Your assistant. Your machine. Your rules. Unlike SaaS assistants where your data lives on someone else’s servers, OpenClaw runs where you choose—laptop, homelab, or VPS. Your infrastructure. Your keys. Your data.

OpenClaw is an open agent platform that runs on your machine and works from the chat apps you already use

WhatsApp, Telegram, Discord, Slack, Teams

Two months ago, I hacked together a weekend project. What started as “WhatsApp Relay” now has over 100,000 GitHub stars and drew 2 million visitors in a single week.

He talks about the intended audience for his work, whom he is speaking to. “My work addresses black [American] people, everybody else gets to listen in.” How having a limited imagined audience for your work is not an exclusionary act. How it is something that breathes life into the work, injects meaning and passion into a creative expression, impossible to achieve if that work would have been imagined for everyone. After which that life, meaning and passion can be appreciated as well by anyone outside those that are originally being addressed.

He talks about the spectrum between good and bad, hence the title of the interview ‘not all good, not all bad’. That us typically wanting to pigeonhole someone or something as either good or bad, before finding out an aspect about it that doesn’t fit, should not lead to then fully switching to labeling it the opposite. You have to get comfortable with the discomfort of juggling different and opposite notions about someone or something at the same time.

met de overheid en andere marktpartijen

Digitale soevereiniteit gaat over controle op drie niveaus: geografisch, juridisch en operationeel. Als data en kritische bedrijfsprocessen in datacentra binnen Nederland of Europa staan, dan ben je geografisch en juridisch in control, omdat deze datacenters vallen onder Nederlandse en Europese jurisdictie. Dat is echter niet voldoende, want voor digitale soevereiniteit is ook operationele controle nodig.

Niet altijd zal de nieuwe software dezelfde functionaliteit hebben die men gewend was. Minder functionaliteit tegen hogere kosten kan een gevolg zijn van de keuze voor autonomie.

geografisch in control? Mag ik zelf beslissen waar mijn systemen en data staan?

juridisch in control? Wat is het risico dat ik mijn data verplicht moet overdragen aan een derde, niet-Europese partij?

operationeel in control? Wat is het risico dat de aanbieder de voorziening afsluit; heb ik een mogelijkheid tot een exit met behoud van mijn data?

Het lijkt in het huidige debat alsof de hele overheid voor haar digitalisering moet overgaan naar autonome of soevereine toepassingen, en wel meteen. Dat is echter niet haalbaar en ook niet nodig. Het begint met het maken van heldere keuzes voor welke data en systemen digitale autonomie en soevereiniteit nodig zijn, en voor welke niet. Zodat vervolgens in een realistisch tempo en haalbare stappen de overgang ingezet kan worden.

Daarom is voor digitale soevereiniteit ook operationele controle nodig. Dat realiseer je door waarborgen in te bouwen, die je in staat stellen om de controle te houden. Dit wordt bepaald door de keuze en een specifieke implementatie van de componenten waaruit de cloud is opgebouwd. Software van niet-Europese partijen kan binnen die veilige kaders nog steeds gebruikt worden. Nog beter is het om toepassingen te gebruiken van Nederlandse of Europese aanbieders. Ook dan zijn waarborgen nodig, zoals afspraken over verkoop aan ongewenste partijen.

Digitale autonomie gaat over het zelfstandig keuzes kunnen maken in het digitale domein. Het gaat over het behouden van beslissingsbevoegdheid, zonder volledige onafhankelijkheid. Digitale soevereiniteit gaat een stap verder. Het betekent volledige controle en zeggenschap over data, digitale infrastructuur en technologieën.

The choice is ours. We simply need to choose whom we admire. Whom we want to recognize as successful. Whom we aspire to be when we grow up. We need to sing the praises of our true heroes: those who contribute to our commons.

Supporting Forgejo with work on dependency features would help too. The goal would be feature parity with GitHub and GitLab so self-hosted forges work with the same security tooling.

Procurement requirements could include open supply chain tooling. If an agency requires SBOMs, they could also require that generation doesn’t depend on proprietary services. If they require vulnerability scanning, the scanner could consume open advisory databases. Germany’s ZenDiS and openCode.de initiatives are relevant here. Connecting them with existing open solutions would be more efficient than starting fresh.

The strategy is to unbundle the parts of a package manager and standardize them individually. Registry APIs, dependency graphs, vulnerability feeds, update notifications. Each piece can be commodified without replacing entire systems. Eat the elephant one bite at a time.

Treat dependency intelligence as infrastructure worth funding directly. The Sovereign Tech Fund model applies: direct funding to open source projects that serve as foundations. Ecosyste.ms, VulnerableCode, OSV, PURL implementations, CycloneDX/SPDX tooling, Forgejo’s dependency features all fit this category.

What governments and funders could do

The gap between these columns is where standardization would reduce switching costs. Not building a European deps.dev, but defining a common dependency graph API. Not building a European Dependabot, but standardizing how dependency updates get proposed. A protocol for package management could let different implementations compete on the same interfaces. GitHub and GitLab bundle dependency features into their platforms: dependency graphs, vulnerability alerts, automated updates. A self-hosted Forgejo or Gitea instance doesn’t have equivalent tooling. But if those features were built on open standards and open data sources, switching forges wouldn’t mean losing supply chain visibility. The dependency intelligence could come from any provider that implements the same interfaces, rather than being locked to the forge vendor. Some gaps need new standards rather than adoption of existing ones. There’s no good specification for package version history across registries. Codemeta describes a package at a point in time, not its release history. PkgFed proposes using ActivityPub to federate release announcements, similar to how ForgeFed handles forge events.

Most standards work in this space focuses on compliance artifacts: SBOMs for the Cyber Resilience Act, attestations for procurement requirements. Less attention goes to the underlying tools developers actually use. The dependency graph that feeds the SBOM generator, the metadata lookup that powers vulnerability scanning, the notification when a new version ships.

Other areas don’t, which keeps switching costs high. Dependency graph APIs vary by platform, vulnerability scanning integration is proprietary per forge, Dependabot and Renovate each have their own config format, and package metadata APIs differ across registries.

some areas have formal specifications. PURL provides a standardized way to reference packages across ecosystems. OSV and OpenVEX let advisory data flow between systems. CycloneDX and SPDX handle SBOMs. SLSA, in-toto, and TUF cover provenance. OCI standardizes container images.

Eaves’s commodification argument depends on standards to reduce switching costs. In the package management landscape, some de facto standards have emerged. Git is nearly universal for source hosting. Semver is the dominant versioning scheme, even if ecosystems interpret it differently. Lockfile formats vary by ecosystem, but they’ve become standards in practice: every dependency scanning company builds the same set of parsers to extract dependency information from all of them. Syft, bibliothecary, gemnasium, osv-scalibr, and others all parse the same formats. I made a dataset covering manifest and lockfile examples across ecosystems, and a similar collection of OpenAPI schemas for registry APIs. These are what made git-pkgs come together quickly.

Dries Buytaert extended this to procurement: governments buy from system integrators who package and resell open source, but that money doesn’t reach the maintainers who build it. If procurement scoring rewarded upstream contributions, money would flow differently. Open source is “the only software you can run without permission” and therefore useful for sovereignty, but it needs funding to work.

Ploum made a related point: Europe doesn’t need a European Google. The European contribution to software has been infrastructure that serves as collective commons: the web, Linux, Git, VLC, OpenStreetMap.

The security and metadata tooling built on top of these registries tends to be US-based regardless of where the registry itself is hosted. A European company running Forgejo for code hosting still typically uses US services for dependency updates, vulnerability scanning, license compliance, and SBOM generation. Self-hosting the forge doesn’t change the intelligence layer.

The package registries follow a similar pattern, with a few European exceptions: Registry Owner Country npm Microsoft US PyPI Python Software Foundation US RubyGems Ruby Central US Maven Central Sonatype US NuGet Microsoft US Crates.io Rust Foundation US Go module proxy Google US Docker Hub Docker Inc US Conda/Anaconda Anaconda Inc US CocoaPods CocoaPods US Pub.dev Google US CPAN Perl Foundation US Homebrew Homebrew US Hex.pm Six Colors AB Sweden Packagist Private Packagist Netherlands CRAN R Foundation Austria Clojars Clojars Germany

The dependency intelligence layer built on top of these forges

Most git forges are US-based: Forge Owner Country GitHub Microsoft US GitLab GitLab Inc US Gitea Gitea Ltd US HuggingFace Hugging Face Inc US

The same logic applies to the software supply chain, though that layer gets less attention in sovereignty discussions than cloud and storage.

Europe shouldn’t try to build its own AWS. Instead, governments should use procurement power to enforce interoperability standards.

If governments required that kind of compatibility as a condition for contracts, smaller providers could compete. Sovereignty through standards rather than state-owned infrastructure.

S3 API became a de facto standard

I’m Andrew Nesbitt. I’ve spent the last decade thinking about package management.

Mais en novembre, le groupe français a répondu à un nouvel appel d’offres, cette fois pour identifier et localiser des étrangers. Cela s'appelle du skip-tracing, et une urgence pour l'ICE. Capgemini rafle la plus grosse part du marché, avec jusqu'à 365 millions de dollars à la clé. C'est écrit noir sur blanc : plus la société française localisera de migrants, plus elle pourra empocher d'argent. Les bonus financiers, en effet, sont basés sur le taux de réussite dans la vérification des adresses des étrangers.

Le champion français des services informatiques compte 350 000 collaborateurs dans le monde, et une filiale américaine installée près de Washington. Celle-ci travaille avec plusieurs agences gouvernementales : ministère de la Santé, des Anciens Combattants et, depuis plus de quinze ans, le département de la Sécurité intérieure. Des contrats que nous avons consultés sur les bases de données publiques. Pour l'ICE, Capgemini gère par exemple un standard téléphonique réservé aux victimes de crimes commis par des étrangers. Une création de Donald Trump.

If proven, these failures would constitute infringements of Articles 34(1) and (2), 35(1) and 42(2) of the DSA.

he Commission has extended its ongoing formal proceedings opened against X in December 2023 to  establish whether X has properly assessed and mitigated all systemic risks, as defined in the DSA, associated with its recommender systems, including the impact of its recently announced switch to a Grok-based recommender system.

The new investigation will assess whether the company properly assessed and mitigated risks associated with the deployment of Grok's functionalities into X in the EU. This includes risks related to the dissemination of illegal content in the EU, such as manipulated sexually explicit images, including content that may amount to child sexual abuse material.

OpenHands demonstrated strong capabilities, particularly for complex refactoring tasks. With better configuration and more explicit instructions about development workflows, it could likely match Copilot's reliability. The open-source nature also makes it attractive, since the entire system can be self-hosted and confugred for every team's or project's needs.

OpenHands: Capable but Requiring InterventionI connected my repository to OpenHands through the All Hands cloud platform. I pointed the agent at a specific issue, instructing it to follow the detailed requirements and create a pull request when complete. The conversational interface displayed the agent's reasoning as it worked through the problem, and the approach appeared logical.

When an agent doesn't deliver what you expected, the temptation is to engage in corrective dialogue — to guide the agent toward the right solution through feedback. While some agents support this interaction model, it's often more valuable to treat failures as specification bugs. Ask yourself: what information was missing that caused the agent to make incorrect decisions? What assumptions did I fail to make explicit?This approach builds your specification-writing skills rapidly. After a few iterations, you develop an intuition for what needs to be explicit, what edge cases to cover, and how to structure instructions for maximum clarity. The goal isn't perfection on the first try, but rather continuous improvement in your ability to delegate effectively.

One effective technique for creating comprehensive specifications is to use AI assistants that have full awareness of your codeba

A complete task specification goes beyond describing what needs to be done. It should encompass the entire development lifecycle for that specific task. Think of it as creating a mini project plan that an intelligent but literal agent can follow from start to finish.

we tend to underspecify because we're exploring, experimenting, and can provide immediate course corrections. We might type a quick prompt, see what the AI produces, and refine from there. This exploratory approach works when you're actively engaged

The fundamental rule for working with asynchronous agents contradicts much of modern agile thinking: create complete and precise task definitions upfront. This isn't about returning to waterfall methodologies, but rather recognizing that when you delegate to an AI agent, you need to provide all the context and guidance that you would naturally provide through conversation and iteration with a human developer.

The ecosystem of asynchronous coding agents is rapidly evolving, with each offering different integration points and capabilities:GitHub Copilot Agent: Accessible through GitHub by assigning issues to the Copilot user, with additional VS Code integrationCodex: OpenAI's hosted coding agent, available through their platform and accessible from ChatGPTOpenHands: Open-source agent available through the All Hands web app or self-hosted deploymentsJules: Google Labs product with GitHub integration capabilitiesDevin: The pioneering coding agent from Cognition that first demonstrated this paradigmCursor background agents: Embedded directly in the Cursor IDECI/CD integrations: Many command-line tools can function as asynchronous agents when integrated into GitHub Actions or continuous integration scripts

isn't just about saving time — it's about restructuring how software gets built.

several of these tasks running in parallel, each agent working independently on different parts of your codebas

You prepare a work item in the form of a ticket, issue, or task definition, hand it off to the agent, and then move on to other work.

While interactive AI keeps you tethered to the development process, requiring constant attention and decision-making, asynchronous agents transform you from a driver into a delegator.

Asynchronous coding agents — also called background agents or cloud agent

why asynchronous agents deserve more attention than they currently receive, provides practical guidelines for working with them effectively, and shares real-world experience using multiple agents to refactor a production codebase.

asynchronous coding agents represent a fundamentally different — and potentially more powerful — approach to AI-augmented software development. These background agents accept complete work items, execute them independently, and return finished solutions while you focus on other tasks.

Further ReadingI’m not gonna pretend to be an expert here (any more than I’m an expert Obsidian plugin developer :p) but here are some resources that helped me figure out Claude CodeKent writes a lot about how he uses Obsidian with Claude Code.This is an incredible hub of resources for using Claude Code for project management, by someone who also uses Obsidian.This take on Claude Code for non-developers helped solidify my understanding of how it all works; it hallucinates less, for one thing.Eleanor Berger has fantastic tips for working with asynchronous coding agents and is incredibly level-headed about the LLM landscape.This article does a great job of breaking down all the nitty-gritty of how Claude Code works.Damian Player has a step-by-step guide on using Claude Code as a non-technical person that goes into more depth.Here’s a tutorial from a pro that breaks down best practices for using Claude Code, like the importance of planning and thinking things through, and exactly why a good CLAUDE.md file matters.

Little Tips for Claude Code + Obsidian

Terminal Practice with GamesSome folks I’ve talked to are a little intimidated by the terminal. Want to practice in a low-stakes way?

As for the privacy concerns? There isn’t anything private in my vault, so I don’t really care about Anthropic access.

My favorite kind of problem is a solvable problem. I know a lot of people who just brute force or deal with their issues, but I try to notice pain points and deal with them. This isn’t just an AI thing, this is a life thing.

Building the habit of delegating — and using language clear and precise enough for a teenaged girl who doesn’t live in my house to understand — has really helped with leveraging LLMs.

and I don’t need to bother my friends to get stuff done.

Suddenly, I can actually make use of the APIs I’ve always known existed.

I’m already finding better ways to batch my tasks. Making smarter to-do lists that include more context

But these days I’m not generally trying to do things faster, I’m trying to do them with less attention. All these searches and tasks run in the background, which means they actually get done. When I had to actively sit there and click through things, half of it never happened because something else more important would come up, or I just didn’t feel like doing grunt work just then.

Setting Claude Code Up in ObsidianI was genuinely surprised at how easy the terminal plugin was to install for Obsidian. In Obsidian, I went to community plugins, searched for “terminal,” and installed the Terminal plugin by polyipseity. Then I clicked the “open terminal” button on the left-hand side. That’s it.There’s a dedicated Claudian plugin (subtly different from the Claudsidian solution people), but the Terminal felt a little higher fidelity to how I’m used to doing things, and a little simpler to understand. Plus, Claudian looks great but honestly I don’t think I can live without plan mode, which the readme says it doesn’t currently support. Plan mode is nice because it asks questions, really thinks things through, and can be trusted not to do dumb destructive things.

If you have been following along with me for years you know I don’t hype things just because people are hyping things. But Claude Code finally has made AI a core part of my processes instead of just a thing I use sometimes as an extra source or bonus spell checker or quicker way to reformat files.

The UI feels so intuitive, like an old-school MUD.

ICE is angry, ICE is terrified, of how deeply unpopular it is.

May I encourage all reading this to find ways to talk to people, to nudge people to take action, to become “upstanders” (as opposed to “bystanders”). An upstander is someone who takes positive action, no matter how small, to counter evil.

While there are questions around the implications of the ownership structure, AWS’s European Sovereign Cloud still provides a greater level of sovereignty compared to its standard public cloud service in terms of enabling regulatory compliance, according to analysts. This could appeal to European organizations, they said, depending on their sovereignty requirements.

“The AWS European Sovereign Cloud is a step in the right direction. It signals that they acknowledge the problem.”

“There has been a pivotal shift in the last few months; we have seen a fundamental switch from just interest in sovereign solutions to actual buying behaviors,” said Maisto. “The demand is there. Organizations are investing money into sovereign migration projects, and we have not seen this before,” he said.

In the end, most customers will opt for strategies that comprise a mix of sovereignty levels depending on their needs.

Google and Thales, for instance, or Microsoft and Bleu, a joint venture between Orange and Capgemini. This involves the hyperscaler providing access to its technology, while the two companies remain independent. Buest said the arrangement provides a higher level of “operational sovereignty” compared to AWS European Sovereign Cloud, though it still involves some level of technological dependence on the hyperscaler.

The other one that happened was just before Russia invaded Ukraine, they managed to disable the Viasat modems. And this is an interesting case. These modems are used for satellite communications. And they were able to attack these modems so that they physically disabled themselves. It was not like the denial of service attack on the network. No, they managed to wipe the firmware of all these modems in such a way that it could not be replaced. The reason we know about this stuff so well is it turns out there were lots of windmills that also had these modems. In Germany, apparently 4,000 of these modems stopped working. And there were 4,000 wind turbines that could no longer be operated. So this was a military cyber attack that happened as Russia was invading Ukraine. And it was of great benefit to them because it disabled a lot of military communications in Ukraine. But this is the kind of thing that can happen, only that it’s quite rare.

The best time to learn how to work together with a group of people is before a crisis, not during it. Crisis engineering tells us that a team is more likely to be successful if everyone has already worked together.

Most of the antennas that ship with evaluation boards are not very good. One option for an upgrade if you’re using the recommended 868 MHz network is the Taoglas TI.08.A. IMPORTANT: Never turn on a LoRa device without an antenna attached! The power sent to the antenna can destroy the device if there is no antenna attached to radiate it.

LILYGO T-Echo If you’d like a device that good for hacking and comes in a small case, The LILYGO T-Echo is a simple small low-power ready-to-use handheld device for about €80. It has ~3cm square e-ink display, a case with a few buttons, Bluetooth, GPS, and about a day’s worth of battery. Input/output/charging is via USB-C (but use a USB-A to USB-C cable). Received messages are displayed on the e-ink screen and can be cycled through with the buttons. Sending messages requires connecting with another device via Bluetooth.

This is a great option for your “everyday carry” Meshtastic node. It’s the size and shape of a few credit cards. It’s also convenient to give to your less technical family and friends.

Heltec V4 or later If you have more time than money, try the Heltec V4 or later, currently one of the cheapest boards available at around €20. It has a postage stamp-sized OLED screen, a couple of tiny buttons, WiFi/Bluetooth, and USB-C input/power (but use a USB-A to USB-C cable). Received messages are displayed on the OLED and can be cycled through with tiny buttons. Sending messages requires connecting to it via WiFi or Bluetooth. It has no case, but the little plastic box it comes in can easily be turned into one with a sharp pen knife. It also has no battery, but it is a good idea to have a separate power bank anyway since you need a working phone or computer to send messages. It has no GPS.

SenseCap Solar P-1 Pro For people who can afford €100, this is the best option to add a LoRa node that will keep running without external power. It is a solar-powered battery-backed LoRa node ready to attach to your balcony or roof or fence. The P-1 Pro includes batteries and GPS; the P-1 does not.

Solar powered, battery-backed outdoor: SenseCap Solar P-1 Pro Cheapest: Heltec V4 Everyday carry and/or for non-techies: SenseCap Card Tracker 1000E Portable, good for hacking: LILYGO T-Echo

How to form an Internet Resiliency Club: Collect a group of internet-y people within ~10 km of each other Decide how to communicate normally (Signal, Matrix, email, etc.) Buy everyone LoRa (Long Range) radios and a powerbank with trickle charge Install Meshtastic on the LoRa radios Choose a LoRa channel to communicate on Organize meetups, send messages over Meshtastic, have fun If you work for a internet infrastructure company, you can suggest giving interested employees a LoRa radio, a mobile phone powerbank, and maybe even a small solar panel for their personal use (perhaps as part of an annual gift or bonus).

Amsterdam announced that it is planning for three weeks without electricity

Ham radio is too expensive, difficult, and power-hungry Initially I looked into ham radio, but it is just too expensive, difficult, and power-hungry to be practical. Then Alexander Yurtchenko told me about LoRa (Long Range) radio and Meshtastic, a cheap, low-power method of sending text messages across a few kilometers.

I started thinking about what I could personally do without any help from government or businesses. What if I could organize a group of volunteer networking experts who could communicate without any centralized infrastructure? We could effectively bootstrap communications recovery with just a few volunteers and some cheap hardware.

class I took on Crisis Engineering from Layer Aleph, on how organizations facing an existential crisis either swiftly transform themselves into a more functional form, or they fail and become even more dysfunctional.

What made me finally take action is watching a video created by Ukrainian IXP 1-IX to teach other European countries what Ukrainian internet operators have learned about hardening and repairing internet infrastructure leading up to and following the 2022 Russian invasion. The practical realities of keeping networks operating during war were sobering: building camoflouged router rooms with 3 days of generator power, replacing active fiber optic cable with passive, getting military service exemptions for their personnel, etc.. You can watch the most recent version, “Network Resilience: Experiences of survival and development during the war in Ukraine”, a 30 minute presentation at RIPE 90.

I am Valerie Aurora, a systems software engineer with 25 years of experience in open source software, operating systems, networking, file systems, and volunteer organizing. When I moved from San Francisco to Amsterdam in 2023, I started looking for ways to give back to my new home. In addition to systems consulting, I am a special rapporteur for the EU’s Cyber Resilience Act, serve as a RIPE Meeting program committee member, and speak at European technical conferences.