What have I been writing when I haven’t been writing here?

Stuff I wrote

Duck Alignment Academy

• Taking a break is good — We’re all still people and we need time to regroup. If you find yourself overwhelmed, you can take a break.
• Not all policy enforcement needs to be automated — Automatic enforcement of policy is great when it’s possible. When it’s not, it’s often to your benefit to adopt the policy anyway.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Every project has politics — Politics in open source is inescapable. As soon as two or more people interact, politics becomes a consideration.
• How to triage security reports — There’s slop coming, but also a lot of medium-to-high quality reports. Maintainers are going to have to know how to triage security reports.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Handling a PR disaster for your project — Bad PR doesn’t have to kill your project. Recent events suggest that maybe there really is no such thing as bad publicity.
• The best way to setup a kanban board — The best way to setup a kanban board is whatever way works best for you. If you’re not sure what that is, I have considerations for you.

Kusari

• Facts and Mythos: understanding the future of AI security analysis — Mythos undoubtedly represents an advancement in the capability of frontier models. It’s also not the apocalypse.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• You’d better start believing in supply chains because you’re in one — This talk started as a silly joke, but it covers a serious and timely topic.
• A trust paradox — If automated CI tests are both a way to measure trust and a vector for attack, what’s the responsible maintainer to do?

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• New metrics resource page and updated AI resources page — I made the website a little more useful.
• Sometimes saying less is more — If you can cut a word or phrase without losing clarity, do it.
• What does it mean to be welcoming? — The whole point of adding community members is to change the community in some beneficial way. Being welcoming takes active, ongoing effort.
• Trust in open source communities — Open source communities run on trust. But what does “trust” mean, how do you measure it, and what do you do with it?

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Open source trends in 2026 — I peer into my crystal ball to see what 2026 will hold.
• GitHub Discussions versus Discourse — The GitHub Discussions versus Discourse comparison isn’t about which is better — both are good. But which is better for your specific project?
• Measuring contributor affiliations is complicated — Determining a contributor’s affiliation is not as easy as it seems. It’s not always clear if a contribution is part of someone’s job.
• Use your labels — A label that you don’t use complicates the experience. A label that you’re not consistent in using will lead to unreliable analysis data.
• Open conversations are worthwhile — There are valid reasons to hesitate about having “public” conversations, and it’s a hard skill to build, but the effort is worthwhile.

Where have I been writing when I haven’t been writing here?

Duck Alignment Academy

• The do’s and don’ts of measuring contributions “outside of working hours” — Do: not. Don’t: correct. The clock time of contributions tells you very little, and almost certainly not what you’re trying to learn.
• Invalid bug reports are sometimes documentation bugs — Invalid bug reports often represent real bugs, it’s just that they’re documentation bugs instead of software bugs.
• How quickly should you fix vulnerabilities? — It’s okay to say “pay me if you want fast fixes”, but communicate that policy ahead of time so people can make informed decisions.
• Reviewing open source trends in 2025 — How well did I capture trends in open source for 2025? The vibe was right, even if some of the specifics were wrong.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Giving contribution gifts: the risks and rewards — Giving contribution gifts can be a great way to reward people for the work they do in your project, but it comes with challenges.
• curl’s zero issues — The curl project briefly achieved zero open issues. If you want that for your project, there are a few simple things to do.

Kusari

• Breaking the “Department of No” – Ship Fast, but also Secure — Security shouldn’t slow you down. Kusari and Cloudsmith enable faster, safer releases by turning noisy CVE scans into actionable insight and enforcing policy from build to deploy. Go fast and secure.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Who should enforce the code of conduct? — There are valid reasons to involve outside experts in code of conduct enforcement, but it’s ultimately a leadership responsibility.
• Duplicate bug reports and how to handle them — Duplicate bug reports waste time for everyone involved. You can reduce them by understanding the complicated dynamics.
• Who is a “member” of your project? — We often use the words “contributor” and “member” interchangeably in open source projects, but there are subtle differences between the two.

Kusari

• Celebrating OpenSSF’s Anniversary — Kusari celebrates the past, present, and future of the Open Source Security Foundation.
• Using Kusari Platform to Manage your Open Source Dependencies (ghostwrite) — Companies need to pay attention to the security of their open source dependencies. Kusari Platform can help.

DEVOPSdigest

• What America’s AI Action Plan means for you today — The recent directive from the White House is light on details, but you can start heading in the right direction to be ready when the details arrive.

What have I been writing when I haven’t been writing here?

Duck Alignment Academy

• Using AI moderation tools — Use AI moderation tools to help human moderators, not to act on their own. Don’t take the humanity out of your community management.
• You can only expect the help you ask for — People won’t know you need help unless you ask for it. Be specific about what you need and be prepare to help the helpers.

Kusari

• Supply chain security for gitops — Software supply chain security doesn’t stop at the application layer. Kusari Inspector can help secure your infrastructure-as-code, too. 
• Addressing the challenges of cloud-native application security — Kusari’s software supply chain expertise gives you the ability to overcome the challenges in securing your cloud-native applications.