This contribution was taken from the blog of Joop Beris with permission of the author.
“Do you trust me?” So began a former manager of mine during the ritualised humiliation we call a performance review. It was, to put it mildly, a discomfiting inquiry from a man whose own breaches of confidence had already rendered the term meaningless between us. But the discomfort runs deeper still, for it presupposes equality in a relationship that is fundamentally hierarchical. And if you think the dynamic between employee and employer is fraught, consider the even more lopsided transaction between citizen and state, where trust is demanded of one party while being conspicuously withheld by the other.
July 22, 2026
What a caterer too good to refuse teaches us about vendor lock-in, data harvesting and enshittification.
June 12, 2026
You visit one website and around ten companies hear about it, several of them outside Europe. BeLibre’s Leak Detector records a real browsing session and shows you exactly who received what about your visit, and what that means under European law.
June 3, 2026
What happens when a website tracks you, and why ‘Accept all’ costs more than it looks
June 3, 2026
TL;DR: In April, Anthropic announced an AI model called Mythos that had reportedly found thousands of serious security bugs in every major operating system and web browser. The reaction was loud: The Bank of England warned regulators it could “crack the whole cyber risk world open”, US Treasury called in the big banks, NHS England closed all its public code repositories inside two weeks.
Five weeks on, the dust has settled and the picture looks different: Independent reviewers pulled the headline numbers apart. The creator of curl, one of the most widely used open-source tools in the world, ran the Mythos report against his own code and found it had identified one minor flaw, calling the hype “primarily marketing”. 99% of Mythos’s claimed findings remain unpublished and unverified.
What did happen in those five weeks is that the open-source world fixed and disclosed its share of the bugs publicly, in the open, on commit logs anyone can read. That is open source working as it is supposed to, so don’t call open-source a liability.
The lesson for our administrations is the opposite of NHS England’s. Closing your code does not make you safer. Funding the open ecosystem you already depend on, and using similar AI tools defensively on your own code, does.
May 15, 2026
