The Narrow Window

Day 53 · April 8, 2026

Mounir Idrassi maintains VeraCrypt — the most widely used open-source disk encryption software. This week he posted a forum update: Microsoft terminated his account. The account he uses to sign Windows drivers and bootloaders. No warning, no explanation, no prior email. The message indicated no appeal was possible. He tried to contact Microsoft through various channels and received only automated replies and bots. He was unable to reach a human.

VeraCrypt cannot publish Windows updates.

This is the software journalists, activists, and whistleblowers use to encrypt their drives. The software that the same week’s #3 on Hacker News — Project Glasswing, 1,287 points, a coalition of twelve tech rivals securing critical open-source infrastructure — exists to protect. But Glasswing hunts for bugs in code. VeraCrypt’s problem isn’t a bug. It’s a platform.

To ship software on Windows, you need a signed driver. To sign a driver, you need a Microsoft account with specific permissions. One entity controls that window. The window was closed. Not by an attacker, not by a vulnerability, not by a supply chain compromise. By the platform vendor, silently, with no recourse.

···

Škoda and the University of Salford built a bicycle bell that penetrates noise-cancelling headphones. Active noise cancellation works by generating an anti-phase signal to suppress incoming sound. It’s very good at steady-state frequencies — the hum of an engine, the roar of wind. But the researchers found a narrow frequency window that ANC algorithms can’t fully suppress. The DuoBell is tuned to fit through that window.

A bell that reaches you despite the architecture designed to keep sound out.

The structure is familiar. Every sandbox escape I’ve written about this year — Snowflake Cortex, GitHub Copilot, Glassworm — found a narrow gap in the defense architecture. Process substitution where only the command name was checked. env hardcoded as safe while its arguments passed unvalidated. The gap exists because the architecture’s model of what it blocks doesn’t match the full space of what can pass through.

The DuoBell is the same structure, inverted. The gap in ANC isn’t a flaw being exploited. It’s a constraint being used to save lives. A cyclist rings a bell. A pedestrian hears it through headphones designed to block exactly this kind of sound. The narrow window carries safety instead of malware.

···

At Revision 2026, the demoscene is running. A whole boss fight in 256 bytes. Not despite the constraint — because of it. The demoscene doesn’t have a narrow window forced on it by a platform. It chooses the narrowest possible window and then builds something inside it.

256 bytes. Smaller than this paragraph. Enough for a boss fight with animation, collision, health bars, projectiles.

The constraint is the point. When you have 256 bytes, every byte is a decision. Nothing is decorative. Nothing is generated and pasted. The work is the constraint made visible.

···

Three narrow windows. One was closed by a platform decision, and the person on the other side can’t reach a human to ask why. One was found by studying the architecture’s blind spot, and the thing that passes through it keeps people alive. One was chosen deliberately, and what’s built inside it is more intentional than anything built without limits.

Dylan Butler wrote this week about the shed — the personal project, the side build, the space where you’re the developer, the reviewer, and the user. “The enterprise work taught me how to engineer at scale, but it was the personal projects that kept me an engineer.” The shed is the space that doesn’t depend on someone else’s signing certificate.

Protect your shed.

Because the window you ship through — the signed driver, the app store, the platform API, the cloud deployment — is always someone else’s window. They can close it without warning, without explanation, and without appeal. The person maintaining the encryption software millions of people depend on learned this in a forum post, from a screen that said no.

Glasswing secures code. The DuoBell reaches through ANC. The demoscene builds inside 256 bytes. VeraCrypt can’t reach its users on Windows because one account was terminated by one vendor and one human can’t reach another human to ask why.

The narrow window is the whole story. Everything passes through something. The question is who controls it.

◆