nesbitt.io on Hacker News

Git Submodules as a Package Manager(nesbitt.io)

80 points by ErenayDev 1 month ago | 28 comments

Interview with a Maintainer(nesbitt.io)

17 points by ryangibb 3 months ago | 9 comments

git's –end-of-options Flag(nesbitt.io)

175 points by Erenay09 3 months ago | 108 comments

Incident CVE-2026-LGTM(nesbitt.io)

484 points by mooreds 4 months ago | 82 comments

Andrew Nesbitt's satirical incident report about a malicious package slipping past seven AI-powered security gates in a fictional future CVE.

Protestware for Coding Agents(nesbitt.io)

23 points by SVI 5 months ago | 15 comments

Dumb ways for an open source project to die(nesbitt.io)

166 points by chmaynard 5 months ago | 105 comments

Incident Report: CVE-2024-YIKES(nesbitt.io)

658 points by miniBill 5 months ago | 156 comments

A satirical incident report by Andrew Nesbitt about a cascading software supply chain attack spanning JavaScript, Rust, and Python package ecosystems.

GitHub Actions is the weakest link(nesbitt.io)

210 points by dochtman 6 months ago | 68 comments

How to attract AI bots to your open source project(nesbitt.io)

129 points by zdw 7 months ago | 21 comments

If It Quacks Like a Package Manager(nesbitt.io)

41 points by jandeboevrie 7 months ago | 5 comments

Package managers need to cool down(nesbitt.io)

44 points by zdw 7 months ago | 39 comments

Sandwich Bill of Materials(nesbitt.io)

218 points by zdw 8 months ago | 25 comments

The C-Shaped Hole in Package Management(nesbitt.io)

34 points by tanganik 9 months ago | 39 comments

Package management is a wicked problem(nesbitt.io)

82 points by zdw 9 months ago | 59 comments

Workspaces and Monorepos in Package Managers(nesbitt.io)

18 points by Couto 9 months ago | 3 comments

Reducing Dependabot Noise(nesbitt.io)

60 points by zdw 9 months ago | 38 comments

How dependabot works(nesbitt.io)

57 points by zdw 9 months ago | 11 comments

Cursed Bundler: Using go get to install Ruby Gems(nesbitt.io)

23 points by SPBS 10 months ago | 3 comments

How uv got so fast(nesbitt.io)

1179 points by zdw 10 months ago | 405 comments

Blog post by Andrew Nesbitt examining the design decisions and packaging standards that make the uv Python package installer much faster than pip.

Package managers keep using Git as a database, it never works out(nesbitt.io)

742 points by birdculture 10 months ago | 426 comments

Andrew Nesbitt's blog post arguing that package managers like Cargo repeatedly use git repositories as registry databases and run into scaling problems.

Could lockfiles just be SBOMs?(nesbitt.io)

57 points by zdw 10 months ago | 40 comments

GitHub Actions has a package manager, and it might be the worst(nesbitt.io)

408 points by robin_reala 10 months ago | 236 comments

Andrew Nesbitt's blog post arguing GitHub Actions functions as a package manager lacking lockfiles, integrity hashes, and other supply chain safeguards.