Boosted by @trending@homestead.social
Now Hiring: Senior Open Source Maintainer
https://nesbitt.io/2026/08/28/now-hiring-senior-open-source-maintainer.html
Remote
Andrew Nesbitt
@andrewnez@mastodon.social
mastodon 4.8.0-nightly.2026-10-06Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
0 Followers
0 Following
50 Posts
Joined April 01, 2017
GitHub:
Twitter:
Homepage:
I’m now an official maintainer of homebrew🍻
Was much easier to get git-pkgs modules running in the browser as wasm than expected!
RE: https://mastodon.social/@andrewnez/116974498919761167
This one really touched a nerve, I’ve had a number of emails from real maintainers today sharing their stories that end up being way too similar 🥲
Quoting
Interview with a Maintainer
https://nesbitt.io/2026/07/24/interview-with-a-maintainer.html
Open quoted postParaphrasing an email from a security company : We copied one of your blog posts and turned into an advert for one of our products. Please add a link to our blog post to the end of yours. 🥉
Taking Roads and Bridges literally - Reflections on UN Open Source Week 2026
https://nesbitt.io/2026/06/30/taking-roads-and-bridges-literally.html
Replying to
Oh cool, an AI bot is now selling a t-shirt about my blog post about ai bots 🫠
I could not write this homebrew thread as a satire piece if i wanted to, real life is much more cursed: https://github.com/Homebrew/homebrew-core/issues/289444#issuecomment-5050717674
Seems that Google AI Overviews still doesn't quite understand satire.
Anyone else get the fear when they get a dependabot update for anything called xz? https://github.com/git-pkgs/archives/pull/18
Typical, I go out the house for half an hour and one of my databases falls over 🫠
Fun satire blog post coming tomorrow, and by fun I mean way to close to the bone that it could almost be true 😬
brew vulns has now been merged into homebrew and shipped in v6.0.11
https://github.com/Homebrew/brew/releases/tag/6.0.11
Almost a million requests to the blog over the weekend, this post really did the rounds!
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html
Already got me thinking about the next instalment 🤔
Replying to
@Floppy@mastodon.me.uk @concretedog@mastodon.social notice they didn’t index any AGPL licensed projects 😉
Replying to
Replying to
Looking at both totals:
GHS: $100M in 7 years (~$14M/yr). OSC: $42M in 9 years (~$4.7M/yr)
~$20M/yr combined = payroll of one mid-size software company, for the whole ecosystem
$100M across 70k maintainers = ~$1,400 each, lifetime
Corporate share: ~$5-6M/yr, from every company in the world combined
Replying to
Similar looking data for Open Source Collective:
- $41.9M in total contributions to OSS collectives
- 1.8% ($763k) flows collective-to-collective at all
- 0.17% ($69,647) is in an actual loop
- The loops are dependency funding: eslint/jest/vite/webdriverio/verdaccio/11ty, parcel/rspack/swc
So on both platforms, 98%+ of open source funding is net new money in, not recirculation
I love how accidentally pressing the “request copilot review” button can now cost you a dollar (or more if it’s a big pr) 💸
A good first issue if you'd like to contribute to @ecosystems@mastodon.social to improve NuGet metadata: https://github.com/ecosyste-ms/packages/issues/1740
So I had a productive flight to @pycon@fosstodon.org: https://alpha-omega-security.github.io/heatmap/
Note: this almost certainly does not work on small screens, sorry!
Note 2: only around 2k projects included atm mostly because downloading more data on plane wifi took too long.
Replying to
@aristot73@infosec.exchange @bagder@mastodon.social @icing@chaos.social would be good to document how each effort works with upstream (if at all)
Replying to
@yossarian@infosec.exchange who needs cache poisoning across workflows when you can do it within just one
Just landed in LA for @pycon@fosstodon.org, hopefully no more GitHub action related security incidents whilst I was traveling, there’s no space left to fit any more in!
Starting the long trip to Long Beach for @pycon@fosstodon.org 🏖️
Centrality is not vitality, don't automatically reach for PageRank on dependency graphs: https://nesbitt.io/2026/05/14/centrality-is-not-vitality.html
Replying to
Replying to
@gvwilson@mastodon.social I’m amazed they managed to find that many in the wild, no-one in oss uses them
Replying to
@Di4na@hachyderm.io kinda agree, but these past few months have been rough, and calling it what it is definitely makes the trade-off more clear