Andrew Nesbitt is a developer and researcher known for work on open source dependency data, and this site collects his long-form writing on the software supply chain. Posts focus on how packages, registries, and trust infrastructure interact, with an emphasis on risks that are easy to overlook in day-to-day development.
The core of the site is technical analysis backed by data. Articles examine package manager behavior, certificate and root store handling, and the downstream effects of upstream security decisions, often quantifying the problem across ecosystems such as Python, Rust, Node.js, Go, and Linux distributions.
The writing suits maintainers, security engineers, and platform teams who need to understand dependency risk beyond vulnerability scanners. It is also useful for developers curious about how trust decisions propagate through language toolchains and operating systems.
Use the archive to follow specific themes like CA bundles or package manager internals, and check linked disclosure pages and fix tables for actionable version numbers. Posts are reference material rather than tutorials, so expect to read with your own toolchain in mind.
Comments & Ratings
0No comments yet. Be the first to review.