Andrew Nesbitt

nesbitt.ioDR 63 Accessible 300 views

Development & Programming Andrew Nesbitt's blog covers software supply chain security, package managers, and open source dependency risks, including analysis of CA trust stores and certificate bundles.

Visit now Favorite

Editor's Review

For reference only

Nesbitt's posts dig into the mechanics of dependency management rather than surface-level news, using concrete audits such as comparing CA bundles across language ecosystems. Readers get reproducible findings and links to upstream fixes, though the material assumes familiarity with packaging interna

Site introduction

Andrew Nesbitt is a developer and researcher known for work on open source dependency data, and this site collects his long-form writing on the software supply chain. Posts focus on how packages, registries, and trust infrastructure interact, with an emphasis on risks that are easy to overlook in day-to-day development.

The core of the site is technical analysis backed by data. Articles examine package manager behavior, certificate and root store handling, and the downstream effects of upstream security decisions, often quantifying the problem across ecosystems such as Python, Rust, Node.js, Go, and Linux distributions.

The writing suits maintainers, security engineers, and platform teams who need to understand dependency risk beyond vulnerability scanners. It is also useful for developers curious about how trust decisions propagate through language toolchains and operating systems.

Use the archive to follow specific themes like CA bundles or package manager internals, and check linked disclosure pages and fix tables for actionable version numbers. Posts are reference material rather than tutorials, so expect to read with your own toolchain in mind.