Ideas

We regularly write about Open Source governance and burnout, software supply chains, package management, funding and metrics, and other topics in Open Source sustainability.



All Posts

Software Supply Chains

How to sustainably and securely manage dependencies.

GitHub Actions security in Python packages

A portrait of Andrew NesbittAndrew Nesbitt
25 May 2026

Dependency Pruning

A portrait of Andrew NesbittAndrew Nesbitt
22 May 2026

Not a Security Issue

A portrait of Andrew NesbittAndrew Nesbitt
12 May 2026

Weekend at Bernie's

A portrait of Andrew NesbittAndrew Nesbitt
8 May 2026

Free as in Tribbles

A portrait of Andrew NesbittAndrew Nesbitt
7 May 2026

Revisiting the 2015 Open Source Census

A portrait of Andrew NesbittAndrew Nesbitt
6 May 2026

GitHub Actions is the weakest link

A portrait of Andrew NesbittAndrew Nesbitt
28 Apr 2026

Who Built This?

A portrait of Andrew NesbittAndrew Nesbitt
7 Apr 2026

The Cathedral and the Catacombs

A portrait of Andrew NesbittAndrew Nesbitt
6 Apr 2026

The Fragmented World of Dependency Policy

A portrait of Andrew NesbittAndrew Nesbitt
19 Mar 2026

Reviewing ENISA's Package Manager Advisory

A portrait of Andrew NesbittAndrew Nesbitt
12 Mar 2026

Transitive Trust

A portrait of Andrew NesbittAndrew Nesbitt
2 Mar 2026

Downstream Testing

A portrait of Andrew NesbittAndrew Nesbitt
1 Mar 2026

Two Kinds of Attestation

A portrait of Andrew NesbittAndrew Nesbitt
25 Feb 2026

The C-Shaped Hole in Package Management

A portrait of Andrew NesbittAndrew Nesbitt
27 Jan 2026

How I Assess Open Source Libraries

A portrait of Andrew NesbittAndrew Nesbitt
15 Dec 2025

Slopsquatting meets Dependency Confusion

A portrait of Andrew NesbittAndrew Nesbitt
10 Dec 2025

Maintainer Well-Being

How to care for the people who build the tech we rely on.

Open Source Burnout Claims Another Project

A portrait of Vlad-Stefan HarbuzVlad-Stefan Harbuz
20 May 2026

Respectful Open Source

A portrait of Andrew NesbittAndrew Nesbitt
13 Feb 2026

Funding Tech Infrastructure

How to sustainably finance our ecosystems.

How OSPOs can Measure the Impact of OSS Funding

A portrait of Dawn FosterDawn Foster
2 Jun 2026

Not Paying Open Source Maintainers Is Expensive

A portrait of Vlad-Stefan HarbuzVlad-Stefan Harbuz
18 Jun 2025

Software Metrics

How to measure what makes software sustainably developed.

Centrality is not vitality

A portrait of Andrew NesbittAndrew Nesbitt
14 May 2026

The Mismeasure of Open Source

A portrait of Andrew NesbittAndrew Nesbitt
9 May 2026

Project Governance

How to share control of our tech.

The Dependency Layer in Digital Sovereignty

A portrait of Andrew NesbittAndrew Nesbitt
28 Jan 2026

Package Registries Are Governance Providers

A portrait of Andrew NesbittAndrew Nesbitt
22 Dec 2025

Philosophy

How to categorise practical and moral Open Source concepts.

What does Open Source mean?

A portrait of Andrew NesbittAndrew Nesbitt
4 Apr 2026

npmx: A Lesson in Open Source's Collaboration Feedback Loops

A portrait of Vlad-Stefan HarbuzVlad-Stefan Harbuz
3 Mar 2026

Whale Fall

A portrait of Andrew NesbittAndrew Nesbitt
21 Feb 2026

Keystone Maintainers Keep the Internet Going

A portrait of Vlad-Stefan HarbuzVlad-Stefan Harbuz
13 Nov 2025

Package Management

How to build package managers and registries.

Signing is for the bad days

A portrait of Andrew NesbittAndrew Nesbitt
24 May 2026

Language Registries Are Unstable by Default

A portrait of Andrew NesbittAndrew Nesbitt
15 May 2026

Patching and forking in package managers

A portrait of Andrew NesbittAndrew Nesbitt
1 May 2026

The stages of package installation

A portrait of Andrew NesbittAndrew Nesbitt
27 Apr 2026

The Tuesday Test

A portrait of Andrew NesbittAndrew Nesbitt
15 Apr 2026

Standing on the shoulders of Homebrew

A portrait of Andrew NesbittAndrew Nesbitt
14 Apr 2026

Common Package Specification

A portrait of Andrew NesbittAndrew Nesbitt
13 Apr 2026

Package Registries and Pagination

A portrait of Andrew NesbittAndrew Nesbitt
10 Apr 2026

npm's Defaults Are Bad

A portrait of Andrew NesbittAndrew Nesbitt
31 Mar 2026

What's Going On with FAIR Package Manager

A portrait of Andrew NesbittAndrew Nesbitt
14 Mar 2026

If It Quacks Like a Package Manager

A portrait of Andrew NesbittAndrew Nesbitt
8 Mar 2026

Package Managers Need to Cool Down

A portrait of Andrew NesbittAndrew Nesbitt
4 Mar 2026

Package Management is Naming All the Way Down

A portrait of Andrew NesbittAndrew Nesbitt
3 Mar 2026

Reproducible Builds in Language Package Managers

A portrait of Andrew NesbittAndrew Nesbitt
24 Feb 2026

Where Do Specifications Fit in the Dependency Tree?

A portrait of Andrew NesbittAndrew Nesbitt
23 Feb 2026

What Package Registries Could Borrow from OCI

A portrait of Andrew NesbittAndrew Nesbitt
18 Feb 2026

Separating Download from Install in Docker Builds

A portrait of Andrew NesbittAndrew Nesbitt
15 Feb 2026

Lockfiles Killed Vendoring

A portrait of Andrew NesbittAndrew Nesbitt
10 Feb 2026

Package Manager Podcast Episodes

A portrait of Andrew NesbittAndrew Nesbitt
9 Feb 2026

Crates.io's Freaky Friday

A portrait of Andrew NesbittAndrew Nesbitt
6 Feb 2026

Package Management at FOSDEM 2026

A portrait of Andrew NesbittAndrew Nesbitt
4 Feb 2026

Will AI Make Package Managers Redundant?

A portrait of Andrew NesbittAndrew Nesbitt
30 Jan 2026

Zig and the M×N Supply Chain Problem

A portrait of Andrew NesbittAndrew Nesbitt
29 Jan 2026

PkgFed: ActivityPub for Package Releases

A portrait of Andrew NesbittAndrew Nesbitt
25 Jan 2026

Package Management is a Wicked Problem

A portrait of Andrew NesbittAndrew Nesbitt
23 Jan 2026

A Protocol for Package Management

A portrait of Andrew NesbittAndrew Nesbitt
22 Jan 2026

A Jepsen Test for Package Managers

A portrait of Andrew NesbittAndrew Nesbitt
19 Jan 2026

importmap.lock: a lockfile for the web

A portrait of Andrew NesbittAndrew Nesbitt
19 Jan 2026

Workspaces and Monorepos in Package Managers

A portrait of Andrew NesbittAndrew Nesbitt
18 Jan 2026

How Dependabot Actually Works

A portrait of Andrew NesbittAndrew Nesbitt
2 Jan 2026

Community Tools Bring Lockfile Support to GitHub Actions

A portrait of Andrew NesbittAndrew Nesbitt
30 Dec 2025

The Compact Index: How Bundler Scales Dependency Resolution

A portrait of Andrew NesbittAndrew Nesbitt
28 Dec 2025

How to Ruin All of Package Management

A portrait of Andrew NesbittAndrew Nesbitt
27 Dec 2025

How uv got so fast

A portrait of Andrew NesbittAndrew Nesbitt
26 Dec 2025

Cursed Bundler: Using go get to install Ruby Gems

A portrait of Andrew NesbittAndrew Nesbitt
25 Dec 2025

Package managers keep using git as a database, it never works out

A portrait of Andrew NesbittAndrew Nesbitt
24 Dec 2025

Could lockfiles just be SBOMs?

A portrait of Andrew NesbittAndrew Nesbitt
23 Dec 2025

Federated Package Management and the Zooko Triangle

A portrait of Andrew NesbittAndrew Nesbitt
21 Dec 2025

Why JavaScript Needed Docker

A portrait of Andrew NesbittAndrew Nesbitt
19 Dec 2025

Docker is the Lockfile for System Packages

A portrait of Andrew NesbittAndrew Nesbitt
18 Dec 2025

Why I'm Fascinated by Package Management

A portrait of Andrew NesbittAndrew Nesbitt
9 Dec 2025

GitHub Actions Has a Package Manager, and It Might Be the Worst

A portrait of Andrew NesbittAndrew Nesbitt
6 Dec 2025

Tooling

How to find good tools for developers to use.

A GitHub for maintainers

A portrait of Andrew NesbittAndrew Nesbitt
2 May 2026

Features everyone should steal from npmx

A portrait of Andrew NesbittAndrew Nesbitt
16 Apr 2026

Package Manager Easter Eggs

A portrait of Andrew NesbittAndrew Nesbitt
3 Apr 2026

Git Diff Drivers

A portrait of Andrew NesbittAndrew Nesbitt
30 Mar 2026

.gitlocal

A portrait of Andrew NesbittAndrew Nesbitt
6 Mar 2026

Rewriting git-pkgs in Go

A portrait of Andrew NesbittAndrew Nesbitt
24 Jan 2026

Making git-pkgs feel like Git

A portrait of Andrew NesbittAndrew Nesbitt
4 Jan 2026

Revisiting Gitballs

A portrait of Andrew NesbittAndrew Nesbitt
28 Nov 2025