Library articles are longer, more complete treatments of a topic: explanations, analysis, technical specifications, or historical context. A library article is something you can return to months or years later. I often keep them updated.
See also Jottings and Deep Research, or browse by tag.
Digital freedom and law#
The battles over who controls software, data, and communications have been running for thirty years and are not over. These articles cover the legal and policy terrain — patents, privacy law, data sovereignty — from the perspective of someone who has been involved in several of the fights directly.
Software you can trust#
A recurring theme in my work is that software fragility is underestimated and under-addressed. These projects and articles approach that problem from different angles — data integrity, reproducibility, reversibility, and version control.
- LumoSQL — Modifying SQLite to give device owners genuine control over their own data, without breaking compatibility.
- Reversible Execution — Rewinding and replaying software to find bugs and security problems. Still the biggest advance in debugging since source-level debuggers.
- Logical and Thermodynamic Reversibility — How reversibility connects to the energy crisis in AI infrastructure.
- Not Before Time — Time-locking information using existing tools and tried mathematics.
- Not Forking — Automating change management across source trees in ways version control systems cannot.
- Fossil — The only realistic alternative to Git, with stronger cryptographic and reproducibility guarantees.
- How to Replace Windows NT with Linux — Written at Linuxcare in 1999. Historical, but part of the Samba story.
AI safety and agentic systems#
Current AI safety efforts focus on making individual models better-behaved. My work on the Perseverance Composition Engine takes a different approach: structure the system so that misbehaviour is caught before it causes harm, the way human institutions have worked for centuries. These articles develop that argument and its technical context.
Practice and teaching#
- Security Standards and Certifications — How the major standards work in practice, and why their bad reputation is mostly undeserved.
- Teaching Exercises — Exercises in cybersecurity and computer science I have used over many years of mentoring.
- Code of Conduct — A concise code of conduct for open source projects, compressed from the Mozilla Participation Guidelines.
- BibLaTeX, eras and scripts — Managing references across non-Latin scripts, ancient sources, and non-English languages in LaTeX.
I participated in many battles directly against Microsoft in the Ballmer era, 1998-2014. Every Samba feature release seem to further anger Microsoft. Copyright and then especially patents were weaponised, as well as well-funded hit teams aimed at spreading confusion and intimidating their own (Microsoft’s!) customers. In the Nadalla era from 2014-present, Microsoft and other tech giants are using even more brutal ways (paracopyright, technical protection measures and the Unitary Patent System), to coerce citizens and governments.
...
This timeline covers the period when Microsoft decided free software and Samba in particular was an exisential threat. Microsoft often buried competitors in expensive legislation, but turned out to be much more difficult to bury open source like Samba. This was the Ballmer era, named after the then-CEO, and the history of Samba’s triumphs feels highly relevant to 2026 where other giant companies seek to prevent the rise of open source competitors.
In 2014, Microsoft got a new CEO and dramatically changed course from explicit hostility to embracing open source. The battleground is now about paracopyright and preventing non-US cloud but it has its roots in the great open source IP battles of the 21st century.
...
In 2026, the Samba Project is nearly 30 years old and has conservatively a billion users. Samba started when I got upset at Microsoft for trying to monopolise all computer networking. I discovered some unmaintained but interesting open source software for sharing files and printers with workstation computers. And the rest is the official Samba history.
Samba is implemented by talented software engineers with a very large number of total contributors. I was (and remain) most interested in interoperability architecture and design, why these things are needed and make sense to users. Plus some protocol analysis, for example, technical readers may know the NTLMv2 encryption scheme was tricky, but turned out to be the same as used in the NTFS filesystem - NTLM is deprecated in favour of Kerberos now but those were the days. I wrote How to Replace Windows NT with Linux, explaining protocol-first strategies for removing Microsoft software.
...
How to manage BibLaTeX across time and cultures I wrote a paper in English using LaTeX on the topic of Epidemiology and One Health. Some essential references did not exist in English. That might sound simple — just list the originals, plus some translation/cross-referencing work to get the necessary information! It isn’t that simple.
This howto is for LaTeX authors with references which are less common in computing/mathematics but otherwise unremarkable, particularly: non-latin scripts, latinisations, non-English references, rare scripts and ancient documents. My sources had all of these at once, giving me the following situation:
...
The topic of reversible computers and backwards execution is quite different to logical reversibility. My experiences of reversibility were all driven by correctness in software and it didn’t matter that under the bonnet nothing truly executes backwards. Now AI with its hungry datacentres has made energy a top priority problem to solve, and development of reversibile hardware to achieve thermodynamic reversibility seems feasible.
Logical and thermodynamic reversibility Large Language Models are subject to the laws of physics in a bad way, because they use so much power and make so much heat. With reversibility, physics might come to our rescue and greatly reduce the amount of power required.
...
Not-forking is a technical tool for software development. Not-forking assists with reproducibility.
Here are some simple ways of explaining what Not-forking can do:
Not-forking lets you integrate non-diffable codebases, a bit like patch/sed/diff/cp/mv rolled into one. Not-forking is a machine-readable file format and tool. It answers the question: What is the minimum difference between multiple source trees, and how can this difference be applied as versions change over time? Not-forking avoids duplicating source code. When one project is within another project, and the projects are external to each other, there is often pressure to fork the inner project. Not-forking avoids that. Not-forking helps address the problem of reproducibility. By giving much better control over the input source trees, it is more likely that the output binaries are the same each time. But here is the big win: Not-forking avoids project-level forking by largely automating change management in ways that version control systems such as Fossil, Git, or GitHub cannot.
The full documentation goes into much more detail than this overview.
...
Reversible execution creates computers that seem to run backwards, applying time shifting techniques with simulation/virtualisation. They address the problems of software unreliability and complexity, and I believe my excited comments from 2005 still stand:
Reversibility is the biggest advance in debugging since source code debugging
— Me, on the GDB developers list In 2026, reversibility still isn’t seen as an ubiquitous must-have for software development, but awareness is increasing.
At the same time, the equally interesting topics of logical reversibility and thermodynamic reversibility have become very important. They are not really anything to do with reversible execution, they just sound similar. But if you’re interested in the problems AI datacentres present the world, this kind of reversibility looks highly relevant.
...
I have been lead implementer of the main security and privacy standards several times each. These can seem intimidating, but properly used they improve security overall, and can help a business run more smoothly.
From a pragmatic, business point of view:
These standards are about writing down the actual rules of your business relevant to security and privacy, and then writing down how you improve these rules, and recording how well they work. All businesses can benefit from challenging their working habits and practices, and since privacy and security touch most parts of a business, this is an opportunity to review how the business works before something goes wrong. From the point of view of both Computer Science and Information Management Science:
...
These are some exercises and tricks I have either created or been subjected to over the years, and I have mentored students through them on many occasions.
The general theme here is that most of the systems and stacks that are taken for granted often don’t work very well, and often don’t seem to have a very bright future. This is even the case for famous codebases relied on by billions of people. There are no absolutes and no immediate fixes, but it is food for thought if we can demonstrate immense waste of human effort amid poor quality computing systems, even when impressive modern computer science is applied.
...