Vlad-Stefan Harbuz

444 Followers
160 Following
81 Posts

I work on protecting the Open Source infrastructure the world depends on. I live in Edinburgh and love cats & birds.

※ Executive Director @stewardshiplab
※ Director @opensourcepledge
※ Adviser https://endowment.dev

More: https://opensourcesecurity.io/2026/2026-04-open-source-pledge-vlad/

websitehttps://vlad.website

I published an article in IEEE's Computer with advice and resources for improving open source project sustainability through good governance practices. It's only 4 pages, so it's a nice, easy read if you want to learn about how governance impacts project success and sustainability.

https://doi.org/10.1109/MC.2026.3667269

what I will say is this. there are pieces of software that are frankly "mission critical".

for example, pkgconf, as a key component of most build toolchains, cannot have regressions because those regressions will reverberate throughout the entire "software supply chain" in the form of build errors. it is a mission critical piece of software.

this is why as lead maintainer of pkgconf I have implemented a number of policies and initiatives to reduce the likelihood of software errors and promote correctness in pkgconf as part of the pkgconf 3.0 work.

these initiatives include banning LLM contributions, requiring DCO signoffs on commits, refactoring the codebase to remove entire classes of vulnerability, improving the quality of the windows port so it is equivalent to its unix counterparts and reimplementing and expanding the test suite from scratch.

why? because every single thing I listed reduces the likelihood for regressions.

rsync, like pkgconf, is used at all times of the day, all around the world. I try to visualize the scope to which pkgconf is used and it is just not possible.

rsync is the same way: everyone is using it somehow, either to back up their data, or to mirror data from one machine to another. there are numerous utilities which make use of it somehow to provide functionality.

a regression in rsync is even less tolerable than a pkgconf regression: if you have errors in rsync, they can potentially cause data corruption or loss.

but rsync goes in basically the opposite direction from pkgconf: it embraces LLM contributions. it also has had several regressions since doing so.

People are worried about AI killing open source, I'm more worried about some companies looking to enclose open source under the premise that AI is making it too risky.

https://newsroom.ibm.com/2026-05-28-ibm-and-red-hat-commit-5-billion-to-redefine-the-future-of-open-source-in-the-ai-era

IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era

IBM and Red Hat today announced Project Lightwell, a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software.

IBM Newsroom

My dear friend Chad is retiring from tech. Nobody has taught me more about Open Source, or about kindness and compassion. Between Gittip and the Pledge, Chad has helped OSS devs more than almost anyone. I will miss him very much, and I will try every day to carry his work forward. ❤️💃

https://bsky.app/profile/chadwhitacre.com/post/3mmvzlutrvk2g

Chad Whitacre (@chadwhitacre.com)

I'm “retiring” from tech, gonna go try to rebuild offline community. Last day at @sentry.io is tomorrow, rolling off the @endowment.dev board in August. Best wishes to everyone carrying the Open Source flame! 🔥 🙏 💃

Bluesky Social

Pasting a huge AI generated explanation to a problem in an issue or pull-request is nothing but RUDE. Don't do it. You look stupid and the receivers of that feel insulted.

We are humans. We communicate like humans. Fine, use the tools you like, but don't insult us.

A new way to explore your node modules folder: https://nesbitt.io/heap

A new report from Bloomberg explains why companies should move “from passive consumption to active stewardship” of the Open Source packages they rely on: “you cannot have sustainable code without sustaining the humans who write it (…) if you live in the house, you help fix the roof”.

https://spawn-queue.acm.org/doi/full/10.1145/3799738

I’m going to start doing a weekly roundup post of the interesting package management links, send me your tips to get them included (or rss feeds I should follow)
We need more tools to support the mental health of maintainers. @mirandah is working on this as part of a new non-profit, the @stewardshiplab. Let's support Miranda's work.

OSS burnout claims another project. On 2 Apr, an entitled user angrily asked the burned-out maintainer of nvim-treesitter to “go switch to something that doesn't require interacting with people”.

The maintainer replied “OK” — and archived the repo, stopping development of nvim-treesitter.

https://vlad.website/nvim-treesitter-burnout/

Open Source Burnout Claims Another Project

Yet another OSS maintainer quits because of burnout. To fix this, we need better mental health resources for maintainers.

Vlad's Website