Library articles are longer, more complete treatments of a topic: explanations, analysis, technical specifications, or historical context. A library article is something you can return to months or years later. I often keep them updated.
See also Jottings and Deep Research, or browse by tag.
Digital freedom and law#
The battles over who controls software, data, and communications have been running for thirty years and are not over. These articles cover the legal and policy terrain — patents, privacy law, data sovereignty — from the perspective of someone who has been involved in several of the fights directly.
Software you can trust#
A recurring theme in my work is that software fragility is underestimated and under-addressed. These projects and articles approach that problem from different angles — data integrity, reproducibility, reversibility, and version control.
- LumoSQL — Modifying SQLite to give device owners genuine control over their own data, without breaking compatibility.
- Reversible Execution — Rewinding and replaying software to find bugs and security problems. Still the biggest advance in debugging since source-level debuggers.
- Logical and Thermodynamic Reversibility — How reversibility connects to the energy crisis in AI infrastructure.
- Not Before Time — Time-locking information using existing tools and tried mathematics.
- Not Forking — Automating change management across source trees in ways version control systems cannot.
- Fossil — The only realistic alternative to Git, with stronger cryptographic and reproducibility guarantees.
- How to Replace Windows NT with Linux — Written at Linuxcare in 1999. Historical, but part of the Samba story.
AI safety and agentic systems#
Current AI safety efforts focus on making individual models better-behaved. My work on the Perseverance Composition Engine takes a different approach: structure the system so that misbehaviour is caught before it causes harm, the way human institutions have worked for centuries. These articles develop that argument and its technical context.
Practice and teaching#
- Security Standards and Certifications — How the major standards work in practice, and why their bad reputation is mostly undeserved.
- Teaching Exercises — Exercises in cybersecurity and computer science I have used over many years of mentoring.
- Code of Conduct — A concise code of conduct for open source projects, compressed from the Mozilla Participation Guidelines.
- BibLaTeX, eras and scripts — Managing references across non-Latin scripts, ancient sources, and non-English languages in LaTeX.
What Did They Know, and When Did They Know It? This old question in law, journalism and commerce has decided the outcomes of criminal trials, ended political careers, and settled the fate of companies. But when it comes to digital information, until recently it was quite difficult to answer.
Not Before Time (NBT) is a public broadcast facility that connects information to time in three ways that can be trusted without trusting any single person or organisation:
...
This is a technical note about a problem that is going to bite agentic AI users soon.
AI is slow, and Agentic AI is even slower. I develop an MCP server that generates PDF documents, and I work with the Agentic Perseverance Composition Engine daily, and AI seems so, so slow. There’s so much waiting, and every mistake means yet more sitting around. Tasks we know actually take maybe 5 microseconds on an operating system (eg, does a file called Things-to-Do exist?) can take one million time longer – between 2 and 5 seconds. This is because the big brain in the cloud is being consulted multiple times, often with timeouts. It’s a young, unstable and unreliable stack, rather like the early days of MS DOS or the Apple ][. When AI gets hold of the data from your computer via an MCP server it can do some very interesting things, but it is not put together well.
...
There are many problems with what billions of people perceive to be AI in 2026, not least sustainability in many senses. All of the large AI companies are following more-or-less the same approaches to solving safety and predictability.
Since February 2026 I have been working on the code of a different approach, and it really does seem promising.
Addressing the Biggest Problems in AI The Perseverance Composition Engine (PCE) approaches pressing problems in AI from a different perspective. PCE does not try to make LLMs behave better. Instead, PCE applies familiar structure from human organisations so their inevitable misbehaviour is detected and corrected. This article explains why Artificial Organisations are worth trying. And if you’re not a computer scientist but you think you’ve heard this all before, you are right: games and scifi fans rejoice!.
...
From time to time I am engaged to help organisations in the UK and in the EU make decisions about where their data is stored, how it is accessed, and how to keep things as stable as possible over the next few years. This was a dizzying mess until 2025, and in 2026 there are some big decisions coming. Organisations need as much certainty as they can get for making decisions which are expensive to change in the future.
...
This file is a Code of Conduct first written in 2020 for the LumoSQL project. Here is Version 1.6 – Updated 9th February, 2026. Heavily adapted and compressed from the large and repetitive version 3.1 of the Mozilla Participation Guidelines and published by LumoSQL under the Creative Commons Attribution-ShareAlike 4.0 International license.
Contents LumoSQL Code of Conduct This file exists because the LumoSQL Project needed it, less than one year after starting in 2019. We take it seriously, and hope that most English-reading adults can understand what is said. We hope this is not needed very often.
...
The detail of the GDPR and its implied computer science contain a solution for sharing secrets according to law. This continues to be true in 2026, as the Digital Omnibus Regulation takes shape.
Executive Summary
The GDPR sets up a conflict in trust between companies in particular circumstances, which can only be resolved by using the automation of a cryptographic audit trail with particular properties as described below.
Problem Statement
Under the EU’s GDPR law virtually every company is a Controller, and virtually all Controllers use at least one Processor. When a Processor is engaged, the GDPR requires that a contract is signed with the very specific contents spelled out in clause 3 of Article 28. The GDPR requires that Controllers and Processors cooperate together in order to deliver data protection, and this cooperation needs to be very carefully managed to maintain the security and other guarantees that the GDPR also requires. That’s what this mandatory contract is intended to achieve.
...
When Linux was a Struggling Challenger In 1999 I joined my first startup, Linuxcare in San Francisco. The Linuxcare story is a quintessential United States dot-com bubble narrative, featuring a famous venture capital fund, massive growth, a failed IPO, and a fancy new ex-IBM CEO resigning under a cloud. Founded in 1998, Linuxcare aimed to be the “0800 number for Linux”, a concept we now know was sound. So close!
...
Privacy Shield was a 2016 self-certification scheme for US companies to hold themselves to the strict EU privacy rules. In 2020 Privacy Shield was struck down by the EU Court of Justice. In non-technical terms, the Court said: There is no way Privacy Shield can work. So don’t use US-controlled cloud companies such as Google or Amazon.
In late 2021 this decision started rippling out across Europe, as one place and then another moves away from these giant US companies, starting with government users. We all like familiarity and wish to avoid change, so this decision seems astonishing to many people. Once organisations get over their surprise, it is not so difficult to do. In 2023 I wrote It remains to be seen what these US cloud companies will do in 2023. Some of them are wealthier than several smaller EU nations combined. By 2026 we had the answer - they used coercion by political, economic and legal means to prevent EU citizens using their own IP to build their own services.
...
The Fossil source code management system is the most fully-featured alternative to Git, and has had twenty years of development and testing since 2006. After helping Fossil make some changes I now use Fossil for several projects. I also use Git extensively on various software forges (but not GitHub unless I must). Mercurial is actively maintained but has lost most of its mindshare since Mozilla, Bitbucket and others migrated away, and is rarely chosen for new projects today.
...
LumoSQL protects data on mobile phones using a new data storage technology which is highly compatible with most existing devices. With LunmoSQL, the device owner has ultimate right to decide who can read or change their data… and this decision continues to be enforced even after it has been copied off the phone to (for example) a bank or insurance company for processing with their in-house database software. In contrast, the situation at present is that device owners are rarely in control of the privacy of their own data, despite many laws relating to privacy.
...