Flying into RubyKaigi, I thought we had months to stand up AI-assisted vulnerability scanning for rubygems.org. Turns out we were out of time. We started prototyping during the conference, scanned the most critical gems, and four hours later submitted our first advisory to Nokogiri.

GitHub Actions is the weakest link: nesbitt.io/2026/04/28/g...

I had a chat with @vlad.website about the @opensourcepledge.com Vlad has a ton of insight into how hard it is to just figure out what you're running plus the challenges maintainers have Vlad has a ton of great ideas how to start tackling some of these incredibly difficult problems

New job title: Critical Infrastructure Hobbyist

Fixed this :)

Andrew does a better job than we do at walking through the features of npmx.dev. We need to set up a resources page to link to these kinds of posts. If you care about registries, ecosystems, and open source, queue every single one of Andrew's posts to your reading list.

we're having a little npmx social tonight in London! come join us for conversation, food, beer, and stickers 🥳 guild.host/events/npmx-...

Features everyone should steal from @npmx.dev nesbitt.io/2026/04/16/f...

The Tuesday test 🌮 nesbitt.io/2026/04/15/t...

Standing on the shoulders of Homebrew: nesbitt.io/2026/04/14/s...

Common Package Specification: Not the cross-ecosystem format the name suggests. nesbitt.io/2026/04/13/c...

Package Registries and Pagination - 100MB of metadata for 10,451 versions: nesbitt.io/2026/04/10/p...

Following on from yesterdays post about package security problems for AI agents, here's some potential defenses: nesbitt.io/2026/04/09/p...

Package Security Problems for AI Agents: nesbitt.io/2026/04/08/p...

Recreating office-style pranks in a remote AI-loving world

Who Built This? nesbitt.io/2026/04/07/w...

I had a chat with @andrewnez.bsky.social about why creating a new package repository is so hard. There are a ton of little details like support from SBOM and vulnerability scanners nobody even thinks about. There are so many little details Andrew does a great job explaining all this and more

New blog post 🥳 Stamp It! All Programs Must Report Their Version In this article, I’ll explain how 3 simple steps (Stamp it! Plumb it! Report it!) are sufficient to save you hours of delays and stress during incident response. Read more: michael.stapelberg.ch/posts/2026-0... #nix #golang #linux

The Cathedral and the Catacombs - Stretching a metaphor deep into the floor. nesbitt.io/2026/04/06/t...

What does Open Source mean? nesbitt.io/2026/04/04/w...

Package Manager Easter Eggs: nesbitt.io/2026/04/03/p...

One of the strengths of Homebrew, despite it being unpopular, is being willing to break backwards compatibility when necessary. NPM’s unwillingness to do so reflects GitHub’s: both show excessive caution that harm both security and usability.

npm's Defaults Are Bad: nesbitt.io/2026/03/31/n...

npm's Defaults Are Bad: nesbitt.io/2026/03/31/n...

Turns out my blog was featured on a rather popular youtube channel: www.youtube.com/watch?v=DAHZ...

Git Diff Drivers: nesbitt.io/2026/03/30/g...

The Roles of Packages: nesbitt.io/2026/03/29/t...

The Top 10 Biggest Conspiracies in Open Source: nesbitt.io/2026/03/25/t...

So your boss built a prototype on the train... mynameismartin.co.uk/blog/your-bo...

How to Attract AI Bots to Your Open Source Project: nesbitt.io/2026/03/21/h... (This post was contributed by an ai bot)

Nerd sniped again, this time by @miketheman.com, into looking at how various package managers do mirroring: nesbitt.io/2026/03/20/p...

The Fragmented World of Dependency Policy: nesbitt.io/2026/03/19/t...

Nerd sniped by Bastien Guerry of @softwareheritage.org into writing about git remote helpers: nesbitt.io/2026/03/18/g...

plz. i am just an engineer. stood in front of a failure demand concealment device. asking it to report the failure to any string concatentor that might spare a cycle to lower the drawbridge far enough to let us, maybe, use your service.

I’ve been hacking on a new tool today: brief, a cli to quickly give you (or your coding agent) a fast summary of a software project's toolchain, configuration, and conventions. github.com/git-pkgs/brief

Guided Meditation for Developers: nesbitt.io/2026/03/15/g...

New blog post: How Can Governments Pay Open Source Maintainers? https://shkspr.mobi/blog/2026/03/how-can-governments-pay-open-source-maintainers/ When I worked for the UK Government I was once asked if we could find a way to pay for all the Open Source Software we were using. It is a …

What's Going On with FAIR Package Manager? nesbitt.io/2026/03/14/w...

In case you missed it in Homebrew 5.1.0 release notes: we’re doing a short user survey to inform future development.

Forge, a unified CLI for GitHub, GitLab, Gitea, Forgejo, and Bitbucket. nesbitt.io/2026/03/13/f...

'Code Contribution and Credit in Science' - new paper led by @evamaxfield.bsky.social w/ @isaacslaughter.bsky.social 1. We build a model that matches scientists (authors) with their GitHub accounts 2. We apply our model to ~140K paper-software repository pairs direct.mit.edu/qss/article/...

Some notes on ENISA's Technical Advisory for Secure Use of Package Managers: nesbitt.io/2026/03/12/r...

How to add git-pkgs to your GitHub Actions workflows: nesbitt.io/2026/03/11/g...

I've been working on a unified cli that works for github, gitlab, gitea/forgejo and bitbucket. So you (or a coding agent) doesn't need to learn 4 different sets of commands for what are basically all doing the same things: github.com/git-pkgs/forge

Taking 'just use Postgres' to its logical endpoint: git push to deploy into a single Postgres process. nesbitt.io/2026/03/10/j...

This week on #OpenSourceSecurity I had a chat with Paul Kehrer and Alex Gaynor about the statement they published discussing the challenges posed by modern OpenSSL for the python cryptography module

100 posts on the blog 🎉 nesbitt.io/2026/03/09/1...

If It Quacks Like a Package Manager: nesbitt.io/2026/03/08/i...

Open Source Foundations Consortium Announces Seven New Working Groups nesbitt.io/2026/03/07/a...

What if a tool could drop an empty file in its config directory and git would just know not to track it? Turns out git has no mechanism for this, every ignore option requires someone other than the tool to act. So I wrote up a proposal for a `.gitlocal` file: nesbitt.io/2026/03/06/g...