Thomas Hühn on Discoveries

The idea about an “SBOM-first” or maybe even “SBOM-only” workflow already teased earlier still appeals to me.

Introduction While the Cyber Resilience Act is rather readable for a legal instrument, it is structured in such a way that many requirements are duplicated, triplicated, or n-plicated across the Articles and their paragraphs.

Some working groups for the standardisation of programming languages (like Ada or C) publish rationales.

These are some things I heard at last week‘s FSFE Legal & Licensing Workshop in Berlin.

This is only half-serious, but I think it is rather more than less true: Recently I found the EU’s guidance about the CRA, specifically its requirement on licensing security fixes you upstream to the original project: Where the component is a free and ope…

Recently I wrote about discussions I’ve experienced about a year ago, where lawyers and open source practitioners wondered what the reporting obligations of the Cyber Resilience Act meant in edge cases.

It’s been twenty years now that I’ve gotten one of the best letters ever.

Article 13 (6) in the Cyber Resilience Act requires manufacturers to report security vulnerabilities they find in an Open Source component they use to the upstream project.

In general, IEC 62443 is quite well-written, especially if you compare it to (older) safety standards.

I’m still thinking about something I touched on in the OpenChain & Friends post: AI generated code isn’t copyrightable, because only human creations are eligible for copyright.

Legal & Licensing Workshop 2026 is coming up, and it made me remember something that a participant said in passing: many of the leading lawyers publishing about AI and the law have formerly been publishing about Open Source and the law.

These are some things I heard (and some things I said) at last week‘s OpenChain & Friends Event in Stuttgart.

Ruben Schade recently wrote about a Flight Simulator 98 book.

Hyper-masculine attributions to a certain class of employees like “rock star” or “ninja developer” are commonplace.

I feel a bit late to the party, but after some time with Claude Code, I like agentic LLM systems.

There are four directions from which you may get in legal trouble when you’re not fulfilling Open Source license obligations: The obvious source are authors, i.e. copyright holders.

Myths about /dev/urandom is my only post that ever got somewhat popular.

There is this strange little clause in the GNU General Public License, version 2 – but not version 3 – that pretty much everybody ignores.

I‘m a bit surprised that in the world of SBOM tooling many tools seem to insist on creating a whole SBOM and thus giving me yet another, but incomplete view of my software.

Scanning source files for licensing information (because the package managers‘ metadata is insufficient) is a lot of work, and a lot of wasted effort, because only rarely do companies pool their resources.

In the late eighties, an anthropology professor and her doctoral student investigated traditional master–apprentice relationships in the training of several vocations: native Mexican midwives, west-African tailors, British quartermasters, and – to shake t…

Why?

Triumph of the City is an unabashed apologia of cities and metropolises.

W.

Venice’s Secret Service by Ioanna Iordanou undertakes to show that organized intelligence is not – as commonly thought – an invention of the modern industrial state, but already existed in Renaissance Venice of the 1500s and early 1600s.

The SimCity Planning Commission Handbook by Johnny L.

The name may mislead you.

I’ve been using a Logitech MX Master 3 mouse for about two years now.

Between Christmas and New Year’s it struck again: after months of peace the severe back pain was back.

Oracle Cloud offers a free tier that includes a beefy ARM64 virtual server. with lots of RAM.

It took me some time to find out why outside services like Letsencrypt could not connect to my free Oracle Cloud instance.

Create a new MySQL database CREATE DATABASE wp_lindyhoppeln CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'lindyhoppeln'@'localhost'; GRANT ALL PRIVILEGES ON wp_lindyhoppeln.* To 'lindyhoppeln'@'localhost' IDENTIFIED BY 'passphrase'; utf8…

Introduction Sometimes called “The Father of Quality Management”, William Edwards Deming shaped the field during the twentieth century.

Back in 2015 DanBC wrote on Hackernews: 2) I buy many books for my child.

These are only notes I scribbled down while reading the book.

How to Win Friends & Influence People by Dale Carnegie is a classic self-help book about social skills.

The Now Habit by Neil Fiore is a self-help book about understanding and overcoming procrastination.

Influence by Robert B.

Wool by Hugh Howey is a dystopian science fiction novella, originally self-published for Amazon Kindle.

The Deadline by Tom DeMarco is a real project management classic.

Note from 2024: This article was published in 2014.

In product development in the EU today, the requirement to conform with EU directives and other legal statutes is pervasive.

The Bible, book of books.