Standard Search

https://nesbitt.io/2026/06/11/what-happened-to-tea.html · 11 Jun 2026

Reading the tea leaves

package-managers supply-chain deep-dive

https://nesbitt.io/2026/06/04/gittuf-a-signed-log-for-git-refs.html · 4 Jun 2026

Branch protection is a row in someone else's database

git security supply-chain

https://nesbitt.io/2026/05/29/composer-dependency-policies.html · 29 May 2026

uBlock Origin for composer install

package-managers security supply-chain

https://nesbitt.io/2026/05/28/protestware-for-coding-agents.html · 28 May 2026

printMessageForCodingAgents()

supply-chain security ai

https://nesbitt.io/2026/05/25/github-actions-security-in-python-packages.html · 25 May 2026

Thank you Dr. Zizmor

security supply-chain python

https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.html · 24 May 2026

TUF, in-toto, and Sigstore only look pointless while nothing is on fire

supply-chain security package-managers

https://nesbitt.io/2026/05/22/dependency-pruning.html · 22 May 2026

A survey of unused-dependency detectors

supply-chain dependencies package-managers

https://nesbitt.io/2026/05/19/dumb-ways-for-an-open-source-project-to-die.html · 19 May 2026

How your dependencies became Bernies

open-source maintainers supply-chain

https://nesbitt.io/2026/05/15/language-registries-are-unstable-by-default.html · 15 May 2026

apt install -t unstable, but make it your whole personality

package-managers security supply-chain

https://nesbitt.io/2026/05/08/weekend-at-bernies.html · 8 May 2026

Which of your dependencies are wearing sunglasses

open-source security supply-chain maintainers