Terence Eden. He has a beard and is smiling.

Terence Eden’s Blog

Theme Switcher:

GDS weighs in on the NHS's decision to retreat from Open Source

· 8 comments · 900 words · Viewed ~4,907 times


Guidance. AI, open code and vulnerability risk in the public sector. Guidance for safely publishing source code in the open, and reducing the risk of AI-accelerated vulnerability discovery.

Within the UK's Civil Service you occasionally hear the expression "being invited to a meeting without biscuits". It implies a rather frosty discussion without any of the polite niceties of a normal meeting. In general though, even when people have severe disagreements, it is rare for tempers to fray. It is even rarer for those internal disagreements to spill over into public. Which is what…

UK Government Kicks Out Palantir

· 10 comments · 800 words · Viewed ~7,960 times


A list of UK government contracts won by Palantir.

The UK Government, for all its faults, is pretty good at publishing contracts it has awarded. That's why I get depressed when I see rage-bait nonsense about how companies have been award "Top Secret" deals. Right now you can go to https://www.contractsfinder.service.gov.uk and search for whichever bête noire has you riled up. You might want to argue that the company is corrupt, incompetent, or …

NHS Goes To War Against Open Source

· 43 comments · 1,100 words · Viewed ~19,342 times


All source code repositories must be private by default. Repositories may be internal where there is a legitimate need for visibility within the enterprise. Repositories must not be public unless there is an explicit and exceptional need, and public access has been formally approved by the Engineering Board. Purpose Public repositories materially increase the risk of unintended disclosure of source code, architectural decisions, configuration detail, and contextual information that may be exploited — particularly given rapid advancements in Al models capable of large-scale code ingestion, inference, and reasoning (e.g. developments such as the Mythos model). This red line establishes a default-closed posture for code while the organisation assesses the impact of these changes and ensures that any public publication of code is a deliberate, reviewed, and justified decision. • For P&P Public repositories we will switch to Private on Monday the 11th May 2026 • Teams that have a need for an exemption need to declare this to the Engineering mailbox by COP Wednesday 6th May 2026 • Teams can change to private at any time ahead of this • Central tracking of public repositories: NHSE public repositories.xlsx

The NHS is preparing to close nearly all of its Open Source repositories. Throughout my time working for the UK Government - in GDS, NHSX, i.AI, and others - I championed Open Source. I spoke to dozens of departments about it, wrote guidance still in use today, and briefed Ministers on why it was so important. That's why I'm beyond disappointed at recent moves from NHS England to backtrack on…

Does Mythos mean you need to shut down your Open Source repositories?

· 3 comments · 350 words · Viewed ~3,607 times


A padlock engraved into a circuit board.

Much Sturm und Drang in the world of Open Source with the announcement that the "Mythos" AI is now the ultimate hacker and is poised to unleash havoc on every code base. So should you close all your Open Source projects to make them safe? No. Firstly, all your Open Source code has already been slurped up. It was all ingested for "training purposes" years ago. If it was moderately interesting…

How Can Governments Pay Open Source Maintainers?

· 14 comments · 1,000 words · Viewed ~3,614 times


A tiny lego Storm Trooper eats a chocolate coin.

When I worked for the UK Government I was once asked if we could find a way to pay for all the Open Source Software we were using. It is a surprisingly hard problem and I want to talk about some of the issues we faced. The UK Government publishes a lot of Open Source code - nearly everything developed in-house by the state is available under an OSI Approved licence. The UK is generally pretty…

Book Review: Diversifying Open Source - An Open Standards Playbook for Inclusive and Equitable Tech Projects by Paloma Oliveira

· 450 words · Viewed ~223 times


Book cover featuring a colourful bird.

It is refreshing to read a political polemic which contains useful actions the reader can take. Too many books about the social problems with technology end up being a diagnosis with no cure. Paloma Oliveira's new book (with technical review by my friend Dawn Foster) is a deep dive into how we can all make Open Source more inclusive and equitable. Unlike most tech books, it doesn't follow the …

The Peaceful Transfer of Power in Open Source Projects

· 6 comments · 600 words · Viewed ~13,863 times


A book from 1680 written by Robert Filmer. Patriarcha - The Divine Right Of Kings.

Most of the people who run Open Source projects are mortal. Recent history shows us that they will all eventually die, or get bored, or win the lottery, or get sick, or be conscripted, or lose their mind. If you've ever visited a foreign country's national history museum, I guarantee you've read this little snippet: King Whatshisface was a wise and noble ruler who bought peace and prosperity…

How to *actually* test your readme

· 12 comments · 150 words · Viewed ~4,637 times


List of Linux OSes.

If you've spent any time using Linux, you'll be used to installing software like this: The README says to download from this link. Huh, I'm not sure how to unarchive .tar.xz files - guess I'll search for that. Right, it says run setup.sh hmm, that doesn't work. Oh, I need to set the permissions. What was the chmod command again? OK, that's working. Wait, it needs sudo. Let me run that again.…

I'm never going back to Matrix

· 58 comments · 950 words · Viewed ~18,844 times


A list of errors saying "Unsupported Event".

I should love Matrix. It is a decentralised, privacy preserving, multi-platform chat tool. Goodbye Slack and your ridiculous free limits. Adiós Discord and your weird gamification. Suck it IRC with your obscure syntax and faint stench of BO. WhatsApp and Telegram can stick their heads in a bucket of lukewarm sick and sing sea shanties! Let's join the future! The problem is - Matrix is shit. Not …

Towards a test-suite for TOTP codes

· 11 comments · 1,250 words · Viewed ~7,134 times


Screenshot showing a QR code and numeric codes.

Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own idiosyncratic variants. The official RFC is infuriatingly vague. That's no…

A small contribution to curl

· 5 comments · 500 words · Viewed ~687 times


daniel stenberg saying "Welcome Terence Eden as #curl commit author 1342"

The venerable curl is one of the most fundamental pieces of code in the modern world. A seemingly simply utility - it enables other programs to interact with URls - it runs on millions of cars, is inside nearly every TV, used by billions of people, and is even in use on Mars. And, as of last week, features a small contribution by me! Look, I'm not an experienced bit-twiddler. I can't…

Talking Contact Tracing at FOSDEM

· 8 comments · 650 words · Viewed ~272 times


I was delighted to be invited to speak at FOSDEM. And I was not at all intimidated to be speaking on the cavernous Janson stage. The audience were lovely, asked interesting questions, and - most importantly - laughed in all the right places 😅. Regular readers will recognise this as being an updated version of the talk I gave at EMF 2024 - feel free to watch that one if you want to see if I've im…