How curl's disclosure policy filtered an AI scanner's findings at source
Andrew Nesbitt
• Andrew Nesbitt
Not a Security Issue
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Author
- Andrew Nesbitt
- Generator
- Jekyll
- Public lists
- davewiner/hackerNewsStars
- Fetched
Andrew Nesbitt
• Andrew Nesbitt
proxy
A lightweight multi-ecosystem caching package proxy
Andrew Nesbitt
• Andrew Nesbitt
Madame Semver Will See You Now
The cards do not lie.
Andrew Nesbitt
• Andrew Nesbitt
The Mismeasure of Open Source
The streetlight effect in project-health scoring
Andrew Nesbitt
• Andrew Nesbitt
Weekend at Bernie’s
Which of your dependencies are wearing sunglasses
Andrew Nesbitt
• Andrew Nesbitt
Free as in Tribbles
The next metaphor after free-as-in-puppy
Andrew Nesbitt
• Andrew Nesbitt
Revisiting the 2015 Open Source Census
The riskiest projects in open source, scored a decade early
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Threat Models
The non-CVE half of package manager security
Andrew Nesbitt
• Andrew Nesbitt
Package Manager CWEs
Recurring weakness classes in package managers
Andrew Nesbitt
• Andrew Nesbitt
A GitHub for maintainers
Giving dependencies the same treatment the fork got
Andrew Nesbitt
• Andrew Nesbitt
Patching and forking in package managers
What to do when upstream ghosts you