Extracting the dependency tree from Renovate for given repositories (4 mins read).
Creating a (hacky) solution to retrieve the dependency graph from Renovate for a set of repositories.
by 
Jamie Tanna
.
#blogumentation
#whitesource-renovate
#open-source
#security
#typescript.
Automattic acquired Pocket Casts last July, and since we’ve been tapping away trying to make the best podcast client for people who love listening to podcasts. And! The team has been working …
by Jamie Tanna
.
#podcasts
#open-source.
Does the tech industry thrive on free work? (6 mins read).
Thinking about how there are subtle expectations to work on your career outside of tech, and how it's not necessarily great.
by Jamie Tanna
.
#career
#job
#adhd
#open-source
#mental-health.
Recommended read: GitHub Copilot investigation · Joseph Saveri Law Firm & Matthew Butterick https://githubcopilotinvestigation.com/
Analysing our dependency trees to determine where we should send Open Source contributions for Hacktoberfest (8 mins read).
How we (at Deliveroo) are using GitHub Advanced Security's dependency scanning functionality to determine what our most popular dependencies are, and whether we can find any Open Source contributions for the month of Hacktoberfest.
There have been discussions in the aftermath of the log4j vulnerability about whether or not open source is broken or sustainable, what we can do to improve the sustainability of the open source ecosystem moving forwards, and the entitlement of users and companies in expecting maintainers to fix their problems.
Recommended read: Entitlement in Open Source https://mikemcquaid.com/entitlement-in-open-source/
by Jamie Tanna
.
#open-source.
💶 Instead of sponsoring open-source contributors for their work, sponsor them to go on vacation. 🏝️ (Suggested by @Tixie_)Mara Bos (@m_ou_se)Fri, 16 Sep 2022 15:31 +0000
by Jamie Tanna
.
#open-source.
Do open source, they said. It will be great, they said.
snipe, lixo tóxico ⭑⭒⭒⭒⭒ (@snipeyhead)Thu, 25 Aug 2022 17:29 +0000
by Jamie Tanna
.
#open-source.
I think the world would be a better place if we viewed forks of free software as officially endorsed fan fiction
Matthew Garrett (@mjg59)Thu, 25 Aug 2022 10:03 +0000
by Jamie Tanna
.
#open-source
#shitpost.
by Jamie Tanna
.
#open-source.
What do Docker, GitLab, and Red Hat have in common? Aside from various levels of participation in open source, they’ve all been punching bags over the past few years for non-paying users angr…
"Running a successful open source project is just Good Will Hunting in reverse, where you start out as a respected genius and end up being a janitor who gets into fights." Quote attributed to @cra, and I don't think I've ever seen anything more true posted.Jens Axboe (@axboe)Fri, 12 Aug 2022 17:16 +0000
by Jamie Tanna
.
#open-source.
For many open source consumers the "logical units" being depended on are libraries. However, the libraries themselves are only a product of what consumers are actually depending on: people. Y...
Recommended read: People in your software supply chain https://sethmlarson.dev/blog/people-in-your-software-supply-chain
Idea for Open Source/Startup: monetising the supply chain (2 mins read).
An idea I've had for how to better distribute support to Open Source libraries in the supply chain for your software.
Always include a complete example on how to reproduce your problem. signed, all your OSS maintainersMatteo Collina (@matteocollina)Tue, 10 May 2022 16:04 +0000
by Jamie Tanna
.
#open-source.
Hey, students and professors: Making fake commits against real OSS projects is not a valid class assignment. It wastes people's time, irritates them, and gives the student a bad reputation on Github and OSS. Don't do it.Berkubernetus (@fuzzychef)Fri, 08 Apr 2022 21:00 +0000
by Jamie Tanna
.
#open-source.
https://twitter.com/erikbtweets/status/1513072362752823298
You can't just pick some repo on github and demand the maintainer teach you how to participate in an Open Source project. That's not how any of this works.Joe Cooper 🌻🇺🇦🌻 (@swelljoe)Sun, 10 Apr 2022 09:34 +0000
by Jamie Tanna
.
#open-source.
Recommended read: Open source ‘protestware’ harms Open Source https://opensource.org/open-source-protestware-harms-open-source
So here's why I bought a receipt printer: Every time one of my GitHub repos gets a new issue, I now get a physical ticket printed out on my desk 🪄Andrew Schmelyun (@aschmelyun)Thu, 24 Mar 2022 11:44 GMT
https://twitter.com/_msw_/status/1506459050594082820
I have noticed what seems like an almost generational divide in people who contribute to open source. Those who did open source before 2015, and those who think GitHub = OpenSource. 🙃Aeva ✈ ShmooCon! ✨ (@aevavoom)Wed, 23 Mar 2022 14:58 GMT
by Jamie Tanna
.
#github
#open-source.
People who say "open source isn't a place for politics" might be unfamiliar with the decades-long social movement. It's always been political.msw (@_msw_)Fri, 18 Mar 2022 15:11 GMT
by Jamie Tanna
.
#open-source.
I talked about this yesterday wrt pinning your dependencies, but these sorts of actions, even if the rationale comes from a good place, are NOT OK. twitter.com/techmeme/statu…Post details
Maintainer of the popular open source networking tool node-ipc appears to have sabotaged the tool's code to wipe data on computers based in Russia and Belarus (@josephfcox / VICE) vice.com/en/article/dyp… techmeme.com/220318/p9#a220…Techmeme (@Techmeme)Fri, 18 Mar 2022 16:51 GMT
Christina Warren (@film_girl)Fri, 18 Mar 2022 19:29 GMT
by Jamie Tanna
.
#open-source.
https://twitter.com/juliaferraioli/status/1499449536934137856
At some point, we're going to have to have a brutally honest conversation about the cult of personality in open source.
julia ferraioli (@juliaferraioli)Thu, 03 Mar 2022 18:21 GMT
I don't say stuff like this often, but if you think that #OpenSource is about one person, you are doing it wrong.julia ferraioli (@juliaferraioli)Thu, 03 Mar 2022 18:20 GMT
Happy to see @nodejs be fully free at last. When considering @deno_land and other venture backed similar projects, remember to take the governance model of those projects into account. It can have quite the impact over time.Post details
Exciting news today! Joyent has transferred ownership of the Node.js trademarks to the OpenJS Foundation to help protect the work of the Node.js collaborators. We’ve worked hard to make OpenJS a stable, neutral home for the JavaScript community. openjsf.org/blog/2022/02/1…OpenJS Foundation (@openjsf)Mon, 14 Feb 2022 17:03 GMT
Pelle Wessman (@voxpelli)Mon, 14 Feb 2022 17:59 GMT
by Jamie Tanna
.
#open-source.
💝 Still shopping for Valentine's day? Here's the perfect way to show that special somebody you love them.* *If they are an open source contributor you appreciate. Others might prefer some flowers. We ❤️ open source. Share your love too. oss.loveNetlify (@Netlify)Sun, 13 Feb 2022 09:59 GMT
by Jamie Tanna
.
#open-source.
Since #Log4j you've heard how OSS vulns impact most orgs, how OSS is underfunded & we need to do more to help, but did you know OSS security has improved drastically in the last 4 years? In 2017, 35% of OSS libs used had a known flaw. In 2022 it's < 10% veracode.com/state-of-softw…Chris Wysopal (@WeldPond)Wed, 09 Feb 2022 19:36 GMT
Successful open source is doing enough work to make people like your project, but doing it just poorly enough they feel compelled to help.
Post details
every open source project is like "we're a community project!" and then you look at contributions and it's like 1 person doing 70k commits a day and a long tail of 5 people doing readme fixes
kat.rs (@zkat__)Tue, 08 Feb 2022 06:35 GMT
Phil Nash 💉💉💉 (@philnash)Tue, 08 Feb 2022 12:35 GMT
by Jamie Tanna
.
#open-source.
My Open Source contributions stopped right after I joined Google. 😅
Nicolas A Perez (@anicolaspp)Sat, 05 Feb 2022 17:42 GMT
by Jamie Tanna
.
#open-source
#google.
We need to stop thinking about open source sustainability as “raise enough money to work full-time.” Not every maintainer wants that. Sustainability might be better achieved by four people working ten hours a week instead of one person working 40 hours a week.Nicholas C. Zakas (@slicknet)Thu, 03 Feb 2022 16:30 GMT
by Jamie Tanna
.
#open-source.
I wish we as an industry would stop underfunding and abandoning open source 🙃 relatedly i'm spending the rest of my week fixing stuff _again_ because of lack of lack of investment and support over the last several yearsdanielle 🏳️🌈 (@endocrimes)Tue, 01 Feb 2022 19:32 GMT
by Jamie Tanna
.
#open-source.
https://twitter.com/tanepiper/status/1487354505322762243
Now on the other hand if a company uses open source to profit from, then yes companies should likely have a duty to treat that project as a supplier and act accordingly.
Tane Piper (@tanepiper)Sat, 29 Jan 2022 09:18 GMT
by Jamie Tanna
.
#open-source.
I've been writing open source software for over 20 years and I'd say it's absolutely no one's duty to contribute to anything - that's conferring a moral or legal obligation on people. It should only ever be a choice from a persontwitter.com/parik36/status…Tane Piper (@tanepiper)Sat, 29 Jan 2022 09:18 GMT
by Jamie Tanna
.
#open-source.
Being an open source maintainer: build something popular and you either die a hero or live long enough to be told, “you’re what’s wrong with open source. “ 🤷♂️
Nicholas C. Zakas (@slicknet)Fri, 28 Jan 2022 01:58 GMT
by Jamie Tanna
.
#open-source.
If you don't have a paying day job you will likely die of malnutrition while the corporations sponge off your #OpenSource work.Post details
Being an open source maintainer: build something popular and you either die a hero or live long enough to be told, “you’re what’s wrong with open source. “ 🤷♂️
Nicholas C. Zakas (@slicknet)Fri, 28 Jan 2022 01:58 GMT
Justin Johansson (@IndieScripter)Fri, 28 Jan 2022 09:33 GMT
by Jamie Tanna
.
#open-source.
I started a sketch of my thoughts on the funding of open source and so far my conclusions are so bleak I hesitate to publish.
Laurie Voss (@seldo)Mon, 24 Jan 2022 02:28 GMT
by Jamie Tanna
.
#open-source.
If you are a multi billion dollar company and are concerned about log4j, why not just email OSS authors you never paid anything and demand a response for free within 24 hours with lots of info? (company name redacted for *my* peace of mind)
Daniel 🥌 Stenberg (@bagder)Fri, 21 Jan 2022 23:43 GMT
by Jamie Tanna
.
#open-source.
Recommended read: Here’s how Stack Overflow users responded to Log4Shell, the Log4j vulnerability affecting almost everyone https://stackoverflow.blog/2022/01/19/heres-how-stack-overflow-users-responded-to-log4shell-the-log4j-vulnerability-affecting-almost-everyone/
https://twitter.com/oleg_nenashev/status/1483705093153337346
... but pure altruism isn't scalable, it's difficult to build a big community just on that. There're many advantages of participating pro-bono: learning/mentorship, portfolio, addressing your own needs, exposure, etc. These reasons are totally valid, and they can be win-winOleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 07:42 GMT
by Jamie Tanna
.
#open-source.
https://twitter.com/oleg_nenashev/status/1483691924452265988
For what it worth, there are many small projects being maintained by solo maintainers. Their time investment is way beyond direct and indirect benefits they get for it. This is where altruism takes place, and it should be appreciated. Kudos to these maintainers🙏Oleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 07:37 GMT
by Jamie Tanna
.
#open-source.
https://twitter.com/IAmJerdog/status/1483494934841901063
Pure altruism of maintainersOleg Nenashev (@oleg_nenashev)Wed, 19 Jan 2022 06:44 GMT
by Jamie Tanna
.
#open-source.
"Securing the (open source) software supply chain" naturally focuses attention "upstream" in the supply chain. And there is so much to do _downstream_ in how we assemble and operate software more securely. Improvements downstream don't need to wait on investments upstream.Matthew S. Wilson (msw) (@_msw_)Sun, 16 Jan 2022 17:18 GMT
by Jamie Tanna
.
#open-source
#security.
Everyone wants to create something new to start a startup But there are so many open source projects that are widely used, but don’t have anyone offering support or custom dev You might not get huge valuations, but there are a thousand million-dollar businesses out thereDaniel Feldman.ehh (@d_feldman)Sat, 15 Jan 2022 06:17 GMT
by Jamie Tanna
.
#open-source
#startup.
Recommended read: The Gift of It's Your Problem Now https://apenwarr.ca/log/20211229
by Jamie Tanna
.
#open-source
#free-software
#log4shell
#politics
#capitalism.
Recommended read: The burden of an Open Source maintainer https://www.jeffgeerling.com/blog/2022/burden-open-source-maintainer
by Jamie Tanna
.
#open-source.
Recommended read: Making Open Source economy more viable with dual license collectives https://dpc.pw/making-open-source-economy-more-viable-with-dual-license-collectives
Imagine how much worse this could have been (and how long it would have gone undetected) if the change was siphoning AWS credentials instead of graffiti in the terminal.
Post details
Looks like the AWS CDK is broken because the dependency on colors.js which has a totally hilarious bug: github.com/aws/aws-cdk/is… It shows "LIBERTY LIBERTY LIBERTY".Soenke Ruempler (@s0enke)Sun, 09 Jan 2022 18:43 GMT
Aidan W Steele (@__steele)Sun, 09 Jan 2022 23:22 GMT
by Jamie Tanna
.
#open-source
#security.
Looks like the AWS CDK is broken because the dependency on colors.js which has a totally hilarious bug: github.com/aws/aws-cdk/is… It shows "LIBERTY LIBERTY LIBERTY".Soenke Ruempler (@s0enke)Sun, 09 Jan 2022 18:43 GMT
Recommended read: The right to delete: how faker.js exposed the fragile nature of open source culture, again https://www.thegingerviking.com/the-right-to-delete-fakerjs-fragile-nature-open-source/
by Jamie Tanna
.
#open-source
#ethics.
Thanks to this tip I just found out Datasette gets a mention in this academic paper! "What Else Is New? Open Data Users Need to Know What’s Changed" computer.org/csdl/magazine/…Post details
Well worth searching your GitHub URL with Google Scholar. E.g. scholar.google.com/scholar?q=gith… Great way to find out if your code has made it into any academic publications.Terence Eden (@edent)Sun, 09 Jan 2022 15:56 GMT
Simon Willison (@simonw)Mon, 10 Jan 2022 02:07 GMT
by Jamie Tanna
.
#open-source.
You're currently viewing page 1 of 4, of 198 posts.
