Map: Censorship Resistance

Censorship resistance is the property that no single entity (registrar, host, ISP, payment processor, app store) can unilaterally remove or block content. It comes from removing single points of control: decentralized naming, P2P transport, self-custodied keys, alternative payment rails.

The censorship stack

Recurring patterns

1. Self-authenticating identifiers

When the name is the key, no registry can move it. Examples: Tor v3 onion, Nostr npub, PKARR records, did:key, Bitcoin addresses.

2. Permissionless write paths

When anyone can publish, content moderation has to happen at the read side. Examples: Nostr relays, Bitcoin txs, BitTorrent DHT, IPFS, Arweave, Blossom mirrors.

3. Code transparency

When the binary is publicly reproducible and logged, takedown attempts are observable. Examples: Apple PCC transparency log, Sigstore, deterministic builds.

4. Layered redundancy

When traffic can fall back to alternative transports, blocking one does not sever the channel. Examples: Tor pluggable transports, Reticulum over heterogeneous links, Briar over Bluetooth, Wi-Fi, and Tor.

Reference stacks

Maximum-resistance LLM endpoint

PKARR or .onion
   ↓
Attested TLS bound to enclave key
   ↓
Confidential VM (TDX/SEV-SNP) + H100 CC
   ↓
Open-weights model + transparency-logged build
   ↓
Lightning paywall (no KYC)

See Confidential-AI-Inference and Private-LLM-Inference-Patterns.

Maximum-resistance social account

Nostr keypair (your local file)
   ↓
Posts signed locally → broadcast to many relays
   ↓
Media on Blossom servers → mirrored by SHA-256
   ↓
Share Nostr public keys independently; NIP-05 aliases depend on DNS and HTTPS
   ↓
Lightning zaps for monetization

Sovereign node (no internet, no banks, no cloud)

Local AI inference
   ↓
LoRa mesh (MeshCore / Meshtastic / Blackout)
   ↓
Cashu ecash (now with TEE mint path) + Bitcoin
   ↓
Encrypted chunked comms + local maps

See MeshCore, Cashu and Chaumian Ecash, and new composition examples in MOC - Composing Primitives.

Threat model themes

• Takedown via choke point: addressed by removing the choke point.
• Sanctions or financial deplatforming: addressed by self-custodied money.
• Court order on operator: addressed by no-knowledge architectures (E2EE, sealed-sender, attested TEEs without persistence).
• Mass deplatforming of consumers: addressed by app stores being optional (web, sideloading, alternative app stores).

Files most relevant

• Overview - Decentralized DNS
• Overview - Mix Networks
• Overview - Off-Grid Networks
• Overview - Decentralized Compute
• Overview - Decentralized Storage
• Overview - Encrypted Messaging
• Overview - Financial Sovereignty
• Overview - Confidential Computing
• Confidential-AI-Inference

Primary sources

• Tor onion-service protocol
• Nostr NIP-01: events and relays
• Nostr NIP-05: DNS-based identifiers
• IPFS: persistence and availability
• Briar: transports and peer-to-peer synchronization

For the access layer, compare WireGuard, Outline, Psiphon and Tor bridges and pluggable transports. OONI explains how to read network measurements and assess the risks of collecting them. For deployment, see the private-server guide.