Hi,

In 1960 the journalist A. J. Liebling wrote one sentence about newspapers that turns out to be a sentence about AI. Freedom of the press is guaranteed only to those who own one.

The right to print was universal. The press cost more than most people would ever have. So the permission meant what the machinery allowed it to mean, and not one word more.

Last week the largest open AI model ever released landed on the internet. Free to download. A license permissive enough to build a business on. Renting the hardware to run it costs up to half a million dollars a month. Same shape, different century, silicon standing where the press used to stand.

What people did about the press is that they pooled their money and bought one together. What a group of strangers did last week is a stranger version of the same move, and it arrives with a problem the printers never had. Once you are pooling with strangers, how do you know what the strangers actually ran?

This week's episode is about that gap, and about why the answer to it is not a second product but the same one.

Listen:

Spotify: https://open.spotify.com/episode/72E4VBjp9InWgnIGKlKMF2

Apple Podcasts: https://podcasts.apple.com/kg/podcast/plain-strata/id6783455764?i=1000779926226

YouTube: https://youtu.be/ZrswHoNRfBQ

---

The full piece, no need to click through:

On July 27 a lab in Beijing put a folder on the internet and said anyone could have it.

The folder runs to about 1.56 terabytes across a hundred-odd files. On a fast home connection the download takes most of a day, and when it lands it has used more storage than most laptops have ever shipped with. Inside is Kimi K3, from Moonshot AI: 2.8 trillion parameters, the first open model in the three-trillion class, a license permissive enough to build a business on, and benchmark results that put it in the same conversation as the best closed American systems.

It costs nothing. Almost nobody can run it.

That gap is this week's story, and it is the whole story. When people say a model is open, they almost always mean the license is open. A license is a text file. A model is a physical quantity of memory, and memory is the thing that was ever actually scarce. So the event worth explaining is not the release. It is what happened the day after, when a group running consumer graphics cards said they had the entire model serving on hardware you could buy in a computer shop, and what they had to build alongside it before that claim was worth anything to a stranger.

Start with what the file physically is, because the abstraction gets confusing fast. A model's weights are just numbers. Billions of them, each one saying how strongly one small piece of the network pulls on another. Training is the long, expensive process of finding good values for those numbers. Once found, the numbers are the model. Copy them and you have copied it.

The word for one of those numbers is a parameter, from the Greek para, beside, and metron, measure: a thing measured alongside something else, a setting that shapes an outcome without being the outcome. Kimi K3 has 2.8 trillion of them.

Here is the constraint that makes the rest of this make sense. To answer a single question, a model's numbers have to be sitting in fast memory attached to a processor, all of them, ready at once. Not on a hard drive. Not streamed in from somewhere. Resident. So the size of the file is, near enough, the size of the memory bill, and 1.4 terabytes of weights plus working space lands around 1.5 terabytes of memory that has to exist before the first word comes out.

The memory that normally does this job is called high bandwidth memory, HBM for short, and the physical picture matters. It is stacked in vertical towers and soldered onto the same package as the processor, millimeters from the math, so bytes reach the arithmetic without a long trip. It is also among the most supply-constrained components in the industry. A current datacenter accelerator carries somewhere between roughly 140 and 190 gigabytes of it, which is why the model's own publisher suggests sixty-four or more accelerators to serve it, and why the published rental rates at major providers put a running Kimi K3 somewhere between about two hundred thousand and half a million dollars a month before anyone is paid to look after it.

So the license says: help yourself. The hardware says: if you have half a million dollars a month, help yourself. That is the gate, and it has been the gate all along, quietly, on every open model. It just never bit this hard before, because the models were small enough that the gate sat below where most people were standing.

The day after the release, the operator of a Bittensor subnet called Engy said they had the whole model serving on eighty RTX 5090s.

Three terms, defined once. Bittensor is a network where anyone can plug in machines and get paid for doing AI work, with no company deciding who is allowed to join. A subnet is one set of machines on that network all running the same job, and Engy is subnet 53, operated by a team called Hanlin AI. The RTX 5090 is a gaming graphics card. It uses GDDR7, ordinary board-mounted memory, not the stacked HBM in a datacenter accelerator. Slower per card. Vastly easier to buy.

The numbers they published: ten nodes of eight cards each, connected by twenty-five gigabit ethernet, which is fast office networking rather than exotic cluster fabric. The official weights, in the format the publisher shipped them, with nothing shrunk down to fit. Twenty tokens a second on a single stream, on day one, untuned. Eighty cards at thirty-two gigabytes apiece is 2.56 terabytes of memory in total, which is roughly the capacity of thirty-two datacenter cards, assembled out of parts with no waiting list.

The reason this works at all, and it is not a stunt, is the model's own shape. Kimi K3 is a mixture of experts: it holds many specialist sub-networks and sends each word to a small handful of them, so about a hundred billion of its 2.8 trillion parameters do any work on any given word. All of the numbers have to be present. Only a slice of them has to be busy. That splits the problem in two, and the two halves have very different prices. Capacity is expensive and getting worse. Arithmetic per word is modest. A pile of cheap cards is bad at the thing this model does not need much of and perfectly adequate at holding an enormous amount of memory, provided you accept the penalty for the model being spread across ten machines instead of sitting in one.

That penalty is a smaller cousin of something this show has walked through before. Training a frontier model across the open internet is still out of reach because every training step has to push an enormous bundle of numbers across the wire, and a slow wire turns expensive processors into machines waiting their turn. Serving a model across many machines pays a version of the same toll, since each word has to walk through pieces of the model living in different boxes. The difference is one of degree, and the degree is everything: what is hopeless over home broadband is merely a tax over twenty-five gigabit ethernet in one building. The wall did not fall. Someone found a place where it is low enough to step over.

Now the part that turns this from a hardware anecdote into the show's actual subject.

If serving a giant model on cheap hardware works, it also creates an obvious temptation. Nobody can tell, from the answer alone, which model produced it. Swap in something smaller, or squeeze the numbers down to a coarser format that fits in less memory, and the answers stay plausible while the electricity bill drops. The operator pockets the difference. From outside, the two are the same text.

So Engy's product is not really cheap serving. It is checked serving. Machines doing the work, called miners on this kind of network, run the full model and commit to what happened inside it while running, not just to the answer. Machines doing the scoring, called validators, then audit slices of that record and check a signature tied to the exact bytes that went out. It sits at the cheap end of the range of ways to check AI work, closer to a spot inspection with money behind it than to a cryptographic proof, and it is honest about being that.

This is the sentence worth carrying out of the episode: cheap hardware and checkable output are not two products, they are one. The moment the machines running your model are strangers with a financial reason to cut corners, the checking is what makes the cheapness usable. Take the checking away and you have not built an open alternative, you have built a lottery.

Name the shape, because it is old and it is everywhere.

In 1960 the journalist A. J. Liebling wrote that freedom of the press is guaranteed only to those who own one. The right was universal. The printing press was not. Every generation of this pattern looks the same: a permission is granted to everyone, and the physical thing required to use the permission stays concentrated in few hands, so the permission means what the hardware allows it to mean.

Open weights is that pattern with silicon in the place of the press. The license democratizes the artifact and does close to nothing about access, and the bigger the models get, the wider those two things come apart. Which also predicts the response, because the pattern has one of those too: when permission outruns capacity, someone builds a way to pool the capacity. Co-operatives bought presses together. Here, a permissionless network is the pooling mechanism, and the thing it must add is a way for people pooling with strangers to check what the strangers actually did.

Every number above comes from the team that ran the experiment. Nobody outside has reproduced them, and no benchmark has been published.

Twenty tokens a second on a single stream is slow. It is a day-one, untuned figure by the team's own description, and the interesting question is not the single stream but what happens when many people ask at once, which nobody has shown. A gaming card is not a datacenter accelerator on power draw, on reliability, or on running for months without attention. And the subnet's own token is up roughly three hundred percent in a month, so there is real money sitting behind the announcement being loud.

None of that makes the claim false. All of it means it is a claim, and the show's standing rule applies: a company-reported result becomes evidence when somebody outside the company reproduces it.

If the claim survives contact with other people, the significance is not that gaming cards are good. It is that the gate on the largest open model in the world moved without anyone manufacturing anything new. No fab, no fresh supply of stacked memory, no smaller model. A serving strategy, and a way to check the people running it.

The open question underneath is the one the show keeps arriving at from different directions. Access built this way is access through strangers, and the whole arrangement rests on the checking being good enough and cheap enough to run constantly. Spot-checking slices of a computation is much cheaper than proving it, and it is also weaker: it raises the cost of cheating rather than removing the possibility. Whether that is enough depends on how much is riding on the answer, which is a question nobody gets to answer once and for all.

Two concrete things. First, whether anyone outside Hanlin AI reproduces the eighty-card configuration, or publishes throughput under real concurrent load rather than a single stream. Second, whether the other decentralized inference networks announce Kimi K3 hosting in the next few weeks, because a 1.5 terabyte open model is the strongest test yet of the pitch that these networks exist to serve models nobody can self-host.

---

The two voices are AI. The research and writing are mine.

Decentralized AI, layer by layer.

Dastan