Articles are often updated, substantial, useful for reference.
See also Notes
and Research
, or browse by topic
.
Digital freedom and law#
The battles over who controls software, data, and communications have been running for thirty years and are not over. These articles cover the legal and policy terrain — patents, privacy law, data sovereignty — from being in the middle of it.
More reliable software#
A recurring theme in my work is that software fragility is underestimated and under-addressed. These projects and articles approach that problem from different angles — data integrity, reproducibility, reversibility, and version control.
- LumoSQL
— Modifying SQLite to give device owners genuine control over their own data, without breaking compatibility.
- Reversible Execution
— Rewinding and replaying software to find bugs and security problems. Still the biggest advance in debugging since source-level debuggers.
- Logical and Thermodynamic Reversibility
— How reversibility connects to the energy crisis in AI infrastructure.
- Not Before Time
— Time-locking information using existing tools and tried mathematics.
- Not Forking
— Automating change management across source trees in ways version control systems cannot.
- Fossil
— The only realistic alternative to Git, with stronger cryptographic and reproducibility guarantees.
- How to Replace Windows NT with Linux
— Written at Linuxcare in 1999, this kind of independence from US-centric software is suddenly a global concern. Part of the Samba story.
- Margaret Hamilton and Software Intent
contains a reconstruction of a 1994 article of Hamilton’s I found
and cleaned up, with permission. The idea of intent seems central to software reliability.
AI safety and agentic systems#
Current AI safety efforts focus on making individual models better-behaved. My work on the Perseverance Composition Engine ↗
takes a different approach: structure the system so that misbehaviour is caught before it causes harm, the way human institutions have worked for centuries. These articles develop that argument and its technical context.
Health and medical#
- Radiophobia
— Why patients should not be advised to consider cancer risk relating to scans, what it costs in missed diagnoses and fear-driven harm, and an explantion of the medical term ‘radiophobia’.
Practice and teaching#
- Security Standards and Certifications
— How the major standards work in practice, and why their bad reputation is mostly undeserved.
- Teaching Exercises
— Exercises in cybersecurity and computer science I have used over many years of mentoring.
- Code of Conduct
— A concise code of conduct for open source projects, compressed from the Mozilla Participation Guidelines.
- BibLaTeX, eras and scripts
— Managing references across non-Latin scripts, ancient sources, and non-English languages in LaTeX.
I participated in many battles directly against Microsoft in the Ballmer era, 1998-2014. Every Samba feature release seemed to further anger Microsoft. Copyright and then especially patents were weaponised, as well as well-funded hit teams aimed at spreading confusion and intimidating their own (Microsoft’s!) customers. In the Nadella era from 2014-present, Microsoft and other tech giants are using even more brutal ways (paracopyright, technical protection measures and the Unitary Patent System), to coerce citizens and governments.
...
This timeline covers the period when Microsoft decided free software and Samba in particular was an existential threat. Microsoft often buried competitors in expensive litigation, but turned out to be much more difficult to bury open source like Samba . This was the Ballmer era, named after the then-CEO, and the history of Samba’s triumphs feels highly relevant to 2026 where other giant companies seek to prevent the rise of open source competitors.
...
In 2026, the Samba Project ↗ is nearly 30 years old and has conservatively a billion users. Samba started when I got upset at Microsoft for trying to monopolise all computer networking. I discovered some unmaintained but interesting open source software for sharing files and printers with workstation computers. And the rest is the official Samba history .
Samba is implemented by talented software engineers with a very large number of total contributors. I was (and remain) most interested in interoperability architecture and design, why these things are needed and make sense to users. Plus some protocol analysis, for example, technical readers may know the NTLMv2 encryption scheme was tricky, but turned out to be the same as used in the NTFS filesystem - NTLM is deprecated in favour of Kerberos now ↗ but those were the days. I wrote How to Replace Windows NT with Linux , explaining protocol-first strategies for removing Microsoft software.
...
How to manage BibLaTeX across time and cultures I wrote a paper in English using LaTeX ↗ on the topic of Epidemiology and One Health . Some essential references did not exist in English. That might sound simple — just list the originals, plus some translation/cross-referencing work to get the necessary information! It isn’t that simple.
This howto is for LaTeX authors with references which are less common in computing/mathematics but otherwise unremarkable, particularly: non-latin scripts, latinisations, non-English references, rare scripts and ancient documents. My sources had all of these at once, giving me the following situation:
...
Large Language Models are subject to the laws of physics in a bad way, because they use so much electricity and make so much heat. I was interested to learn about a Mr Landauer and his principle of thermodynamic reversibility, which suggests physics might also help, by greatly reducing the amount of power required by AI datacentres. That still leaves many, many AI problems including an economic bubble, but it would definitely help.
...
Not-forking ↗ is a technical tool for software development. Not-forking assists with reproducibility.
Here are some simple ways of explaining what Not-forking can do:
Not-forking lets you integrate non-diffable codebases, a bit like patch/sed/diff/cp/mv rolled into one. Not-forking is a machine-readable file format and tool. It answers the question: What is the minimum difference between multiple source trees, and how can this difference be applied as versions change over time? Not-forking avoids duplicating source code. When one project is within another project, and the projects are external to each other, there is often pressure to fork the inner project. Not-forking avoids that. Not-forking helps address the problem of reproducibility. By giving much better control over the input source trees, it is more likely that the output binaries are the same each time. But here is the big win: Not-forking avoids project-level forking by largely automating change management in ways that version control systems ↗ such as Fossil ↗ , Git ↗ , or GitHub ↗ cannot.
The full documentation ↗ goes into much more detail than this overview.
...
Reversible execution creates computers that seem to run backwards, applying time shifting techniques with simulation/virtualisation to address software unreliability and complexity. I stand by my excited comments from way back in 2005:
Reversibility is the biggest advance in debugging since source code debugging
— Me, on the GDB developers list ↗ In 2026, reversibility still isn’t seen as an ubiquitous must-have for software development, but awareness is increasing.
💡 Confusingly similar names I also have an article on the totally different but similar-sounding topics of logical reversibility and thermodynamic reversibility . If you’re interested in the problems power-hungry AI datacentres present the world you might find it interesting. What is checkpoint-based reversible execution? Reversible execution is about giving the appearance of a program executing backwards in time. If you’ve not seen it before, it is just as strange and impressive as it sounds.
...
I have been lead implementer of the main security and privacy standards several times each. These can seem intimidating, but properly used they improve security overall, and can help a business run more smoothly.
From a pragmatic, business point of view:
These standards are about writing down the actual rules of your business relevant to security and privacy, and then writing down how you improve these rules, and recording how well they work. All businesses can benefit from challenging their working habits and practices, and since privacy and security touch most parts of a business, this is an opportunity to review how the business works before something goes wrong. From the point of view of both Computer Science and Information Management Science:
...
These exercises assume a CS graduate-level background and familiarity with the tools mentioned; they are for mentors to adapt for their students. I have either created or been subjected to all of them over the years, and I have mentored students through them on many occasions.
The general theme here is that most of the systems and stacks that are taken for granted often don’t work very well, and often don’t seem to have a very bright future. This is even the case for famous codebases relied on by billions of people. There are no absolutes and no immediate fixes, but it is food for thought if we can demonstrate immense waste of human effort amid poor quality computing systems, even when impressive modern computer science is applied.
...