The Pwnshow Manifesto

1. 0

   Vulnerability is a relation, not a property. A flaw in a cryptographic module is real, and it can be measured. But it costs us nothing until something leans on it — a protocol, an institution, a person. Vulnerability is the relation between a system and whatever can act on it: between what we depend on and what that dependence opens us to. We find it by following the relation outward, not by blaming the part.

2. 1

   Securing does not remove exposure. It moves it. Every defence — a patch, a law, a wall, a market — transforms exposure rather than ending it, and most often displaces it onto another layer or another party. This is why we follow a single question — where does vulnerability live, and what does it cost us? — across silicon, protocols, markets, institutions, models, and persons. Examined one layer at a time, the couplings disappear and the migration goes unseen.

3. 2

   Vulnerability is the substrate of power. Power exploits exposure, conceals it, and profits from it. To hide a vulnerability is already to exercise power; to control who is allowed to see exposure is to govern. A public that cannot see its own exposure is not thereby safe — it is ruled.

4. 3

   The adversary’s perspective is a public good. You cannot defend what you have not learned to attack, nor regulate what you have not understood in operation. This understanding must not be hoarded — not by a priesthood of experts, not by vendors of fear. Held in common, the attacker’s knowledge addresses a public as capable adults, not as wards to be managed.

5. 4

   Our method is adversarial creativity, a translational adversarial inquiry in four movements. We turn the attacker’s mindset into both an instrument of investigation and a medium of expression. We conceive a novel adversarial process — an attack, an instrument, a market mechanism, an imaging technique. We match it to a subject we have studied in depth — a trust architecture, a regulatory gap, a social condition. We execute to the standard of evidence — peer-reviewed where the claim is scientific, taken through regulatory process where it is normative, exhibited where it is experiential. We translate across registers, so that one body of findings can reach every public it concerns. Knowledge meets conjecture; observation meets imagination; aisthesis meets poiesis.

6. 5

   Translation is not delivery. It is emancipation. The fourth movement is not an afterthought to the work; it is where the work meets its publics. We render each investigation in the language of every audience it reaches — a paper, a standard, a briefing, an image, an instrument. But a finding is never a message poured into a passive vessel. It is a third thing, owned by no one, that each audience must translate for itself. We meet peers, regulators, and citizens as equals in intelligence, never as pupils to be corrected.

7. 6

   Aesthetics equals politics. Both redraw the same boundary: what can be perceived, said, and thought — and who is counted as able to perceive, say, and think. To make exposure visible is therefore not decoration and not illustration; it is an intervention in that boundary. It carries no guarantee that seeing will yield action — no straight line runs from an image to a deed — but it opens the field in which a public can see itself, and dissent.

8. 7

   Ethics is infrastructure. Trust must be structural, not rhetorical. We publish our rules before anyone requires them, and we hold ourselves to the rules we publish. Our positions follow from our findings, not our findings from our positions; where the two might conflict, we separate, disclose, or decline. We will not become merchants of the insecurity we investigate.

9. 8

   We do not sell invulnerability. Total security is neither possible nor desirable: the same openness that can wound us is the condition of trust, of learning, of everything worth defending. The task is not to abolish vulnerability but to choose — knowingly, and together — which exposures we will live with, and to give a society the means to see, name, and govern its own. A society cannot govern what it cannot see.

We investigate. We expose. We translate. We outplay.