Password Managers

Mike's Notes

I have used Avast Password Manager; it was reliable, but it's now useless.

What is the best password manager? I found this Reddit discussion with a comparison table. NordPass got the highest ranking. Some of the debate is copied below.

Resources

• https://www.reddit.com/r/Passwords/comments/17f73pa/i_made_a_comparison_table_to_find_the_best/
• https://docs.google.com/spreadsheets/d/1b2zEEU8_YPsgo3nY1BJ72qgLXteP7Yt0_mnlYJ8m0RI/edit#gid=0
• https://nordpass.com/plans/business/
• https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
• https://www.theregister.com/2025/08/28/16_billion_credentials_exposed/
• https://www.theregister.com/Tag/Password/
• https://www.theregister.com/Tag/Avast/
• https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

References

• Reference

Repository

• Home > Ajabbi Research > Library >
• Home > Handbook > 

Last Updated

25/01/2026

I made a Comparison Table to find the Best Password Manager

By: barnabebro

Reddit: 28/08/2024

Hey everyone! Recently I started thinking about purchasing a password manager for my family and myself. With all the cyber threats going around recently (did you know that a random, eight-character password can be hacked within eight hours?), I am starting to lose all trust in saving my password anywhere else.

After a brief research, I don’t know why, but I was very surprised about how many different options we have here. And boy, it is hard to choose the one you like from the first sight. Also to know which product is legitimate and which is just the work of an excellent marketing team.

So I took some time over the past few days and did an in-depth research myself (my inner nerd was very happy about it). And thought that I would share it with you as well.

The top criteria I was looking for:

Privacy features: I looked mainly into 4 different areas (MFA, Biometrics, Data Breach alert, and Encryption) as it was most important for me, and made a separate table for them as well evaluating it by numbers.

Credit card safety: Another feature I was looking for was saving a credit card. As I shop online quite often, I wanted to have my credit card details on hand and autofill them instantly and still feel safe about it.

Password health check: I think it is a great feature to see if my passwords are easy to hack as sometimes I am not as creative as I think I am with my passwords. I guess the password generator feature will be helpful in this area too.

Here is the Comparison Table.

As it was done for my own research, let me know if there are other brands that you think I should include. Also feel free to suggest any other criteria for the table. Let’s make this as helpful as it can be for everyone like me who has no idea how to choose the best password manager out here.

***

Table updated on 2024-08-28. Edits made: prices and features of some of the providers updated, new provider added.

Discussion

fdbryant3 - 2 years ago

This turned out to be a lot longer than I thought it would be when I started. So I want to preface this by saying kudos to you for making this and it is certainly a lot more than I have ever done (and probably better done than I would have). Please take all of the following as constructive criticism and feel free to implement or ignore as you see fit.

A criterion I would add to the privacy score is whether or not the password manager is open-source or closed-source, with points being given for being open-source (personally I consider this a top criterion for security apps). More points should be given if the password manager is regularly audited by independent 3rd parties.

Another criterion I would consider is if the password manager is the only product made by a developer or part of a suite of products they offer (whether or not related to password management and security). The reason is if the password manager is part of a suite then its development must be balanced against the resources and priorities of the other products.

Personally, I wouldn't factor in Data Breach Alerts as those are easily available elsewhere and more of a convenience than a password manager function (to be fair I'm a little salty as it is dragging down my preferred password manager Bitwarden who is apparently the only one not to offer it). I would reclassify it, along with VPN, file storage, and other not-really password management features (such as Bitwarden's Send feature or ability to generate TOTP authentication codes) as miscellaneous or bonus features and then I guess quantify how useful you think they are (which is of course totally subjective) or don't quantify them at all and just let people know they are there.

Something else to look for is if the password manager has backup/export functions. Can backups be generated encrypted and unencrypted? Can it import/export to/from other password managers?

Can you access the password from a web browser (not using an extension)?

Does the password manager have a password generator? If so can it also generate passphrases? Can it generate logins and integrate with services like addy.io to anonymize your email address?

I would also note which password managers support the superior Argon2 key derivative function (KDF) as an alternative to PBKDF2 and give weight to that. Ideally, Argon2 should now be the default KDF when setting up a new account. I would rank this in your privacy score (more on this in a bit).

Password sharing and passkeys are not the same thing. For instance, Bitwarden does support password sharing but currently does not support passkeys (passkeys should hopefully be supported within the next month). I would separate them into two different criteria. Right now I wouldn't weigh passkeys too highly as it is very new, and not widely supported across the Internet yet (and will probably be a bit before they are if widely supported at all). Mostly I would want to know if the password manager plans to support them if they don't already.

I would note which browsers they have extensions for - specifically Chrome, Firefox, Edge, and Safari. Since almost every other browser uses one of those engines (most of them being Chromium) it can probably be assumed they will be supported whether listed or not.

I'm a little confused by what you mean by "service is using more than 2 authentication factors". Do you mean it supports using more than 2 steps during login or has multiple types of 2FA methods? For instance, you gave Bitwarden a 3 even though it supports FIDO2 Webauthn, TOTP (authenticator apps), email, as well as security keys and DUO Security through its premium tier. Meanwhile, you give NordPass a 5 even though it only offers security keys, TOTP, and recovery codes (which technically Bitwarden does as well if you consider that 2FA method). Bitwarden also supports passwordless login with a device (ie a passkey for Bitwarden) which by default is 2FA (although not two-step) login whereas NordPass currently does not (they are working on it).

...

I do not understand your encryption scores. You gave Bitwarden a 5 for listing AES-256+salting+PBKDF2-SHA256, ZoHo Vault a 3 for AES-256, Keeper a 5 even though you only list AES-256, and LastPass a 4 even though it is also listed with AES-256+PBKDF2-SHA256 salting. To be honest you don't really need to mention salting because I would be surprised if any were not doing it whether they mention it in the marketing or not (you'd have to read through the white papers to figure out if they are or not, but I'd just assume they are) and salting is part of the KDF functions. I would revamp this score to consider the following

• Encryption Protocol: This is really just informational as long as they are using a recognized standard modern encryption protocol and not something either outdated or rolling their own
• KDF Function options: PBKDF2, Argon2 (with Argon2ID being ranked higher)
• Default KDF Function: More points for having Argon2 as the default upon account creation
• Default number of iterations for PBKDF2: a minimum of 600,000, anything less should be ranked lower
• Default settings for Argon2ID (you actually probably don't need to worry about this: minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.

So for Bitwarden, I might give a score of 8

• 1 point for AES-256
• 1 point for PBKDF2
• 1 point for PBKDF2 default 600,000 iterations (the minimum recommendation)
• 2 points for Argon2ID (as opposed to 1 point if it was just Argon2, Argon2i, or Argon2d)
• 2 points for Argon2ID defaults exceeding OWASP minimum recommendations (1 for meeting, one for exceeding)
• 1 points for PBKDF2 being the default KDF on account creation (I would have given 2 points if Argon2ID was the default)

Whereas LastPass I would give a score of 4

• 1 point for AES-256
• 1 point for PBKDF2
• 1 point for PBKDF2 default 600,000 iterations (the minimum recommendation)
• 0 points for Argon2 (currently not supported but being worked on)
• 1 point for PBKDF2 being the default KDF

Personally, I would remove LastPass from the list due to the security breach last year which resulted in password vaults being stolen (and to my knowledge, they are the only password manager to suffer such a breach). On top of that, some of those vaults have been cracked because they did not update security settings such as the PBKDF2 iteration counts on those vaults. While all that is bad what really makes them dead to me is the way they have communicated information about the breach (it basically dripped out over months) was and remains unsatisfactory (to my knowledge they never notified specific users whose vaults might have been stolen). That said they probably have fixed everything that contributed to this breach (but they are a close source password manager so how do we know) so if you want to include them that is up to you but they need an asterisk or score dropped to zero or something.

On the topic of security breaches, you might want to try to research (I would do a 1st-page search engine search and check the Wikipedia page for anything in the last 3 years) and score like this:

• 4 - no reported security breaches found on the 1st page of a search engine search or noted in Wikipedia within the last 3 years (or whatever time frame you think relevant)
• 3 - reported security incidents that did not result in access or stolen user data
• 2 - reported security breaches where user data was accessed or stolen but not password vaults.
• 1 - reported security breaches where the password vault is stolen
• 0 - reported security breach where the vault was stolen and reportedly cracked

Password managers have different options at different tiers. For instance, Bitwarden has unlimited entries on its free tier, whereas Dashlane recently limited the number of entries on the free tier to 25 (I think, I know it was limited and do not feel like looking it up). Another example is Bitwarden allows you to access your password vault from any device on the free tier whereas LastPass only allows you to access it from mobile devices or computers on the free tier. If you don't want to break it down to that level of detail I would put a note that you are comparing across the top premium tiers.

As someone else noted you should add ProtonPass. I would also consider KeePass although you would also have to note whether or not a password manager is cloud-based or natively offline. If you want to include it for kicks and giggles you might compare password managers to a spreadsheet/piece of paper.

RedFin3 - 2 years ago

Although it is interesting to see all these features listed on a table, I think that your approach is very much mis-guided and frankly wrong. A password manager is not just yet another piece of software you download. It is a critical part of your life, and security and integrity are not only paramount but they easily tramp bells and whistles that a password manager may offer. It is not different to selecting a bank. Would you select a well-known bank or will you go for a bank that few people know much about but may offers a few more features.

The "winner" in your list is Nordpass, the VPN seller known as Nord VPN. Although I cannot fault them much, VPN companies in general are notoriously dodgy. I would never trust a VPN company as my password manager. Some exceptions to this would be Proton, which has a well established reputation, and even Mollvad if they had a password manager.

As far as I am concerned, the main serious contenders are 1Password (the one I use), Bitwarden, Keepass, and Proton. Lastpass my previous password manager has already shown that they are incompetent and liars (as they never disclosed that some data was not encrypted).

I would generally avoid any password manager that does not have its executive team on its website.

EDIT: I replaced Bitlocker with Bitwarden

A roadmap to Pipi 10

Mike's Notes

Pipi 10 will run on BoxLang in production.

I sent draft notes to Ortus Solutions yesterday to discuss future use of BoxLang. I then edited the notes and shared them with the growing Pipi community. I will add the answers as more is discovered about what needs to be done to make it possible for Pipi 10 to use BoxLang.

Training is available on BoxLang Academy.

Can you spot any errors in my assumptions? Do you have other ideas or queries?

Contact me.

Update 04/06/2024, 05/06/2025

Cristóbal Escobar Henríquez from Ortus Solutions provided excellent answers to the questions sent via email. These answers have been added to the questions at the end of this article, which are slightly different from the original ones (all my fault). Thanks :)

Update 09/06/2025

Luis Majano from Ortus Solutions provided additional answers to my follow-up questions, which I sent by email. They have been added to the post below. Thank you, Luis.

Update 12/06/2025

Luis Majano from Ortus Solutions provided additional answers to my follow-up questions, which I sent by email. They have been added to the post below. Thank you, Luis.

Update 13/06/2025

Luis confirmed that BoxLang cannot use CommandBoc modules. It appears that BoxLang can currently handle 90% of my needs. The only real gap is that Pipi cannot currently autonomously configure BoxLang itself via the command line, which is needed for scaling.

This is sufficient to make a start, with the hope that Ortus will address these issues in the future.

I expect Pipi 10 to be a 12-month build after Pipi 9 is in full production.

Update 14/06/2025

There will be an online meeting with people from Ortus next week to discuss and confirm details regarding the migration plan, paid support, and sponsorship of Ortus' open-source.

Resources

• https://www.blog.ajabbi.com/2025/05/boxlang-100.html
• https://www.blog.ajabbi.com/2024/12/pipi-builld-roadmap.html
• https://www.blog.ajabbi.com/2025/05/a-three-data-centre-model-for-pipi.html
• https://boxlang.io/download#modules
• https://learn.boxlang.io/
• https://ucanaccess.sourceforge.net/site.html
• https://github.com/spannm/ucanaccess
• https://spannm.github.io/ucanaccess/
• https://modern-cfml.ortusbooks.com/intro/intro-to-commandbox
• https://commandbox.ortusbooks.com/developing-for-commandbox/commands
• https://commandbox.ortusbooks.com/developing-for-commandbox/injection-dsl

References

• Reference

Repository

• Home > Ajabbi Research > Library >
• Home > Handbook > 

Last Updated

14/06/2025

A roadmap to Pipi 10

By: Mike Peters

On a Sandy Beach: 21/05/2025

Mike is the inventor and architect of Pipi and the founder of Ajabbi.

Draft roadmap

• This is a draft, so expect it to change
• This roadmap is probably for the next 2-3 years at least
• The finalised plan will be published for the Pipi Community.
• No money is available right now.
• A plan is needed to avoid rework.
• Don't expect Ortus to do work for free.
• Realistic expectations of what is possible.
• Good income will come later from paying customers for solving complex problems.
• Focus on the core by outsourcing other work to experienced contractors.
• Open-source all modules on GitHub.

Ajabbi

• The common name of 
• A company to handle payments
• Non-profit foundation to support users (to be established)
• Research Institute for ongoing development (to be established)
• Description
• Solved a huge, expensive problem with no existing competitors
• Pre-revenue start-up with no $$$
• Growing community
• Purpose
• Act like other foundations (Wikimedia, Apache and Linux) and use the income surplus to support
• Minority languages i18n
• Open-source efforts (especially CFML, including Ortus)
• User groups
• User conferences
• Book publishing
• Open research grants
• Etc

Pipi

• The name of the software
• Mike has been the architect since 1997
• Versions 1-4 were in production eventually with 300K lines of code, an 800-table database, ESRI Web GIS, 500 classes, 3K methods, a 5 FTE team and a 3-rack data centre
• Versions 6-8 were working, non-production, undergoing refactoring
• Version 9 works, moving to production (current)
• Version 10 (planned)

Current Pipi 9

• Works great
• Runs in a dev environment
• Unique architecture with 20+ layers and hundreds of autonomous agents
• Uses nature-inspired algorithms
• Going from headless to a Pipi-generated UI
• Migrating to a 42U server rack completely isolated from the internet.
• Using old Windows server boxes will do for now.
• The CFML code runs on ColdFusion Server 2021 Developer Edition.
• The CFML code could run on ColdFusion MX, Open Blue Dragon, or Lucee. 
• Uses <CF> tags as in Ben Forta, et al. (don't tell Michaela, I don't want to die)
• Uses 300+ embedded config databases (MS Access)
• Uses PostgreSQL for production data
• Writes CFML code and then executes it
• Writes SQL and then executes it to create and populate tables
• Static HTML generator (90K page websites)
• Uses XML, XML Schema, etc, internally
• Mostly self-managing
• Self-documenting
• Currently rendering a 20,000-page static website for developers
• The code base will self-grow 10x larger over time

Planned Pipi 9

• Some money is coming soon
• Generate revenue from niche batch render jobs
• Code generators and the generated code must be rewritten to be BoxLang compatible, so no refactoring by Ortus is required.
• Pipi 9 will create Pipi 10
• Pipi 10 to be BoxLang native
• BoxLang (+++++++) paid support
• Pipi 10 to become geodatabase capable
• BoxLang will enable the future use of Python, PHP, etc

Planned Pipi 10 Systems

• Render System
• Functions as an automated AI-assisted development environment
• Isolated from the internet
• Uses VM
• Run on BoxLang installed on Windows on new 64 hardware
• JDK 21+
• Ortus to supply a ready-to-run VM image.
• 100% self-managing via CommandBox dynamic CFML scripts
• Renders working enterprise system modules (database, code, UI, API, user documentation)
• MS SQL edition
• MySQL edition
• Oracle edition
• PostgreSQL edition
• Exports modules to the Staging System via manual hard drive transfers
• Staging System
• Connected to the internet
• Uses VM
• Runs on BoxLang installed on Debian
• JDK 21+
• Ortus to manage the BoxLang platform VM on a long-term contract
• Uses PostgreSQL
• Adds i18n to modules
• Creates updates
• Integrates i18n modules into customised enterprise systems for paying customers
• Exports
• Github
• i18n modules to GitHub for open-source
• i18n user documentation
• Cloud
• Customised i18n enterprise systems
• System updates
• Cloud System
• Connected to the internet
• Uses VM
• Runs on BoxLang installed on Debian
• JDK 21+
• Ortus to manage the BoxLang platform VM on a long-term contract
• VM hosted
• AWS
• Azure
• Digital Ocean
• GCP
• IBM
• etc
• private cloud.
• The customer chooses their production RDMS database(s) for their data.
• MS SQL
• MySQL
• Oracle
• PostgreSQL

Questions for Ortus Solutions

Answered by Cristóbal Escobar Henríquez, and Luis Majano.

• Is a list of supported (or not supported) CFML tags available?
• Yes! We maintain a detailed inventory of supported tags and functions:
• CFML Tags Compatibility Inventory
• CFML BIFs Compatibility Inventory
• Is <Cf tags> style coding supported?
• Yes, BoxLang fully supports CFML tags when running in CFML compatibility mode. This ensures legacy CFML applications can continue to function with minimal changes.
• Is there a performance hit from using CML compatibility mode?
• There is of course a penalty to pay if you are transpiling on the fly.  It's negligible to the point that we are faster in CFML mode than all Adobe engines even in transpile mode.  However, you can transpile to BX as part of your build process and then this won't exist.
• Does BoxLang use CommandBox modules?
• No.  BoxLang Modules are something new.  Eventually maybe, but for now, no.
• Can BoxLang accept (CFML) command-line modules generated by Pipi without needing to be restarted?
• Yes.
• The ModuleService has the necessary API for you to load modules a-la-carte.  All of our integration testing uses this approach.
• You can also uninstall them
• Will these CF tags become compatible with BoxLang in future?
• cfftp
• This is done in our bx-ftp module
• cfregistry
• This can be sponsored if needed.
• cfschedule
• This is in progress, but can be accelerated by sponsorship
• Could BoxLang use MS Access via JDBC on the isolated Render System, and how much would it cost to create a module to do this?
• We can enable MS Access integration by building a custom module using the UCanAccess JDBC driver.
• Estimated time: 10–15 hours (2–3 business days)
• Note: This estimate covers driver integration only and does not guarantee full MS Access compatibility. As an alternative, we recommend migrating the database to SQLite, Derby, or MySQL for improved stability and long-term support.
• What kinds of modules can be developed by Ortus?
• Ortus can develop any module you need, whether it's for BoxLang, application features, integrations, or infrastructure. We tailor modules to your requirements, from core language enhancements to platform-level tools.
• What is the cost for Ortus to provide dedicated platform support?
• We offer dedicated platform support through our BoxLang+ and BoxLang++ plans, which include guaranteed response times, SLAs, priority bug handling, and access to our core engineering team.
• You can review the full details and pricing here: https://boxlang.io/plans
• We’d be happy to tailor a plan based on your service level and usage expectations.
• Can patched VM images be supplied?
• Yes, we can provide patched VM images as part of a BoxLang++ subscription. If you're not on a ++ tier, this can still be delivered through a separate consulting plan.
• What about the time zone differences between New Zealand, the US, and Spain?
• Our team operates mainly on Central Standard Time, but we can easily align with your schedule. If needed, we can also assign a developer located in the EU (CET) for better time zone overlap.
• Would a 100% dedicated Ortus developer be possible in the future?
• Yes, we offer team augmentation services, including assigning a dedicated developer to your project. We can adapt the engagement based on scope, timeline, and availability.
• Is a 24/7/365 platform supported by Ortus possible in the future?
• Yes, that’s absolutely possible. We can support a 24/7/365 production environment using our teams in El Salvador and Spain. This would require a custom service agreement or license tier beyond the standard BoxLang offerings, but we’re happy to scope and price this accordingly based on your needs in the future.

Questions for the Pipi Community

• Would support also be available from independent CFML contractors?
• 
  
• Where is the boundary between community contributions and paid contractors?
• 
  
• What other new BoxLang Modules would be helpful, including other coding languages?
• 
  

On a Sandy Beach, reformat is done - what's next

Mike's Notes

Over the last six weeks, all 381 current posts and 12 pages on the blog have been reformatted. The job took careful manual editing. Grammarly fixed many grammar and spelling errors; broken links and missing photos were relinked.

More changes are planned.

Resources

• https://www.blog.ajabbi.com/2025/05/sandy-beach-is-being-reformated.html
• https://www.blog.ajabbi.com/2025/04/on-sandy-beach-metadata.html
• https://wiki.ajabbi.com/eng/9/algorithm-engine.html

References

• Reference

Repository

• Home > Ajabbi Research > Library >
• Home > Handbook > 

Last Updated

21/05/2025

On a Sandy Beach, reformat is done - what's next

By: Mike Peters

On a Sandy Beach: 21/05/2025

Mike is the inventor and architect of Pipi and the founder of Ajabbi.

The first stage of fixing this blog is complete.

What's Next

A blogging module needs to be built and added to Pipi 9 CMS. This could then be used to create blog posts using an underlying database, which could be modified to be more useful.

Data Model version 1 (current)

• Mike's Note
• Resources
• References
• Repository links
• Date Updated
• Title
• Page Url
• Author
• Source publication
• Date Created
• Author description
• Body of the article
• Tags
• Comments

Data Model version 2 (next)

• Title
• Page Url
• Site-wide Navigation
• Site-wide Breadcrumb
• Mike's Note
• Author
• Source publication
• Date Created
• Author description
• Body of the article
• References
• Further Reading (replacing References)
• Articles
• See Also (cross links to Ajabbi.com website pages, replacing Repository URL)
• External Links (replacing Resources)
• Keywords (replacing Tags)
• Sharing
• Updated
• Forum (replacing Comments)

Website consistency

The second format is similar to that used on the rest of Ajabbi.com and would enable greater integration. It will also require On a Sandy Beach to be directly published and hosted by Pipi CMS.

Blog URLs

Keep the current URL structure for each page and post. For example.

• https://www.blog.ajabbi.com/2025/05/boxlang-vs-world-by-kai-koenig.html
• https://www.blog.ajabbi.com/p/pipi.html

Ajabbi Research integration

This blog is Mike's working notes about building Pipi. The notes are written for Mike to remember what he has done and where to find references, but he is happy to share them with anyone interested. Many notes raise issues to solve or refer to external research results and differing opinions. The planned Ajabbi Research could use all this written material to provide a starting point. These are some problems to work on, not the answers.

Other voices

Making these changes will enable other authors at Ajabbi Research to blog and encourage the rapid, free, robust, open exchange and experimental testing of ideas. Any occurrence of Cancel Culture will be ruthlessly exterminated.

Data Model version 3 (later)

• Title
• Page Url
• Site-wide Navigation
• Site-wide Breadcrumb
• Notes (by Mike and others at Ajabbi Research)
• Author
• Source publication
• Date Created
• Author description
• Body of the article
• Experimental Results
• References
• Further Reading (replacing References)
• Articles
• See Also (cross links to Ajabbi.com website pages, replacing Repository URL)
• External Links (replacing Resources)
• Keywords (replacing Tags)
• Sharing
• Updated
• Forum (replacing Comments)

The Oracle’s Curse: Mathematical Models in Modern Society

Mike's Notes

This article asks some hard questions about the use of mathematical models.

Resources

• https://www.fairobserver.com/world-news/the-oracles-curse-mathematical-models-in-modern-society/
• https://www.amazon.com/Escape-Model-Land-Mathematical-Models/dp/1541600983
• https://sites.ualberta.ca/~dwiens/stat575/misc%20resources/regression%20to%20the%20mean.pdf
• https://www.britannica.com/science/Brownian-motion
• https://www.investopedia.com/terms/b/blackscholes.asp
• https://rize.io/blog/quantified-self
• https://royalsocietypublishing.org/doi/10.1098/rsos.230803
• https://today.usc.edu/fukushima-disaster-was-preventable-new-study-finds/
• https://pmc.ncbi.nlm.nih.gov/articles/PMC7351545/
• https://www.pnas.org/doi/10.1073/pnas.0912953109
• https://www.journalofaccountancy.com/issues/2002/apr/theriseandfallofenron/
• https://www.britannica.com/topic/black-swan-event
• https://thedecisionlab.com/biases/confirmation-bias
• https://thedecisionlab.com/biases/availability-heuristic
• https://intellectualtakeout.org/2015/07/wendell-berrys-unsettling-description-of-modern-life/
• https://www.britannica.com/topic/negative-externality

References

• Reference

Repository

• Home > Ajabbi Research > Library >
• Home > Handbook > 

Last Updated

23/05/2025

The Oracle’s Curse: Mathematical Models in Modern Society

By: Usama Malik

Fair Observer: 18/05/2025

Mathematical models help us understand complex systems. However, our overreliance on them — treating them as objective oracles rather than imperfect abstractions — has created disaster, ethical blind spots and social harm. We must rethink our relationship with models by embracing uncertainty, incorporating diverse human values and grounding decision-making in ethical reflection.

In an age dominated by data and algorithms, mathematical models have become the oracles of our time. From predicting weather patterns to forecasting economic trends, these complex mathematical constructs have infiltrated nearly every aspect of our lives. However, as we increasingly rely on these models to shape policy, guide business decisions and inform public discourse, we must confront a crucial question: Have we placed too much faith in these modern-day prophets?

The rise of Model Land

The journey into what statistician Erica Thompson calls “Model Land” began innocuously enough. The late 19th and early 20th centuries saw the emergence of statistical methods that promised to bring order to chaos, to discern patterns in the noise of reality. Polymath Francis Galton’s concept of regression to the mean and Albert Einstein’s work on Brownian motion laid the groundwork for a new way of understanding the world through mathematics.

As computational power grew exponentially in the latter half of the 20th century, so did the complexity and pervasiveness of mathematical models. Weather prediction, economic forecasting and financial risk assessment became increasingly reliant on these sophisticated tools. By the dawn of the 21st century, we found ourselves deep in the heart of Model Land, a place where reality is simplified, quantified and projected onto screens and balance sheets.

The infiltration of models

The allure of mathematical models lies in their promise of objectivity and precision. In politics, economic models began to shape policy decisions, offering a veneer of scientific rigor to inherently complex social issues. In science, models became central to disciplines ranging from climate studies to particle physics, often determining the direction of research and the allocation of resources.

In the realm of finance, models like the Black–Scholes equation transformed the way we understand and trade risk. These models didn’t just describe the financial world; they began to shape it, creating a feedback loop where the map increasingly became the territory.

Culture and society, too, felt the influence of this modeling revolution. Social media algorithms, built on complex models of human behavior and interaction, began to shape our digital landscapes and, by extension, our perceptions of reality. The “quantified self” movement encouraged individuals to model their own lives, reducing the richness of human experience to a series of data points and trends.

The peril of models as oracles

As our reliance on models grew, so did our tendency to treat them as oracles rather than tools. This shift from model-assisted to model-driven decision-making brought with it significant perils, many of which we are only now beginning to fully appreciate.

Thompson’s concept of Model Land provides a powerful framework for understanding these dangers. In Model Land, the complexities and uncertainties of the real world are stripped away, replaced by a set of equations and assumptions that, while internally consistent, may bear little resemblance to reality.

The danger lies not in the use of models themselves, but in our forgetting that we are operating in Model Land rather than the real world. As Thompson argues, we have become too comfortable in this abstracted space, often treating model outputs as infallible truths rather than simplified approximations or scenarios.

The great model failures

History is replete with examples of model failures, each serving as a stark reminder of the dangers of overreliance on these mathematical constructs. Below are a few examples of “models as oracles,” used across various domains, leading to catastrophic outcomes:

• The 2008 Financial Crisis: Complex financial models failed to account for the systemic risks that led to the near collapse of the global financial system.
• Covid-19 Pandemic: Early epidemiological models produced wildly varying predictions, leading to confusion and mistrust in scientific modeling.
• Fukushima Daiichi Nuclear Disaster (2011): Risk assessment models underestimated the potential impact of a tsunami on the nuclear power plant.
• Boeing 737 MAX Crashes (2018–2019): Flight control system models failed to accurately predict how pilots would respond to malfunctions, contributing to two fatal crashes.
• Robert Moses’s Urban Planning in New York (1930s–1960s): Traffic models used to justify massive highway projects failed to account for induced demand, leading to increased congestion and urban sprawl.
• Green Revolution Unintended Consequences: Models promoting the widespread adoption of high-yield crops and intensive farming methods failed to predict long-term soil degradation and loss of biodiversity.
• Enron Scandal (2001): Complex financial models were used to hide losses and inflate profits, leading to one of the largest corporate bankruptcies in history.

These failures underscore what statistician Nassim Nicholas Taleb calls the “Black Swan” problem — the tendency of models to underestimate the impact of rare, high-consequence events. They also highlight the dangers of overreliance on models that often fail to capture the full complexity of the systems they attempt to represent.

Moreover, these examples demonstrate that model failures are not isolated incidents but a pervasive issue across many fields and industries. They serve as a powerful reminder of the need for a more nuanced, critical approach to modeling that acknowledges the limitations of our ability to predict and control complex systems.

The human factor: behavioral economics and model bias

The story of models is incomplete without considering the human factor. Behavioral economics, pioneered by researchers like Daniel Kahneman and Amos Tversky, reveals the myriad ways in which human cognition deviates from the rational ideal assumed by many models.

Our cognitive biases — from confirmation bias to the availability heuristic — don’t just affect how we interpret model outputs; they shape the very construction of the models themselves. Modelers, being human, bring their own biases and assumptions to their work, often unconsciously.

Moreover, once a model gains acceptance, it can create a self-reinforcing cycle of belief. The model’s predictions shape decisions and behaviors, which in turn generate data that seems to confirm the model’s validity. This feedback loop can lead to a dangerous form of groupthink, where alternative viewpoints are dismissed and the model’s authority goes unchallenged.

The amoral nature of model land

While the technical limitations of models have been widely discussed, there’s a more profound and often overlooked issue at the heart of our reliance on mathematical modeling: the fundamentally amoral nature of Model Land. This abstracted realm, where complex realities are reduced to equations and data points, often fails to capture — or worse, completely ignores — the moral and existential dimensions of the problems it attempts to solve.

The absence of human values

In Model Land, concepts like spirituality, sacredness, love, connection, creativity, well-being and safety — some of the cornerstones of the human experience — are either entirely absent or treated in reductionist, often sophomoric ways. Climate change models, for instance, might accurately predict rising temperatures and sea levels, but they struggle to capture the profound sense of loss and displacement felt by communities forced to relocate. Economic models may project GDP growth, but they often fail to account for the emotional and psychological toll of economic inequality.

This disconnect between Model Land and lived human experience has far-reaching consequences. As models increasingly drive decision-making processes, we risk creating policies and systems that optimize for abstract metrics while neglecting the very human values they’re meant to serve.

The tyranny of quantification

The philosopher-poet Wendell Berry once wrote, “The disease of the modern character is specialization.” In the context of modeling, this disease manifests as an obsession with quantification. Anything that can’t be easily measured or quantified — like the intrinsic value of an ecosystem or the cultural significance of a historical site — often gets left out of the model entirely.

This tyranny of quantification leads to what economists call “negative externalities” — costs or consequences that aren’t captured by the model but are borne by society or the environment. The classic example is pollution: A factory’s production model might show increased efficiency and profit but fail to account for the long-term health impacts on the surrounding community or the degradation of local ecosystems.

Moral abdication in the face of complexity

Perhaps most troublingly, the complexity and perceived objectivity of models can lead to a kind of moral abdication. Decision-makers may defer to model outputs rather than grappling with the difficult ethical questions that underlie many of our most pressing challenges. The use of predictive policing algorithms provides a stark example: Models predicting crime hotspots can inadvertently shift the discourse from one of addressing systemic social issues and racial bias (“How can we create a more just society?”) to one of resource allocation and efficiency (“Where should we deploy police to maximize arrests?”). This shift is subtle but profound. It moves us from the realm of values, ethics and collective responsibility to one of amoral calculation. In doing so, it can paralyze meaningful reform, as we endlessly debate the accuracy of predictive models rather than confronting the moral urgency of addressing the root causes of crime and social inequality.

The human cost of model-driven decisions

The consequences of this model-centric, amoral approach to decision-making are not merely theoretical. They play out in the lived experiences of individuals and communities around the world:

• Urban Development: City planning models that prioritize efficiency and economic growth may lead to gentrification and the displacement of long-standing communities, ignoring the human cost of lost social networks and cultural heritage.
• Healthcare: Models used to allocate medical resources may optimize for overall population health but fail to account for individual suffering or the moral imperative to care for the most vulnerable.
• Environmental Policy: Cost-benefit analyses of environmental regulations often struggle to quantify the true value of biodiversity, clean air or the mental health benefits of access to nature.
• Education: Performance models in education may drive policies that increase test scores but neglect the development of creativity, critical thinking and emotional intelligence.

In each of these illustrative cases, the limitations of Model Land collide with the complex, value-laden realities of human experience, often with devastating consequences for individuals and communities.

Towards a new relationship with models

Given these challenges, how can we forge a healthier relationship with mathematical models? Thompson and other critics offer several key recommendations:

1. Transparency and interpretability: Models should be as transparent as possible, with their assumptions, limitations and potential biases clearly communicated.
2. Embracing uncertainty: We must learn to be comfortable with uncertainty, treating model outputs as possibilities rather than prophecies.
3. Holistic metrics: Expand our definition of “optimization” to include metrics of well-being, social cohesion and ecological health alongside traditional economic measures.
4. Diverse perspectives: The development and interpretation of models should involve diverse voices, including those from outside the traditional modeling community, including interdisciplinary and participatory modeling, ensuring that local knowledge, stories, values and concerns are represented.
5. Qualitative wisdom: While quantitative models are powerful tools, they should be balanced with qualitative expert judgment and real-world experience.
6. Ethical modeling: Modelers and those who use models must consider the ethical implications of their work, particularly when models influence decisions that affect human lives.
7. Models as tools, not oracles: Perhaps most importantly, we must shift our view of models from oracles to tools — aids to thinking rather than substitutes for thought.

As we navigate the complexities of the 21st century, mathematical models will undoubtedly remain powerful tools for understanding and shaping our world. However, we must resist the temptation to retreat entirely into the amoral abstraction of Model Land. Instead, we must strive to create bridges between our models and the rich, morally complex tapestry of human experience.

By recognizing the limitations of our models, embracing the full spectrum of human values and cultivating a more holistic approach to decision-making, we can harness the power of modeling while remaining grounded in the realities and responsibilities of our shared human condition. In doing so, we may find that our most powerful tool is not the model itself, but our capacity for moral reasoning, empathy and collective wisdom in the face of uncertainty.

As we “escape from Model Land,” in Thompson’s words, we can redefine our relationship with mathematical models, viewing them not as infallible prophets, but as powerful tools in the ongoing human endeavor to understand and shape our world. This new perspective, grounded in humility, ethics and a deep appreciation for the complexity of human experience, may be our best guide as we face the unprecedented challenges of our time.

[Lee Thompson-Kolar edited this piece.]

Are we ready? Understanding just how big solar flares can get

Mike's Notes

I'm gathering information about massive solar flares and their risk to electrical systems, including data centres.

• What are they?
• How often do they happen?
• What risk do they pose?
• How to build robust resiliency into a data centre
• Is a Faraday Cage the answer?

The article below is copied from the excellent Knowable Magazine. A detailed paper about the Carrington Event is included in the resources.

Resources

• https://knowablemagazine.org/content/article/physical-world/2021/understanding-just-how-big-solar-flares-can-get
• https://www.annualreviews.org/content/journals/10.1146/annurev-astro-112420-023324
• https://doi.org/10.1146/annurev-astro-112420-023324
• https://en.wikipedia.org/wiki/Carrington_Event
• https://academic.oup.com/mnras/article/20/1/13/983482
• https://www.nature.com/articles/nature11123
• https://www.nature.com/articles/ncomms2783
• https://www.pnas.org/content/116/13/5961
• https://www.researchsquare.com/article/rs-753272/v1
• https://iopscience.iop.org/article/10.3847/2041-8213/abf14c
• https://iopscience.iop.org/article/10.3847/1538-4357/abc8f5/meta
• https://iopscience.iop.org/article/10.3847/1538-4357/ab6606

References

• Reference

Repository

• Home > Ajabbi Research > Library > Subscriptions > Knowable Magazine
• Home > Handbook > 

Last Updated

19/05/2025

Are we ready? Understanding just how big solar flares can get

By: Christopher Crockett

Knowable Magazine: 17/09/2021

Christopher Crockett is a staff researcher for Knowable and a freelance science writer living in Arlington, Virginia. He is thankful for the sun but wouldn’t want to see it when it’s angry.

On May 1, 2019, the star next door erupted.

In a matter of seconds, Proxima Centauri, the nearest star to our sun, got thousands of times brighter than usual — up to 14,000 times brighter in the ultraviolet range of the spectrum. The radiation burst was strong enough to split any water molecules that might exist on the temperate, Earth-sized planet orbiting that star; repeated blasts of that magnitude might have stripped the planet of any atmosphere.

It would be bad news if the Earth’s sun ever got so angry.

But the sun does have its moments — most famously, in the predawn hours of September 2, 1859. At that time, a brilliant aurora lit up the planet, appearing as far south as Havana. Folks in Missouri could read by its light, while miners sleeping outdoors in the Rocky Mountains woke up and, thinking it was dawn, started making breakfast. “The whole of the northern hemisphere was as light as though the sun had set an hour before,” the Times of London reported a few days later.

Meanwhile, telegraph networks went haywire. Sparks flew from equipment — some of which caught on fire — and operators in Boston and Portland, Maine, yanked telegraph cables from batteries but kept transmitting, powered by the electrical energy surging through the Earth.

The events of that Friday evoked biblical descriptions. “The hands of angels shifted the glorious scenery of the heavens,” reported the Cincinnati Daily Commercial. The actual impetus was a bit more prosaic: The skies had been set ablaze by an enormous blob of electrically charged gas, shot out from the sun following a flash of light known as a solar flare.

Space weather encapsulates the prevailing conditions in the solar system caused by the solar wind and the sun’s far-reaching magnetic field. Sudden changes on the sun, such as flares and eruptions of material, are like weather fronts, bringing with them magnetic “storms” that can be felt on the planets. On Earth, this can cause stunning auroras, but it can also create havoc with electronics. The flash of light from a flare takes about 8 minutes to reach Earth; solar material expelled from the sun in a coronal mass ejection (CME) may take hours to days to travel the distance. Magnetic storms may be brief or last for many days.

Such a blob — a tangle of plasma and magnetic fields — is known as a coronal mass ejection. Upon arrival at Earth, such an ejection can trigger the most ferocious of geomagnetic storms. The 1859 storm, named the Carrington Event for the scientist who witnessed the flare that preceded it, has long been upheld as the most powerful wallop that the sun has ever delivered.

But in recent years, research has indicated that the Carrington Event was just a taste of what the sun can throw at us. Tree rings and ice cores encode echoes of dramatically stronger solar storms in the distant past. And other stars, such as Proxima Centauri, show that even the most energetic documented solar outbursts pale in comparison with what is possible.

Nevertheless, the Carrington Event offers important clues to what the sun might have in store for Earth in the future, solar physicist Hugh Hudson writes in the 2021 Annual Review of Astronomy and Astrophysics. “Danger lurks for humanity’s technological assets, especially those in space,” writes Hudson, of the University of Glasgow. In the wake of a Carrington-like event today, entire power grids could shut down and GPS satellites could be knocked offline.

Understanding just how severe solar storms can be provides insights into what the universe may sling our way — and maybe how to foretell the next one so that we’re better prepared when it happens.

Anatomy of a flare

Roughly 18 hours before the 1859 event brightened Earth’s skies, an English astronomer noticed something strange on the surface of the sun.

While working in his observatory, Richard Carrington saw two brilliant points of light emerge from among a clutch of dark sunspots and vanish within five minutes. Another English astronomer, Richard Hodgson, saw the same thing, noting that it was as if the brilliant star Vega had appeared on the sun. At the same time, compass-like needles at England’s Kew Observatory twitched, a hint of the magnetic storm about to ensue.

Before then, no one knew about solar flares — mostly because no one was tracking sunspots every clear day the way Carrington was. Decades would pass before astronomers and physicists could unravel the physics of solar flares and their impact on Earth.

In 1859, English astronomer Richard Carrington was making this sketch of sunspots (left), when he saw two beads of light emerge from the large cluster of spots near the top. Carrington drew the first appearance of the flare as two bean-shaped regions nestled in among the spots (labeled A and B in close-up at right). Five minutes later, the two white spots had drifted to the right and faded considerably (marked C and D).

CREDIT: S. PROSSER, OXFORD UNIVERSITY PRESS 2018 (LEFT) / RICHARD CARRINGTON, PUBLIC DOMAIN (RIGHT)

A solar flare is an eruption on the sun, a sudden flash of light — usually near a sunspot — that can release as much energy as roughly 10 billion 1-megaton nuclear bombs. The trigger is a sudden, localized release of pent-up magnetic energy that blasts out radiation across the entire electromagnetic spectrum, from radio waves to gamma rays.

Many solar flares, though not all, are accompanied by a coronal mass ejection, a massive chunk of the sun’s hot gas blown into space along with a tangle of magnetic fields. Billions of tons of sun stuff can billow out into the solar system, crossing the 150 million kilometers to Earth’s orbit in anywhere from about 14 hours to a few days. 

Most solar eruptions miss our planet by a wide margin. But occasionally, one gets aimed right at Earth. And that’s when things can get interesting.

About eight minutes after a solar flare, its light reaches Earth in a flash of visible light. That’s also when a spike in ultraviolet light and X-rays sprays the upper atmosphere, causing a slight magnetic disturbance at the surface. That was the twitch the magnetic instruments at the Kew sensed in 1859.

The coronal mass ejection can trigger a geomagnetic storm when it encounters the magnetic field that envelops Earth. The disturbance to the magnetic field induces electrical currents to course through conductors, including wires and even the planet itself. At the same time, high-speed charged particles spewed by the sun crash into atoms in the upper atmosphere, lighting up the aurora.

On September 6, 2017, the sun emitted a powerful X-class solar flare — a designation reserved for the most intense flares. Seen here in ultraviolet light captured by NASA’s orbiting Solar Dynamics Observatory, the flare was one of the strongest seen in years and came amid a spate of solar eruptions that month. The glowing threads are scorching filaments of plasma ensnared by magnetic fields arcing over the sun’s surface.

CREDIT: NASA / GSFC / SDO

The 1859 flare has long been, and remains, a standout in its energy and effects on Earth. Comparably powerful solar eruptions are often referred to as “Carrington events.” But it does not stand alone.

“It’s oftentimes described as the most intense storm ever recorded,” says Jeffrey Love, a geophysicist at the US Geological Survey in Denver. “That’s possibly not exactly true, but it certainly is one of the two most intense storms.” Or three or four.

In May 1921, the sun dealt our planet a geomagnetic storm on par with the Carrington Event. As in 1859, a brilliant aurora appeared well beyond the polar regions. Telegraph and telephone systems broke down, with some sparking destructive fires.

And just 13 years after Carrington spied his eponymous flare, another solar storm came along that by some measures may have topped it. “It looks now, based on aurora and sparse magnetometer measurements, that an event in 1872 was probably larger than the Carrington Event,” says Ed Cliver, a solar physicist retired from the US Air Force.

These storms show that the Carrington Event wasn’t a “black swan,” Hudson says. If anything, the sun has been holding back in the modern era. Evidence from the more distant past points to a few solar storms that make the Carrington Event seem almost puny by comparison.

Forgotten flares

Trees have long memories. Each year of growth chronicles tidbits about environmental conditions at the time in concentric annual rings. From those rings researchers can reconstruct scenes from Earth’s past.

Some cedar trees in Japan recall a tsunami of atomic particles hurled from the sun around the year 775. Those trees recorded a significant uptick in carbon-14, a radioactive variant of carbon that trees absorb from the atmosphere. Carbon-14 emerges from run-ins between atmospheric nitrogen and cosmic rays — high-speed particles from space that pummel our planet daily. Some solar flares shower Earth with an excess of cosmic rays, which ramps up production of carbon-14. The change in carbon-14 levels recorded in 775 was about 20 times larger than the normal ebb and flow from the sun, researchers reported in 2012.

“The clear suggestion there was that super events could happen, because this was a factor of 10 — if it was a solar flare — a factor of 10 or 20 or more greater than the Carrington Event,” Hudson says.

In the early hours of March 1, 2011, a ripple in the solar wind whacked Earth’s magnetic field and triggered a minor geomagnetic storm, causing the ethereal aurora seen here over the Poker Flat Research Range in Alaska.

CREDIT: NASA / GSFC / JAMES SPANN

A carbon-14 boost in tree rings showed signs of another sizable solar event in 994. Ice cores from Antarctica showed a corresponding increase, in both 994 and 775, of beryllium-10, another product of cosmic rays — adding more certainty to the tree ring findings.

Looking farther back in time, a study of ice cores suggests a third similar event around 660 BCE. And in August (in a paper still undergoing peer review), researchers reported two more carbon-14 spikes in tree rings from around 7176 BCE and 5259 BCE, possibly on par with the 775 event.

It’s hard to directly compare these past storms with the Carrington Event, says Ilya Usoskin, a space physicist at the University of Oulu in Finland and a coauthor of the August study. The 1859 flare did not produce a particle downpour on Earth, so there are no carbon-14 counts to compare. But the 775 event appears to be one of the strongest solar particle storms recorded in the last 12,000 years, Usoskin says.

There is a catch, Hudson notes. Tree rings are laid down annually, so a few smaller flares within the span of several months might appear as one big event in the tree ring record.

But even then, any one of these smaller flares may still have been impressive. “Every one of those events would be at least on the order of three times as big as the Carrington Event in terms of its energy,” Cliver says.

That, however, is still modest compared with some other stars in our galaxy.

Super flares

If life does exist on the planet orbiting Proxima Centauri, it probably has a rough go of it.

“You really are looking at having something like a Carrington Event happening daily,” says Meredith MacGregor, an astrophysicist at the University of Colorado Boulder. Even stronger “super flares,” like the one she and colleagues spotted in 2019, may go off roughly every other day. Her team spotted that flare, possibly 100 times as powerful as the Carrington Event, after watching the star next door for just 40 hours.

With a near-constant barrage of flares, any atmosphere clinging to the rocky planet snuggled up close to the star would never have time to recover. “Yes, a Carrington Event [on Earth] would fry some electronics and would ruin GPS signals,” MacGregor says, “but it’s not going to destroy the habitability of our planet.”

The star Proxima Centauri and its neighboring duo of Alpha Centauri A and B are the closest stars to the sun, lying a mere 4.2 light-years away. Proxima, the nearest of the trio, is a dim red orb with frequent, powerful flares that buffet the Earth-mass planet that orbits close to it. 

CREDIT: DIGITIZED SKY SURVEY 2. ACKNOWLEDGEMENT: DAVIDE DE MARTIN / MAHDI ZAMANI

To be clear, Proxima Centauri is not like the sun. It’s an M dwarf, a diminutive orb that glows red. And these tiny stars are famous for their oversized flares. But some sunlike stars can send up super flares as well.

This realization has come from telescopes in space designed to look for planets around other stars. NASA’s now-defunct Kepler telescope did this by looking for subtle dips in starlight as planets crossed in front of their suns.

Over four years, Kepler recorded 26 super flares — up to about 100 times as energetic as the Carrington Event — on 15 sunlike stars, researchers reported in January. NASA’s ongoing TESS mission, another space-based telescope hunting for exoplanets, found a similar frequency of superflares on sunlike stars in its first year of operation.

The Kepler data imply that sunlike stars experience the most powerful of these flares roughly once every 6,000 years. Our sun’s most powerful eruption in that time span is an order of magnitude weaker — but could a super flare be in our future?

“I don’t think any theory has sufficient predictive capability to mean anything,” Hudson says. “The leading theory basically says that the bigger the sunspot, the greater the flare.” Sunspots mark where the sun’s magnetic field punches through its surface, preventing hot gas from bubbling up from below. The spot looks dark because it’s cooler than everything around it.

And that is one difference between the sun and its eruptive neighbors. Super flares seem to happen on stars with cool, dark spots far larger than ever appear on the sun. “Based on known spot areas, there would therefore be a limit,” Hudson says.

The intricacies of any star’s magnetic machinations — spots, flares, etc. — are still poorly understood, so tying all these observations into one cohesive story will take time. But the quest to understand all this might improve predictions about what to expect from the sun in the future.

Flares that are powerful enough to disrupt our power grid probably occur, on average, a few times a century, Love says. “Looking at 1859 kind of helps put it in perspective, because what’s happened in the space-age era, since 1957, has been more modest.” The sun hasn’t aimed a Carrington-like flare at us in quite a while. A repeat of 1859 in the 21st century could be disastrous.

Humanity is far more technologically dependent than it was in 1859. A Carrington-like event today could wreak havoc on power grids, satellites and wireless communication. In 1972, a solar flare knocked out long-distance telephone lines in Illinois, for example. In 1989, a flare blacked out most of Quebec province, cutting power to roughly 6 million people for up to nine hours. In 2005, a solar storm disrupted GPS satellites for 10 minutes.

The best prevention is prediction. Knowing that a coronal mass ejection is on its way could give operators time to safely reconfigure or shut down equipment to prevent it from being destroyed.

Building in extra resiliency could help as well. For the power grid, that could include adding in redundancy or devices that can drain off excess charge. Federal agencies could have a stock of mobile power transformers standing by, ready to deploy to areas where existing transformers — which have been known to melt in previous solar storms — have been knocked out. In space, satellites could be put into a safe mode while they wait out the storm.

The Carrington Event was not a one-off. It was just a sample of what the sun can do. If research into past solar flares has taught us anything, it’s that humanity shouldn’t be wondering if a similar solar storm could happen again. All we can wonder is when.