The Curious Engineer

All blogs / Software / engineering practice

Andrew Nesbitt

nesbitt.io

Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.

Software / engineering practiceSecurityDev tools / editors / IDEs

’17’18’19’20’21’22’23’24’25’26
Posts
250 from 1 Feb 2017 to 7 Nov 2026
Posting
about daily (238 in the last year)
Kind
personal blog
Feed
https://nesbitt.io/feed.xml

2026 203

  1. This Week in Package Management: 7 November 2026
  2. Weekend at Bernie’s II
  3. This Week in Source Control: 4 November 2026
  4. This Week in Package Management: 31 October 2026
  5. Signing and Attestations Across Package Registries
  6. This Week in Source Control: 28 October 2026
  7. Package Management Devroom at FOSDEM 2027: Call for Participation
  8. This Week in Package Management: 24 October 2026
  9. One Small Bug
  10. Trust Stores Are Dependencies Too
  11. This Week in Package Management: 17 October 2026
  12. Now That’s What I Call Technical Debt!
  13. This Week in Package Management: 10 October 2026
  14. Package Management RFCs
  15. This Week in Package Management: 3 October 2026
  16. Software Heritage Identifiers
  17. Posts from October 2026
  18. This Week in Package Management: 26 September 2026
  19. Package Manager Sandboxing
  20. Package Manager Threat Model, Revisited
  21. Unfinished Work in Package Security
  22. This Week in Package Management: 19 September 2026
  23. Good Morning, Your Toaster Is Compromised
  24. Shadowing the Standard Library
  25. This Week in Package Management: 12 September 2026
  26. Package Manager Trends
  27. What’s new in git-pkgs
  28. This Week in Package Management: 5 September 2026
  29. How much should you trust your OSS data?
  30. Git Submodules as a Package Manager
  31. Posts from September 2026
  32. This Week in Package Management: 29 August 2026
  33. Now Hiring: Senior Open Source Maintainer
  34. Bazel Module Versions Aren’t SemVer
  35. Hardening the Override Flag
  36. This Week in Package Management: 22 August 2026
  37. Issues in the Repo
  38. Two-Factor Authentication Across Package Registries
  39. This Week in Package Management: 15 August 2026
  40. How This Blog Is Built
  41. Supplier Security Questionnaire
  42. Shared Code Between Package Managers
  43. This Week in Package Management: 8 August 2026
  44. The Software Stewardship Lab
  45. A year of AI disclosure in critical packages
  46. brew install actions/checkout
  47. This Week in Package Management: 1 August 2026
  48. Posts from August 2026
  49. The AI Phrasebook
  50. Wheels, Bottles and Images
  51. Why npm Dependency Trees Are So Big
  52. This Week in Package Management: 25 July 2026
  53. Interview with a Maintainer
  54. Package Name Prefixes
  55. –end-of-options
  56. This Week in Package Management: 18 July 2026
  57. Plumbing Homebrew into the vulnerability ecosystem
  58. This Week in Package Management: 11 July 2026
  59. Package Management as Org Chart
  60. Unboxed: Zig
  61. Content addressing in package managers
  62. This Week in Package Management: 4 July 2026
  63. The CRA is not about open source
  64. Posts from July 2026
  65. Taking Roads and Bridges literally
  66. Unbundling the standard library
  67. This Week in Package Management: 27 June 2026
  68. Incident Report: CVE-2026-LGTM
  69. Scrutineer: scanning open source without flooding maintainers
  70. Sunsetting a Package Manager
  71. This Week in Package Management: 20 June 2026
  72. Open Source vs the Invisible Hand
  73. How Open Source Projects Change Hands
  74. This Week in Package Management: 13 June 2026
  75. Joint Guidance on Vulnerability Naming and Disclosure
  76. What Happened to tea.xyz
  77. Forms of Open Source Government
  78. Package Manager Patents
  79. This Week in Package Management: 6 June 2026
  80. Install-script allowlists
  81. gittuf - a signed log for git refs
  82. Skills Registry Threat Models
  83. The Infosec Phrasebook
  84. Posts from June 2026
  85. This Week in Package Management: 30 May 2026
  86. Composer’s dependency policies
  87. Package managers that package package managers
  88. Protestware for coding agents
  89. CHAOSS Metrics in 2026
  90. GitHub Actions security in Python packages
  91. Signing is for the bad days
  92. This Week in Package Management: 23 May 2026
  93. Dependency Pruning
  94. RFC: Artificial Contributors to Open Source
  95. Dumb Ways for an Open Source Project to Die
  96. Language Registries Are Unstable by Default
  97. Centrality is not vitality
  98. Showing Our Work
  99. Not a Security Issue
  100. Proxy
  101. Madame Semver Will See You Now
  102. The Mismeasure of Open Source
  103. Weekend at Bernie’s
  104. Free as in Tribbles
  105. Revisiting the 2015 Open Source Census
  106. Package Manager Threat Models
  107. Package Manager CWEs
  108. A GitHub for maintainers
  109. Patching and forking in package managers
  110. Posts from May 2026
  111. Announcing the 2026 Open Source Fantasy Draft
  112. GitHub Actions is the weakest link
  113. The stages of package installation
  114. Brief
  115. Features everyone should steal from npmx
  116. The Tuesday Test
  117. Standing on the shoulders of Homebrew
  118. Common Package Specification
  119. Package Registries and Pagination
  120. Package Security Defenses for AI Agents
  121. Package Security Problems for AI Agents
  122. Who Built This?
  123. The Cathedral and the Catacombs
  124. What does Open Source mean?
  125. Package Manager Easter Eggs
  126. Posts from April 2026
  127. npm’s Defaults Are Bad
  128. Git Diff Drivers
  129. The Roles of Packages
  130. The Top 10 Biggest Conspiracies in Open Source
  131. How to Attract AI Bots to Your Open Source Project
  132. Package Manager Mirroring
  133. The Fragmented World of Dependency Policy
  134. Git Remote Helpers
  135. Guided Meditation for Developers
  136. What’s Going On with FAIR Package Manager
  137. Forge
  138. Reviewing ENISA’s Package Manager Advisory
  139. git-pkgs/actions
  140. Just Use Postgres
  141. 100 Posts
  142. If It Quacks Like a Package Manager
  143. Announcing New Working Groups
  144. .gitlocal
  145. Package Manager Magic Files
  146. Package Managers Need to Cool Down
  147. Package Management is Naming All the Way Down
  148. Transitive Trust
  149. Downstream Testing
  150. Posts from March 2026
  151. npm Data Subject Access Request
  152. xkcd 2347
  153. Git in Postgres
  154. Two Kinds of Attestation
  155. Reproducible Builds in Language Package Managers
  156. Where Do Specifications Fit in the Dependency Tree?
  157. Forge-Specific Repository Folders
  158. Whale Fall
  159. ActivityPub
  160. Go Modules for Package Management Tooling
  161. What Package Registries Could Borrow from OCI
  162. Platform Strings
  163. CHANGELOG.md
  164. Separating Download from Install in Docker Builds
  165. Package Management Namespaces
  166. Respectful Open Source
  167. The Many Flavors of Ignore Files
  168. Package Management Consulting
  169. Lockfiles Killed Vendoring
  170. Package Manager Podcast Episodes
  171. Sandwich Bill of Materials
  172. Crates.io’s Freaky Friday
  173. Dependency Resolution Methods
  174. Git’s Magic Files
  175. Package Management at FOSDEM 2026
  176. Incident Report: CVE-2024-YIKES
  177. Posts from February 2026
  178. Will AI Make Package Managers Redundant?
  179. Zig and the M×N Supply Chain Problem
  180. The Dependency Layer in Digital Sovereignty
  181. The C-Shaped Hole in Package Management
  182. Introducing Package Chaos Monkey
  183. PkgFed: ActivityPub for Package Releases
  184. Rewriting git-pkgs in Go
  185. Package Management is a Wicked Problem
  186. A Protocol for Package Management
  187. An AI Skill for Skeptical Dependency Management
  188. The Lesser Evil of Compliance: Enterprise SBOM Strategy for CRA Readiness
  189. A Jepsen Test for Package Managers
  190. importmap.lock: a lockfile for the web
  191. Workspaces and Monorepos in Package Managers
  192. Lockfile Format Design and Tradeoffs
  193. Package Manager People
  194. Package Manager Glossary
  195. 16 Best Practices for Reducing Dependabot Noise
  196. Package Management Blog Posts
  197. brew-vulns: CVE scanning for Homebrew
  198. The Nine Levels of JavaScript Dependency Hell
  199. Making git-pkgs feel like Git
  200. The Package Management Landscape
  201. How Dependabot Actually Works
  202. git-pkgs: explore your dependency history
  203. Posts from January 2026

2025 36

  1. Open Source Activity in 2025
  2. Community Tools Bring Lockfile Support to GitHub Actions
  3. Categorizing Package Manager Clients
  4. Categorizing Package Registries
  5. The Compact Index: How Bundler Scales Dependency Resolution
  6. How to Ruin All of Package Management
  7. How uv got so fast
  8. Cursed Bundler: Using go get to install Ruby Gems
  9. Package managers keep using git as a database, it never works out
  10. Could lockfiles just be SBOMs?
  11. Package Registries Are Governance Providers
  12. Federated Package Management and the Zooko Triangle
  13. Jekyll Stats Plugin
  14. Package Managers Devroom at FOSDEM 2026: Schedule Announced
  15. Why JavaScript Needed Docker
  16. Docker is the Lockfile for System Packages
  17. Typosquatting in Package Managers
  18. How I Assess Open Source Libraries
  19. Supply Chain Security Tools for Ruby
  20. Building Ecosyste.ms Polite API Rate Limits
  21. Slopsquatting meets Dependency Confusion
  22. Why I’m Fascinated by Package Management
  23. GitHub Actions Has a Package Manager, and It Might Be the Worst
  24. Package Manager Design Tradeoffs
  25. What is a Package Manager?
  26. PromptVer
  27. Posts from December 2025
  28. Documenting Package Manager Data
  29. A Taxonomy for Open Source Software
  30. Revisiting Gitballs
  31. Community Benchmarks for AI Coding Tools
  32. Extending Git Functionality
  33. Podcast Interviews 2025
  34. Package Manager Timeline
  35. Package Management Papers
  36. Posts from November 2025

2024 2

  1. From ZeroVer to SemVer: A List of Versioning Schemes in Open Source
  2. Posts from June 2024

2023 2

  1. Ecosyste.ms 2023 End of Year Update
  2. Posts from December 2023

2018 3

  1. Making 24 Pull Requests more inclusive for 2018
  2. Untangle your GitHub Notifications with Octobox
  3. Posts from November 2018

2017 4

  1. What does a sustainable open source project look like?
  2. Posts from November 2017
  3. Exploring Unseen Open Source Infrastructure
  4. Posts from February 2017