Bert Hubert's writings · 373 posts visible on site (September 2014 to September 2026) · plus one long page begun in 2001 and revised through 2021 · a clear pivot around 2020, from C++ / DNA / satellite navigation writing to European technical sovereignty and Dutch government IT · still active, latest post 14 September 2026 · written in a mix of Dutch and English, entirely free, no paywall · this page is based on 17 posts read in full, spanning April 2016 to September 2026, plus the one begun in 2001; several fall on each side of the pivot · the reading list is built on the author's own "notable projects, publications & presentations" list from his homepage — this is the author himself saying what to read — topped up with outside attention
There is a lift bridge in the Rotterdam port area called the Botlekbrug. It has jammed roughly 250 times.
The consequences are serious — it is the one way truck traffic gets from A to B. So the bridge acquired its own website to publish its outages, its own SMS service (text "BBRUG AAN" to 3669; Hubert notes "not kidding"), and an engineer installed full-time in a van beside it, on hand whenever it broke. That halved the downtime.
Three years went by and nobody knew why it kept failing. The eventual cause: a server inside the bridge managing its state and sensors had a rotten ethernet cable, or port.
And during that two-year period, everyone thought, it cannot be the computer. No one came and said, shall we just replace all the cables and ethernet ports for once and see what happens? We lacked the expertise.Cyber Security: A Pre-War Reality Check, 14 May 2024
The man telling this story is Bert Hubert: Dutch programmer, founder of PowerDNS in 1999, author of RFC 5452 (which makes DNS harder to fool with forged answers), once a member of a Dutch intelligence oversight board, now a part-time technical advisor to several government departments. He has spent his whole career performing one move: where everyone else says "this is too complicated, we'd better call someone," he takes the lid off and reads the thing himself.
In December 2020 the World Health Organization published the full genetic sequence of the BioNTech/Pfizer covid vaccine. The thing is 4,284 characters long — short enough to fit in a handful of tweets. Most people glanced at it and scrolled on. Hubert treated it as source code and read it character by character.
He found that the first two letters, GA, encode nothing at all and yet must be there — exactly as every Windows executable begins with MZ and every Unix script with #!. He found that every U had been swapped for a close cousin called Ψ, because the body runs a ferocious antivirus system against foreign RNA, and Ψ makes the immune system lose interest while the cell still accepts it as a normal U. His comment: security people know this trick — send a slightly corrupted message the firewall can't parse but the backend accepts anyway.
He also isolated the only two changes in the entire sequence that actually alter the protein: two amino acids replaced by proline. Free-standing spike protein collapses into a different shape once it leaves the virus body, and proline is very rigid — two splints holding the spike in the pose the immune system needs to see. The people who discovered that, he wrote, "should be walking around high-fiving themselves incessantly."
That article was read by 1.7 million people, translated into more than thirty languages, and led him to write a book about DNA. He had been practising the technique since 2001, when he was just a programmer who wrote DNS software and started reading the human genome as code: 97% of it commented out, comments opening with GT and closing with AG — functionally /* and */; tumours as fork bombs; two copies of each chromosome as RAID-1. He has never changed that page's subtitle: "or, If you are a hammer, everything looks like a nail."
That is the key to him. The same hammer later swung at other things.
In January 2020, while Europe argued about whether 5G should use Huawei equipment, he wrote that the question was being asked too late: Huawei and its close partners were by then already directly operating the mobile networks of over 100 million European subscribers, and call detail records had been outsourced since the early 2000s to third and frequently foreign parties. "There is no need to plant backdoors — data willingly gets sent out." Then the conclusion that leaves you with nothing to say: worrying that the Chinese could disrupt our communications through backdoors misses the point, because all they'd need to do to disrupt our communications is stop maintaining our networks for us.
The same piece carries one more number: a European network with fifteen million subscribers ran all of its addressing and numbering on a core team of four people, one of whom was their manager — and those four were about to be outsourced too.
Six years later he turned all of this into a parable about a toilet. In a large organisation a toilet runs and won't flush; a week of phone calls, legal involvement and escalation establishes who is responsible. A handy colleague says he can fix it in ten minutes, but he'd have to go into the wall. So management meets daily: who is liable if he damages the wall, does insurance cover his injury, and the outsourced facilities partner has let it be known that clients may not tinker with installations under its management. HR drafts a waiver; the colleague refuses to sign; tens of thousands of litres run away. One building over, the same toilet breaks, an employee walks to the van, gets the right tools, and it is fixed by 09:30. Management never hears about it.
The difference? The second organisation "is of the technology" and could deal smoothly with a technical challenge. Hubert's name for the first state is learned helplessness: as long as we treat IT as something you have to phone someone about, we get nowhere.
Twenty-five years, from genomes to vaccines to 5G to government server rooms, all saying one thing: we are systematically losing the ability to open something up and look inside, and that loss is more dangerous than any particular vendor.
Glossary (the handful of ideas this page assumes, one line each)
The Botlekbrug is a lift bridge in the Rotterdam port area. It opened in 2015 — a new bridge. It has jammed roughly 250 times, and in its early years managed about seventy-five failures a year.
This is not a small matter: it is the one way truck traffic gets from A to B. So things developed. The bridge acquired its own website publishing its outages. It acquired its own SMS subscription service that texts you when it breaks — text "BBRUG AAN" to 3669, and Hubert takes care to add "not kidding." Management even stationed an engineer full-time in a van beside the bridge, on hand the moment it failed. That halved the downtime.
Three years went by and nobody knew why it kept failing.
The eventual cause: inside the bridge sits a server managing its state and its sensors, and its ethernet cable, or port, was rotten.
Hubert told this story in a talk for the Dutch national cyber security centre, and the line that matters is the one he added afterwards:
And during that two-year period, everyone thought, it cannot be the computer. No one came and said, shall we just replace all the cables and ethernet ports for once and see what happens? We lacked the expertise.Cyber Security: A Pre-War Reality Check, 14 May 2024
Then a nastier guess: maybe they solved it by accident, because someone needed that cable for their other computer.
"This is a sign that you do not have control over your own infrastructure. That you have a major bridge and for three years long, you do not manage to find out what is wrong with it. And I worry about that."
Bert Hubert is Dutch, a programmer by trade. In 1999 he founded PowerDNS — software that answers "which machine is this address on" — which still runs in the racks of a great many European telecom operators. He wrote RFC 5452, the standard whose job is to make DNS harder to fool with forged answers. The company was later sold to Open-Xchange, of which he was a shareholder.
In 2020 he joined a Dutch intelligence oversight board, which he has since left. His own about page puts it flatly: "In 2020, I joined a government oversight board, which I have since left." These days he is a (in his own word, "very") part-time technical advisor at several government departments, including the Dutch Electoral Council.
One detail with a picture in it: he builds his own hardware and writes his own software to monitor every navigation satellite in the sky (the project is galmon.eu), and when Galileo suffered its great outage in 2019 he was one of the few people able to explain from the outside what had happened. Another: the Netherlands has an enormous storm surge barrier called the Maeslantkering, not far from his house, and he mentions in a talk that he sometimes just goes there to look at it, because he appreciates it.
He writes in Dutch and English by turns. Europe and Dutch politics get Dutch; DNA, C++ and climate mostly get English; the important pieces often get both. The site carries 373 posts from 2014 to today, still growing, the most recent dated 14 September 2026. All free, no paywall.
The question he has not put down in twenty-five years is not "who should we be afraid of." It is: do we still recognise the things we depend on every day?
There is a date and a place where he hit it. January 2020, with all of Europe arguing about whether 5G should use Huawei equipment. That debate carried an implicit picture of the world: operators procure equipment; their own staff get trained, unpack it, test it, configure it, build the network; their own staff run and monitor it; if the equipment behaves strangely — sending data to outside servers, say — their own people would notice and investigate; when the vendor ships a software upgrade, the operator tests it before installing; sensitive things like call detail records are handled in-house; when police arrive with a warrant, the data is extracted from systems under full local control. Governments believe this picture too, which is why they require key personnel at national providers to hold security clearances.
Inside that picture, 5G is a procurement question: pick the wrong vendor and this fine local control is upset.
Hubert's vantage point told him the picture had stopped being true long ago. PowerDNS and its parent had made customers of most of Europe's large telecom operators, so he had seen these companies from a supplier's side; and his earlier work in national security had shown him how governments actually "interact" with telecoms. So he wrote: this particular Rubicon has long been crossed.
In reality, most service providers have not been operating on this model for decades.5G: The outsourced elephant in the room, 20 January 2020
That moves the whole problem. If control left the building years ago, then "Huawei or Ericsson" is not the axis of the security question at all — it only asks who you would like to hold the thing you no longer hold. The real question is what you have left.
It never left him after that. It grew into the bridge nobody could diagnose for three years, into moving an entire government onto American clouds in 2025, into the toilet nobody was allowed to fix in 2026. The subject keeps getting bigger; the sentence underneath stays the same: when something goes wrong, is there anyone in the building who can do it themselves?
In 2001, a Dutch programmer who wrote DNS software got curious and started reading the human genome as code. He is candid about it in the opening line: "This is some rambling by a computer programmer about DNA. I'm not a molecular geneticist." Twenty years later he added an update underneath: "20 years after starting this post, I can fake it reasonably well."
What he noticed gets better as it goes. The human genome is about three gigabases, which comes to 750 megabytes — his benchmark at the time was that this is "only 3.6 Mozilla browsers," and he was audibly startled that browsers had shrunk. 97% of it is commented out: the stretches that should not be decoded are marked very clearly, comments almost always opening with GT and closing with AG, functionally /* and */ — except that because the comments must be physically snipped out and the ends rejoined, they behave more like HTML comments, with longer markers at both ends.
Onward: nearly every cell carries the entire genome, but a liver cell has no use for the code that makes neurons, so something has to switch the rest off — "the genetic code is full of #if/#endif statements" — and stem cells are precious precisely because their code hasn't been #ifdeffed out yet. Cells are not spawned but forked, and a fork that won't stop is a tumour — which is why the cell is riddled with ulimits and watchdogs.
The loveliest passage he calls holy code. Some code nobody remembers writing or why; we only know it works, so nobody touches it. The genome has this. The histone genes H3 and H4 govern how the genome itself is stored, and any failure there rapidly produces a non-functioning organism — so their effective mutation rate in humans is 0.00, and you share almost exactly the same code with chickens, with grass, with moulds.
And there is the Makefile. Homeobox (HOX) genes only trigger other genes and build nothing themselves, exactly like a Makefile. How holy is that syntax? Insert the mouse Hox-B6 gene into a fruit fly and it can substitute for the fly's own gene, producing legs where the antennae should be. Flies and mammals parted company hundreds of millions of years ago. The "build a leg" routine is of course radically different in each — but the selector still points at the right instructions.
Then December 2020. The WHO published the full sequence of the BioNTech/Pfizer vaccine, 4,284 characters, short enough for a handful of tweets, and Hubert swung the twenty-year-old hammer, reading it character by character.
The first two letters are GA. They encode nothing, and they must be there — exactly like the MZ that opens every DOS and Windows executable, or the #! that opens every Unix script. "In both life and operating systems, these two characters are not executed in any way. But they have to be there because otherwise nothing happens."
Then the first surprise: wherever a U should be, there is an unfamiliar Ψ. The reason is that the body runs a ferocious antivirus system against foreign RNA — "the original one," as he calls it — and cells work hard to destroy RNA of unknown provenance. Years of experimentation found that if the U is replaced by a slightly modified molecule, the immune system loses interest, while the relevant parts of the cell still accept it as a normal U.
In computer security we also know this trick - it sometimes is possible to transmit a slightly corrupted version of a message that confuses firewalls and security solutions, but that is still accepted by the backend servers - which can then get hacked.Reverse Engineering the source code of the BioNTech/Pfizer SARS-CoV-2 Vaccine, 25 December 2020
He set the vaccine's sequence beside the virus's and compared them codon by codon. Almost every difference falls in the third position of a codon — and the universal codon table shows that the third position usually doesn't change which amino acid you get. In other words the changes are synonymous: the sequence differs, the protein is identical. So why bother? He counted, and found that all the changes but one produce more C and G — and RNA richer in C and G is translated into protein more efficiently.
The single change that adds neither C nor G (CCA to CCU) fascinated him, and he asked his readers about it in the article. Readers replied that it may prevent a hairpin forming in the RNA, and he folded the answer back into the text.
Finally, the only two changes in the whole sequence that genuinely alter the protein: two amino acids replaced by proline. He explains why those two are worth triple wages. On a real virus the spike is mounted on the virus body; the vaccine makes spikes and no body, and a free-standing spike collapses into a different structure. Injected as-is, your body would diligently build immunity against the collapsed shape — and then the real virus arrives wearing the spiky one, and the immune system doesn't recognise it. In 2017 someone found that a double proline substitution in exactly the right place holds the spike in its "pre-fusion" configuration even outside the virus, because proline is a very rigid amino acid: a pair of splints.
His verdict on the discoverers is the funniest line in the piece: they "should be walking around high-fiving themselves incessantly. Unbearable amounts of smugness should be emanating from them. And it would all be well deserved." He later updated the post to report that the McLellan lab had been in touch: the high-fiving was subdued, on account of the ongoing pandemic.
The article was read by 1.7 million people, translated into more than thirty languages, and sent him off to write a book about DNA. What made it possible was not that he knows molecular biology — he hands the whole lipid-delivery section away, calling it "the lipid and delivery parts of the vaccines that I am not competent to describe. Luckily Derek is!" What made it possible was something plainer: the document was public, and he actually read it end to end.
The most damaging part of the 2020 5G piece isn't the argument. It's a run of facts.
Huawei and its close partners were by then already directly running the mobile infrastructure of over 100 million European subscribers. He sets that sentence on its own line and invites you to let it sink in.
Billing went earlier. Since the early 2000s most billing has been outsourced by shipping all call detail records — who called whom, for how long, from which tower, roaming in which country — to systems maintained by third parties, frequently in Israel or China. His comment:
In this way, there is no need to plant backdoors - data willingly gets sent out to systems under control of third parties.5G: The outsourced elephant in the room, 20 January 2020
Outsourcing comes in chains. He describes one major mobile provider that outsourced IT to Tech Mahindra, which in turn talks to Ericsson, who finally operate the network — while Ericsson has itself shipped many functions to countries where staff is more affordable. Another large Dutch operator handed most of its technical staff over to Huawei; half of its freshly built and well-designed headquarters has stood empty ever since, and what remains in the other half are IT architects who, in his phrase, do not get closer to actual operations than an Excel sheet or a Visio diagram.
And one number that reads like a dark joke: a European network with fifteen million subscribers now relies for all addressing and numbering on a core team of four people, one of whom is their manager. After years of failed attempts, those four will now be outsourced as well.
From that pile of facts comes the conclusion with no reply to it. All the worry about the Chinese disrupting our communications through backdoors ignores something simpler: to disrupt our communications, all they'd need to do is stop maintaining our networks for us.
What about contracts? Operators know the risks, so the risks live in contracts and service level agreements — Chinese companies won't disrupt our communications, because a contract says so; vendors commit to using our data only for the stated purpose, so our billing records are ring-fenced from foreign intelligence, because a contract says so. His answer is a professional's cold laugh: everyone with even a modicum of experience in national security knows such agreements aren't worth the paper they are written on — and in any case most European laws, like American and Chinese ones, contain provisions where government warrants trump any customer privacy commitment.
So his answer is not a different vendor. His answer is people: in order not to have to trust vendors, wherever they come from, the whole company must skill up and be in actual control of the network and its operation. "It is not enough to have a security department full of good intentions." He throws cold water on open source in the same breath: open source is only transparent to people with the right kind of skills.
Five years later the same argument changed target. In February 2025 he wrote that it is no longer safe to move our governments and societies to US clouds. The trigger was legal — the machinery underpinning EU–US data transfers had been gutted — but his real fire is aimed at the old question: why did we get here? The answer he finds unbearable is: convenience.
But this brings us to the unbearable conclusion that we are entrusting all our data and business processes to the new King of America … because we can't be bothered to get used to a different word processor.It is no longer safe to move our governments and societies to US clouds, 23 February 2025
Worth recording is what he says in the same piece about changing his own mind. His more activist friends, he writes, "rightly accused" him of fooling himself: his earlier position had been "at least let's not move everything to America," which quietly conceded that most systems would still be handed over. He accepted the criticism and put it in print.
Then the 2026 toilet parable (the short version of this page tells it in full). Compressed: a toilet runs and won't flush; a handy colleague says ten minutes, but he'd have to go into the wall; management meets daily about liability and insurance; the outsourced facilities partner declares that clients may not tinker with installations under its management; HR drafts a waiver; the colleague refuses to sign; tens of thousands of litres run away. One building over, the same toilet breaks, an employee walks to the van for the right tools, and it is fixed by 09:30 — management never hears about it.
The difference is one thing only: the second organisation "is of the technology" and could deal smoothly with a technical challenge.
Hubert's question is whether you are, in fact, in this line of work. The Dutch government is by a wide margin the country's largest processor of information and leans on an almost unimaginable quantity of IT systems — and treats IT exactly as the first company treated its toilet: as not really our thing. He twists the knife: there are plenty of capable colleagues inside government who could tackle these problems, but they are not allowed to. It has to go through the proper structures, preferably via contracts with external parties. That gives comfort.
Zolang we IT beschouwen als iets waar we "mensen voor moeten bellen" komen we nergens.("As long as we regard IT as something we have to phone people about, we will get nowhere." — written in Dutch)Hoe wordt de overheid weer 'van de IT'?, 14 September 2026
His name for the condition is learned helplessness — and he insists it is cultural, not technical, which is why a grand technical plan won't fix it. He quotes a Dutch MP for the diagnosis: IT is the digital Bermuda Triangle of your political career. Anyone attached to their future in government knows to stay well clear.
His prescription is not a grand plan either. It is to pick one or two small but important projects and actually do them in-house — a video conferencing system of one's own, say, or bringing the national identity login back home — so that the feeling returns that we can still do things ourselves. Because what is stuck, in his reading, is not the technology but confidence: first seeing, then believing.
In January 2024 the computing pioneer Niklaus Wirth died. He had written a well-known article in 1995 called "A Plea for Lean Software," and Hubert wrote the thirty-years-on version as a memorial.
He opens with facts. If in the past year you ran Ivanti, MoveIT, Outlook, Confluence, the Barracuda Email Security Gateway or Citrix NetScaler, chances are you got hacked — and we continue to rely on all of them. Software is now so dangerous that we tell everyone not to run it themselves, and to leave it to an "as a service" provider or the cloud. His analogy: as if cars were so likely to catch fire that the advice is not to drive one yourself, but to leave it to professionals who are always accompanied by professional firefighters.
He splits security into two factors: the density of problems in the source, and the sheer quantity of exposed code. "Quantity has a quality all of its own," as the US defence community liked to say — and in software it runs the other way: the more you have, the more risk you run.
His example is painfully precise. iPhone users were hacked repeatedly for years because of the attack surface exposed by iMessage: anyone can send an unsolicited iMessage, and the phone immediately processes it to build a preview. Apple decided such messages needed to support a vast array of image formats, accidentally including PDFs, including PDFs with weird embedded compressed fonts using an ancient format that effectively included a programming language. Attackers got to feast on bugs across probably millions of lines of code. As he says: you don't need a high bug density to find an exploitable hole in millions of lines.
What baffles him is that Apple could have prevented all of it easily — it is their platform, they don't need to interoperate with anything, they could have restricted previews to a small set of known-good formats. They didn't. And in 2023 they added support for a new image format so important it had to go outside the security sandbox. It was exploited again.
Then how we ship. Wirth lamented in 1995 that software needed whole megabytes, while his own Oberon operating system fit in 200KB including an editor and a compiler. Hubert's update: there are now likely projects with more than 200KB of YAML alone. A typical app today is built on Electron, bundling both Chromium and Node.js — at least fifty million lines with dependencies, by his estimate — then pulls in hundreds or thousands of Node modules, which pull in more, changing daily, with nobody really knowing what is in there. If the app controls anything in your house, it also talks to another stack at Amazon, also Node, also full of dependencies nobody has counted.
Hence: we are likely looking at 50 million+ lines of code active to open a garage door, running several operating system images on multiple servers.
Most writers would stop there. Hubert went and wrote code.
Writing has been called the process by which you find out you don't know what you are talking about. Actually doing stuff meanwhile is the process by which you find out you also did not know what you were writing about.A 2024 Plea for Lean Software (with running code), 18 January 2024
What he wrote is Trifecta, a self-hostable image sharing site — because for years he'd had to use imgur, which not only installs trackers in his own browser but forces them onto everyone who views an image he shares. 1,600 lines of new source code and around five important dependencies, and the feature list is complete: full user and session management, drag-and-drop for multiple images, multi-image posts, optional titles and captions, public or time-limited posts, passwordless sign-in by email link, lost-password flow, one cookie locked tight to the site, shipping as source, binary, docker, .deb and .rpm. And the line he cares about most: "Source code small enough you could read all of it in a day."
He lists the controls too. Another image sharing solution ships as a 311MB Docker image — he concedes it looks better and has more features, "but not 308MB worth of them." A Node-based equivalent clocks in at 1,600 dependencies and four-odd million lines of JavaScript.
The funniest part is the response. The most common reaction he got was that he should deploy it using a whole bag of AWS services — to a project whose stated goal is standalone software that does not rely on external services. His entire reply: "I'm not sure what is going on here."
He closes with two lines of Wirth's from thirty years earlier. One: "Increasingly, people seem to misinterpret complexity as sophistication, which is baffling — the incomprehensible should cause suspicion rather than admiration." The other speaks for every programmer who ever shipped under a deadline: "Time pressure gradually corrupts an engineer's standard of quality and perfection. It has a detrimental effect on people as well as products."
This idea predates the others — he wrote it in 2016 — and it is the invisible foundation under everything he later says about Europe.
The complaint opens with a jab: "'In a world where change is the only constant' is a lie. It took this world 20 years to invent a decent can opener." Most writing about innovation, he thought, was vapid, concerned with what he calls zeroth order invention: rearranging well-known pieces of technology into new shapes. Uber, AirBNB, Snapchat and Slack are the exhibits — some of them let us do wonderful new things, but almost all of their innovation sits in the (non?)business model, because the technology was all off the shelf: GPS, Web, databases, reviews, and that 1988 invention called IRC.
His counterfactual is lovely. Imagine Uber starting in 2001. It would have had to deliver reliable GPS itself, run on genuinely slow mobile networks, and invent feedback algorithms for ranking drivers and riders. With enough funding and energy it could have been done — and that "Uber2001" would have helped invent the future. Instead it launched in 2010, when apps, mobile networks, precise positioning and review technology were all established, and it "only" had to roll out.
First order innovation is when the thing you want is not possible with reliable, available technology, so you have to invent something, or productise research-grade ideas into something that actually works. His example is Google in the late 1990s: search simply could not index the internet fast enough or usefully enough, because nobody had ever needed to index such stupendous amounts of widely distributed, unstructured, fast-changing information. HotBot and Altavista could not do it.
The frightening one is second order: you have to invent things so you can invent the things you need. His best-documented case is Bell Labs. To get a telephone call from New York to San Francisco they first had to invent a good enough conductor of voice, trying iron, then copper, finally twisted pair; that got them about 1,700 miles, not far enough. So they picked up a poorly understood amplifying device called the Audion, researched it, fixed what was wrong with it, and turned it into the first practical vacuum tube — ancestor of the transistor — delivering the first New York to San Francisco voice call in 1915. Later they did invent the transistor, and it didn't work well because of impurities in the materials: early transistors were so sensitive they could stop working if someone waved a hand or slammed a door, and simply touching one broke it. So Bell Labs went and innovated in metallurgy too, inventing zone melting, which finally enabled production-grade semiconductors. Lockheed's Skunk Works, likewise: titanium turned out to be the right material for supersonic aircraft, so they had to invent the tooling that could machine titanium.
So in short — they had to invent things to invent things to invent things.How About Some Actual Innovation, 17 April 2016
Why the ladder matters: it sits underneath all of his European writing. What he keeps saying is not "Europe needs more startups" — Europe has no shortage of zeroth-order startups. It is that a place which buys in its equipment, its operations, its billing, its cloud and finally its understanding is losing even the standing to attempt order one, let alone order two. And order two is where the future actually gets made. The practical ask at the end of his 2025 piece is the last stop on this same line: European governments should occasionally have the guts to buy something else, because innovation doesn't just happen without the promise of revenues — and spending even a few percent on alternatives would mean billions of euros.
With a writer of twenty-five years, what transfers is usually the method rather than the conclusions. His method has a few clear rules, and every one of them can be pointed at in the text.
Go read the thing itself, not the discussion about the thing. This runs through everything. Mid-way through the vaccine piece he tells the reader: "When in doubt, head to the WHO document with the digital code to see for yourself." The DNA page hands you the genome browser in its opening paragraph. The climate piece ships a Jupyter notebook. The whole argument of the performance post compresses to: stop guessing, go get a call-graph profile.
Distrust jargon that can't be falsified — and distrust your own cleverness. In 2016 he devoted a section to "broad brush optimizations": don't use reference counted pointers, use lock-free code, stay away from the STL. Such advice survives, he says, precisely because it is very hard to implement or refute. The next section is titled "The mindset: the cpu / compiler / library / operating system / language is an idiot." That mindset goes back to the 1980s, when it was true — xor ax,ax really was faster than setting ax to zero. But today the obvious optimisations have mostly been done for you, by a compiler and a CPU that "know a lot more about what your code is doing than you do." He has watched too many projects avoid virtual methods only to reimplement them badly as a switch statement at the top of every function — a tangible step backwards, since compilers can often devirtualise calls and your switch cannot.
Build it, then publish the code and the data. Trifecta is this. So is galmon.eu's satellite monitoring. So is SkewDB, a database of skews for over 30,000 chromosomes and plasmids, which ended up in Nature Scientific Data. So are bagconv, which makes the Dutch buildings and addresses database usable, and tkconv, which turns Dutch parliamentary open data into a working website and a SQLite database. He has defined the habit himself: writing shows you that you don't know what you're talking about; doing shows you that you didn't know what you were writing about either.
Say up front what your model is not. This is the most overlooked and most worth stealing. His long piece on global warming calls itself a spherical cow and gets out ahead of the objection:
Very important to note is that our "spherical cow"-grade model is of course not correct (no model is), but it strives to be educational and capture the key effects.A Spherical Cow Model of Global Warming (With Data and Code), 25 September 2023
He then fences off his inbox, and the phrasing is very him: "I'm VERY interested in hearing about mistakes in the calculations that follow, but there is no need to tell me the model is a huge simplification. There is also really no need to send me alternative research that somehow refutes the reality of global warming!"
Say publicly what you don't know, and point at who does. The entire lipid-delivery section of the vaccine article is handed to the pharmaceutical chemist Derek Lowe, on the grounds that it is "the lipid and delivery parts of the vaccines that I am not competent to describe. Luckily Derek is!" These handovers are everywhere in his writing — and they are exactly what licenses him to be so hard-edged on his own patch.
Say it straight, especially to technical people. He wrote a short piece about this in 2017, prompted by complaining to his office manager that the cleaners wouldn't listen to him. She asked what he had told them. He explained that he had "indicated" that the corridor on the third floor had seen cleaner days. She diagnosed it on the spot: he had been telling a story and dropping hints rather than saying what his problem was.
Do not put your important message between the lines. (…) When in doubt: be explicit. It will almost never hurt. Just leave us some room on the "how".Talking to Technical People, 7 July 2017
His excuse for why engineers are bad at reading hints is his wittiest line: "Something had to give when we learned 15000 pages of expert and arcane knowledge, and this was it."
The last item is closer to character than method, but it sets the quality of everything above: he changes his positions in public and names who changed them. In the 2025 piece he records that his activist friends "rightly accused" him of fooling himself. In 2023's On Being Useful he confesses to a scheme he once designed that looked perfect on paper — a trifecta of PhD students, industry and academic funders cooperating to train scientific programmers — "a real win-win-win." It took him months to discover that his own role in it would consist of years of getting agreements in place, persuading universities and fighting institutional inertia, and that the prospect was just too depressing to ponder. So he didn't do it. The lesson he takes is more useful than any career advice: it is not enough to find something important that you happen to have the skills for — you also have to be sure the actual work is something you can stand. "Does this get me out of bed on Monday" is the question to ask.
The hammer problem, which he put in his own subtitle. The long DNA page is subtitled "or, If you are a hammer, everything looks like a nail," and he states in the opening that he is "not trying to force my view unto the DNA." The self-awareness is real. But an article translated into many languages and treated as the best on-ramp from programming into molecular biology still leaves hundreds of thousands of readers with one impression: that life is readable code.
What makes this more interesting is that the strongest rebuttal to that impression is also his. In 2019's "Is biology too complex to ever understand?" he produces molecular biology's hydrogen atom — the lac operon, three genes, studied for six decades, skipped by no textbook. The result: the textbook picture is "woefully incomplete," and he judges that it is likely possible to write a 1000-page textbook covering nothing but the lac operon. He notes too that lac does not, as the textbooks have it, trigger on a lack of glucose; it senses an excess of a chemical that builds up when glucose stops being transported in — the kind of thing that is rife in life, and that shows clearly it was not designed by any human sort of designer.
There is no rule that says nature can not be more complex than our brains can handle. And after billions of years of evolution, why should it be simple?Is biology too complex to ever understand?, 7 December 2019
There is a genuine crack between those two pieces. He has not closed it and does not intend to. Readers should carry it themselves: the code metaphor is an excellent lift, but it will make you think the building has fewer floors than it does.
The soft spot in the sovereignty argument, which he also worked out himself. His end-of-2025 review of the European cloud situation is the most honest thing on the site and the sharpest challenge to his own programme. His finding: buyers will not lead, since they mostly care about next quarter's results; governments will have to lead, but are ill-equipped; and Europe's own cloud and hosting providers aren't charging ahead either. More concretely: European governments and enterprises are bound hand and foot, and rarely even manage to switch a service from one US supplier to another US supplier, because they built on services specific to Amazon, Azure or Google. Therefore —
So even if you'd show up with a perfectly fine European cloud that offers the same sort of things as (say) AWS, companies and governments would not flock to it.The European Cloud Situation at the end of 2025, 23 December 2025
He adds a take from several industry operators that even he calls cynical, while conceding it rings true: if all of Europe's industry relies on US clouds and something eventually goes wrong, we all go down together and no one specifically gets blamed.
That lights up a hole in his own programme. The diagnosis is sharp, and so is his analysis of why nobody moves — nobody is rewarded for averting a future theoretical risk. But his call to action tends to land on willpower: "Have the courage to use different software and services. Even if it takes some getting used to." Translating twenty years of missing product investment, plus a thicket of proprietary dependencies grown into live business processes, into "getting used to a different word processor" is rhetorically strong and engineering-light. The examples he can actually point to are few — the German state of Schleswig-Holstein has gone live with a sovereign solution for 80% of its staff, and several Austrian ministries are making strides — and he calls these "one of the very few places we can point to." He is right that this shows the size of the problem. But a programme that can name only a handful of exhibits after five years may be short of more than courage.
An asymmetry of stance. The 2020 5G piece contains a fine piece of self-discipline: he quotes the Financial Times reporting a room of telecom operators asked whether the Chinese could eavesdrop through backdoors in Huawei equipment — every hand went up — and then, for balance, whether the US could access communications through key Cisco equipment: "All the hands went straight back up without hesitation." He wrote plainly then that many of the arguments about China work just as well on the US. By 2025–26 that symmetry has all but vanished from the text, with the fire aimed at the American side. Given what actually happened in those years — the legal machinery for EU–US transfers dismantled, Microsoft conceding it cannot shield European data from US snooping, the International Criminal Court affair — the shift has good reasons and isn't a double standard. But readers should notice for themselves: his analysis of the cost of dependence is extremely fine-grained; his analysis of the cost of building your own is noticeably coarser.
On critics: in preparing this page I went looking for substantial, named criticism of him in the original. The most relevant item I could find is Computer Weekly's "Dutch cloud pioneers face the hard limits of digital sovereignty," which I could not open — so I will not repeat the argument of a piece I have not read. Recorded here as a bibliographic fact only: such challenges exist, and the headline points at feasibility rather than motive. Everything specific in this section comes from what he wrote himself.
/* and */, tumours as fork bombs, histones H3 and H4 as holy code nobody dares touch, HOX genes as the Makefile.This page also draws on: Cyber Security: A Pre-War Reality Check (2024-05-14, the Botlek bridge), Ben je van de IT of niet? (2026-07-15, the toilet parable), Hoe wordt de overheid weer 'van de IT'? (2026-09-14), It is no longer safe to move our governments and societies to US clouds (2025-02-23), The European Cloud Situation at the end of 2025 (2025-12-23), How About Some Actual Innovation (2016-04-17), Optimizing optimizing (2016-09-22), Talking to Technical People (2017-07-07), On Being Useful (2023-07-01), A Spherical Cow Model of Global Warming (2023-09-25), Do not invite big-tech to join your digital autonomy discussion (2026-06-16), and the vaccine source code, part 2 (2020-12-31).