year-old rock on Ellesmere Island, because the theory said a fish with limbs should be there, and found Tiktaalik. The same bones sit in a bat's wing and your arm. And DNA gave the strongest test: all life shares one code, and humans and other primates carry the same broken copy of a gene for making vitamin C, a scar easy to explain by descent and hard to explain otherwise.

You can also watch it. After the drought of 1977 on the Galápagos island Daphne Major, the surviving finches studied by Peter and Rosemary Grant had measurably deeper beaks. Richard Lenski's bacteria experiment, started in 1988, has run for tens of thousands of generations.

In the 1930s and 40s Fisher, Haldane, Wright and Theodosius Dobzhansky joined evolution to genetics. Dobzhansky wrote in 1973 that "nothing in biology makes sense except in the light of evolution".

Made possible. Tracking antibiotic resistance and the family tree of a virus, conservation genetics, and directed evolution, in which enzymes are improved by mutation and selection in a test tube (Frances Arnold, Nobel Prize 2018). Evolution explains what happens once there is heredity. It does not by itself say how the first copying system arose; that is the subject of Life's origin: what we know and what we don't. And it is the design process behind every example in Nature as engineer: what nature teaches us.

4. Energy: conserved, and always degrading

The idea. Energy changes form but its total never changes. In every process some of it becomes less useful: entropy does not decrease. Together these two laws forbid perpetual motion and put a hard ceiling on turning heat into work.

The evidence. In 1775 the Paris Academy of Sciences decided to stop examining perpetual-motion machines, because none had ever worked. The measurements came in the 1840s. James Joule let falling weights turn a paddle in water and measured a tiny rise in temperature, and found that the same work always gave the same heat, however it was done. (Water falling 100 m warms by only 0.23 degrees Celsius, so he needed extraordinary thermometers.) Mayer and Helmholtz made it a general law. Sadi Carnot had already shown in 1824 that an engine's best efficiency depends only on two temperatures, and Clausius named entropy in 1865. Ludwig Boltzmann then explained it by counting the arrangements of atoms, which welded idea 4 to idea 1.

  +-----------------------+
  | HOT: 500 C = 773 K    |
  +-----------------------+
              |  100 J of heat in
              v
  +-----------------------+
  | ENGINE (cycle)        |------> work out: 61 J at most
  +-----------------------+
              |  39 J of heat wasted
              v
  +-----------------------+
  | COLD: 30 C = 303 K    |
  +-----------------------+

First law: 100 J in = 61 J work + 39 J waste. Nothing is lost.
Second law: best work share = 1 - 303/773 = 0.61. No engine beats it.

Real coal plants reach about a third to 40%, and the best gas plants approach 60%. A beautiful footnote: Emmy Noether proved in 1918 that energy conservation follows from the laws of physics not changing with time.

Energy also played detective: using the new laws, Kelvin argued that the Sun was only tens of millions of years old, far too young for geology and Darwin. He was wrong only because fusion was still unknown.

Made possible. Engines, power stations, refrigeration, and the chemistry of why reactions go.

5. Fields, relativity and quanta

The idea. Space is not empty. It holds fields, electric, magnetic, gravitational and others, and light is a wave in them. Two further ideas sit on top. Relativity says space and time form one fabric that energy bends. Quantum theory says energy comes in packets and nature deals in probabilities. In modern physics the two merge: the world is made of quantum fields.

The evidence. Michael Faraday found in 1831 that a changing magnetic field drives a current, and imagined invisible lines of force. James Clerk Maxwell wrote the equations in the 1860s and calculated the speed of their waves from electric and magnetic constants alone. It came out as the speed of light: light is an electromagnetic wave. Heinrich Hertz made radio waves in 1887-88. Einstein published special relativity in 1905, and E = mc^2 says that one gram of mass is about 9 x 10^13 joules, around 21 kilotons of TNT. In 1919 an eclipse expedition led by Arthur Eddington measured starlight bending near the Sun as his 1915 general relativity predicted, and in September 2015 the LIGO detectors heard gravitational waves from two black holes that merged about 1.3 billion years ago.

Max Planck found in December 1900 that glowing bodies emit energy in packets. Einstein, Bohr, Heisenberg, Schrödinger and Dirac turned that into a theory that predicted antimatter (found in 1932). Its quantum-electrodynamics form predicts the electron's magnetic moment to about one part in a trillion, among the best-tested predictions in science.

You use relativity daily. A GPS satellite's clock runs fast by about 45 microseconds a day because gravity is weaker up there, and slow by about 7 because it is moving: net +38. Left uncorrected, positions would drift by roughly 11 km a day (38 microseconds times the speed of light).

Made possible. Electric power, radio, radar, the transistor (Bardeen, Brattain and Shockley, 1947) and so every computer, lasers, LEDs, MRI scanners and GPS.

The five at a glance

+-----------+-------------------+-------------------+------------------+
| IDEA      | KEY EVIDENCE      | KEY PEOPLE        | MADE POSSIBLE    |
+-----------+-------------------+-------------------+------------------+
| ATOMS     | fixed ratios in   | Dalton,           | chemistry,       |
|           | compounds;        | Mendeleev,        | materials,       |
|           | jiggling pollen;  | Einstein, Perrin  | nuclear power    |
|           | periodic table    |                   |                  |
+-----------+-------------------+-------------------+------------------+
| CELLS &   | cells in every    | Hooke, Schwann,   | insulin from     |
| GENES     | tissue; 3:1 pea   | Mendel, Franklin, | bacteria, DNA    |
|           | ratios; DNA       | Watson, Crick     | tests, mRNA      |
|           | changes bacteria; |                   | vaccines         |
|           | X-ray images      |                   |                  |
+-----------+-------------------+-------------------+------------------+
| EVOLUTION | fossil sequence;  | Darwin, Wallace,  | tracking         |
|           | island species;   | Fisher,           | resistance and   |
|           | shared DNA; seen  | Dobzhansky        | viruses, enzyme  |
|           | in finches and    |                   | design           |
|           | bacteria          |                   |                  |
+-----------+-------------------+-------------------+------------------+
| ENERGY    | no perpetual      | Carnot, Joule,    | engines, power   |
|           | motion; heat and  | Mayer, Helmholtz, | plants,          |
|           | work trade at a   | Clausius          | refrigeration    |
|           | fixed rate        |                   |                  |
+-----------+-------------------+-------------------+------------------+
| FIELDS &  | light is a wave;  | Faraday, Maxwell, | radio,           |
| QUANTA    | bent starlight;   | Einstein, Planck, | transistors,     |
|           | atomic spectra;   | Bohr, Dirac       | lasers, MRI, GPS |
|           | GPS clocks        |                   |                  |
+-----------+-------------------+-------------------+------------------+

Reading them together

               1700     1750    1800     1850    1900     1950     2000
                 |        |       |        |       |        |        |
ATOMS     .........................a..........b......c...........d......
CELLS     .e.............................f....g..............h.......i..
EVOLUTION ..................................j.............k........l....
ENERGY    ............................m...n..o.p........................
FIELDS    .............................q.....r......s...t..............u
letters refer to the list below; 1 column = 5.8 years

a 1803 Dalton's atomic theory       l 1988 Lenski E. coli experiment
b 1869 Mendeleev, periodic table    m 1824 Carnot's engine limit
c 1908 Perrin settles atoms         n 1847 Helmholtz, conservation
d 1981 tunnelling microscope        o 1865 Clausius names entropy
e 1665 Hooke names cells            p 1877 Boltzmann, entropy counts
f 1839 Schwann, cell theory         q 1831 Faraday, induction
g 1866 Mendel's pea laws            r 1865 Maxwell, light is a wave
h 1953 DNA double helix             s 1905 Einstein, relativity, photons
i 2003 human genome (2022 gapless)  t 1925 quantum mechanics
j 1859 Darwin's Origin              u 2015 gravitational waves
k 1937 Dobzhansky, modern synthesis

Three patterns stand out. Each idea needed an instrument or a measurement before it won: Joule's thermometer, Perrin's microscope, Eddington's eclipse plates. They fuse in pairs: atoms plus energy is statistical mechanics, atoms plus quanta is chemistry, genes plus evolution is the modern synthesis, genes plus atoms is molecular biology. And acceptance was never one experiment. It came when independent lines of evidence, such as fossils and DNA, pointed the same way.

Other ideas could sit on this list: germ theory, plate tectonics, the expanding universe and computation each have a case. If you want to argue with my five, good. Arguing from evidence is the habit they all have in common.

Philosophy for people who read machine code

ozdc@ozdc.us (Can Ozdemir) — Mon, 02 Mar 2026 00:00:00 +0000

The last four posts were about money, banks, the world order and the spirit of the age. This one closes the series by going back to the oldest tools for thinking. People who reverse engineer software meet these questions every day without naming them. Here are some of them, with names.

              .-""""""-.
            .'          '.              "The unexamined binary
           /   O      O   \              is not worth running."
          :                :
          |      .--.      |                     — not Socrates
          :     (    )     :
           \     '--'     /
            '.          .'
              '-......-'
          ___/  |    |  \___
         /      |____|      \

1. Plato's cave: you only ever see the shadows

In Plato's Republic, prisoners are chained in a cave facing a wall. Behind them a fire throws the shadows of objects onto that wall. Having seen nothing else, the prisoners take the shadows for reality. Philosophy, for Plato, is the painful climb out to see the things themselves.

        outside: the sun, the real things
   ______________________________________________________
   |  fire   |  objects carried past:  [#]  [^]  [o]     |
   |   )\    |                                           |
   |  (  )   |   o   o   o   o   o    <- prisoners,      |
   |   ''    |   |   |   |   |   |       chained, facing |
   |_________|______________________________ the wall __|
                                    WALL:  ~#~   ~^~   ~o~
                                    "this is reality"

A disassembler is a cave with good lighting. You never see the programmer's intent or the original source. You see a projection: bytes, decoded into instructions, rendered by a tool that makes its own guesses. Decompiler output is a shadow of a shadow. The discipline of the craft is the same as Plato's: never mistake the representation for the thing, and keep asking what produced it.

2. The ship of Theseus: is it still the same program?

The Greeks told of the ship of the hero Theseus, kept in Athens as a memorial. As planks rotted they were replaced, until no original plank remained. Is it the same ship? Thomas Hobbes added a twist: what if someone collected the old planks and rebuilt a ship from them? Which one is Theseus's ship?

   v1.0   [####][####][####][####]
   v1.1   [####][####][::::][####]     one function patched
   v2.0   [::::][####][::::][::::]     most code rewritten
   v3.0   [::::][::::][::::][::::]     nothing original left
          ^ same name, same version history, same users... same program?

Software makes this concrete. Every release replaces planks. A binary diff tool answers the question in one way (changed bytes), a user in another (same name, same purpose), a lawyer in a third (who owns which part). The lesson is that identity is not a property you can read from the bytes alone. It depends on which criterion you choose, and you should say which one you are using.

3. Descartes' demon and trusting trust

René Descartes asked what he could know for certain if a powerful demon were deceiving all his senses. He stripped away everything doubtable and found one thing left: the fact that he was thinking. Cogito, ergo sum: I think, therefore I am.

In 1984 Ken Thompson gave a Turing Award lecture called Reflections on Trusting Trust that is Descartes' demon in a compiler. He described a compiler that inserts a hidden behaviour into programs it compiles, and also re-inserts that trick whenever it compiles a new version of itself. The source code of both would look clean. His conclusion: you can't fully trust code you did not totally create yourself, and that includes your tools.

   source (looks clean) --> [ compiler ] --> binary (not clean)
                                 ^
                                 |  who compiled the compiler?
                           [ compiler' ] <-- who compiled that one?  ...

Descartes escaped the demon by trusting a good God. Engineers escape it, partly, with methods: reproducible builds, compiling the compiler through independent toolchains, auditing the hardware. Neither escape is a proof. Both are reasonable bets. All knowledge rests somewhere on trust; the craft is choosing where.

4. The Chinese room: does the machine understand?

John Searle's 1980 thought experiment: a man who knows no Chinese sits in a room with a huge rulebook. Chinese questions come in through a slot. He matches the symbols to the rules and passes back the indicated symbols, which turn out to be fluent answers. To the people outside, the room understands Chinese. Searle says no one inside does. Following rules for symbols (syntax) is not the same as understanding them (semantics).

            +----------------------------------------------+
  "%#& @?"  |  [man]  + [ RULEBOOK: if %#& @? -> &&% !# ]  |  "&&% !#"
  --------->|   ._.                                        |---------->
            |   /|\     "I have no idea what this means"   |
            +----------------------------------------------+
            (the squiggles stand for Chinese characters)

Every CPU is a Chinese room. It fetches, decodes and executes with no idea what the program is "about". When we reverse engineer, we supply the semantics: this loop is a checksum, this struct is a network packet. The meaning is in our heads, not in the silicon. With today's language models, Searle's question is no longer academic. Some reply that understanding belongs to the whole system, not to the man. Others agree with Searle that symbol manipulation, however good, isn't understanding. The debate is open.

This brings the series back to its start. Searle also wrote about social reality. Some facts exist only because we collectively accept them, in the form "X counts as Y in context C":

        X                  counts as    Y                    in context C
  a piece of paper     ------------>  a 100-euro note        the euro area
  a number in a DB     ------------>  a bank deposit         banking law
  a line of hex        ------------>  a valid signature      this public key
  a person             ------------>  president              a constitution

Money, borders, companies, marriages and passwords are all real, with huge effects. Yet none would exist if everyone stopped accepting them. That is why What money is ended on trust as the one field you can't write directly. A monetary order, a world order, even a Zeitgeist is a vast structure of "counts-as" agreements. They are sturdy as long as most people go along with them, and surprisingly fragile when they stop.

6. A short toolkit

  +-----------------+--------------------------------------------+
  | Ockham's razor  | prefer the explanation with fewer moving   |
  |                 | parts (usually a bug, not a plot)          |
  |                 |                                            |
  | Socratic method | ask "what do you mean by that?" until      |
  |                 | the definition breaks                      |
  |                 |                                            |
  | Popper          | a claim no test could refute tells you     |
  |                 | little; try to break your own idea first   |
  |                 |                                            |
  | Hume            | "it worked every time so far" does not     |
  |                 | prove it will work next time               |
  |                 |                                            |
  | Wittgenstein    | meaning is use: judge a value by how it    |
  |                 | is used, not by what it is called          |
  +-----------------+--------------------------------------------+

Each of these is also a habit of good analysis. The razor kills conspiracy theories and over-engineered hypotheses about a binary alike. Popper's test is the difference between a hunch and a finding. Wittgenstein's advice is literally how you name variables in a decompiler: by how they are used.

Closing

      .----------------------------------------------.
      |                                              |
      |   bytes  ->  instructions  ->  intent        |
      |   paper  ->  promises      ->  money         |
      |   events ->  patterns      ->  an age        |
      |                                              |
      |   in every case the last step is ours.       |
      |                                              |
      '----------------------------------------------'

Reverse engineering, economics and philosophy share one move: start from raw material that does not explain itself, and reconstruct the structure that gives it meaning. The best practitioners in all three stay humble about the last step, because that is where we add ourselves.

Ghidra: the first hour with a new binary

ozdc@ozdc.us (Can Ozdemir) — Sat, 24 Jan 2026 00:00:00 +0000

Ghidra is free, open source, and has a good decompiler. Opening a binary for the first time can still be overwhelming: thousands of functions named FUN_00401136, and decompiler output full of param_1 and local_18. This is the routine I follow in the first hour. Practise it on programs you compiled yourself, where you can check your guesses against the source.

1. Project and import

File → New Project (non-shared), then File → Import File and pick the binary. Ghidra detects the format (ELF, PE, Mach-O, raw) and the architecture. Look at the import summary: it repeats what file and readelf -h would tell you.

Double-click the file to open it in the CodeBrowser and accept auto-analysis with the default options. For a small program it takes seconds.

2. Get oriented

Four windows do most of the work:

Symbol Tree (left): functions, imports, exports, labels
Listing (centre): the disassembly
Decompiler (right): C-like pseudocode for the current function
Defined Strings (Window → Defined Strings): every string Ghidra found

Start with the imports (Symbol Tree → Imports). They tell you what the program can do: file access, networking, process creation, cryptography. Then skim Defined Strings: messages, paths and format strings often point straight at the interesting functions.

3. Find your way in

Three good starting points:

The entry point → __libc_start_main → its first argument is main (on Linux). Ghidra usually names it for you if symbols exist.
Cross-references from a string: in Defined Strings, double-click a string, then right-click its label → References → Show References to (Ctrl+Shift+F). That lists the code that uses it.
Cross-references from an import: same thing on, say, fopen, to find every place that opens a file.

4. Make the decompiler readable

This is where the time goes, and it compounds: every name you add makes every other function easier to read.

Rename a function or variable: click it, press L. Name what you're sure of; use a prefix like maybe_ for guesses.
Retype a variable: Ctrl+L. Changing undefined8 to char * or to a struct pointer often transforms a whole function.
Fix a function signature: right-click the function name in the decompiler → Edit Function Signature. Correct argument types propagate to every caller.
Comment: ; in the Listing adds a comment at the current line. Write down why you believe something, not just what.
Create a struct from a pointer: right-click the variable → Auto Create Structure, then rename the fields (see "Structs in disassembly").
Go to an address or name: G.

Work outward from what you understand: leaf functions (ones that call nothing) are usually small and easiest to name, and their names make their callers readable.

5. Don't trust the decompiler blindly

Decompiled code is a reconstruction. Check the Listing when:

types look wrong (a pointer shown as a long, odd casts everywhere)
a function seems to take the wrong number of arguments: fix the signature
there are switch statements or jump tables that weren't recovered
the code uses tricks the decompiler simplifies away

Clicking a line in the Decompiler highlights the matching instructions in the Listing, and the other way round. Use that constantly.

6. Save your work

Ghidra saves everything in the project: names, types, comments. File → Save often. For notes that outlive the project, keep a plain text file next to it: the hash of the binary, what you've confirmed, open questions, and the addresses of the important functions.

Practice

Compile one of the small programs from the earlier posts (the sum loop, the switch example, the struct packet functions), strip it with strip, and load it in Ghidra. Rename everything back to the original names using only what you can see. Then compare with the source: where you were wrong teaches you the most.

Zeitgeist: reading the spirit of an age

ozdc@ozdc.us (Can Ozdemir) — Thu, 20 Nov 2025 00:00:00 +0000

The previous three posts were about money: What money is, How banks create money and The world monetary order, from gold to the dollar. Money is never only technical. Each monetary order reflects what its age believed about trust, the state and the future. This post steps back to that larger idea: the spirit of an age.

            .     *        .        .   *       .        *
       *        .     _______________________      .
     .      .        /                       \  *       .
        *           /   Z  E  I  T  G  E  I  S  T  \      .
     .        .    /___________________________\     *
          *          |  |  |  |  |  |  |  |  |  |   .
     .        *      |  the  air  everyone  |  |        *
        .            |  breathes  and  no   |  |   .
     *       .       |  one  can  see       |  |      .
                  ___|__|__|__|__|__|__|__|__|__|___
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The word

Zeitgeist is German: Zeit (time) + Geist (spirit, mind). The idea is usually traced to Johann Gottfried Herder in the late 18th century, who argued that each people and each era has its own way of feeling and thinking, and should be judged by its own standards, not by ours.

G. W. F. Hegel gave the idea its weight. For Hegel, history is the story of Geist, of mind slowly coming to understand itself and its freedom. Every age expresses one stage of that process in its law, art, religion and philosophy. Two of his lines are often quoted in paraphrase:

Philosophy is its own time grasped in thought. No thinker can leap over their era any more than a person can jump over their own shadow.
The owl of Minerva flies only at dusk: we understand an age properly only when it is ending.

   an age is lived ---------------------------> and then understood
   [ dawn ] ........ [ noon ] ........ [ dusk ]
                                          ,___,
                                          (O,O)   <- Minerva's owl
                                          /)  )      sets out only now
                                         --"-"--

That second line is a warning for anyone, me included, who tries to name our spirit while still inside it.

Is there really one spirit?

Critics have pushed back hard on the idea.

Karl Marx turned Hegel upside down: ideas don't drive history, material life does. The "spirit of an age" mostly reflects how it produces things and who owns what.
Karl Popper distrusted any theory that claims to know where history must go. He thought such theories feed authoritarian politics.
Historians point out that every age is plural. Peasants and courtiers, women and men, colonisers and colonised did not share one spirit.

A careful use of the word keeps all three objections in mind. A Zeitgeist is a pattern of shared assumptions: what an era takes for granted, finds obvious, or cannot imagine. It is not a ghost directing events.

About the 2007 film

Many people meet the word through Zeitgeist, an online film from 2007 and its sequels. Since this series is about money, it is worth being direct about it. The film's central claims are:

the US Federal Reserve is a private plot to enslave the public through debt;
the 9/11 attacks were an inside job;
Christianity was copied wholesale from ancient sun myths.

All three are rejected by the historians, economists and investigators who have examined them. The film does touch real questions, such as how banks create money and who benefits from monetary policy. But it answers them with conspiracy rather than evidence. How banks create money covers the actual mechanics, which are both less sinister and more interesting. The later films moved toward a technocratic utopia (the "resource-based economy" of the Venus Project), which is a separate and openly debated set of ideas.

Ages in one picture

Simplifying a lot, here is how the spirit of a few eras is often summarised, set beside its money:

Era	What it took for granted	Its money
19th-c. liberal age	progress, empire, the gold-backed promise	gold standard, sterling
1914-1945	crisis of liberalism, mass politics, total war	broken gold, controls
1945-1971	planning, welfare states, reconstruction	Bretton Woods
1980-2008	markets, globalisation, "end of history"	floating rates, dollar system
after 2008	crises, networks, distrust of institutions	QE, crypto, sanctions

Trying to read our own age

With the owl's warning in mind, here are some descriptions that serious thinkers have offered of the present. Each catches something, and each is disputed.

                       +------------------+
                       |  NETWORKED SELF   |  feeds, profiles, metrics
                       +---------+--------+
                                 |
  +---------------+     +--------v--------+     +-------------------+
  | ACCELERATION  |---->|   O U R   A G E  |<----|  DISTRUST OF THE  |
  | more, faster  |     |       (?)        |     |  INSTITUTIONS     |
  +---------------+     +--------+--------+     +-------------------+
                                 |
                       +---------v--------+
                       |   POLYCRISIS     |  climate, war, money, health
                       +------------------+

Acceleration. The sociologist Hartmut Rosa argues that modern life is defined by speeding up: of technology, of social change, of the pace of living. We gain options but lose a stable connection to the world. He calls that missing connection resonance.
The attention economy. When information is abundant, attention becomes scarce. Platforms compete for it, and what spreads is what provokes. Critics link this to polarisation. Others note that moral panics followed the novel, the radio and television too.
Distrust. Trust in governments, media and experts has fallen in many countries. One reading: elites failed (2008, wars, inequality) and people noticed. Another: networks make every failure visible and every rumour viral, so trust erodes even when performance doesn't.
Polycrisis. The historian Adam Tooze popularised this word for the feeling that crises in climate, energy, money, health and geopolitics now feed each other, so no single one can be solved alone.
The optimists' reply. Writers like Steven Pinker and Hans Rosling point to long-run data: extreme poverty, child mortality and illiteracy have fallen dramatically. On this view our age is a period of real progress, experienced through a news cycle that only reports bad things.

Notice that each description also implies a politics. That is the risk with the word. Whoever names the spirit of the age is often trying to recruit it.

A practical exercise

You can't see the air you breathe, but you can test for it. Three questions help:

What do people around me find obvious that past generations would find strange? (Carrying a networked computer at all times; money as numbers on a screen.)
What would people in fifty years find strange about us?
Who benefits from things staying obvious?

   assumption ----> test it ----> still holds?  --yes--> keep it, for now
                                     |
                                     no
                                     v
                          you just saw a piece of the Zeitgeist

Next and last in this series: Philosophy for people who read machine code, about old questions that look surprisingly fresh to anyone who spends their days in a disassembler.

How we know the universe is expanding

ozdc@ozdc.us (Can Ozdemir) — Tue, 21 Oct 2025 00:00:00 +0000

Nobody has read the source code of the universe. All we have is output: light arriving at telescopes. Cosmology is a long exercise in reverse engineering that output. If the light looks like this, what must the machine behind it be doing? The claim that the universe is expanding sounds like a wild guess, but it rests on independent lines of evidence. This post follows them in the order they were found, and ends with a number that two good methods still disagree on.

Light as a barcode

Every chemical element absorbs and emits light at its own exact wavelengths, a fingerprint that physicists mapped in the 19th century by studying sunlight and flames. If a distant galaxy shows the familiar pattern of calcium, hydrogen, magnesium and sodium lines but everything sits at slightly longer wavelengths, its light has been stretched. The fractional stretch is the redshift z: z equals (observed wavelength minus emitted wavelength) divided by emitted wavelength.

nm           400      500      600      700      800      900     1000
         -----+--------+--------+--------+--------+--------+--------+---
visible     ##################################
z=0.0    ....|.......|..|......|.....|..................................
z=0.05   ......|........|..|.....|......|...............................
z=0.1    ........|........|..|......|......|............................
z=0.5    ......................|...........|....|.........|........|....

| = dark absorption line: Ca (H+K), H-beta, Mg, Na, H-alpha, left to
right. The pattern is the same; the whole thing slides to the red.

From 1912 Vesto Slipher at Lowell Observatory measured these shifts for the "spiral nebulae" and found that nearly all of them were redshifted. The missing ingredient was distance. In 1912 Henrietta Leavitt had found that a class of pulsating stars, the Cepheids, pulse more slowly the brighter they truly are. Compare true brightness with apparent brightness and you have a distance. In 1923 to 1924 Edwin Hubble found Cepheids in the Andromeda "nebula" and showed it lies far outside our Milky Way: it is another galaxy.

In 1927 the Belgian priest and physicist Georges Lemaitre showed that Einstein's equations allow an expanding universe and, from the data then available, estimated the rate. In 1929 Hubble published his own plot: the farther the galaxy, the faster it recedes.

km/s    |                                                          o.
        |                                                    ooo.o. o
        |   speed = H0 x distance                        .o.oo
10,000  |   H0 ~ 70 km/s per Mpc                  o .o... o
        |   (schematic data)                   o....
        |                                 ..ooooo
        |                            ....oo o
        |                    o  ..oo.  o
 5,000  |                  .oo..o
        |             ..oo.
        |        ...o.
        |   oooo.
  0     |...
        +------------------------------------------------------------>
         0             50             100            150            200
         distance in megaparsecs (1 Mpc = 3.26 million light-years)

The straight line is the Hubble-Lemaitre law, v = H0 x d (the IAU recommended that name in 2018). Hubble's first value for H0 was about 500 km/s per Mpc, roughly seven times too high; today it is near 70. The error mattered: 1/H0 is a rough age, and 500 gives only 2 billion years, younger than rocks on Earth. Fixing the distances cured the problem.

Stretching space, not an explosion

The standard picture is not of galaxies flying outward through space, but of space itself stretching. A redshift of z means that the universe has grown by a factor of 1 + z since the light left.

then            A---B---C---D---E
later (x2)      A-------B-------C-------D-------E

seen from A         B   C   D   E
distance then       4   8  12  16
distance later      8  16  24  32
moved away          4   8  12  16   <- speed grows with distance

Think of raisins in rising dough. Every gap doubles, so raisin E moves four times as far as raisin B. Seen from any raisin, the others recede at speeds proportional to distance, so Hubble's law needs no centre. Blow up a balloon with dots on it and you get the same thing:

                                              .........o..
                                           ....          ....
          .                              ..o                ...
     ........o...                      ...                    ...
   ..o          ...                   ..                        ..
  ..              .o                  .                          o
  .                .                  .                          .
  .                ..    inflate      .                          ..
  o                .      ----->      o                          .
  ..              ..                  .                          .
   ...          ...                   ..                        ..
     .o........o.                      ...                    ...
          .                              ...                ...
                                           .o..          .o..
                                              ............

    then                                later: every dot-to-dot gap grew

Both pictures have limits, and the limits matter:

The balloon's surface is the universe. Its inside and its outside are not places, so there is no centre to point at.
Raisins do not grow, and neither do atoms, planets, or galaxies. Bound objects stay bound; Andromeda is moving toward us at about 110 km/s.
Bread has an edge. The universe may be infinite and needs nothing to expand into.
Beyond roughly 14 billion light-years the recession speed exceeds that of light. That is allowed, because it is stretching of space, not motion through it.
The Big Bang was not an explosion at one point. It happened everywhere at once.

The distance ladder

No single method measures distances all the way out, so astronomers stack them, each rung calibrating the next:

                                            +--------------------------+
                                            | 4 Hubble flow            |
                                            | billions of ly           |
                                  +---------+                          |
                                  | 3 Type Ia supernovae               |
                                  | to ~10 billion ly                  |
                        +---------+                                    |
                        | 2 Cepheids, red giants                       |
                        | to ~100 million ly                           |
              +---------+                                              |
              | 1 Parallax (Gaia)                                      |
              | thousands of ly                                        |
    +---------+                                                        |
    | 0 Radar, Kepler's laws                                           |
    | the Solar System                                                 |
    +------------------------------------------------------------------+

Parallax is plain triangulation (Friedrich Bessel did the first in 1838), and the Gaia satellite has measured it for well over a billion stars. Cepheids reach other galaxies. Type Ia supernovae, exploding white dwarfs that all peak at nearly the same brightness once corrected for how fast they fade, are visible across billions of light-years. The catch is that errors accumulate from rung to rung. Hold that thought.

The afterglow

In 1948 Ralph Alpher and Robert Herman predicted that a hot early universe should leave a faint cool afterglow, about 5 K. In 1964 two radio engineers, Arno Penzias and Robert Wilson, were testing a horn antenna at Bell Labs in New Jersey and found a stubborn hiss of microwave noise coming equally from every direction. They checked the equipment, even cleaned out pigeon droppings, and the hiss stayed. Not far away, at Princeton, a group around Robert Dicke was building a detector to look for exactly this. Back-to-back papers appeared in 1965, and Penzias and Wilson received the 1978 Nobel Prize in Physics.

This cosmic microwave background (CMB) is light released about 380,000 years after the Big Bang, when the universe cooled to about 3,000 K and electrons and protons first combined into atoms, so light could travel freely. Since then space has stretched by a factor of about 1,100, so that glow now arrives as 2.725 K microwaves. About 1 percent of the "snow" on an old analogue TV tuned between channels is this ancient light.

      |             #######
      |           ##:::::::##                   T = 2.725 K
      |         ##:::::::::::###                peak near 160 GHz
      |        #::::::::::::::::##              (perfect blackbody)
      |       #:::::::::::::::::::###
      |      #:::::::::::::::::::::::##
      |     #::::::::::::::::::::::::::###
      |    #::::::::::::::::::::::::::::::###
      |   #::::::::::::::::::::::::::::::::::#####
      |  #::::::::::::::::::::::::::::::::::::::::##########
      |##:::::::::::::::::::::::::::::::::::::::::::::::::::#######
      +------------------------------------------------------------>
       0        100       200       300       400       500       600
       frequency in GHz (microwaves)

In 1990 the COBE satellite showed that the spectrum is a blackbody to extraordinary precision (Nobel Prize 2006, John Mather and George Smoot). Later missions, WMAP and Planck, mapped temperature differences of one part in 100,000, the seeds of galaxies. A third independent check is the recipe for light elements: a hot early universe predicts about 75 percent hydrogen and 25 percent helium by mass, which is what the oldest gas clouds contain.

The timeline

Putting these together gives the standard timeline. (The name "Big Bang" came from Fred Hoyle, who favoured a rival theory, in a BBC radio talk in 1949.)

t = 0        o  our equations stop working here; "zero" is not described
             |
~1e-36 s     o  inflation (a hypothesis): huge, very fast stretching
             |
~1e-5 s      o  quarks bind into protons and neutrons (1e12 K)
             |
1 s to 3 min o  light nuclei form: ~75% hydrogen, ~25% helium by mass
             |
380,000 yr   o  atoms form, light is freed: the CMB (3,000 K)
             |
0.1-0.3 Gyr  o  first stars and galaxies (JWST sees back to here)
             |
~7.7 Gyr     o  expansion turns from slowing to speeding up
             |
9.2 Gyr      o  the Sun and Earth form (4.6 billion years ago)
             |
13.8 Gyr     *  today: the CMB has cooled to 2.7 K

Gyr = billion years after the Big Bang. Times are rounded, and the
earliest entries are well tested only from about 1 second onward.

1998: the expansion is speeding up

In the 1990s two teams, led by Saul Perlmutter and by Brian Schmidt and Adam Riess, used distant Type Ia supernovae to measure how much the expansion had slowed down, as gravity should do. They found the opposite: the supernovae were fainter, so farther away, than a slowing universe predicts. The expansion is accelerating. (Nobel Prize 2011.) The cause is called dark energy. The simplest candidate is a cosmological constant, a constant energy of empty space that Einstein once introduced and then dismissed. In the standard model dark energy makes up about 68 percent of today's energy budget, dark matter 27 percent and ordinary matter 5 percent. We do not know what it is.

size  |
      |
      |                                                           ***
      |                                                        ***
      |                                                    ****
      |                                                 ***
      |                                            *****
      |                                       *****          ........
      |                                 ****** ..............
      |                          *******.......
  1   |                ..********.
      |        .*********
      | .*******               ^ now
      |**
      +-------------------------------------------------------------->
       0                10               20                30
       time since the Big Bang, billion years

* with dark energy (the simplest model): bends upward, about 6 billion
  years ago, as dark energy took over   . gravity alone: ever slower

Recent surveys, notably DESI in 2024 and 2025, hint that dark energy might change over time. The statistical evidence is intriguing but not decisive.

An open question: the Hubble tension

Two good ways of measuring H0 disagree. The distance ladder (the SH0ES team) gives about 73 km/s per Mpc, with an uncertainty near 1. Inferring H0 from the CMB with the standard model (Planck satellite) gives about 67.4, with an uncertainty near 0.5. That is an 8 percent gap, at the level of five standard deviations. Newer JWST observations of the Cepheids support the ladder's number, while another team using different stars gets about 70, in between.

Either an error lurks somewhere in a long chain of calibrations, or the standard model of cosmology is missing something. Nobody knows yet, and the numbers shift with each new paper, so treat these as the state of play in 2025.

Try the arithmetic yourself. The Coma galaxy cluster has z = 0.0231 and lies roughly 100 Mpc (320 million light-years) away:

c = 299_792.458            # km/s
z = 0.0231                 # redshift of the Coma cluster
d = 100                    # Mpc, about 320 million light-years

v = c * z                  # fine for small z
print(f"v  = {v:,.0f} km/s")
print(f"H0 = {v/d:.0f} km/s per Mpc")
print(f"1/H0 = {3.0857e19 / (v/d) / 3.156e7 / 1e9:.1f} billion years")

v  = 6,925 km/s
H0 = 69 km/s per Mpc
1/H0 = 14.1 billion years

That is 69, between the two camps, and 1/H0 comes out near 14 billion years, close to the true age of 13.8. One cluster settles nothing, though: its own motion and its distance are uncertain, which is why the real work uses thousands of objects. Cosmic expansion rests on the same general relativity as Black holes, simply, and the Doppler idea behind redshift also finds planets, as in Exoplanets: how we find other worlds. For the local scale this all sits on, see A tour of the solar system.

Parsing binary formats with Python's struct

ozdc@ozdc.us (Can Ozdemir) — Sun, 12 Oct 2025 00:00:00 +0000

Decoding a header by hand is the best way to learn a format. Doing it a second time is a waste: write a parser. Python's struct module, in the standard library, turns bytes into numbers with a short format string, and it's enough for most formats you'll meet.

The format string

struct.unpack(fmt, data) reads bytes according to fmt and returns a tuple. The first character sets the byte order:

< little-endian (ELF on x86, PE, most in-memory data)
> big-endian (PNG, JPEG, network protocols)

Then one letter per field:

B  unsigned char   1      b  signed char    1
H  unsigned short  2      h  short          2
I  unsigned int    4      i  int            4
Q  unsigned 8-byte 8      q  signed 8-byte  8
s  bytes, e.g. 4s = 4 raw bytes             x  one padding byte

With < or >, no automatic padding is added: the format describes the bytes exactly.

Example 1: the ELF header

In "The ELF header, byte by byte" we decoded /bin/ls by hand. The same thing in Python:

import struct

FIELDS = ("type machine version entry phoff shoff flags "
          "ehsize phentsize phnum shentsize shnum shstrndx").split()

def elf_header(path):
    with open(path, "rb") as f:
        data = f.read(64)
    if data[:4] != b"\x7fELF":
        raise ValueError("not an ELF file")
    if data[4] != 2 or data[5] != 1:
        raise ValueError("only 64-bit little-endian here")
    values = struct.unpack_from("<HHIQQQIHHHHHH", data, 16)
    return dict(zip(FIELDS, values))

for k, v in elf_header("/bin/ls").items():
    print(f"{k:10} {v:#x}")

unpack_from reads at an offset (16, right after e_ident) without slicing. The format <HHIQQQIHHHHHH is just the field sizes in order: 2, 2, 4, 8, 8, 8, 4, then six 2-byte fields. On Ubuntu 24.04 it prints type 0x3, machine 0x3e, entry 0x6d30: the same values readelf -h shows.

Example 2: walking PNG chunks

From "Reading a PNG by hand": a chunk is a big-endian length, a 4-byte type, the data, and a CRC.

import struct, zlib

def png_chunks(path):
    data = open(path, "rb").read()
    if data[:8] != b"\x89PNG\r\n\x1a\n":
        raise ValueError("not a PNG")
    pos = 8
    while pos < len(data):
        length, ctype = struct.unpack_from(">I4s", data, pos)
        body = data[pos + 8 : pos + 8 + length]
        (crc,) = struct.unpack_from(">I", data, pos + 8 + length)
        ok = crc == zlib.crc32(ctype + body)
        yield pos, ctype.decode("ascii", "replace"), length, ok
        pos += 12 + length

for off, name, size, ok in png_chunks("tiny.png"):
    print(f"{off:#06x}  {name}  {size:5}  crc {'ok' if ok else 'BAD'}")

0x0008  IHDR     13  crc ok
0x0021  IDAT     22  crc ok
0x0043  IEND      0  crc ok

A few lines, and you have a validator that also tells you about extra data after IEND or chunks with bad CRCs: exactly the things you look for when a file seems "off".

Habits that keep parsers honest

Check magic numbers first and fail with a clear message.
Bounds-check every length before you use it: if pos + 12 + length > len(data): raise .... Real files are truncated or deliberately malformed, and a parser for untrusted input must not trust the lengths inside it.
Print offsets in hex next to every value. You'll compare against a hexdump constantly.
For bigger formats, struct.Struct("<HHI") compiles the format once and gives you .size for free, and ctypes.Structure or a library like construct let you describe the layout declaratively.

When to stop and use a library

For ELF and PE, pyelftools and pefile already handle every edge case; for anything you're learning, writing the first version yourself is how the format sticks.

The world monetary order, from gold to the dollar

ozdc@ozdc.us (Can Ozdemir) — Sun, 24 Aug 2025 00:00:00 +0000

What money is and How banks create money looked inside one country. But a Brazilian firm buying German machines with a loan priced in dollars uses three moneys at once. This post follows the wiring between them: the international monetary order, and how it has been rebuilt roughly once a lifetime.

                          .-~~~~~~~~~-.
                      .-~   $    ¥    ~-.
                    .'   €    ____   £   '.
                   /      .-~~    ~~-.     \
                  | CHF  /   W O R L D \ INR|
                  |     |   L E D G E R |   |
                   \     \    ~~~~    /    /
                    '.    '-.______.-'   .'
                      '-.  RUB  BRL  .-'
                          '-~~~~~~~-'
                 many currencies, one question:
             "what do we settle in when we disagree?"

Era 1: the classical gold standard (about 1870-1914)

Major currencies were defined as a weight of gold. A pound sterling was a fixed amount of gold, and so was a dollar, so their exchange rate was fixed too. London was the financial centre, and sterling bills were the way world trade was paid.

Strength: stable exchange rates and long-run price stability. Trade and investment flowed across borders.
Weakness: a country losing gold had to shrink its money supply, which meant falling wages and rising unemployment, with little room to respond. The system worked while governments were able, or willing, to impose that pain.

The First World War broke it. Countries printed money to fight. Attempts to restore gold in the 1920s, with the wrong exchange rates and little cooperation, helped spread the Great Depression. Countries that left gold earliest tended to recover earliest.

  1870 ====== GOLD STANDARD ====== 1914 ~~ war ~~ 1925 = gold again =
                                       1929-1936 xx collapse xx
                                        \__ the Depression spreads __/

Era 2: Bretton Woods (1944-1971)

In July 1944, delegates from 44 Allied nations met at Bretton Woods, New Hampshire, to design a system that would avoid the 1930s. John Maynard Keynes (UK) and Harry Dexter White (US) led the design. The result:

                    +------------------+
                    |   GOLD  $35/oz   |  convertible only for
                    +--------+---------+  foreign central banks
                             |
                    +--------v---------+
                    |    US DOLLAR     |  the anchor
                    +--------+---------+
            fixed but adjustable rates (pegs)
       +-----------+---------+---------+-----------+
       |           |                   |           |
    [ DM ]      [ FF ]              [ £ ]       [ ¥ ]   ...

     watched over by the IMF; rebuilding funded by the World Bank

Other currencies were pegged to the dollar, and the dollar to gold at $35 an ounce.
The IMF lent to countries with temporary payment problems. The World Bank (originally for reconstruction) financed development.
Capital movements were widely controlled, so countries could set their own interest rates.

The design had a built-in tension, later named the Triffin dilemma. The world needed more dollars as trade grew, which meant the US had to run deficits. But the more dollars piled up abroad, the less believable it became that each one could be turned into gold. By the late 1960s foreign dollar holdings far exceeded US gold reserves.

The break: 15 August 1971

On 15 August 1971 President Nixon announced that the US would stop converting dollars into gold for foreign governments, "temporarily". It was never restored. After a short attempt to fix new rates (the Smithsonian Agreement), the major currencies were floating by 1973.

  before 1971:   $ ---> Au    a dollar is a claim on gold
  after  1971:   $ ---> $     a dollar is a claim on the US economy,
                              its laws and its markets

Era 3: floating rates and the dollar system (1973-today)

What came next was less a designed system than a set of habits that hardened. Exchange rates are mostly set by markets, though many countries still manage or peg their currency. And the dollar stayed at the centre, in some ways more than before.

Oil and commodities are mostly priced and paid in dollars. The "petrodollar" arrangements with Gulf producers in the 1970s helped, and petrodollars were recycled into US assets.
Reserves: central banks hold foreign currency to defend their own. According to IMF COFER data, the dollar's share of identified reserves fell from about 70% around 2000 to roughly 56-58% in 2025-26. That is still more than twice the euro.
Trading: in the BIS survey of April 2025, the dollar was on one side of about 89% of all foreign-exchange trades, out of a daily turnover of roughly $9.6 trillion.
Debt: a large share of cross-border loans and bonds is in dollars, so a stronger dollar squeezes borrowers worldwide.

The French minister Valéry Giscard d'Estaing called this the dollar's "exorbitant privilege": the US can borrow cheaply in its own currency, and the world absorbs its deficits. The other side is an obligation. When markets panic, the world runs to the dollar, and the US Federal Reserve has repeatedly acted as a global lender of last resort through swap lines with other central banks (2008, 2020).

   a crisis anywhere --> everyone wants dollars --> dollar rises
          |                                            |
          v                                            v
   dollar debts get heavier               Fed swap lines calm the panic

The plumbing: messages, clearing and sanctions

Money moves between countries through correspondent banks. Banks hold accounts at each other and send payment instructions, most of them over SWIFT, a Belgian cooperative messaging network. SWIFT does not move money itself. It carries the messages that tell banks to debit and credit.

Because so much of the world settles in dollars through US banks, access to this plumbing became a tool of foreign policy. Russia's partial exclusion from SWIFT and the freezing of its central-bank reserves in 2022 were a turning point. Some countries began asking whether their reserves were truly theirs.

The current debate: multipolar money?

This is where reasonable people disagree most. The positions, as their defenders would put them:

"De-dollarisation is under way." Central banks have bought gold at record pace since 2022. China built its own payment network (CIPS) and settles more trade in renminbi. BRICS members discuss settling trade in local currencies. Sanctions have taught the world to diversify, and the US debt burden will slowly erode trust.

"The dollar is still the only real option." A reserve currency needs deep, open, liquid bond markets, free movement of capital, and courts that investors trust. The euro has no single safe bond. The renminbi is held back by capital controls. Gold pays no interest and can't be used for most payments. On the numbers, the dollar's share of trading and debt has barely moved.

"A slow drift, not a switch." Many economists expect a gradual shift: a slowly shrinking dollar share, more regional currencies, more gold, and new digital payment rails, with the dollar still first for decades. Sterling's handover to the dollar took roughly from the 1910s to the 1950s.

  1870 ------ 1914 ---- 1944 -------- 1971 -------- 2008 ---- 2022 --- ?
  £ + gold    war       $ + gold      $ floats      crisis    sanctions
  [classical] [chaos]   [Bretton W.]  [dollar system]         [multipolar?]

Summary

Every world monetary order answers the same three questions:

What is the anchor? Gold, a dominant currency, or nothing.
Who adjusts when imbalances build up? The deficit country, the surplus country, or the market.
Who stands behind the system in a panic? Someone has to be the lender of last resort.

Since 1971 the answers have been the dollar, mostly the market, and the US Federal Reserve. Whether those answers hold in the coming decades is one of the defining questions of our time. That is also where the next post starts: Zeitgeist: reading the spirit of an age.

Reading a PNG by hand

ozdc@ozdc.us (Can Ozdemir) — Sat, 05 Jul 2025 00:00:00 +0000

File formats are where hexdump skills pay off outside of executables. PNG is a perfect first format: simple, well documented, and big-endian, which makes a nice contrast with the little-endian ELF header.

The file

A 2×2 yellow image, 79 bytes in total:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 00 02 00 00 00 02  08 02 00 00 00 fd d4 9a  |................|
00000020  73 00 00 00 16 49 44 41  54 78 9c 63 fc ff 9f 81  |s....IDATx.c....|
00000030  81 81 81 89 81 81 81 81  81 01 00 19 11 02 02 9d  |................|
00000040  ce 17 c3 00 00 00 00 49  45 4e 44 ae 42 60 82     |.......IEND.B`.|

The signature: 8 bytes

89 50 4e 47 0d 0a 1a 0a. Every byte has a job:

89: a non-ASCII byte, so tools that only handle 7-bit text notice corruption
50 4e 47: PNG, readable in a hexdump
0d 0a: a Windows line ending, and later 0a a Unix one: a transfer that converts line endings breaks the signature, so the damage is detected immediately
1a: Ctrl-Z, which stops the type command on old DOS systems from printing binary garbage

It's a nice example of a format designed to fail loudly.

Chunks

After the signature, the file is a list of chunks, each with the same layout:

4 bytes   length of the data (big-endian)
4 bytes   type, four ASCII letters
n bytes   data
4 bytes   CRC-32 of type + data (big-endian)

IHDR at 0x08

length 00 00 00 0d = 13. Big-endian: read the bytes in order, no reversing.
type 49 48 44 52 = IHDR
data, 13 bytes:
width 00 00 00 02 = 2
height 00 00 00 02 = 2
bit depth 08
colour type 02 = RGB, no alpha
compression 00, filter 00, interlace 00
CRC fd d4 9a 73

IDAT at 0x21

length 00 00 00 16 = 22
type IDAT: the image data
data starts with 78 9c: a zlib header. The pixels are compressed with DEFLATE, so you can't read them directly here, but 78 9c is a pattern worth recognising: you'll find zlib streams inside many formats.
CRC 9d ce 17 c3

IEND at 0x43

length 0, type IEND, CRC ae 42 60 82. Every PNG ends with exactly these 12 bytes: 00 00 00 00 49 45 4e 44 ae 42 60 82. Handy when you need to find where an image ends inside a bigger file.

Check the CRC yourself

python3 -c "import zlib; print(hex(zlib.crc32(bytes.fromhex('49484452000000020000000208020000 00'.replace(' ','')))))"

It prints 0xfdd49a73, the same as in the file: CRC-32 over the type and data, not the length.

Decompress the pixels

import zlib
data = open('tiny.png', 'rb').read()
raw = zlib.decompress(data[0x29:0x29 + 22])
print(raw.hex(' '))

01 ff ff 00 00 00 00 02 00 00 00 00 00 00

Two rows of 7 bytes: a filter byte, then 2 pixels × 3 bytes. The encoder filtered each row to make it compress better:

row 1, filter 01 (Sub): each byte is stored as the difference from the byte one pixel to the left. The first pixel is ff ff 00 (yellow); the second is stored as 00 00 00, meaning "same as the previous pixel".
row 2, filter 02 (Up): each byte is the difference from the pixel above, so an identical row is all zeros.

Undo the filters and you get four ff ff 00 pixels: a 2×2 yellow square. Filters are why PNG data compresses well, and why you can't read pixels straight out of a decompressed stream without applying them.

Lessons that carry over

Check the byte order in the spec before reading any number: PNG, JPEG and network protocols are big-endian; ELF on x86, PE and most in-memory structures are little-endian.
Length + type + data is one of the most common file structures you'll meet (RIFF, PNG, many game and firmware formats). Once you spot it, you can walk the file even without a spec.
Data that looks random usually is compressed or encrypted. Look for known headers like 78 9c (zlib) or 1f 8b (gzip) at its start.

How banks create money

ozdc@ozdc.us (Can Ozdemir) — Fri, 16 May 2025 00:00:00 +0000

In What money is we saw that most money is not cash but numbers in bank databases. This post follows those numbers: who writes them, under what rules, and what stops them from growing without limit.

                     _______________________________
                    /                               \
                   /   B A N K   O F   L E D G E R   \
                  /_________________________________ _\
                   |  ||  ||  ||  ||  ||  ||  ||  ||  |
                   |  ||  ||  ||  ||  ||  ||  ||  ||  |
                   |  ||  ||  ||  ||  ||  ||  ||  ||  |
                   |  ||  ||  ||  ||  ||  ||  ||  ||  |
                  _|__||__||__||__||__||__||__||__||__|_
                 |______________________________________|
                       debit  |  credit   (balance: ?)

The textbook story, and why it is misleading

Many of us learned the money multiplier: you deposit 100, the bank keeps 10 as a reserve and lends out 90, the 90 gets deposited elsewhere, that bank lends 81, and so on. Banks are pictured as middlemen that pass savers' money on to borrowers.

In 2014 the Bank of England published a paper, Money creation in the modern economy, that said plainly this is not how it works today. The order is reversed: when a bank makes a loan, it creates a new deposit at the same moment. Lending comes first; the deposit is the result.

A loan, step by step

Look at the bank's balance sheet. Assets on the left, liabilities on the right. Everything must balance.

  BEFORE the loan
  +------------------------+------------------------+
  | ASSETS                 | LIABILITIES            |
  +------------------------+------------------------+
  | reserves       1,000   | deposits       9,000   |
  | other loans    9,000   | equity         1,000   |
  +------------------------+------------------------+
    total     10,000           total   10,000

                      |  the bank types two numbers
                      v

  AFTER a 10,000 loan to Anna
  +------------------------+------------------------+
  | ASSETS                 | LIABILITIES            |
  +------------------------+------------------------+
  | reserves       1,000   | deposits       9,000   |
  | other loans    9,000   | Anna deposit  10,000 * |
  | Anna's loan   10,000 * | equity         1,000   |
  +------------------------+------------------------+
    total     20,000           total   20,000
    * new: an asset (her debt) and a liability (her money)

The bank did not take 10,000 from anyone. It typed two numbers:

an asset: Anna owes the bank 10,000 (plus interest);
a liability: the bank owes Anna a 10,000 deposit she can spend.

That new deposit is money: she can pay a builder with it. Broad money in the economy grew by 10,000. When Anna repays the loan, the reverse happens and the money is destroyed. The money supply is a constant flow of creation (new loans) and destruction (repayments).

     new loan                 spending                  repayment
   +---------+   deposit   +-----------+   deposit   +------------+
   |  bank   | ----------> |   Anna    | ----------> |  builder   |
   | creates |   +10,000   | pays bill |   moves     |  ...       |
   +---------+             +-----------+             +------------+
        ^                                                   |
        |__________ loan repaid: deposit and loan vanish ___|

So what stops banks from printing forever?

If loans make money, why don't banks lend without limit? Because several brakes act on them, and these are the real limits:

Profitability and risk. A loan that isn't repaid is a loss that eats the bank's equity. Banks lend when they expect to be repaid with interest.
Demand. Someone must want to borrow at the offered rate. In a recession, demand for loans falls even if banks want to lend.
Capital rules. International rules (the Basel accords) require equity of at least a certain share of risky assets. Less capital means less lending.
Liquidity rules. When Anna pays a builder at another bank, her bank must transfer real reserves to that bank. A bank must hold enough liquid assets to survive outflows.
The price of money. The central bank sets the short-term interest rate, which ripples out to every loan rate. Higher rates mean fewer profitable loans and fewer willing borrowers.

Two kinds of money, two layers of banks

The system has two layers, and each has its own money:

                    +-------------------------------+
                    |         CENTRAL BANK          |
                    |  issues: cash + RESERVES      |
                    |  sets:   policy interest rate |
                    +---------------+---------------+
                                    |  reserves move only between banks
              +---------------------+---------------------+
              |                     |                     |
        +-----v-----+         +-----v-----+         +-----v-----+
        |  Bank A   | <-----> |  Bank B   | <-----> |  Bank C   |
        | DEPOSITS  | payments| DEPOSITS  |         | DEPOSITS  |
        +-----+-----+  settle +-----+-----+         +-----+-----+
              |       in reserves   |                     |
        households & firms hold DEPOSITS (bank money), not reserves

Reserves are money that only banks hold, in accounts at the central bank. Payments between banks finally settle in reserves.
Deposits are what you and I hold: promises by a commercial bank to pay us central-bank money (cash or a transfer).

Your deposit is therefore a promise layered on another promise. Most of the time nobody notices the difference, because deposits are insured (up to a limit) and convertible one-to-one.

When the promise wobbles: bank runs

A bank keeps only a fraction of its deposits as cash and reserves. That's fine as long as only a few depositors want their money on the same day. If many come at once, even a healthy bank can't pay them all, because its assets are long loans that can't be sold quickly. That is a bank run.

   day 1:  [$][$][$][$][$]  ... calm, a few withdrawals
   day 2:  rumour ->  ( !! )
   day 3:  o o o o o o o o o o o o o o o o o o o   <- the queue
           |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
           "first come, first served" makes waiting irrational

Modern runs happen in hours, through phones. Silicon Valley Bank in March 2023 lost about $42 billion in deposits in a single day. Societies have built three defences:

Deposit insurance, so small savers have no reason to run.
The central bank as lender of last resort, lending reserves against good collateral to a bank that is solvent but short of cash.
Supervision and capital rules, so banks are less likely to be insolvent in the first place.

Critics point out a cost. If the downside is insured and bailouts are likely, banks may take more risk. That problem is called moral hazard.

What the central bank actually does

Before 2008 central banks mainly steered one interest rate by adjusting the amount of reserves. After the 2008 crisis and again in 2020 they also bought large amounts of government and other bonds, paying with new reserves. This is quantitative easing (QE). It pushed long-term interest rates down and filled banks with reserves. Many countries, including the US since March 2020, now have no reserve requirement at all; rates are steered by the interest the central bank pays on reserves.

Views on QE divide sharply:

Supporters say it prevented a depression.
Critics say it inflated asset prices, helping those who already owned stocks and houses, and blurred the line between monetary policy and financing the state.

Debates worth knowing

Full-reserve or "sovereign money" proposals (Switzerland voted on one in 2018 and rejected it) would stop commercial banks from creating money. Only the central bank would create it.
Central bank digital currencies (CBDCs) would let the public hold central-bank money directly. People argue over privacy, over whether deposits would drain out of banks, and over how much the state could see.
Stablecoins and crypto try to build a parallel ledger. They meet the same questions as banks: what backs the promise, and who covers a run?

Summary

  loan --> deposit (new money) --> spending --> repayment --> destroyed
            ^
            limited by: profit, demand, capital, liquidity, rates

Commercial banks create most of the money we use, by lending. Central banks don't control the quantity directly. They control its price and the plumbing, and they stand behind the system when it panics. Next: how these national systems connect into one world monetary order.

How a call to puts reaches libc (PLT and GOT)

ozdc@ozdc.us (Can Ozdemir) — Sat, 19 Apr 2025 00:00:00 +0000

A dynamically linked program doesn't know where puts will be in memory: libc is loaded at a random address each run. So how does call puts work? Through two small tables, the PLT and the GOT. Understanding them explains a lot of what you see in disassembly listings.

The program

#include <stdio.h>
int main(void)
{
    puts("hello");
    puts("again");
    return 0;
}

Built with gcc -O1 -no-pie -Wl,-z,lazy hello.c -o hello. (-no-pie gives fixed addresses that are easier to follow; -z lazy asks for lazy binding, which many distributions no longer use by default. More on that below.)

main calls a stub, not puts

401126:  sub    rsp, 0x8
40112a:  lea    rdi, [rip+0xed3]      ; 0x402004: "hello"
401131:  call   401030 <puts@plt>
401136:  lea    rdi, [rip+0xecd]      ; 0x40200a: "again"
40113d:  call   401030 <puts@plt>
401142:  mov    eax, 0x0
401147:  add    rsp, 0x8
40114b:  ret

Both calls go to puts@plt at 0x401030, inside the binary's own .plt section.

The PLT stub

401030 <puts@plt>:
401030:  jmp    QWORD PTR [rip+0x2fca]   ; jump to the address stored at 0x404000
401036:  push   0x0                      ; relocation index of puts
40103b:  jmp    401020                   ; common resolver stub (PLT0)

The stub doesn't jump to puts directly. It jumps to whatever address is stored in the GOT slot at 0x404000.

The GOT slot, before the first call

.got.plt is a table of 8-byte addresses in a writable data segment. Dumping it from the file:

objdump -s -j .got.plt hello

00403fe8  08 3e 40 00 00 00 00 00  00 00 00 00 00 00 00 00  |.>@.............|
00403ff8  00 00 00 00 00 00 00 00  36 10 40 00 00 00 00 00  |........6.@.....|

The slot at 0x404000 contains 36 10 40 00 …, little-endian 0x401036: the address of the push 0x0 inside the stub itself.

The relocation table confirms which symbol that slot belongs to:

readelf -r hello
  Offset          Type                Sym. Name
  000000404000    R_X86_64_JUMP_SLO   puts@GLIBC_2.2.5

Lazy binding, step by step

First call:

main calls puts@plt.
The stub jumps through the GOT slot, which still points to the next instruction in the stub, push 0x0.
It pushes the relocation index (0 = puts) and jumps to PLT0, which calls the dynamic linker's resolver (_dl_runtime_resolve).
The resolver looks up puts in libc, writes its real address into the GOT slot, and jumps to puts.

Every later call: the stub's first jmp now goes straight to puts in libc. One indirect jump, no resolver.

What modern binaries do

Full RELRO / BIND_NOW (-z now): the dynamic linker resolves every slot at startup and then makes the GOT read-only. No lazy binding; the PLT still exists but the slots are already filled. Many distributions make this the default as a hardening measure.
.plt.sec: with Intel CET enabled you'll see the stubs split across .plt and .plt.sec, with endbr64 instructions. Same idea, different layout.
-fno-plt: the call site does call QWORD PTR [rip+…] through the GOT directly, skipping the stub.

Check a binary with readelf -d hello | grep -E 'BIND_NOW|FLAGS' and readelf -l hello | grep RELRO.

Why this matters when reversing

Tools label stubs as puts@plt or _puts, which is why imported function names show up in a stripped binary: they come from the dynamic symbol table, which stripping can't remove.
A list of imports (readelf --dyn-syms, or the Imports window in IDA/Ghidra) is a quick summary of what a program can do.
In a debugger, a breakpoint on puts@plt catches every call, and watching the GOT slot change on the first call is the best way to see all of this happen for real: try gdb ./hello, break main, run, x/gx 0x404000, next twice, and x/gx 0x404000 again.

What money is: a ledger of promises

ozdc@ozdc.us (Can Ozdemir) — Sat, 22 Mar 2025 00:00:00 +0000

This blog is usually about taking binaries apart. This post takes apart something older and more widely used than any file format: money. The method is the same. Ignore the marketing, look at the structure, and ask who can write to it.

       .--------------------------------------------------.
       |  $  |   THE UNITED LEDGER OF EVERYTHING    |  $  |
       |-----'                                      '-----|
       |    .-------.     PAY TO THE BEARER ON            |
       |   /  .-.  \     DEMAND: ONE (1) UNIT OF          |
       |  |  ( o )  |    "SOMEONE WILL ACCEPT THIS"       |
       |   \  '-'  /                                      |
       |    '-----'      signed: everybody else           |
       |-----.                                      .-----|
       |  $  |   00000001  //  backed by: belief    |  $  |
       '--------------------------------------------------'

Three jobs, one tool

Economics textbooks give money three jobs. They are worth memorising because almost every argument about money is really an argument about which job matters most.

Medium of exchange: you can trade it for things without finding someone who wants exactly what you have.
Unit of account: prices, debts and salaries are written in it. It is the "type" the whole economy is declared in.
Store of value: you can keep it and spend it later.

Anything can try to do these jobs: shells, salt, cigarettes in a prison, gold, paper, numbers in a database. What makes one of them money is that people expect others to accept it tomorrow. That expectation is the real backing of every money that has ever existed. Gold only adds a second reason to expect it.

Barter, debt and the order of things

The classic story says people bartered, found it awkward, and invented coins. Many anthropologists disagree: they find few societies that ran on barter, and many that ran on credit: "you owe me a goat" written on a tally stick or remembered by the village. In that view coins came later, often to pay soldiers, and money was a record of debt long before it was a lump of metal.

You do not need to settle that argument to see the useful idea in it: money behaves like a ledger. Every unit is an entry that says "the holder is owed something by the rest of us".

   barter                  credit / tally               coins
   ------                  --------------               -----
   [goat] <---> [grain]    |||| |||  <- notched stick   (o) (o) (o)
   needs a double          "you owe me 7"               a debt you can
   coincidence of wants    split in two, each side      hand to a stranger
                           keeps half

Commodity money and fiat money

For most of recorded history money was tied to a commodity. A coin contained metal, or a paper note promised to exchange for metal on demand. This has one big strength: nobody can create more gold by decree. It also has a big weakness: the supply of money grows only as fast as mining does, not as fast as the economy. When trade grows faster than gold, prices must fall, and falling prices make debts heavier.

Today almost every currency is fiat money ("let it be done", from Latin). A euro or a dollar is not a claim on any metal. It is valuable because:

The state accepts it, and only it, for taxes. Everyone with a tax bill needs some.
Courts treat it as legal tender for settling debts.
A central bank manages how much of it there is, aiming to keep its value fairly stable.
Habit: everyone around you prices things in it.

   +---------------------+
   |   COMMODITY MONEY   |   value  = the metal (+ trust in the mint)
   |   [ Au ]  [ Ag ]    |   supply = mines
   +----------+----------+   risk   = deflation
              |  1971: the last official link to gold is cut
              v
   +---------------------+
   |      FIAT MONEY     |   value  = taxes + law + trusted institutions
   |   [ 01011001 ... ]  |   supply = central bank + commercial banks
   +---------------------+   risk   = inflation, misuse of the printer

Most money is not cash

If you think of money as banknotes, you are looking at the smallest part of it. Economists count money in layers, roughly:

   +------------------------------------------------------------------+
   |  broad money (M2/M3): savings, deposits, money-market funds      |
   |   +----------------------------------------------------------+   |
   |   |  narrow money (M1): cash + current-account deposits      |   |
   |   |   +--------------------------------------------------+   |   |
   |   |   |  base money (M0): cash + bank reserves           |   |   |
   |   |   |   +------------------------------------------+   |   |   |
   |   |   |   |  physical notes and coins                |   |   |   |
   |   |   |   +------------------------------------------+   |   |   |
   |   |   +--------------------------------------------------+   |   |
   |   +----------------------------------------------------------+   |
   +------------------------------------------------------------------+
     the inner box is a small slice; most money is bank deposits

The exact definitions differ by country, but the shape is the same everywhere: most money is a number in a bank's database. Who gets to write those numbers is the subject of the next post, How banks create money.

Inflation: the ledger gets diluted

If the amount of money grows much faster than the goods and services it can buy, each unit buys less. That is inflation. A little of it (central banks often target about 2% a year) is seen as harmless or even useful: it nudges people to spend and invest instead of hoarding, and gives room to cut real wages without cutting nominal ones. A lot of it destroys savings and makes planning impossible. Germany in 1923 and Zimbabwe in 2008 are the textbook hyperinflations.

Inflation is not only about the money printer. Supply shocks matter too: an oil embargo, a war, a pandemic that closes factories. Arguments about any given inflation are usually arguments about how much each cause contributed.

Who wins, who loses

Every way of running money moves wealth between groups, and that is why the topic is political:

If prices rise faster than expected	If prices fall
Borrowers win (debts shrink in real terms)	Lenders and savers win
Savers in cash lose	Borrowers lose, defaults rise
People with fixed incomes lose	Businesses delay investment

Schools of thought weigh these trade-offs differently:

Keynesians accept active money and fiscal policy to fight unemployment.
Monetarists (Milton Friedman) want steady, predictable money growth.
Austrian-school economists distrust central banks and prefer hard money such as gold.
Modern Monetary Theory argues that a state borrowing in its own currency is limited by inflation, not by running out of money.
Bitcoin advocates want a supply fixed by code instead of by people.

Each camp has real evidence on its side and real failures to explain.

The reverse engineer's summary

  struct money {
      u64  amount;        // the entry in the ledger
      char issuer[];      // central bank, commercial bank, or a protocol
      u8   trust;         // the only field that cannot be written directly
  };

Money is a shared ledger of promises. Its value rests on the expectation that others will honour it, backed by taxes, law and institutions. The interesting questions are always: who can add entries, who audits them, and what happens when people stop believing.

Next: How banks create money.