The FrogNet Living Network
First, we eliminated the Internet attack surface1. Then we made a private, transcontinental HD video call — no lag — over an 850 Kbps link.
The call held and the video automatically adjusted as we ramped the bitrate down through 450 Kbps, then back up.
FrogNet exposes no application endpoints, APIs, services, or useful protocol semantics — on the public Internet or on the local network. A meaningful attack requires physical compromise of the FrogNet or one of its machines, from a physical position where that breach can be used. Even intercepted traffic yields semantic packets, not the application conversation beneath them.
1 What "no attack surface" means, precisely: no discoverable application endpoints, no exposed application protocols, no remotely reachable application interfaces.
The security is not bought by making the network useless. The first unedited run below carries 1280×720 video at 22 frames per second in both directions, across the country, through an encrypted tunnel and a constrained 900 MHz bearer.
Not here for the engineering?See what you'd actually do with it ↓- 18 mocross-internet
- ~10 yrrunning at home
- Falsifiabletest gate ships with it
- Patent lineagepop-up networking
No attack surface. No sacrifice in communication.
This is the actual first run, recorded as it happened and unedited: a live HD video call — 1280×720 at 22 frames a second, both directions, no delay — crossing the country over Wi-Fi, an encrypted tunnel, and a 900 MHz radio link carrying the session at approximately 850 Kbps. The counter on screen shows ~89% of the bytes never had to be sent.
Proof it works. HD bidirectional communication holding at approximately 850 Kbps over the 900 MHz link, ~89% of the bytes never sent.2
2 A did-vs-would estimate against published WebRTC bandwidth for the same session, not a packet capture — we label our numbers.
Two defaults, taken the other way.
Live media rides UDP and networking means passing messages — both good defaults, and on a real degrading link both flip. FrogNet runs media on TCP and drops whole frames at the sender, so the picture thins instead of shattering; and it coordinates through shared memory, so changing quality is a value the far side reads, not a session to renegotiate. The full claim, with the tape →
A private layer beside the Internet
Your devices join the FrogNet; the FrogNet reaches the Internet — directly or through another FrogNet gateway — so you get both at once. Traffic to the private 10.x network rides the adaptive node; everything else routes out at normal speed. It coexists with a 10.x network you already run — nodes just need unique addresses.
A way to optimize the whole Internet
The gains — semantic compression, the adaptive wire, custom handlers — need a cooperating FrogNet on both ends. Talk to an ordinary public server and you reach it fine, as plain HTTP, with none of the advantages. And a FrogNet's size is bounded by its hardware, most of all the elected database host. Yes, both ends run it — that's the point, not a caveat.
Billed for change — never for liveness.
Here is the whole efficiency argument in one game. Picture two people playing backgammon online while friends watch. A naive server handles it like a courier: every move, it bundles up the whole game and mails a fresh copy to everyone — and the copy gets bigger every move. (Real systems send deltas and do better than that — the honest comparison is in the caption below.) FrogNet works like a board on the wall of a room everyone is in. Someone moves a piece; everyone just sees it. Each update is only the move — a few bytes — however long the game runs or however many people watch. That is UnREST's shared memory and BLDC-1's semantic compression doing their job automatically, with no code from you.
Mails the whole game, every move
Re-sends everything that has happened so far. By move 42 a single move costs 1,619 bytes — and it never stops growing.
Shares one board everyone reads
Sends only what changed — the move itself. About 45 bytes, flat, from first move to last. Extra watchers read the same board for free.
Stop writing the plumbing. Write the values.
If you've ever wired a sensor to a dashboard or made two services agree on a number, you know the tax: a one-line goal that becomes a thousand lines of reconnect, retry, and serialization. FrogNet deletes that layer.
# package a request, send it, BLOCK on a round trip resp = client.get("/sensor/42/reading") # handle the status code, deserialize the body reading = resp.json()["value"] # and it's already stale — so you poll. again. use(reading)
# producer writes the value where it computes it put("sensors", "reading", scope, {"value": v}) # consumer reads it where it needs it — always current reading = get("sensors", "reading", scope)["value"] use(reading)
No endpoint to design. No verb to choose. No status code to map. No poll loop. The shared space is the rendezvous; convergence is the efficiency. REST and UnREST, side by side — Magnum Croakus § 28 →
Real-time data, no polling
Read the value where your code needs it — it's always current. Convergence diffs each read against what you last saw, so an unchanged value is nearly free. Stability is the cheap case, not the expensive one.
Tuple access is the whole interface
Write a named value where you compute it; read it where you need it. The producer doesn't know who reads; the consumer doesn't know who wrote. Time, presence, and identity all decoupled.
No more messages
No curl, no HTTP handlers, no glue code, no JSON wrangling, no retries, no reconnect logic, no version numbers on a control channel. You describe what's true and where; the substrate moves it.
Because state is content-addressed, not party-addressed: watchers and replay come free — any reader sees the same converged state, and the change log is the recording. (it's also why the efficiency chart above stays flat no matter how many people watch.)
Why it works
Exchange memory, not messages.
Every networked program rebuilds shared state by sending, receiving, ordering, and retrying messages — the hardest, most fragile code in the system. FrogNet inverts it: state is the medium, not the outcome.
The idea is forty years old — Linda tuple spaces, from David Gelernter at Yale in the mid-1980s — carried into the wide-area, partition-prone, sovereign world it was always shaped for. Your whole job collapses to four declarations: what the data is, how fresh each field must be, where truth lives, and what a received value means. Everything between is inherited from the substrate.
- CONTINUOUS
- audio — protected
- LATEST_ONLY
- video, status, positions
- LOSSLESS_EVENTUAL
- chat, moves, commands
- RESIDENT_ONCE
- schema, layout, scaffold
- freshness is the protocol
Ten software subsystems, one fabric.
Ten parts, each doing one job — the coordination layer, the codec, the wire protocol, the media ladder, the floating database, and the rest. I wrote the software; my co-founder Daniel Tone builds the hardware and RF that carry it onto real radios. It takes both.
Tuple-space coordination
The shared-memory layer — a variable any participant reads or writes, time- and identity-decoupled. The Linda idea, at network scale.
Magnum Croakus § 22 — From messages to memory →Semantic compression
A codec that learns a payload's structure once, then ships only the diff — an unchanged value collapses to a hash of about twenty bytes, whatever its size.
Magnum Croakus § 23 — Semantic compression →Wire protocol
The binary framing underneath — the SAME/DIFF machinery that makes "billed for change, never for liveness" true on the wire.
Magnum Croakus § 24 — FNWP-1, the wire →Adaptive real-time media
Song of the Frogs — an A/V ladder that sheds video before audio and steps fidelity to match the bearer, proven HD down to a 25-byte beacon and back.
Magnum Croakus § 27 — Song of the Frogs →Floating database
A current-state store on an elected host that floats to another node if that host dies — because the meaning was never trapped in the process.
Magnum Croakus § 15 — One name, a moving target →Capability-scored roles
Hosts are chosen by measured capability and re-elected the moment a better node appears. Authority serves at the network's pleasure.
Magnum Croakus § 14 — Selecting the service hosts →Self-discovery, repair & tuning
Automated discovery, integration, repair, and optimization: nodes find each other, join, heal around failure, and tune their own routing and roles — the network administers itself instead of waiting for someone to.
Magnum Croakus — Discovery & autonomics →Extensible sensing
A pluggable framework for bringing any sensor — soil, camera, gate, telemetry — onto the shared fabric as first-class, always-current state, with no bespoke integration per device.
Magnum Croakus § 20 — The sensor platform →Extensible intelligence
A framework for running AI on the same shared memory, so models read and write the network's live state directly — the substrate is the pipeline, not a thing bolted beside it.
Magnum Croakus § 21 — The AI platform →HTTP as the control plane
Ordinary HTTP repurposed as the coordination tool — the one protocol already allowed nearly everywhere — so nodes discover and coordinate through existing infrastructure without demanding a new port.
Magnum Croakus § 12 — HTTP as coordination →Two levels of adoption — and you can stop at the first.
You don't have to rewrite anything to win. The first level is a drop-in that pays for itself the same afternoon; the second is where the architecture gives you everything it has.
Move your internal sites onto FrogNet
Point your existing services at FrogNet transport and leave the code alone. Standard semantic compression — BLDC-1 with SAME/DIFF — ships only what actually changed, so an unchanged response collapses to a small hash instead of a full payload.
- An order-of-magnitude drop in bandwidth with no rewrite — the win lands before any redesign does.
- A security gain, not just a speed one: a compact binary frame instead of sprawling plaintext REST endpoints, and traffic that stays on your own fabric rather than fanning out through public infrastructure.
Rewrite the application as UnREST
Change the model, not just the wire. The application exchanges network shared memory instead of firing requests at a server — read a value where you need it, write it where you compute it, and let the substrate converge.
- Maximum advantage: the stack of caches, sockets, and presence services collapses into one shared space that goes silent when nothing is changing.
- Local reads, self-healing: every participant already holds the current state, so there is no centre to gate it, bottleneck it, or take it down.
Most teams take level one first — an order of magnitude for an afternoon's work — and move to level two where it earns them the most. The full walk-through, with worked numbers, is in Appendix D of the build manual and on the use-cases page.
- A transport-agnostic fabric — one flat plane of shared state over any bearers.
- Self-forming, sovereign, and partition-tolerant by default.
- Running across the internet for 18+ months; a home network for ~a decade.
- Not a cloud service — there is no center holding the meaning.
- Not a VPN or tunnel product — WireGuard is just one bearer it can use.
- Not request/response — it moves memory, not messages.
Built, running, and falsifiable.
FrogNet ships with a simulator whose only job is to try to break it — building hostile topologies, killing nodes mid-run, partitioning the mesh — and it exits nonzero the instant any check fails. Green is green because every oracle passed, not by default. The backgammon number above came off that same real engine, not a slide. The simulator and its oracles — Magnum Croakus →
That posture — read the source, find the root cause, instrument, prove — is the discipline FrogNet ships with, and the one behind every line you would build on it.
- Cross-internet mesh
- 18+ months
- Home network
- ~10 years
- Patent lineage
- pop-up networking ✓
- Developer license
- free ✓
- Falsifiable gate
- ships with it ✓
- Founders
- two · SW + RF
All the things you'd do with your people — somewhere that's just yours.
No accounts, no algorithm deciding what you see, no company quietly selling it back to you. Just the people you choose and the ordinary things you'd want to do together.
The call that won't drop
Your people, a map only you see
Game night across three houses
Interface previews — the Communicator, the family map, and the game table
Play together
Cards, board games, party games — everyone at the same table, wherever they happen to be, with no app store or subscription sitting in the middle.
Share the album
Send the vacation photos and the home videos at full quality to the whole family — and they stay in the family, not parked on a platform mining them.
Talk any way you like
Group chats, voice, and video with your people — no phone numbers handed out, no stranger and no company reading along.
Movie night, in sync
Start a show and watch it together from different houses, in step, with the side chat running the whole time.
Know who's around
A simple presence map for the household — who's home, who's out — that no outsider and no company ever gets to see.
Pass things hand to hand
Documents, recordings, the shoebox of scanned photos — moved straight between your own machines, never left sitting on someone's cloud.
Know that your conversations and your data are private
Not a policy you're asked to trust — the way the network is built. There's no company in the middle that could read them, sell them, or lose them, because there is no middle at all.
It starts with a private call. It doesn't stop there.
One network, running today — across the internet for years, and on local radios with no internet at all. Here's the range.
Private calls, video & messaging
Reach the people you choose with calls, video, and chat that no company can read — because there's no company in the middle to read it.
Your family's own network
A presence map, shared photos, and a calendar for your people — living in your home, not on a platform that sells what it learns about you.
Works in a blackout
Storm, outage, or dead zone — everyone stays connected. It runs on local radios and Wi-Fi with no internet at all, and reaches across the web only when you choose.
Off-grid, anywhere
Ranch, worksite, boat, or back-country camp. If two points can reach each other by any means — Wi-Fi, long-range radio, satellite — FrogNet links them. Every transport it rides →
Your sensors and smart home
Cameras, gates, soil, weather — read into one private picture you own, with no gateway subscription and nothing routed through anyone's cloud.
Ready for the worst day
Built for when the infrastructure fails: emergency and disaster communication that keeps working while the towers, power, and internet are down.
No cloud, nothing rented
Runs on boxes you already have — a Raspberry Pi, an old laptop. FrogNet itself carries no recurring cloud fee and no off-switch in anyone else's hand. Owning the capability isn't the same as a lower bill, though: replacing a paid service only saves you money if you actually cancel it.
Yours to build on
Developers get a network you write to like local variables — the whole platform, free to build on. See where it's deployed →
Investigate what a network of your own makes possible.
You don't have to be a network engineer. You plug in a box, it finds the others on its own, and you're running — often the same afternoon. From a single family to a whole town, here's what people stand up on day one.
Everyone under one private roof
Calls, video, messages, shared photos, and a where's-everyone map for just your people — no accounts, no cloud, nothing sold. It runs on a spare box in the closet and keeps working when the internet doesn't.
Your shop's own nervous system
Tie the registers, cameras, back office, and the phone in your pocket into one system without renting a separate SaaS for each. No monthly seat fees, and your numbers never leave the building.
Eyes on every acre — no cell bars needed
Soil, tanks, gates, and cameras spread across land the carriers gave up on, read into one picture over long-range radio. Set it up once; it heals itself when a node drops off.
Connectivity a town can own
A village, a co-op, or a disaster zone can stand up its own calls, messaging, and services with no carrier and no data center — and keep them running through the outage that takes everything else down.
The same box does all of it at once — you don't pick a lane. Start with the one you need today; the rest is already there when you want it.
We'll even tell you the one place it could be tapped.
Most services would never admit to one. Here's the honest picture. While your network stays on local Wi-Fi or radio, there is no point on the internet to tap at all. When you bridge two sites across the public internet, the traffic passes through a single relay — a broker3 — and that one point is, in theory, where machine-to-machine traffic could be intercepted. So look at what someone trying would actually be up against.
Won't answer a knock
The relay sits on an IP you control and a port you choose, behind WireGuard — which stays silent to bad probes. A scanner sweeping the whole internet gets no reply and no hint anything is even there.
On ground you picked
You choose the address and the port. No well-known endpoint, no service banner, nothing announcing itself — just one quiet door among billions of addresses.
Nothing readable crosses it
Everything through the relay is semantically compressed and run through the SAME/DIFF protocol — not messages, just differences against state the far end already holds. Without that memory, it's noise.
And public input needs no door at all.5
Even a form on the open internet doesn't have to be a way in. It can sit exposed and still be air-gapped from the network: the public side only drops files into a watched folder — it never holds a socket the network answers. Inside, those files are picked up, inspected however you like, and only the vetted result is handed to the applications; replies make the reverse trip. Nothing on the internet can address the network; it can only leave a file the inside chooses to read. A selective directional gap — disconnected doesn't mean dark.
Finding it would be like finding a single grain of sand on a long beach. Making sense of what crossed it would be like extracting one strand of DNA from that single grain.
3 Full disclosure: on this site the broker shares one droplet with the public storefront — the marketing site and its license form — because that's where people come to get FrogNet. The storefront isn't part of the network it advertises; a production broker exposes nothing to the internet but the silent WireGuard endpoint.4
4 And that single box runs nominal — the limit was never CPU, it's the network, and semantic compression with SAME/DIFF cut that to a trickle, leaving ample room for real-time video.
5 This is the established cross-domain pattern — a data diode or watched-folder drop — and the boundary FrogNet is designed to sit behind. It isn't a shipped FrogNet feature yet; the architecture assumes it, and the implementation is on the roadmap.
The whole idea — explained for anyone.
FrogNet is written down, from first principles, in two free books. Start with the story; drop into the manual when you're ready to build.
How to Think Like a Frog
Networking for the 21st century, in plain English — no code, no jargon. Why the network you rent works the way it does, and what changes when you own it instead. If you read one thing, read this.
Magnum Croakus
How to Work Like a Frog — the engineering build manual. Install a node, discover the mesh, elect the database, and write your own handlers, with worked examples throughout.
Own it
Headed for an open standard — with a reference you can run.
The protocol underneath FrogNet is being written up as an open specification, so the wire is a public contract anyone can implement against — the engine you license is the reference implementation, not a black box. Both books are free, and so is the developer license — no seat count, no expiry. When FrogNet runs inside something commercial, a simple license covers it, with support and The Communicator included. And a Foundation is being established to steward the standard, so it stays owned by the people who use it. Closed engine, open protocol — on purpose: the plan →