Terence Eden. He has a beard and is smiling.

Terence Eden’s Blog

Theme Switcher:

NHS Goes To War Against Open Source

· 8 comments · 1,000 words · Viewed ~6,462 times


All source code repositories must be private by default. Repositories may be internal where there is a legitimate need for visibility within the enterprise. Repositories must not be public unless there is an explicit and exceptional need, and public access has been formally approved by the Engineering Board. Purpose Public repositories materially increase the risk of unintended disclosure of source code, architectural decisions, configuration detail, and contextual information that may be exploited — particularly given rapid advancements in Al models capable of large-scale code ingestion, inference, and reasoning (e.g. developments such as the Mythos model). This red line establishes a default-closed posture for code while the organisation assesses the impact of these changes and ensures that any public publication of code is a deliberate, reviewed, and justified decision. • For P&P Public repositories we will switch to Private on Monday the 11th May 2026 • Teams that have a need for an exemption need to declare this to the Engineering mailbox by COP Wednesday 6th May 2026 • Teams can change to private at any time ahead of this • Central tracking of public repositories: NHSE public repositories.xlsx

The NHS is preparing to close nearly all of its Open Source repositories. Throughout my time working for the UK Government - in GDS, NHSX, i.AI, and others - I championed Open Source. I spoke to dozens of departments about it, wrote guidance still in use today, and briefed Ministers on why it was so important. That's why I'm beyond disappointed at recent moves from NHS England to backtrack on…

Does Mythos mean you need to shut down your Open Source repositories?

· 1 comment · 350 words · Viewed ~2,331 times


A padlock engraved into a circuit board.

Much Sturm und Drang in the world of Open Source with the announcement that the "Mythos" AI is now the ultimate hacker and is poised to unleash havoc on every code base. So should you close all your Open Source projects to make them safe? No. Firstly, all your Open Source code has already been slurped up. It was all ingested for "training purposes" years ago. If it was moderately interesting…

How Can Governments Pay Open Source Maintainers?

· 14 comments · 1,000 words · Viewed ~3,562 times


A tiny lego Storm Trooper eats a chocolate coin.

When I worked for the UK Government I was once asked if we could find a way to pay for all the Open Source Software we were using. It is a surprisingly hard problem and I want to talk about some of the issues we faced. The UK Government publishes a lot of Open Source code - nearly everything developed in-house by the state is available under an OSI Approved licence. The UK is generally pretty…

Book Review: Diversifying Open Source - An Open Standards Playbook for Inclusive and Equitable Tech Projects by Paloma Oliveira

· 450 words · Viewed ~211 times


Book cover featuring a colourful bird.

It is refreshing to read a political polemic which contains useful actions the reader can take. Too many books about the social problems with technology end up being a diagnosis with no cure. Paloma Oliveira's new book (with technical review by my friend Dawn Foster) is a deep dive into how we can all make Open Source more inclusive and equitable. Unlike most tech books, it doesn't follow the …

The Peaceful Transfer of Power in Open Source Projects

· 6 comments · 600 words · Viewed ~13,825 times


A book from 1680 written by Robert Filmer. Patriarcha - The Divine Right Of Kings.

Most of the people who run Open Source projects are mortal. Recent history shows us that they will all eventually die, or get bored, or win the lottery, or get sick, or be conscripted, or lose their mind. If you've ever visited a foreign country's national history museum, I guarantee you've read this little snippet: King Whatshisface was a wise and noble ruler who bought peace and prosperity…

How to *actually* test your readme

· 12 comments · 150 words · Viewed ~4,627 times


List of Linux OSes.

If you've spent any time using Linux, you'll be used to installing software like this: The README says to download from this link. Huh, I'm not sure how to unarchive .tar.xz files - guess I'll search for that. Right, it says run setup.sh hmm, that doesn't work. Oh, I need to set the permissions. What was the chmod command again? OK, that's working. Wait, it needs sudo. Let me run that again.…

I'm never going back to Matrix

· 58 comments · 950 words · Viewed ~18,762 times


A list of errors saying "Unsupported Event".

I should love Matrix. It is a decentralised, privacy preserving, multi-platform chat tool. Goodbye Slack and your ridiculous free limits. Adiós Discord and your weird gamification. Suck it IRC with your obscure syntax and faint stench of BO. WhatsApp and Telegram can stick their heads in a bucket of lukewarm sick and sing sea shanties! Let's join the future! The problem is - Matrix is shit. Not …

Towards a test-suite for TOTP codes

· 11 comments · 1,250 words · Viewed ~7,124 times


Screenshot showing a QR code and numeric codes.

Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own idiosyncratic variants. The official RFC is infuriatingly vague. That's no…

A small contribution to curl

· 5 comments · 500 words · Viewed ~681 times


daniel stenberg saying "Welcome Terence Eden as #curl commit author 1342"

The venerable curl is one of the most fundamental pieces of code in the modern world. A seemingly simply utility - it enables other programs to interact with URls - it runs on millions of cars, is inside nearly every TV, used by billions of people, and is even in use on Mars. And, as of last week, features a small contribution by me! Look, I'm not an experienced bit-twiddler. I can't…

Talking Contact Tracing at FOSDEM

· 8 comments · 650 words · Viewed ~269 times


I was delighted to be invited to speak at FOSDEM. And I was not at all intimidated to be speaking on the cavernous Janson stage. The audience were lovely, asked interesting questions, and - most importantly - laughed in all the right places 😅. Regular readers will recognise this as being an updated version of the talk I gave at EMF 2024 - feel free to watch that one if you want to see if I've im…

Working around an old and buggy HTML Tidy in PHP

· 250 words


The PHP logo.

Dan Q very kindly shared his script to make WordPress do good HTML. But I couldn't get it working. Looking at the HTML it was spitting out, the meta generator said it was HTML Tidy version 5.6.0. That's quite old! I confirmed this by running: echo tidy_get_release(); Which spat out 2017/11/25. Aha! There are a few bugs in this version of HTML Tidy, some of which are fixed in later…

Can you trust ProtonApps.com?

· 2 comments · 450 words · Viewed ~433 times


Screenshot of the ProtonApps page.

I've recently signed up to the privacy-preserving service Proton. All the email, calendar, drive, VPN, and other services seem to hang off the proton.me domain. I wanted to download the Android apps to my phone - without using the Google Play Store. The VPN app is on F-Droid but none of the others are. So, because I'm lazy, I Googled "Download Proton Mail". I landed on…