A lot of why working in tech feels the way it does is because our industry runs on insufficient evidence.
We've got an honest-to-goodness scientist out here working to help us make use of our lived experience.
Throw down for a paid subscription, if you can.
https://www.fightforthehuman.com/
https://mastodon.social/@grimalkina/115380195615296782
> Mistakes in information technology will repeat themselves without an environment that enables change for the better.
So. True. đź‘Ź
mkay folks, newsletter is away; something i have been thinking about how to articulate for a while, and current events have given me the opportunity:
https://buttondown.com/dorian/archive/supply-chain-risks-in-late-2025/
The majority of NPM attacks utilise post-install scripts to run arbitrary code when the infected package is installed. In response to the Shai-Hulud worm I disabled post-install scripts using this yarn config line: enableScripts: false. I also added an allowlist in the package.json dependenciesMeta section.
It's been a week and across a team of about 20 people we've had no issues with dependencies, so I recommend everyone take this measure to only allow postinstall script selectively.
It adds a little friction but controls a huge amount of supply chain risk.
I’ve spent 15 years of my life working on Bundler. When I introduce myself, people say “oh, the Bundler guy?”, and I am forced to agree. I didn’t come up with the original idea for Bundler (that was Yehuda). I also didn’t work on the first six months worth of prototypes. That was all Carl and Yehuda together, back when “Carlhuda” was a super-prolific author of Ruby libraries, including most of the work to modularize Rails for version 3.
Together with PyPI, Maven Central, crates.io and other major package registries we signed a statement on sustainable open source infrastructure.
3B+ installs/month and evolving #composerphp and packagist.org requires sharing the costs.
Our Blog: https://blog.packagist.com/a-call-for-sustainable-open-source-infrastructure/
Open Letter: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/
Today, we joined other major package registries in signing an important joint statement on sustainable stewardship of open source infrastructure. Together with Maven Central, PyPI, crates.io, Open VSX, OpenJS Foundation, OpenSSF and Alpha-Omega, we're addressing a critical challenge: the growing gap between infrastructure usage and support. The Reality We
Talking to friends in software orgs recently, I've been struck by commonalities across countries and sectors:
Executives are driving "efficiency," by which they mean maximizing time spent on direct value-creation activities.
BUT there's a tacit, industry-wide assumption that writing code is the only value-creating activity and that all coding generates value.
It's like everyone has prioritized instantaneous boat speed and abandoned navigation and maintenance.
Such a reckoning coming...
Ana Hevesi
Marc Kalmes 
André Arko
dorian
Jared Norman
Zeph!
André Arko
packagist
Elizabeth Ayer
cate