Andrew Nesbitt

A year of AI disclosure in critical packages: https://nesbitt.io/2026/08/06/a-year-of-ai-disclosure-in-critical-packages.html

RE: https://mastodon.social/@andrewnez/117031823385268173

I’m now getting daily reminder emails that I have not responded to this request yet. 😬

My 4-year/old just learned about the concept of infinity and is now throwing a tantrum over it. “It’s weird! I don’t like it. I just want numbers to stop!”

Please help if you can: I am working with some students who are studying programmers' beliefs about software engineering folklore. If you can spare a few minutes to answer the question in https://survey.bth.se/survey/2545, we would be very grateful. We would also be grateful if you could circulate the survey link to colleagues and friends - we would like to reach as diverse a demographic as possible. Thanks in advance.

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring.

Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents:

https://phpunit.expert/articles/your-composer-lock-knows-what-a-carmaker-only-guesses.html?ref=mastodon

Unexpected use case for https://github.com/git-pkgs/proxy - putting it in front of their Artifactory.

I suspect people are using it for edge fan-out without actually paying for Artifactory Edge nodes.

Packaging 26.3 is out, with ranges (huge), PEP 808 support, and tons of fixes, improved performance, etc. https://github.com/pypa/packaging/releases/tag/26.3 #python #release

my keynote from europython is online!

https://youtu.be/wMPe_KepOjc

#python #europython

https://github.com/chaoss/disclosure is proving to be a very useful tool in analysing disclosure of ai contributions to oss projects.

brew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.

https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html

i didn’t think it was physically possible, but there’s finally something worse than curl | sh

brew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.

https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html

Also if you're adding cache busting url parameters to api requests to try and get fresher results, I'm just going to block you, don't do that.

Curl had it's summer of bliss, @ecosystems is having it's Summer of Piss (taking) by security companies hammering the public api and ignoring the data license.

Anubis upgraded to 1.26.2 and difficulty level increased.

Also found some new security companies heavily scraping, I look forward to seeing whatever they produce with this CC-BY-SA data that I'm sure they will follow the license of and republish their findings under the same license.

RE: https://mastodon.social/@andrewnez/117032582823441702

Investigating this today, looks like there's a new residential proxy scraping the html of the various ecosyste.ms services, not the json api.

Useragent is all last years chrome on desktop mac, all executing js and passing anubis, see if I can make some tweaks to that config to shut it down.

RE: https://fosstodon.org/@adamchainz/117017044548701755

"Wheels are also now built with frame pointers enabled, per the PEP 831 change in Python 3.15. Frame pointers are a debugging feature for low-level languages like C, which allow debuggers to reconstruct the call stack of a program. Python has decided to enable frame pointers by default and encourage the ecosystem to do so as well, to make debugging easier for us all, so time-machine is joining the party."

Enabled by default for 3.15, do this for older versions:

https://github.com/adamchainz/time-machine/pull/627

#Python

It’s now up to 101m 🫣

92m requests to @ecosystems so far today, the biggest single day I've ever seen 🫠

Paraphrasing an email from a security company : We copied one of your blog posts and turned into an advert for one of our products. Please add a link to our blog post to the end of yours. 🥉