My day job is with a vendor of IT security solutions. Alongside that I build software I run myself: a web server, a CMS and, for some time now, a programming language optimised for AI.
I have spent my whole career between sales and engineering. What I sold was always a solution, never a product: a customer has a problem, and I have to understand it before I can offer anything. Today I talk with CISOs and IT leaders at companies across very different industries: banking, insurance, manufacturing and more.
Privately I believe in open source and I am a big fan of OpenBSD. Software I use, I want to be able to read and check.
Since Claude Mythos, the world of IT security has changed. We used to have weeks to close vulnerabilities; today, once a vulnerability becomes known, it takes less than 24 hours until active attacks show up in the wild. So it is essential to patch or mitigate within that window. That only works autonomously and with reliable solutions. I am glad my employer offers exactly the right solution here.
I have been running the Hiawatha web server since 2010. My enthusiasm for the project made me a contributor: I designed the HTTP/2 implementation and the sandbox. I am currently working on a CDN solution: Hiawatha behind an edge, so it can defend itself properly when IPs come in through the edge. It is already running on my servers. I also extended the reverse proxy, so there is now an HTTP/2 reverse proxy. These solutions will find their way into the official Hiawatha step by step.
The current situation with PHP2Shell and Node2Shell showed me that my approach is exactly right: a single binary via FastCGI behind Hiawatha. I dropped PHP a while ago. My CMS Lucy is written in Go and optimised for Hiawatha's ban via CGI.
For some time I have been working on my own programming language: Hilde. I was looking for a language that gives AI less room to introduce serious bugs. We have seen enough of the classic C bugs lately, double free and use after free; PHP2Shell is a fine example.
The names sound playful, and that is allowed: Hilde is my cat, Wolly her brother. Still, every letter says what is inside. HILDE stands for High-Integrity, Linear, Deterministic, Explicit: reliable code, every resource used exactly once, predictable results, and nothing happens behind your back. The framework WOLLY stands for Web-ready, OpenBSD-first, Linear, Lean, Yours: ready for the web, built for OpenBSD first, with the same strict rules as Hilde, lean, and in the end it belongs to you.
I found the dormant Austral project, which essentially describes what a language should look like, and forked it as the base for my own language. What Fernando Borretti did really well: his language emits C code plus a prelude.c that provides everything needed to build that code with gcc, clang or zig.
Contracts (requires/ensures) on every public function. Linear types: use a resource twice or forget it, and it does not compile. A pattern match that leaves out a case does not compile.
Structured concurrency with scoped tasks and linear channels; deadlocks are reported. Raft as a pure state machine. SPERLI spreads computing work across several machines over the network, as a simple replacement for MPI.
SQLite in the language, queries checked against the schema at compile time. Encrypted with SQLCipher and a linear key that is wiped after use. Replicated through the Raft log.
Sandbox as part of the language: pledge/unveil, Landlock/seccomp, Seatbelt. Post-quantum signatures (ML-DSA and ML-DSA-44 + Ed25519). A vault for encrypted secrets in .env files.
JSON error messages, hilde query, fmt, LSP and llms.txt. A package manager where every command takes --json. Jinja2 templates are checked at compile time.
hilde test runs TSan, ASan/UBSan and Valgrind over the generated C. Regular expressions in linear time. Compiles to C and wasm, gated on Linux, FreeBSD, macOS and OpenBSD 8.0.
More is in progress.
Rights, Accounts, Multi-factor, Bearer tokens & OAuth
Built in Hilde and already in active use, including passkeys. It is how I log in to Lucy, Tweety and Lucio.
Lightweight Unified Content Yielder
My CMS, which runs this site.
Tracking, Watchlists, Events, Evidence, Trends & Yields
My WorldMonitor replacement.
LLM Unified Control, Integration & Orchestration
My own AI development tool.
ERP
My ERP, in Go today, in Hilde after Hilde 1.0.
Browser extension
I built Inga to test Lucy: it shows what Lucy delivers and checks load times through Cloudflare.
Once Hilde is ready for version 1.0, which will be soon, I will migrate Lucy and my ERP Tessa from Go to Hilde. Hilde, its framework Wolly, RAMBO and Lucy will be released as open source on GitHub.
Hilde started as a feasibility study: does AI (Claude Code) really write better code? Hilde is of course not in Claude's training data, yet it has already won that bet so far.