What a caterer too good to refuse teaches us about vendor lock-in, data harvesting and enshittification.
June 12, 2026
You visit one website and around ten companies hear about it, several of them outside Europe. BeLibre’s Leak Detector records a real browsing session and shows you exactly who received what about your visit, and what that means under European law.
June 3, 2026
What happens when a website tracks you, and why ‘Accept all’ costs more than it looks
June 3, 2026
TL;DR: In April, Anthropic announced an AI model called Mythos that had reportedly found thousands of serious security bugs in every major operating system and web browser. The reaction was loud: The Bank of England warned regulators it could “crack the whole cyber risk world open”, US Treasury called in the big banks, NHS England closed all its public code repositories inside two weeks.
Five weeks on, the dust has settled and the picture looks different: Independent reviewers pulled the headline numbers apart. The creator of curl, one of the most widely used open-source tools in the world, ran the Mythos report against his own code and found it had identified one minor flaw, calling the hype “primarily marketing”. 99% of Mythos’s claimed findings remain unpublished and unverified.
What did happen in those five weeks is that the open-source world fixed and disclosed its share of the bugs publicly, in the open, on commit logs anyone can read. That is open source working as it is supposed to, so don’t call open-source a liability.
The lesson for our administrations is the opposite of NHS England’s. Closing your code does not make you safer. Funding the open ecosystem you already depend on, and using similar AI tools defensively on your own code, does.
May 15, 2026
Google and Microsoft publish transparency reports twice a year on government data requests. But beyond the country-by-country subpoenas lies a second layer of US legal instruments that no data residency commitment can neutralise.
May 6, 2026