The Curious Engineer

All blogs / Software / engineering practice

Andrew Nesbitt

nesbitt.io

Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.

Software / engineering practiceSecurityDev tools / editors / IDEs

’17’18’19’20’21’22’23’24’25’26
Posts
247 from 1 Feb 2017 to 31 Oct 2026
Posting
about daily (236 in the last year)
Kind
personal blog
Feed
https://nesbitt.io/feed.xml

2026 200

  1. This Week in Package Management: 31 October 2026
  2. Signing and Attestations Across Package Registries
  3. This Week in Source Control: 28 October 2026
  4. Package Management Devroom at FOSDEM 2027: Call for Participation
  5. This Week in Package Management: 24 October 2026
  6. One Small Bug
  7. Trust Stores Are Dependencies Too
  8. This Week in Package Management: 17 October 2026
  9. Now That’s What I Call Technical Debt!
  10. This Week in Package Management: 10 October 2026
  11. Package Management RFCs
  12. This Week in Package Management: 3 October 2026
  13. Software Heritage Identifiers
  14. Posts from October 2026
  15. This Week in Package Management: 26 September 2026
  16. Package Manager Sandboxing
  17. Package Manager Threat Model, Revisited
  18. Unfinished Work in Package Security
  19. This Week in Package Management: 19 September 2026
  20. Good Morning, Your Toaster Is Compromised
  21. Shadowing the Standard Library
  22. This Week in Package Management: 12 September 2026
  23. Package Manager Trends
  24. What’s new in git-pkgs
  25. This Week in Package Management: 5 September 2026
  26. How much should you trust your OSS data?
  27. Git Submodules as a Package Manager
  28. Posts from September 2026
  29. This Week in Package Management: 29 August 2026
  30. Now Hiring: Senior Open Source Maintainer
  31. Bazel Module Versions Aren’t SemVer
  32. Hardening the Override Flag
  33. This Week in Package Management: 22 August 2026
  34. Issues in the Repo
  35. Two-Factor Authentication Across Package Registries
  36. This Week in Package Management: 15 August 2026
  37. How This Blog Is Built
  38. Supplier Security Questionnaire
  39. Shared Code Between Package Managers
  40. This Week in Package Management: 8 August 2026
  41. The Software Stewardship Lab
  42. A year of AI disclosure in critical packages
  43. brew install actions/checkout
  44. This Week in Package Management: 1 August 2026
  45. Posts from August 2026
  46. The AI Phrasebook
  47. Wheels, Bottles and Images
  48. Why npm Dependency Trees Are So Big
  49. This Week in Package Management: 25 July 2026
  50. Interview with a Maintainer
  51. Package Name Prefixes
  52. –end-of-options
  53. This Week in Package Management: 18 July 2026
  54. Plumbing Homebrew into the vulnerability ecosystem
  55. This Week in Package Management: 11 July 2026
  56. Package Management as Org Chart
  57. Unboxed: Zig
  58. Content addressing in package managers
  59. This Week in Package Management: 4 July 2026
  60. The CRA is not about open source
  61. Posts from July 2026
  62. Taking Roads and Bridges literally
  63. Unbundling the standard library
  64. This Week in Package Management: 27 June 2026
  65. Incident Report: CVE-2026-LGTM
  66. Scrutineer: scanning open source without flooding maintainers
  67. Sunsetting a Package Manager
  68. This Week in Package Management: 20 June 2026
  69. Open Source vs the Invisible Hand
  70. How Open Source Projects Change Hands
  71. This Week in Package Management: 13 June 2026
  72. Joint Guidance on Vulnerability Naming and Disclosure
  73. What Happened to tea.xyz
  74. Forms of Open Source Government
  75. Package Manager Patents
  76. This Week in Package Management: 6 June 2026
  77. Install-script allowlists
  78. gittuf - a signed log for git refs
  79. Skills Registry Threat Models
  80. The Infosec Phrasebook
  81. Posts from June 2026
  82. This Week in Package Management: 30 May 2026
  83. Composer’s dependency policies
  84. Package managers that package package managers
  85. Protestware for coding agents
  86. CHAOSS Metrics in 2026
  87. GitHub Actions security in Python packages
  88. Signing is for the bad days
  89. This Week in Package Management: 23 May 2026
  90. Dependency Pruning
  91. RFC: Artificial Contributors to Open Source
  92. Dumb Ways for an Open Source Project to Die
  93. Language Registries Are Unstable by Default
  94. Centrality is not vitality
  95. Showing Our Work
  96. Not a Security Issue
  97. Proxy
  98. Madame Semver Will See You Now
  99. The Mismeasure of Open Source
  100. Weekend at Bernie’s
  101. Free as in Tribbles
  102. Revisiting the 2015 Open Source Census
  103. Package Manager Threat Models
  104. Package Manager CWEs
  105. A GitHub for maintainers
  106. Patching and forking in package managers
  107. Posts from May 2026
  108. Announcing the 2026 Open Source Fantasy Draft
  109. GitHub Actions is the weakest link
  110. The stages of package installation
  111. Brief
  112. Features everyone should steal from npmx
  113. The Tuesday Test
  114. Standing on the shoulders of Homebrew
  115. Common Package Specification
  116. Package Registries and Pagination
  117. Package Security Defenses for AI Agents
  118. Package Security Problems for AI Agents
  119. Who Built This?
  120. The Cathedral and the Catacombs
  121. What does Open Source mean?
  122. Package Manager Easter Eggs
  123. Posts from April 2026
  124. npm’s Defaults Are Bad
  125. Git Diff Drivers
  126. The Roles of Packages
  127. The Top 10 Biggest Conspiracies in Open Source
  128. How to Attract AI Bots to Your Open Source Project
  129. Package Manager Mirroring
  130. The Fragmented World of Dependency Policy
  131. Git Remote Helpers
  132. Guided Meditation for Developers
  133. What’s Going On with FAIR Package Manager
  134. Forge
  135. Reviewing ENISA’s Package Manager Advisory
  136. git-pkgs/actions
  137. Just Use Postgres
  138. 100 Posts
  139. If It Quacks Like a Package Manager
  140. Announcing New Working Groups
  141. .gitlocal
  142. Package Manager Magic Files
  143. Package Managers Need to Cool Down
  144. Package Management is Naming All the Way Down
  145. Transitive Trust
  146. Downstream Testing
  147. Posts from March 2026
  148. npm Data Subject Access Request
  149. xkcd 2347
  150. Git in Postgres
  151. Two Kinds of Attestation
  152. Reproducible Builds in Language Package Managers
  153. Where Do Specifications Fit in the Dependency Tree?
  154. Forge-Specific Repository Folders
  155. Whale Fall
  156. ActivityPub
  157. Go Modules for Package Management Tooling
  158. What Package Registries Could Borrow from OCI
  159. Platform Strings
  160. CHANGELOG.md
  161. Separating Download from Install in Docker Builds
  162. Package Management Namespaces
  163. Respectful Open Source
  164. The Many Flavors of Ignore Files
  165. Package Management Consulting
  166. Lockfiles Killed Vendoring
  167. Package Manager Podcast Episodes
  168. Sandwich Bill of Materials
  169. Crates.io’s Freaky Friday
  170. Dependency Resolution Methods
  171. Git’s Magic Files
  172. Package Management at FOSDEM 2026
  173. Incident Report: CVE-2024-YIKES
  174. Posts from February 2026
  175. Will AI Make Package Managers Redundant?
  176. Zig and the M×N Supply Chain Problem
  177. The Dependency Layer in Digital Sovereignty
  178. The C-Shaped Hole in Package Management
  179. Introducing Package Chaos Monkey
  180. PkgFed: ActivityPub for Package Releases
  181. Rewriting git-pkgs in Go
  182. Package Management is a Wicked Problem
  183. A Protocol for Package Management
  184. An AI Skill for Skeptical Dependency Management
  185. The Lesser Evil of Compliance: Enterprise SBOM Strategy for CRA Readiness
  186. A Jepsen Test for Package Managers
  187. importmap.lock: a lockfile for the web
  188. Workspaces and Monorepos in Package Managers
  189. Lockfile Format Design and Tradeoffs
  190. Package Manager People
  191. Package Manager Glossary
  192. 16 Best Practices for Reducing Dependabot Noise
  193. Package Management Blog Posts
  194. brew-vulns: CVE scanning for Homebrew
  195. The Nine Levels of JavaScript Dependency Hell
  196. Making git-pkgs feel like Git
  197. The Package Management Landscape
  198. How Dependabot Actually Works
  199. git-pkgs: explore your dependency history
  200. Posts from January 2026

2025 36

  1. Open Source Activity in 2025
  2. Community Tools Bring Lockfile Support to GitHub Actions
  3. Categorizing Package Manager Clients
  4. Categorizing Package Registries
  5. The Compact Index: How Bundler Scales Dependency Resolution
  6. How to Ruin All of Package Management
  7. How uv got so fast
  8. Cursed Bundler: Using go get to install Ruby Gems
  9. Package managers keep using git as a database, it never works out
  10. Could lockfiles just be SBOMs?
  11. Package Registries Are Governance Providers
  12. Federated Package Management and the Zooko Triangle
  13. Jekyll Stats Plugin
  14. Package Managers Devroom at FOSDEM 2026: Schedule Announced
  15. Why JavaScript Needed Docker
  16. Docker is the Lockfile for System Packages
  17. Typosquatting in Package Managers
  18. How I Assess Open Source Libraries
  19. Supply Chain Security Tools for Ruby
  20. Building Ecosyste.ms Polite API Rate Limits
  21. Slopsquatting meets Dependency Confusion
  22. Why I’m Fascinated by Package Management
  23. GitHub Actions Has a Package Manager, and It Might Be the Worst
  24. Package Manager Design Tradeoffs
  25. What is a Package Manager?
  26. PromptVer
  27. Posts from December 2025
  28. Documenting Package Manager Data
  29. A Taxonomy for Open Source Software
  30. Revisiting Gitballs
  31. Community Benchmarks for AI Coding Tools
  32. Extending Git Functionality
  33. Podcast Interviews 2025
  34. Package Manager Timeline
  35. Package Management Papers
  36. Posts from November 2025

2024 2

  1. From ZeroVer to SemVer: A List of Versioning Schemes in Open Source
  2. Posts from June 2024

2023 2

  1. Ecosyste.ms 2023 End of Year Update
  2. Posts from December 2023

2018 3

  1. Making 24 Pull Requests more inclusive for 2018
  2. Untangle your GitHub Notifications with Octobox
  3. Posts from November 2018

2017 4

  1. What does a sustainable open source project look like?
  2. Posts from November 2017
  3. Exploring Unseen Open Source Infrastructure
  4. Posts from February 2017