I regularly have people ask me about Mythos these days, so here are my thoughts: Finding bugs is never the hard part. Fixing them is. How’s your organizational alignment? Are your engineers burned out? How is your production resilience? Before you worry about the new shiny, focus on your basics

Open Source Summit, here we gooooo 🇲🇽MEX ⮕ 🇺🇸ORD ⮕ 🇺🇸MSP I'm incredibly excited to be back in Minneapolis and getting a couple of days to enjoyb the city, the world owes so much to Minnesotans 👊

Can't have a conflict of interest if you don't have interests!

Yaaa🤘🤘🤘🤘

Oh what fun with case insensitive filesystems and git.

Fixed this :)

Ok French friends. No. Just don't. Corn tortillas have a purpose. Wheat tortillas have a purpose.

Good bye ingress-nginx #KubeCon

LONG LIVE INGRESS NGINX 🪦 @strongjz.bsky.social archiving ingress nginx live on the #KubeConEU stage with @youngnick.net and other gateway API maintainers 👑 #KubeCon #CloudNativeCon

It’s done. #KubeCon

Found @strongjz.bsky.social looking at ingress-nginx. #KubeCon

This 👇

Reminder: if your community does not have an enforced code of conduct, it becomes possible to subvert it to attack or ostracise individuals and spread a whole lot of ugly that marginalised people will run screaming away from.

Rejekts, let's goooooo 🚀

TinyGo 0.40 is out with many improvements to close out the year. Plenty of bugfixes and stability enhancements to make your life better and easier. New updates to the GC that are up to 10% faster! New boards! Go get it right now! github.com/tinygo-org/t... #tinygo #golang

Sorry for the hiccup with our tag in the previous post! Our thanks again to @ostifofficial.bsky.social for their help with this important audit, which you can again read about in our blog post: blog.thunderbird.net/2025/12/thun...

🎉 10 years of open source Swift! A decade ago today, we opened Swift to the world with a simple blog post: swift.org/blog/welcome What's grown since—thanks to an incredible community of contributors—has been extraordinary. Here's to the next ten years. 🧡

apk-tools 3.0.0 final is out

🌟 New OpenSSF Project Spotlight 💃 In this interview, SLSA Steering Committee member Tom Hennen (Google) breaks down how SLSA is helping organizations strengthen trust across the software supply chain. Watch the full Project Spotlight: 🔗 www.youtube.com/watch?v=gdYl... #OpenSSF #SLSA #OSSSecurity

The only thing that beats having some of your best friends at home for dinner is when one of them is a friggin cocktail master. México City SIG Release dinner with @veronicalg.bsky.social and @cpanato.dev .

Back from #KubeCon with a replenished heart from seeing so many good friends IRL again. I feel so grateful for all the support from folks around the @carabiner.dev projects. I think our supply chain security ecosystem is about to crack a very important milestone in usability as we advance together!

Obligatory yearly notice: This #KubeCon would be so much better if @parisinbmore.bsky.social was here 🥲 #missyou

@puerco.mx kicking off Open Source SecurityCon by demonstrating how to prevent cats messing with your training data.

Headed to Atlanta with @staceypotter.bsky.social for the most epic keynote ever on Tuesday. You don't want to miss it, it's going to be action-packed 💥 (and yes 🫲🏽🫲🏽🫲🏽)

As if there wasn't enough to do already, next week I will present on the role @protobom.dev plays in making SBOMit's verifiable SBOMs consumable. See you there!

⚞NEW⚟ “Trailblazing Python Security” dedicated talk track coming for #PyConUS 🛡️ 🐍🔥 We are looking for sponsors interested in supporting security in the Python ecosystem: pycon.blogspot.com/2025/10/pyco... bsky.app/profile/pyco... #python #opensource #oss #security #supplychain

Wow this is a match made in heaven 🤩

Check out this new example we published in the SLSA blog, it turned out really cool!

We've published a new 🔴🟡🟢 AMPEL case study on the SLSA Blog!

Spotted a dead snake on today's run 🐍

I am very proud of this release. Among other improvements, we now support evidence chains in PolicySets. This lets AMPEL synthesize verification subjects from attested data. For example, you can now apply a policy to all the dependencies extracted from an SBOM, the demo below shows how.

Give me a bolillo 🥖💩😱

Piggy

v0.2.0 of our signer library is out! This release ships with full support for DSSE signing and verification. github.com/carabiner-de...

I recorded a short video demoing this release if you'd like to see how it works :) youtu.be/RDmsAhD3znk

Menacing containers. Evem while bike touring.

It's impossible to describe what an IPA feels like after 84 km on the loaded bike. Pure heaven 🤤

Last big code reorg PR ahead of next week's release!

In spite of all, still one of the best runs 🏃🏽‍♂️

At the very edge of Latin America.

OK, so Japan it is 🇯🇵

A Discord server and new GitHub organization for zizmor https://blog.yossarian.net/2025/05/07/zizmor-discord-server-github-org #security #oss #devblog #programming #rust #zizmor

The term 'rune' for a Unicode code point was coined by Ken Thompson during a discussion we had to find a concise name to supplement 'char' for bytes. The Plan 9 C source files /sys/src/libc/port/*rune* appeared in the daily backup on Dec 9, 1991, so the name was coined on the evening of the 8th.

What's wrong babe? It's #MayThe4th an you've barely touched your Jabbacado toast.

if you love debugging, may I recommend purchasing a home?

Open Source Zeitgeist: The cloud-native messaging edition. youtu.be/MXcxWsdjYHA

I'm totally building a Warhol-style wall of silkscreens from these 😂

Attention vulnerability management nerds! If you are at #Kubecon in London, come hear how @kubernetes.io Release Engineering and SIG Security are building the K8s VEX feed. We'll show off slick new tools coming out to manage @openssf.org OpenVEX to help VEXing your CRA woes✌🏽 (17:30 in L1/S10/C)

@golangci-lint.run v2 is awesome, well worth the upgrade 🏆 I just read this post and you should too :)