An article about a technical subject, such as a new technology or a new feature
View All Tags
Data files are not passive. They can manipulate and compromise your application.
We are used to thinking about code as having the capacity to behave maliciously. Stories about services being compromised, supply chain attacks and bugs leaking data are fairly common.
By comparison, transmission formats like JSON and XML are typically regarded to be fairly inert. In fact, these too can be a credible threat to your application.
Not all 'Open' initiatives are equal
In the Open Data community I have noticed an occasional blurring of two very different concepts; Open Data and Open Access (in the sense of 'freely available documents'). This can cause problems and increase costs for all stakeholders involved (from data availability to FOI burden).
I argue here that we (managers, data scientists, developers) need to strongly differentiate the two, as it has a real impact on the community stakeholders - the individuals, businesses and institutions that consume our data.
In this article I'll set out a case (from a consumer perspective) for each, to provide some insight into how these are two different things for two very different audiences.
There have been several high-profile supply chain attacks in the NPM ecosystem recently, including the tanstack compromise a few days ago, the recent Axios 'RAT' of Spring 2026, the first wave of "Shai-Hulud" worm in late 2025 and before that chalk and debug in September 2025 - and many more in between all these.
If you run a web application or Node.js service, this should be a concern. Every time you run npm install
you may be pulling a compromised version of a package - if that happens your local data is at risk, so are the stored
keys you use to access services, depending on the malicious code you may even spread the infection.
A reflection on a day's work with AI coding assistance
AI code assistance is all the rage in software development. I decided to spend a day working with IntelliJ's Junie AI in "chat mode", to build a clean sheet project, to analyze the sort of technical decisions that the AI made, where it went wrong and what it struggled with.