I grew up on the internet in the 1990s, when logging on felt like heading west on a trail full of new friends and strange stories. No algorithms decided what I saw. No advertisements followed me between sites. And nothing stopped you from port scanning half the internet.

The system wasn't watching back. For better or worse, neither was anyone else.

I spent a long time thinking of that as a security failure we hadn't gotten around to fixing. It isn't. It was the design.

In 1969, four computers were wired together by graduate students who wrote the rules as they went. They knew each other by first name. So when they specified how to send mail, resolve a name, route a packet, they left authentication out — not by oversight, but because it was genuinely unnecessary. You don't verify the identity of someone whose house you bike past on the way to work.

Those protocols are still running. Five billion strangers later, they still believe whatever they're told.

I went through the RFCs — nearly ten thousand of them now, starting with the one that apologized for existing — and wrote a book about what happened next. Twenty-three protocols, one per chapter, each traced from the idea that made it to the breach that broke it:

A 75-cent accounting discrepancy that led a Berkeley astronomer to a hacker selling stolen logins to the KGB. A misconfigured router in Pakistan that erased YouTube from the internet for two hours — not just from Pakistan, from everywhere. A forged Google certificate, issued by a small Dutch company that had been quietly broken into, turning up on the connections of hundreds of thousands of Iranians — two years after the Green Movement was crushed, and who was reading was never established publicly.

What surprised me was how few of these were break-ins at all. Almost every attack in the book used the protocols exactly as specified. Nothing was subverted, nothing was exploited in the sense we usually mean. The systems did what they were built to do, which was believe people.

The internet was designed for a world that no longer exists. It works in the world that does.

That second sentence is why the book isn't a eulogy. It works. Right now, while you read this, the packets arrive and the names resolve and the connections hold — on a foundation nobody would design this way today and nobody can afford to replace. I find that more remarkable than any of the breaches.

The last chapter is about robots.txt, a plain text file that worked for twenty-eight years purely because everyone chose to honor it. Then training data got expensive, and the largest companies on earth stopped checking. Whether the file was ever enforceable isn't really the question. Publishers who said no were owed the courtesy of being asked.

Which is why the book's own site asserts that reservation in its robots.txt, in a file that cannot compel anyone. That's the whole argument, stated the only way the internet has ever known how to state anything: politely, and on the assumption that you'll play along.

Rough Consensus: How Engineers, Hackers, and Spies Built the Internet is out now in paperback and Kindle. More at builttheinternet.com