Quantum Observer #4 - The Quantum PC Moment Is Here (And China Shipped the OS First)
Quantum computing's modular revolution, new RSA-breaking research, the ECC debate, Google's HTTPS gambit, PQC migration reality, and a fresh scam to avoid
In this edition: I’m back after a pause - apologies and thank you for the messages asking when the next edition would arrive. A lot has happened since November. Today’s lead story is one I think most people have missed entirely: the quantum computing industry is quietly entering its “PC moment,” with modular, open-architecture systems replacing sealed black boxes - and China just released the world’s first freely downloadable quantum operating system. I also share highlights from my discussion with QuantWare’s CEO about their plan to reach 10,000 qubits by 2028 using a radical 3D chiplet architecture. We cover the Pinnacle architecture’s dramatic claim about breaking RSA-2048 with only ~100,000 physical qubits, the surprisingly nuanced debate about ECC falling before RSA, Google’s Merkle Tree approach to quantum-proofing HTTPS (which is not what many think it is), why PQC migration turned out to be a 120,000-task monster that became my most-read article ever, and a new snake-oil vendor claiming they’ve cracked RSA-4096. Plus: free quantum security webinars and a new SANS course.
A Note on the Return (and the New Format)
First things first: I owe you an apology. The Quantum Observer went quiet after edition #3 in November, and many of you reached out asking what happened. The honest answer is that I was dealing with some personal matters that took me away from work for a while. When I came back, the volume of news on PostQuantum.com had grown to a point where the newsletter drew the short straw. That was a mistake - I’ve heard from enough of you to know it matters.
So we’re back. But with a small format change: I’m dropping the strict weekly cadence. Instead, expect one or two editions per week - sometimes one focused on quantum computing developments, another on quantum security. And if major news breaks, I’ll cover it in a special edition. Quality over calendar.
Now, let’s get into it. And I want to start with something I believe is one of the most underappreciated stories in quantum computing right now.
The Story Most People Missed: Quantum Computing’s “PC Moment”
In 1981, IBM released the IBM PC. The machine itself was unremarkable. What made it revolutionary was what it wasn’t: a sealed, proprietary box that only IBM could build or extend. By publishing the architecture and using off-the-shelf components, IBM inadvertently created an entire industry. Within years, hundreds of companies were building IBM-compatible PCs from interchangeable parts. The personal computer revolution wasn’t about any single machine - it was about the moment computing moved from vertical integration to an open, modular ecosystem.
Something remarkably similar is happening in quantum computing right now, and almost nobody is talking about it.
From Black Boxes to Building Blocks
For most of its commercial existence, a quantum computer has been something you bought as a complete, sealed system from a single vendor - IBM, Google, IonQ, Quantinuum. Qubits, control electronics, cryogenics, software stack, cloud interface - all from one source. This vertical integration made sense early on, just as it made sense for DEC to sell complete minicomputers.
But the economics and geopolitics of quantum computing are pushing the industry toward a fundamentally different model. In my deep dive on Quantum Open Architecture, I traced how this transition is unfolding across six converging drivers: the sheer technical complexity of building every layer in-house, the economics of specialization, the speed advantages of modular innovation, the need for customization across different use cases, the geopolitical imperative of quantum sovereignty, and the growing community push for democratized access.
The results are already visible. Last year, the University of Naples Federico II assembled Italy’s largest quantum computer by sourcing a Dutch-made quantum processor, pairing it with third-party control electronics, and integrating the whole system in-house. The Israeli Quantum Computing Center built an open facility from best-of-breed components. The Netherlands’ Tuna-5 project did the same. In late 2025, a coalition in Colorado announced the first QOA-based quantum computer in the U.S., integrating components from QuantWare, Qblox, Q-CTRL, and Maybell Quantum into a cloud-accessible platform. These aren’t science projects - they’re the first “PC clones” of the quantum era.
The “Intel of Quantum” and the Hardware Scaling Problem
To understand what’s driving QOA, it helps to talk to someone who’s building the components. I recently sat down with Matt Rijlaarsdam, CEO of QuantWare - the Dutch startup that supplied the quantum processor for the Naples system - for an in-depth discussion about the modular revolution. Rijlaarsdam’s framing is blunt: QuantWare wants to be the Intel of quantum computing. The company doesn’t build complete quantum computers - it designs and fabricates superconducting quantum processors and sells them to anyone who wants to build one. They now ship QPUs and components to customers in over 22 countries, and the customer base has shifted from predominantly academic to majority commercial.
The Intel analogy is more than marketing. As devices get exponentially more complex, no single organization can afford to be world-class at every layer of the stack. By focusing narrowly on processors and selling at volume, QuantWare drives down unit costs through the same amortization logic that made Intel dominant - higher volume, lower costs, better yield, more customers, in a virtuous cycle that mirrors exactly how the semiconductor industry matured.
But the most technically fascinating part of our conversation was about QuantWare’s VIO-40K architecture - their plan to reach 10,000 qubits by 2028. The core insight is that today’s superconducting chips have an I/O bottleneck: as much as 90% of chip area gets consumed by wiring and routing infrastructure, leaving only about 10% for the qubits themselves. Beyond a few hundred qubits, you simply can’t snake all the control lines across a 2D plane without causing interference. QuantWare’s solution goes vertical - a 3D stack of chiplets that delivers control signals from above rather than sprawling outward across the chip surface. The design supports up to 40,000 I/O connections, theoretically enabling 10,000 qubits with about four lines each. And counterintuitively, Rijlaarsdam argues that fidelity could actually improve in the vertical architecture because signals are better shielded in the 3D channels than in a crowded planar layout.
To be clear: 10,000 physical qubits in 2028 would not break RSA or trigger Q-Day. Rijlaarsdam himself estimates such a device would yield on the order of 10 to 100 logical qubits - modest but enormously valuable as the first platforms for real fault-tolerant computation. The full interview covers the scaling economics, the geopolitics of quantum sovereignty, QuantWare’s upcoming KiloFab (Europe’s first dedicated quantum chip factory), and why he thinks the key problems are solved and what remains is mostly engineering. Read the full discussion here.
But There’s a Missing Piece - And China Just Filled It
Here’s where it gets interesting, and where the story gets uncomfortable for Western observers.
Every PC clone needed an operating system. You could assemble a motherboard, a CPU, RAM, and a hard drive from different vendors, but without an OS to tie them together, you had an expensive paperweight. The PC revolution didn’t truly ignite until software - first CP/M, then DOS, then Windows - provided the integration layer that made the hardware ecosystem work.
The quantum open-architecture movement has exactly the same problem. You can buy a quantum processor from one company, control electronics from another, and cryogenic systems from a third. But who provides the software layer that makes them all work together? Who handles the calibration, the error mitigation, the job scheduling, the classical-quantum orchestration? This is what I call platform-level quantum systems integration - assembling a working quantum computer from modular components - and it’s distinct from enterprise-level integration, which is about connecting a quantum computer into existing HPC, cloud, and IT environments. Both are essential; neither is solved. I examined the full picture in my article on Quantum Systems Integration - and at the platform level, the answer until this week was essentially “nobody, you figure it out yourself.”
This week, China’s Origin Quantum made the world’s first quantum operating system freely available for download. Origin Pilot isn’t a programming framework like Qiskit or Cirq - it’s a full systems integration layer. It handles hardware abstraction across multiple qubit types, provides calibration and error mitigation, manages job scheduling, and orchestrates the classical-quantum boundary. It’s the missing piece that turns a collection of quantum components into a working quantum computer.
As I analyzed in my detailed assessment of Origin Pilot and China’s quantum OS strategy, this move isn’t competing with Qiskit. It’s competing with the absence of any Western equivalent - and that’s a much bigger problem. The Western quantum ecosystem has no freely available, hardware-agnostic systems integration layer. Every open-source framework (Qiskit, Cirq, PennyLane) operates at the SDK/application level, assuming someone else has already solved the messy integration work underneath. Nobody has.
Why This Matters for You
The DeepSeek parallel is real - and the stakes may be higher. Just as China’s release of competitive open-source AI models reshaped assumptions about the AI race, Origin Pilot’s free release could reshape the quantum computing landscape. Countries pursuing quantum sovereignty now have a ready-made integration layer to build upon. And if that layer is free and Chinese-built, the ecosystem that grows around it will naturally tend toward Chinese standards and interfaces.
The Western quantum industry isn’t asleep - companies like Qblox, Zurich Instruments, and Quantinuum are building excellent components, and as the QuantWare interview shows, the hardware side of QOA is advancing rapidly. But nobody is building the equivalent of DOS for quantum computing. In the PC revolution, the company that controlled the OS eventually captured more value than any hardware maker.
The quantum industry’s architecture is being defined right now. If you’re not paying attention to QOA and quantum systems integration, I’d strongly recommend the full QOA analysis, the QuantWare CEO discussion, and the Origin Pilot deep dive.
Pinnacle Architecture: 100,000 Qubits to Break RSA-2048 - But Read the Fine Print
A new paper from Iceberg Quantum introduced the “Pinnacle” architecture, claiming that RSA-2048 could be broken with approximately 100,000 physical qubits - a dramatic reduction from the millions typically cited. The key innovation is aggressive use of quantum low-density parity-check (qLDPC) codes, which encode logical qubits far more efficiently than surface codes.
The reaction was appropriately mixed. Craig Gidney - Google’s top quantum error correction researcher - offered measured criticism of the spacetime volume claims. Scott Aaronson endorsed the direction with caveats.
Here’s what matters for planning: the 100,000-qubit figure didn’t make Q-Day closer. What Pinnacle did is shift the difficulty from one part of the stack to another. The qubit count dropped dramatically, but the paper relies on qLDPC codes whose practical decoding at scale remains an unsolved problem - a point I unpack in my detailed analysis of the Pinnacle architecture and a companion piece on qLDPC codes. The hardware requirements went down; the algorithmic and engineering requirements went up by a comparable amount. This is valuable research that advances the field, but it’s not a reason to panic - and it’s not a reason to relax either.
The broader pattern is worth watching: resource estimates for breaking RSA-2048 continue moving in only one direction - down. Each breakthrough doesn’t eliminate the hard problems but relocates them. The margin of safety you thought you had is shrinking, even if Q-Day itself hasn’t meaningfully moved.
The ECC Debate: Why RSA Timelines Don’t Apply to Bitcoin
There was a notable stir recently when Scott Aaronson pointed out something cryptographers have known for years but that hasn’t penetrated mainstream quantum-threat planning: under certain conditions, ECC would fall to a quantum computer before RSA.
This matters enormously for systems that rely on ECC - most prominently Bitcoin, which uses ECDSA for all transaction signing. As I explain in my updated deep dive on how Shor’s algorithm affects RSA, ECC, and Diffie-Hellman differently the quantum resource requirements depend on which mathematical problem is being attacked. For equivalent classical security levels, breaking ECC generally requires fewer logical qubits than breaking RSA. The exact ratio depends on error correction assumptions, but the directional conclusion is robust.
My Bitcoin-specific analysis became discussed because it makes the implication explicit: if you’re using RSA-2048 resource estimates to plan your quantum security timeline for ECC-based systems (including Bitcoin, Ethereum, and many TLS implementations using ECDHE), you’re likely overestimating how much time you have.
The bottom line: don’t use RSA timelines for ECC-based decisions.
Google’s Merkle Tree HTTPS Gambit: What People Got Wrong
Google recently announced Merkle Tree Certificates (MTC) for HTTPS authentication in Chrome, and I saw widespread confusion online. Several commentators interpreted it as Google bypassing NIST’s post-quantum cryptography standards. That’s wrong.
As I explain in my analysis of Google’s MTC approach, this is an architectural optimization, not a cryptographic one. Post-quantum signatures (ML-DSA, SLH-DSA) are significantly larger than classical ones, adding latency to the TLS handshake - noticeable at Google’s scale of billions of daily connections. MTC reduces per-connection overhead by batching certificate validations into a tree structure. The underlying primitives remain NIST PQC standards. Google isn’t replacing post-quantum crypto - they’re redesigning the plumbing to handle larger payloads efficiently.
This is exactly the pragmatic engineering the PQC transition needs more of. Anyone dismissing it as Google “going its own way” is missing the point.
120,000 Tasks: The Article That Hit a Nerve
My most-visited article over the past few months wasn’t about a hardware breakthrough or a threat timeline. It was about project management.
120,000 Tasks: Why Post-Quantum (PQC) Migration Is Enormous walked through a realistic program plan for PQC migration at a large enterprise - and the numbers shocked people. For the example organization I modeled, the migration generated approximately 120,000 individual tasks spanning cryptographic discovery, algorithm replacement, testing, deployment, vendor coordination, compliance, and operational changes.
Some readers found the number galvanizing. Others pushed back - their organization wouldn’t face 120,000 tasks. Fair enough: yours may face 30,000 or 60,000. The specific number isn’t the point. PQC migration is not a “swap some libraries” exercise. It is a multi-year, enterprise-wide transformation program that touches every system using public-key cryptography - which is, effectively, every system. If your leadership still thinks this is a quarter-long sprint, share this with them.
Quantum Flapdoodle: The “We Broke RSA-4096” Scam
A new company has been making the rounds claiming they’ve broken RSA-4096 - and selling PQC solutions on the strength of this supposed achievement. The claims are bold, but the technical substance is zero.
In No One Has Secretly Broken RSA-2048 or RSA-4096 — Here’s the Science, I walk through why this is physically impossible with any quantum hardware that exists or is known to be in development. If someone had actually achieved this, it wouldn’t be a marketing pitch for a consulting or a product firm - it would be the most consequential technological development of the century.
The tell is always the same: fabricate a dramatic, unverifiable claim to create urgency, then sell solutions to “protect” against the threat you just invented. If a vendor tells you they’ve broken RSA-4096, ask for the peer-reviewed paper. You’ll hear crickets. There are real quantum threats that justify real urgency. You don’t need fake ones.
From the Applied Quantum Desk
A few updates from Applied Quantum:
Quantum Systems Integration Services: Speaking of QOA and the modular revolution - Applied Quantum is now offering quantum computer systems integration services, helping organizations assemble, deploy, and operate quantum systems from best-of-breed components. If the QOA story above resonated and you’re wondering how to get started, get in touch.
Free Webinars: We’ve launched a series of free quantum security webinars covering PQC migration fundamentals to advanced threat assessment. Full schedule at appliedquantum.com/events.
SANS Quantum Security Course - Now Live: The first quantum security course we developed with SANS Institute - Quantum Security Readiness for Executives - is open for registration. First session: March 18. Practical, hands-on, designed for security leaders who need decision-making fluency, not a physics PhD. Register at sans.org.
Resource Update: Getting Started With Quantum Readiness
One more thing - I’ve significantly updated my curated guide on Getting Started With Quantum Readiness and PQC Migration. If you need a structured reading path to bring yourself or your team up to speed, this is the best place to start — organized by topic and experience level.
That’s it for Quantum Observer #4. If this was useful, forward it to a colleague who should be paying attention. If I got something wrong, hit reply - I read everything and correct publicly.
And one ask: I’d love to hear how I can make this newsletter more useful for you. More depth on fewer topics, or keep the broad survey? Too long? Too short? Different topics? Hit reply - your feedback directly shapes what comes next.
See you in the next edition.
— Marin
Wow, interesting!! You should check out my articles on such frameworks 🤔