Andrew Nesbitt

I’m excited to be a part of the new Software Stewardship Lab, which is launching today! The Software Stewardship Lab is a new organization dedicated to funding research on open source sustainability, a topic I care deeply about. https://fastwonderblog.com/2026/08/07/launching-the-software-stewardship-lab/

Listen to our Sustain podcast episode to learn more about our work.

https://podcast.sustainoss.org/292

The Software Stewardship Lab

https://nesbitt.io/2026/08/07/the-software-stewardship-lab.html

Today, we're launching a world-class research lab dedicated to Open Source sustainability with a team of some of the most experienced people in the world.

https://stewardshiplab.org/ideas/a-research-lab-for-open-source/

Join us for the launch of the Software Stewardship Lab!

Vlad-Stefan Harbuz (@vlad) joins hosts @richlitt, @abigailnussbaum & @erioldoesdesign to talk about this new nonprofit for OSS research.

Best of luck to the current team: @vlad, @andrewnez, @mikemcquaid, @mirandah, @geekygirldawn, @danielroeven, and @patak_dev!

Listen at 🎙️ https://podcast.sustainoss.org/292

In a recent piece for Issues in Science and Technology, IOI's Kaitlin Thaney and Jennifer Gibson from Dryad make the case plainly: without sustained operational funding, open research infrastructure keeps disappearing, and everything built on top of it goes with it.

Using data from IOI's State of Open Infrastructure report, the piece lays out concrete steps for funders and institutions to stop treating this infrastructure as an afterthought.

Read the full piece: https://issues.org/open-data-research-%20infrastructure-gibson-thaney/

@andrewnez so basically, still limited to a really small amount of projects, and the one that use it use a lot of it, the others mostly do not use it.

I am not surprised, that fits the model. Nice to have validation.

Also I will stand by my "FOSS maintainers have not seen benefit from LLM". Which align with the flurry of LLM bans we are seeing.

A year of AI disclosure in critical packages: https://nesbitt.io/2026/08/06/a-year-of-ai-disclosure-in-critical-packages.html

A year of AI disclosure in critical packages: https://nesbitt.io/2026/08/06/a-year-of-ai-disclosure-in-critical-packages.html

RE: https://mastodon.social/@andrewnez/117031823385268173

I’m now getting daily reminder emails that I have not responded to this request yet. 😬

My 4-year/old just learned about the concept of infinity and is now throwing a tantrum over it. “It’s weird! I don’t like it. I just want numbers to stop!”

Please help if you can: I am working with some students who are studying programmers' beliefs about software engineering folklore. If you can spare a few minutes to answer the question in https://survey.bth.se/survey/2545, we would be very grateful. We would also be grateful if you could circulate the survey link to colleagues and friends - we would like to reach as diverse a demographic as possible. Thanks in advance.

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring.

Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents:

https://phpunit.expert/articles/your-composer-lock-knows-what-a-carmaker-only-guesses.html?ref=mastodon

Unexpected use case for https://github.com/git-pkgs/proxy - putting it in front of their Artifactory.

I suspect people are using it for edge fan-out without actually paying for Artifactory Edge nodes.

Packaging 26.3 is out, with ranges (huge), PEP 808 support, and tons of fixes, improved performance, etc. https://github.com/pypa/packaging/releases/tag/26.3 #python #release

my keynote from europython is online!

https://youtu.be/wMPe_KepOjc

#python #europython

@voxpelli.com ugh the ai language throughout that page, did the author even read it before publishing? looks like a level 4 to me, not a level 3

https://github.com/chaoss/disclosure is proving to be a very useful tool in analysing disclosure of ai contributions to oss projects.

brew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.

https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html

i didn’t think it was physically possible, but there’s finally something worse than curl | sh