How a PHP security scare brought me back to a neglected blog, a few early experiments, some rather expensive lessons and the uncomfortable business of questioning my own assumptions.

The blog that refused to die

Last week, news broke about two critical PHP vulnerabilities, collectively known as PHP2Shell.

I immediately remembered something I had successfully avoided thinking about for quite some time: my rather dormant blog runs on PHP.

There is nothing particularly secret here. Mostly articles, reflections and some increasingly outdated predictions. But there are registered user accounts, associated data, certificates and the usual ingredients of a website that deserve proper attention.

After a few days of growing discomfort, I finally logged in.

The first thing I noticed was the traffic statistics. Instead of the usual handful of daily visitors, I was suddenly seeing 20–30.

Not exactly viral by LinkedIn standards, but enough to raise my pulse considerably under the circumstances.

Had somebody found a way in? Was an automated attack underway? Or were people simply visiting some of the older articles?

I had no evidence of an attack, but that did not prevent a few rather uncomfortable thoughts.

I started checking PHP versions, security advisories and installation instructions, eventually establishing that the latest PHP branch needed the patched release, 8.5.12.

Except that it was already installed.

I checked again. And again.

Eventually, I found my hosting provider Websupport’s incident report. They had been monitoring the situation and had already deployed the relevant patches without taking customers’ websites offline.

After more than 20 years as a customer, it was another reminder of why I have stuck with them.

Once the initial panic had subsided, I looked more carefully at the statistics. The blog still attracts a couple of hundred visits a year. Some are almost certainly bots scraping the internet, but there appeared to be genuine interest in a few of the old articles.

Perhaps it was time to revive the blog rather than merely make sure it was still secure.

And while I was thinking about what to write, I realised there was a rather good story in why I had started writing about the future in the first place.

A small warning before we proceed: AI has helped me write this article. Quite extensively, actually. Mostly by arguing with me about my memories, questioning dates and attempting to make my already rather long text shorter.

I will return to that, including why I consider it a failure if the result sounds AI-generated.

For now, back to a time when having access to a spellchecker was apparently rather suspicious.

Curiosity arrived early. Commercial success was less predictable.

My interest in technology started well before I had anything resembling a professional career.

In primary school, around the age of 10–12, I was the first in my class to submit homework written on a word processor and printed on a dot-matrix printer.

This was before PCs became common in homes, courtesy of my grandfather, an early adopter who had bought the equipment for his business.

My teachers had mixed feelings.

Apparently, using an early spellchecker was suspiciously close to cheating. Does that sound familiar? I promised to come back to my use of AI.

On the other hand, they could finally read my homework, as my handwriting was somewhere between challenging and catastrophic.

A little later, my best friend David, sadly no longer with us, and I spent an enormous amount of time developing a golf game on an early PC.

Around 3,000 lines of BASIC.

We were rather pleased with ourselves.

Unfortunately, nobody else thought it was worth playing more than once.

Perhaps we should have spent a little less time programming and a little more time asking whether anybody actually wanted the game.

At university, I was again among the earliest to arrive with a laptop. My handwritten notes had not improved much, so this was partly a matter of survival. It also made me popular among classmates who preferred not to take notes.

For a year or two, I was the only person in my immediate academic circle producing colour-printed overhead transparencies for group presentations.

That made me remarkably popular for group assignments as well.

Sometimes competitive advantage does not require an advanced business strategy.

A colour printer will do 🙂

Streaming music, and an early experiment in social networking

In May 1995, I initiated and served as responsible publisher for a live internet audio broadcast of the Grand Concerto at the Student Orchestra Festival (SOF) in Linköping.

It was an unusually early experiment in live internet broadcasting, at a time when very few people had the bandwidth or software required to listen.

As I remember it, we had fewer than 100 simultaneous listeners.

I also remember us being a few weeks ahead of Sveriges Radio’s comparable internet broadcasts, although finding reliable documentation from those early web days has proved surprisingly difficult.

I will happily settle for having been rather early.

Two years later, as General of SOF 1997, I found another application for digitalisation.

I built a digital contact archive of almost all former festival committee members, making it possible to reconnect with people who had been involved over the years.

This helped us achieve what we believed was a record turnout of former committee members at the festival.

I would love to claim that the success was entirely due to our clever use of technology.

However, ABB generously sponsored the reunion dinner, possibly including a drink or two.

That may also have influenced attendance.

Still, bringing together people through a digital network several years before Facebook appeared was a rather interesting experience.

Which brings me to Facebook, although with considerably less enthusiasm.

The late 1990s: the internet, Y2K and a mountain

At Procter & Gamble, I had the opportunity to manage an early Swedish consumer website project before the turn of the millennium, working with a much larger and very talented team.

The site provided teenagers with information about menstruation and related health matters.

There was one unexpected problem.

When I tried to access our own site, the corporate content filter blocked it.

Apparently, a combination of words relating to teenagers, vaginas and blood was enough to make perfectly legitimate health information look deeply suspicious. If I recall it right the system threatened to report further attempts to my manager.

We eventually sorted it out.

I occasionally think about that experience when I see today’s automated systems confidently misunderstanding context, although the consequences can now be considerably more serious.

Then came Y2K.

I was responsible for parts of the millennium preparations, including planning and risk mitigation for customer service and logistics.

Having completed the preparations and arranged cover, I managed to negotiate six weeks of leave to climb Aconcagua, departing around Lucia in December 1999.

My very understanding manager handled the transition in my absence.

When I returned, I learned that one printer had required a firmware upgrade.

I would like to think my assessment of the risk had been excellent. More realistically, the relatively uneventful transition reflected the enormous amount of preparation carried out by people across the world.

And I was fortunate to have a manager willing to take responsibility while I was away.

In the following years, I was also lucky enough to work with people fascinated by mathematics, statistics and optimisation, contributing on the business side of advanced planning solutions associated with SAP Advanced Planner and Optimizer.

Back then, I don’t think any of us would have described ourselves as data scientists. We were simply people who enjoyed solving problems with mathematics and statistics.

That interest eventually earned me a rather fancy Lean Six Sigma Black Belt, a qualification I still have, although I rarely hear anyone asking for one these days.

Funny how professional titles and fashionable methodologies come and go, while the underlying mathematics continues to be useful.

Being early can be surprisingly expensive

In the mid-2000s, I became involved in home automation and started a business combining connected-home technology, design and consumer electronics.

The concept made considerable sense to me, and I still believe much of it was right.

Unfortunately, commercial reality did not entirely agree. We were probably several years ahead of the mainstream consumer market, and the financial crisis of 2008–2009 did not help.

I also discovered that I enjoyed designing solutions, advising clients and developing businesses considerably more than the operational realities of selling consumer electronics.

A useful education, although a rather expensive one.

Around the same period, e-commerce and traditional retail began converging.

My FMCG background and experiences from my own small business proved unexpectedly useful. I spent much of the following decade working with end-to-end digital business solutions connecting product information, stores, warehouses, ERP, CRM and e-commerce.

One project provided a particularly memorable lesson.

We had strongly advised a client against selecting a bleeding-edge e-commerce platform from one of the major software suppliers.

The client decided otherwise.

Just weeks before the planned release, we finally received a version through the vendor’s early adopter programme.

The graphical interface looked quite promising. We loaded test data. Unfortunately, very little actually worked.

My lead developer discovered that much of the functionality demonstrated in earlier alpha versions had disappeared in the beta.

Eventually, the vendor withdrew the entire product.

By then I had moved on from the project. My former colleagues and the client eventually implemented the more established solution we had recommended from the beginning.

Since that experience, I have generally advised clients to allow about a year between a product’s public release and using it for mission-critical operations. There are exceptions, of course, but I have developed a healthy respect for the difference between a manufacturer’s roadmap and software that has survived real customers.

AI is making that rule more difficult to apply. Waiting a full year can feel like waiting for an entirely new generation of two of technology.

I increasingly try to balance early experimentation with designing solutions around models and components that may be somewhat less clever, but are also more predictable, economical and reliable.

A reputable supplier, an impressive roadmap and a polished interface are still not sufficient proof that the software behind them actually exists. Recent events have shown the risk with early adoption for production.

Cloud, data ownership and the technologies we keep rediscovering

Around 2017, I became involved in developing my employers cloud strategy, working across business and IT and with the major cloud providers.

One large client asked me quite bluntly why they would ever surrender control of data stored safely in their own data centre and move it to something called the cloud.

Even then, I advocated hybrid architectures, although implementing them was considerably more complicated than it is today.

Coming from FMCG and retail, I knew how important it was that a store or warehouse could continue operating when its connection went down.

The same was true for retail operations aboard aircraft and ships, where connectivity was often intermittent at best.

Years later, working with defence, I recognised some surprisingly familiar requirements: local autonomy, resilient communications, synchronisation and the ability to keep operating while disconnected.

Obviously, the consequences of failure are very different on a battlefield. But I find it fascinating how architectural lessons from a supermarket, a warehouse or an aircraft can remain relevant in a completely different domain.

And now, after years of discussing why organisations should move to the cloud, data sovereignty and local control are once again central to the debate.

Perhaps the answer was never quite as binary as some of the sales presentations suggested.

My own approach to data probably illustrates that I have never been entirely comfortable putting all the eggs in somebody else’s basket.

Take my photographs, which I consider among my most valuable digital possessions. I keep them on two local NAS devices, one available for everyday use and another powered up periodically for manual incremental backups. I also use two separate cloud services while keeping full local copies on both a desktop computer and a laptop.

Probably excessive for a private collection of photographs, but I have encountered businesses with considerably less protection for far more critical information.

My caution about digital ownership actually goes back to the early days of Facebook.

When Facebook began gaining traction in Sweden around 2007, I did something apparently rather unusual: I read the terms and conditions before signing up.

What particularly bothered me was the extensive licence Facebook required to use photographs and other material uploaded to the platform.

To be precise, the issue was not simply that Facebook would become the copyright owner. The licensing rights and the practical loss of control were what concerned me.

I found the terms completely unreasonable and decided not to join.

With hindsight, my suspicion of the underlying business model was not entirely misplaced. The economic value of our content, relationships, interests and behaviour has become fundamental to the advertising businesses built around social platforms.

I sometimes think of users as the content-producing cows being milked for the benefit of advertisers. Perhaps not a particularly elegant metaphor, but it describes my feelings back then reasonably well.

Consequently, I have never signed up for Facebook or the other Meta social platforms, and I use Google’s services rather selectively.

There is an obvious irony in discussing this on LinkedIn, another platform with its own commercial interests in user data. I am not pretending otherwise.

The same caution increasingly applies to AI. I spread my usage across different services and try to think carefully before sharing anything genuinely private or sensitive.

Convenience is attractive, but so is retaining some control over your own information. The same applies at company and state level, it is often not either or and instead a question of balancing risk and value.

AI: plenty of clever people, and initially rather few paying customers

Around 2018, I was asked to help bring together my employers emerging AI capabilities.

One interesting discovery was how much expertise already existed across the organisation.

People working with computer-aided design, simulation, optimisation, mathematics and statistics had been tackling sophisticated analytical problems for years, often without describing themselves as data scientists.

For a while, we had an impressive concentration of expertise, even comparing ourselves with Ericsson in terms of the number of specialists.

Unfortunately, many soon discovered that their skills were considerably more valuable in product companies and start-ups than in traditional hourly consulting.

The customer market had its own timing problems.

Five or more years ago, plenty of organisations were happy to discuss AI and receive advice, preferably free of charge. Far fewer were ready to fund substantial implementations.

It also became increasingly clear that the large AI platform providers had advantages in scale that individual companies would struggle to match by developing and training everything themselves.

Today, with increasingly capable models, more accessible training and fine-tuning tools, and changing computing economics, I wonder whether the balance may shift again towards smaller, specialised solutions.

I certainly hope so.

I struggle to see how we will otherwise achieve a reasonable balance between capability, cost, privacy and reliability as AI increasingly moves into the physical world, with robots interacting directly with us.

I would happily welcome a collaborative robot, or cobot, that could handle my laundry. Preferably including the folding and putting things away.

But I would insist that it process sensitive information locally in my house and that I retain control over software updates.

And no, there are currently no robot vacuum cleaners, robotic lawnmowers or smart speakers with microphones or cameras roaming around my home. I may be enthusiastic about technology, but that does not mean every new device is automatically welcome. My home automation and my alarm system are integrated with analog switches to ensure air gap between them.

During the pandemic, I built several external market-monitoring and open-source intelligence (OSINT) solutions, using relatively straightforward data collection, classification and rule-based methods.

I recently discovered, together with a couple of my trainees, that parts of those solutions were still providing information to a few key account management environments.

The rediscovery of my old internet site “News by FvG” solution was another reason I began thinking about writing here again.

It was a rather satisfying reminder that technology does not necessarily become useless simply because it has stopped being fashionable.

And when a problem can be clearly expressed through rules, a deterministic algorithm will often remain cheaper, more reliable and easier to understand than a more sophisticated generative AI solution.

Sometimes getting people to work together is the real innovation

At Ericsson, I had the opportunity to contribute to an early initiative for fully digital end-to-end billing and invoicing.

It involved sophisticated systems, integrations and considerable technical complexity. Yet, as with many other transformations, the hardest problems involved people: breaking organisational silos, agreeing on common processes and changing established ways of working.

I encountered something similar when asked to help bring together cybersecurity capabilities scattered across my employer.

My contribution was largely to get the relevant people into the same room, facilitate a few discussions and help empower the strongest leadership candidate to take the initiative forward.

The real achievements belonged to those who subsequently developed the business.

Almost a decade later, I find myself working again with two of the people involved back then. Life takes its weird turns sometimes.

Another interesting experience at Ericsson was being among the relatively few external consultants invited to participate in its internal Strategy Perspectives community.

The forum brought together people from different functions, levels and countries to discuss Ericsson’s long-term direction.

Over four years, more than 1,900 people joined, with just over 500 including myself to actively writing or commenting.

I particularly remember discussions about open standards and the opportunities to use more standard IT capabilities within telecommunications networks.

When Ericsson later acquired Vonage, the strategic logic did not surprise me.

I had certainly not predicted the acquisition, nor am I suggesting that our discussions necessarily led to it. But I recognised the underlying arguments from conversations that had taken place years earlier.

It reinforced my appreciation of strategic discussions that involve people across organisational boundaries, particularly when participants are prepared to challenge established assumptions.

The future I was surprisingly slow to recognise

One of my more uncomfortable reflections concerns Russia.

For years, I followed analysts and experts such as Martin Kragh and Gudrun Persson, who helped explain Russia’s historical ambitions, strategic thinking and increasingly confrontational direction.

Much of the evidence was available. I read many of the relevant sources and followed geopolitical developments closely.

Yet I was surprisingly slow to fully accept what those developments could mean.

It took other people, often with considerably deeper expertise, to challenge my assumptions and make me ask questions I should probably have asked much earlier.

Around 2019, together with colleagues, I began advocating that our System Management business should develop towards a more dedicated defence organisation.

That was before Russia’s full-scale invasion of Ukraine in 2022, but certainly not before the warning signs. Russia had already annexed Crimea in 2014, and there were plenty of other developments that should have made the implications clearer.

I was probably relatively early compared with much of the wider public debate, but I was not particularly early compared with those who had been studying Russia seriously for years.

And that is an important distinction.

I occasionally meet people who seem remarkably good at explaining how accurately they predicted events after those events have happened.

I would rather acknowledge that, despite following the subject closely, I needed help recognising where the evidence was pointing.

That experience has stayed with me, particularly as defence and civil preparedness have become central to my professional work.

It also explains why I increasingly seek out people whose perspectives differ from mine, including experts outside the usual Swedish conversation.

With my French background, I naturally follow developments in France and the growing French–Swedish defence relationship. My main geographical interest remains the Nordic-Baltic Eight (NB8), but lessons from France, the US and elsewhere can help challenge assumptions closer to home.

And quite often, some of the most interesting contributions come from younger people who see a problem from a different position in an organisation, or simply have not yet learned why something is supposedly impossible.

So why revive Tomorrow’s the Future?

When I launched the blog, I wrote a little manifesto to myself.

It said, in essence, that I wanted to use reading, writing and reflection to turn information into understanding and, where possible, practical action.

I also warned potential readers that if they preferred short texts, they would probably be disappointed.

Looking at the length of this article, I clearly haven’t improved much in that respect.

One of the ideas in the original About page was that I primarily wanted to write for myself, and if somebody else found it interesting, that was an additional benefit.

That remains true.

Over the years, I have increasingly used LinkedIn instead. It is a good place to discover knowledgeable people, share their work and participate in discussions.

But there is something worthwhile about keeping longer reflections together in one place, particularly when older articles can be revisited years later.

Some have aged reasonably well.

Others are useful reminders of how easily we can become confident about something that turns out rather differently.

I will probably continue writing mainly about technology, business, geopolitics, defence and how societies adapt to change. I will also continue to draw on people who understand particular subjects far better than I do.

I have also made myself a promise concerning AI.

At least some of the time it saves me should be reinvested in becoming better at the things I actually care about: reading more, including longer and more demanding articles and books, sharpening my own thinking, exploring unfamiliar subjects and finding time to write.

I have little interest in replacing my own curiosity with an endless stream of machine-generated summaries.

Which brings me back to the AI assistance I mentioned at the beginning.

I use AI extensively, for research, testing ideas, exploring alternative interpretations, checking facts, challenging assumptions and refining my writing.

It has also become remarkably useful at identifying where my memories may be less reliable than I would like to believe.

This article has been a particularly painful example.

Several of my cherished recollections of being early, or occasionally first, have been challenged rather persistently. Dates did not always agree, historical sources proved difficult to locate, and in a few cases I had to accept that the story I remembered was somewhat more impressive than the available evidence.

I still suspect I am right about a few of them, but suspicion is not particularly strong evidence.

The process forced some healthy revisits of events I have not thought carefully about for decades.

I also spend considerable time trying to get the models helping with my writing to understand my style, my vocabulary and my rather particular sense of humour. The ambition is that they should become almost better than I am at recognising when a sentence does not sound like something I would say.

For most of my articles and LinkedIn posts, AI helps me shorten, sharpen, question and polish material that I have already researched, thought about and worked on.

That is quite different from entering a short prompt and publishing whatever comes back.

And if this article feels obviously AI-generated, I consider that I have failed.

It would be especially ironic given how much time I have spent persuading the technology to stop producing its favourite rhetorical patterns.

I don’t consider myself particularly gifted at predicting the future. There are far too many people with greater expertise, better judgement and a more sophisticated understanding of particular subjects.

What I try to contribute is connecting perspectives, asking difficult questions and helping myself, and hopefully a few others, reflect early enough to reconsider what we do today.

Which brings me back to the rather neglected blog.

The software is patched. The articles are still here. Apparently, so are some of the readers.

Perhaps the next experiment should be to start writing here again.

After all, tomorrow’s the future.

And I would rather arrive a little better prepared, even if I still get the timing wrong.

Frédéric

PS. My reflections on this site are personal unless explicitly stated otherwise. Including any predictions that don’t age particularly well.

PPS. If you followed the blog in its earlier days, or recently discovered one of the old articles, I would genuinely appreciate hearing what brought you here. And which developments do you think we are still too slow to recognise?