Extending import maps with package metadata to improve dependency management and security for browser-native JavaScript.

Applying Jepsen-style adversarial testing to package managers.

Go's module system accidentally created a universal, content-addressed, transparency-logged package CDN. You could abuse this for any language.

Lockfiles and SBOMs record the same information in different formats. What if package managers used SBOMs directly, instead of converting later?

I've been loving all the new apps that have started to emerge in the at-protocol ecosystem, now there isn't just BlueSky but also https://tangled.org/ https://www.flashes.blue/ https://atcr.io/ https://leaflet.pub/home and there is probably even more aweso...