Post details
We should all be using dependency cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns #security #oss
We should all be using dependency cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns #security #oss

Worries about Open Source in the age of LLMs (6 mins read).
Some concerns I have with moving towards "don't use Open Source, get an LLM to generate the code you want" and where it'll take us.
My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.
it's kinda weird that all the software i am expected to use for work are all written by distributed teams, go, python, postgres, linux, chrome, k8s etc and despite being told "the best teams work in an office together" i don't know of any software i use that's actually written that way
Starless: How we accidentally vanished our most popular GitHub repos (11 mins read).

How a change targeting internal GitHub repositories backfired and inadvertently made Elastic's public-facing repositories private.
The Register recently published a story titled Putin on the code: DoD reportedly relies on utility written by Russian dev. They should be ashamed of this story. This poor open source developer is getting beat up now to score some internet points. It’s very upsetting. But anyway, let’s look at some receipts. If you’re not real smrt, it seems like pointing out an open source project is written by one person in a country you don’t like is a bad thing. It could be. But it also could be the software running THE WHOLE F*CKING PLANET is written by one person. In a country. But we have no idea which country. It’s not the same person mind you, but it’s one person.

Another day, another rug pull. At least that’s what the cynical might say, as we as an industry once again are discussing the fallout of another company changing their software from what was previo…

i had some really stressful interactions on github yesterday and today. lets just remember many of us are doing this OSS work for free and to do good, kindness is appreciated
My experience as a maintainer (8 mins read).
A guest post for opensource.org, about my experience as a maintainer, as part of 2025's Maintainer Month.
Looking back at oapi-codegen's last year (6 mins read).

A recap of oapi-codegen's last year, in light of it being Maintainer Month, and continuing to ask for sponsorship.
Three years ago, I was part of a team responsible for developing and maintaining Kubernetes clusters for end user customers. A main source for downtime in customer environments occurred when image registries went down. The traditional way to solve this problem is to set up a stateful mirror, however we had to work within customer budget and time constraints which did not allow it. During a Black Friday, we started getting hit with a ton of traffic while GitHub container registries were down. This limited our ability to scale up the cluster as we depended on critical images from that registry. After this incident, I started thinking about a better way to avoid these scalability issues. A solution that did not need a stateful component and required minimal operational oversight. This is where the idea for Spegel came from.

It's easy to forget how much work it is when someone is paying you
Something they don't tell you about being heavily involved in an open source project is that even when you're unemployed, there are a thousand emails and slack messages you still have to answer and so, so many meetings
AAAHHHHHHHHH BE NICE TO OPEN SOURCE MAINTAINERS OH MY GOD. SOME OF YOU ARE SO RUDE, WHO RAISED YOU
Question for OSS maintainers: what’s the most audacious work a company has ever asked you to do for free? I’ve heard of some projects being asked to fill out security questionnaires for free, but I don’t have a firsthand account of that and it got me curious about what else projects have been asked
Work for free and in return watch your passion get crushed by entitled users who are never satisfied
Open source business models are hard. A question I often get it why is it even open source? Here are some of my thoughts on that, and reasons why

Product requirements for a "fund your dependency tree" service (12 mins read).
Thinking about what functionality I would want as a funder, or a fundee, for a "fund your dependency tree" service.
Overworked, under pressure, and subjected to abuse – is it really worth it?

Attached: 1 image 2025

An infrastructure engineer, focused on distributed storage system
I've said it before, but if Randall Monroe could somehow successfully induce a donation of say ten bucks for each time someone uses That One xkcd Comic in a FOSS talk or blog describing the open source sustainability problem, said problem would be solved.
Attached: 1 image I love being an open source maintainer, we get the best email from only the most delightful people. 🙃 . (maybe i should just switch to macOS and stop caring about linux 🙃 )
OggCamp 2024 (14 mins read).

A recap of this weekend's OggCamp 2024 conference.
Open source is proof free markets are so efficient they can even find a use for communists.
How to use Dependency Management Data to discover which dependencies are participating in Hacktoberfest (3 mins read).

Detailing how you could use dependency-management-data to gain insight into which dependencies you use are participating in Hacktoberfest.
Contributing to open source is a privilege. It doesn't mean you have cheated to do it or that you don't deserve praise for doing it! It only means that not everyone can do it. You need the skills, time and will to do it in addition to doing whatever you need to have a good life. Not everyone has that time. Not everyone works in the field. We must acknowledge it to meaningfully convey the value of open source in society. #opensource #privilege
<p>Folks, today's the day.</p> <p>As of this morning, I've made over a million dollars on GitHub sponsors. Wowoweewow.</p> <p><img src="/pos...

Content warning: Tech culture
Microsoft is experimenting with and investing in sustainability of the open source ecosystem sponsorships. Learn more.

Announcing Geomys, a small firm of professional maintainers with a portfolio of critical Go projects.

After signing up for GitHub Sponsors, I had a nagging feeling that somehow asking for money from other people to support my open source work was inappropriate. But after much reflection, I realized that phrasing the use of GitHub Sponsors as a way to express patronage/support and appreciation for
A JavaScript library maintainer is under fire after merging a controversial PR to support legacy versions of Node.js.


Will Yaak be open source? The short answer is no, there are no plans of going open source. Instead, Yaak will…

Attached: 1 image idk why people say funding OSS is difficult


Attached: 1 image Tips to prevent maintainer burnout from the beautiful soup maintainer. A single maintainer managing a package will millions of users *ask users to contribute issues before a pr * practice defensive programming. Use warnings to point to common user mistakes #pyconus #python #opensource

Creating a more sustainable model for oapi-codegen in the future (9 mins read).

Announcing a request for sponsorship to continue to allow allocating more time to oapi-codegen as well as to make more ambitious changes to the project.
oapi-codegen is moving to its own org (7 mins read).

Announcing oapi-codegen's move to its own GitHub org, and a history lesson about the project.
You're currently viewing page 1 of 7, of 318 posts.