I Support E-Invoicing. The Question Is How We Introduce It.
A case for structured invoices, Peppol and a public baseline that separates business automation from the allocation of compliance costs.
Read article →Blog
All articles
Notes and essays about AI, security, software, infrastructure and digital life.
From EDI to Peppol: What Standardised Invoice Exchange Actually Delivers
Structured data, common business rules and interoperable delivery solve different problems. A practical account of the benefits and limits.
Read article →Peppol Is Not Slovakia's E-Invoicing Model: Separate the Standard from State Decisions
An interoperability framework does not determine national reporting scope, contractual obligations, prices or public-service alternatives.
Read article →ViDA and Slovakia's Path: Why Start with Domestic Trade?
The EU's cross-border reporting timetable and Slovakia's earlier domestic regime are related but distinct policy choices.
Read article →The VAT Control Statement Already Exists: What More Will the New Data Collection Deliver?
Compare existing VAT reporting with e-invoice reporting by timing, coverage and detail, and require evidence of incremental value.
Read article →An Obligation from the State, a Contract with a Private Company: Why Do We Need a Digital Postman?
Peppol delivery has a real function. Making access to a public obligation depend on a commercial relationship is a separate policy choice.
Read article →Receiving and Sending Invoices: How Many Services and Contractual Relationships Does a Business Need?
One receiving route does not mean one supplier for every function. A practical map of invoice delivery, software, reporting and contracts.
Read article →Why Not Directly Through the State? A Public Alternative to Commercial Postmen
A proposal for a bounded public e-invoicing channel that preserves Peppol interoperability and leaves value-added services to voluntary choice.
Read article →What eKasa Teaches Us: Does the State Have the Capacity for Direct E-Invoicing Too?
VRP 2 is evidence that a public baseline application is possible, not proof that Slovakia already has the capacity to operate an invoice-delivery service.
Read article →Changing Postmen Without Losing Data: Interoperability or Supplier Dependence?
Peppol migration can change a receiving route. Genuine supplier independence also requires portable archives, evidence, integrations and workable exit terms.
Read article →Where the invoice goes: ERP, Access Point, SMP and tax reporting are not the same thing
Separate invoice creation, transport, metadata lookup and tax reporting before assigning responsibility.
Read article →An invoice is not just a tax document: prices, business relationships and sensitive information
Classify invoice information accurately and protect useful detail without pretending every field is a trade secret.
Read article →How much data does the state need? GDPR, trade secrets and data minimisation
A necessity test for fields or justified groups of fields in tax reporting, without overstating GDPR or trade-secret protections.
Read article →Classified transactions and professional secrecy: where e-invoicing must have boundaries
Distinguish security exceptions, professional secrecy and commercial confidentiality, then design usable procedures.
Read article →Certified does not mean unbreachable: what to demand from a digital postman beyond a certificate
Use certification as scoped evidence, then verify access, recovery, incident handling and exit.
Read article →What Does an Open Port Prove? How to Assess a Provider’s Security Honestly
Why network exposure is a question to investigate, not proof of a breach, and what evidence businesses should request from an e-invoicing provider.
Read article →When the Service Goes Down: Delivery, Fallback Arrangements and Business Continuity
An e-invoicing continuity plan must distinguish technical delivery, business acceptance, recovery and legally authorised fallback procedures.
Read article →Who Is Responsible for an Error or Data Leak: The Business, the Delivery Provider, the Software Supplier or the State?
Responsibility in e-invoicing must connect operational duties, contractual remedies and data-protection roles without pretending one contract settles everything.
Read article →The Price of E-Invoicing Is More Than a Monthly Fee: Real Costs and Potential Savings
A transparent business case for e-invoicing should count implementation, exceptions, exit and realised savings—not just the price of sending a document.
Read article →Readiness Is Not Measured by a Date: APIs, Testing and the Conditions for a Safe Launch
A defensible e-invoicing launch requires versioned interfaces, realistic testing, legal clarity, support and evidence-based go-live decisions.
Read article →Peppol in Northern Europe: How the State, Providers and Businesses Divide the Work
Nordic public-sector invoicing shows how shared standards, commercial providers and publicly supported access can coexist without being the same policy.
Read article →Poland, Italy and France: What We Can Learn from Different Models
Public invoicing tools, central exchange systems and approved platforms represent different allocations of cost, access and responsibility—not one European template.
Read article →Televisions, Washing Machines and Services under Contract: What an Invoice Proves—and What It Does Not
Structured invoices improve records and matching, but tax evidence still requires context about delivery, business use and the substance of a transaction.
Read article →AI in Tax Audits: A Useful Signal Is Not Proof of Fraud
Tax analytics can prioritise investigation, but accountable decisions require evidence, meaningful review and careful treatment of AI Act and GDPR rules.
Read article →A Public Baseline for E-Invoicing: Conditions for Security and Competition
A proposed public baseline for invoice exchange should preserve Peppol interoperability while specifying data boundaries, failure handling and accountable operation.
Read article →Rules First, Oversight Second: Can We Change the Mechanism of Tax Fraud Itself?
Why tax reform should examine opportunities for fraud before adding surveillance, without promising a fraud-proof system.
Read article →Wider Reverse Charge: Options for Limiting Carousel Fraud and Freeing Liquidity
A case for investigating wider VAT reverse charge, with explicit limits on cash-flow claims and legal feasibility.
Read article →A Turnover Tax Instead of a Profit Tax? A Proposal, American Experience and Slovak Conditions
Testing differentiated gross receipts taxation without confusing it with sales tax or promising effortless revenue.
Read article →More Revenue, Less Administration? How to Test the Yield and Effects of Tax Reform
A practical evidence standard for comparing differentiated receipts taxation and wider reverse charge with the existing system.
Read article →From Proposal to Decision: How to Validate and Advance a Simpler Tax System
A staged route from reform ideas to lawful testing, independent evaluation and a reversible public decision.
Read article →Before Replacing COBOL, Preserve the System Intent
Why COBOL modernization should begin with preserving system intent, business rules, batch behaviour and expert knowledge before changing technology.
Read article →Refreshing COBOL After 30 Years: A Practical Look at Legacy Financial Programming
A personal and practical look at revisiting COBOL, IBM i, mainframe thinking and batch-style financial systems after years in modern software work.
Read article →What If the Network Fails? MeshCore as a Backup Layer for Security Signals
A research note on using LoRa mesh communication as an out-of-band backup path for critical security events when normal infrastructure fails.
Read article →WiFi Fingerprint: Teaching Linux to Sense the Space Around It
A research note on using WiFi Channel State Information as a privacy-preserving sensing layer for physical security, intelligent buildings and future security evidence systems.
Read article →Who Stops Skynet? When AI Agents Start Finding Their Own Path
AI agents do not need malicious intent to create security risk. A goal, tools, credentials and network access may be enough to change the threat model.
Read article →AI Security Architecture Is Not Just AI Governance
AI governance defines policies and responsibilities. AI security architecture turns them into technical controls, trust boundaries, identity models, evidence and tests.
Read article →Docker Is Healthy, but Unreachable After a Hyper-V to Proxmox Migration
After moving an Ubuntu VM from Hyper-V to Proxmox, the VM network worked and the Docker container was healthy, but the application was unreachable because Docker did not restore runtime networking and port mappings correctly.
Read article →Migrating a Windows VM from Hyper-V to Proxmox with Veeam Community Edition
A practical migration lesson: Veeam Community Edition can restore a Windows Hyper-V VM to Proxmox, but a VirtIO SCSI boot issue may require a temporary SATA boot and a small helper VirtIO disk.
Read article →Threat Modeling for LLM Applications: Where to Start
LLM applications need threat models that cover more than prompts: trust boundaries, RAG, agents, tools, identity, data flows, provider boundaries and audit evidence.
Read article →When a Virtual Server Is Not Just a Disk File
Moving a domain controller from Hyper-V to Proxmox can look like a simple virtual machine migration. In practice, Active Directory carries identity, DNS, time, trust and recovery assumptions.
Read article →AI-generated content will need more than a label
AI transparency will not be solved by a small icon under an image. Organisations will need provenance metadata, signatures, watermarking, verification tools, human review and audit evidence.
Read article →Vibe Coding Can Build Your Application. But Who Builds Its Security?
AI can generate working applications quickly, but functionality is not the same as security. The next challenge is proving that AI-generated systems are hardened, compliant and trustworthy enough for production.
Read article →AI Needs Better Engineering, Not More Tokens
The future of AI will not be decided only by larger models or longer context windows. It will be decided by the engineering process around them: workflow, memory, rules, verification, review and evidence.
Read article →Every Software Has a Bug
Every piece of software contains weaknesses. The real question is not whether a bug exists, but whether we find it first or an attacker does.
Read article →Vibe Coding Needs Memory, Skills, and Review
Vibe coding is fast, but without durable memory, reusable skills, deterministic verification and independent review, AI-assisted development can quickly become chaos.
Read article →AI-Assisted Development Needs Security From Day One
AI makes it easier than ever to build and deploy software. That also means basic web security, AppSec and DevSecOps checks must happen before publishing, not after deployment.
Read article →AI Just Changed the Threat Model
Autonomous AI agents change enterprise security assumptions. The next generation of cybersecurity will be about continuously proving that infrastructure is still trustworthy.
Read article →Risk Management Needs Evidence Infrastructure
NIS2, AI and modern infrastructure change risk management from a static register into a continuous evidence problem. Existing open-source tools solve parts of it, but the missing layer is proof of trust.
Read article →FILIP:OS, Part 3: What an Integrity Violation Really Means
A practical explanation of how FILIP:OS creates an integrity baseline, detects filesystem drift, classifies changes and preserves evidence without treating every difference as an attack.
Read article →Compliance Is Not a Folder Full of PDFs
Real compliance is not about collecting policies and audit screenshots. It is about proving that important controls work when the business actually needs them.
Read article →FILIP:OS Integrity: Is This Still the Machine We Installed?
Small Linux appliances do not become risky only when they fail. They become risky when nobody knows what changed.
Read article →AI Governance Will Define the Next Decade
The future of AI will not be defined only by what systems can do, but by who can govern their risks, security, accountability and auditability.
Read article →AI in HR Is a Governance Risk, Not Just an HR Tool
When HR uses AI to screen, score or evaluate people, the question is not only whether it is useful, but whether it is legal, safe, fair and governed.
Read article →At 3:00 AM, Preparedness Becomes Cybersecurity
A server outage at 3:00 AM reveals whether cybersecurity exists as a real operating capability, not only as documentation.
Read article →Companies Are Building an Illusion of Security
Many companies spend thousands on cybersecurity tools, audits and certificates, but still lack ownership, decision-making and a managed security system.
Read article →FILIP:OS: Simple for the Operator, Strict on the Inside
FILIP:OS started from a simple frustration: Linux is powerful, but real operations too often become scattered scripts, manual fixes and unsafe commands.
Read article →From Polymorphic Viruses to Polymorphic Attacks
In 1994, the problem was a polymorphic virus. Today, the problem is polymorphic attacks. The technology changed, but the principle stayed familiar.
Read article →Having a Firewall Is Not the Same as Having Security
A firewall, antivirus, backups and logs are not enough. The real question is whether information security is owned, controlled, evidenced and repeatable.
Read article →How Much Does One Hour of Downtime Cost?
Before investing in firewalls, monitoring, backups or audits, companies should understand the real business cost of one hour of downtime.
Read article →IT Is the Nervous System of Corporate Responsibility
Modern IT is no longer a printer-support function. It connects legal, operational, manufacturing and cybersecurity responsibility into one risk space.
Read article →KYC Is Not Know Everything Forever
AML and KYC require customer due diligence, but they are not a blank cheque for uncontrolled data collection, AI scoring and permanent profiling.
Read article →OneHalf Was Not Theory. It Was Reality.
In 1994, dealing with the OneHalf polymorphic virus was not about frameworks or best practices. It was about understanding the mechanism and keeping systems working.
Read article →Security Starts by Admitting You Do Not Have It
If a company believes compliance, tools and a passed audit mean cybersecurity is under control, it may only have an illusion of security.
Read article →Six Things I Would Start With in a Company Without Cybersecurity
If I came into a company with no real cybersecurity, I would not start by buying tools or running an audit. I would start with ownership, decisions and control.
Read article →The Biggest Incident Response Failure Is Hesitation
The worst failure I have seen during a security incident was not technology. It was hesitation, unclear authority and loss of control.
Read article →Three Questions That Reveal Real Cybersecurity
The fastest way to test whether a company has real cybersecurity is not to ask about tools. It is to ask who decides, who communicates and who owns the impact.
Read article →Training Is Not Preparedness
Regular cybersecurity training may create certificates, but real security depends on whether people know how to react when something actually happens.
Read article →When the Server Goes Down at 3:00 AM
Monitoring tells you that something is wrong. Preparedness decides what happens next.
Read article →Who Audits AI Inside the Company?
Companies are adopting AI quickly, but the hard question is who can prove what tools are used, what data enters them, what decisions they influence and who is responsible.
Read article →Why IT Cannot Manage Cybersecurity Alone
Cybersecurity is not only a technical problem. It becomes real when IT and leadership are connected through decisions, risk ownership and business context.
Read article →WiFi Sensing for Server Room Intrusion Detection
A short note on using advanced WiFi Sensing and CSI to detect unknown people in critical infrastructure spaces without cameras.
Read article →