#XZ Utils
23 related articles
·3 min
Linux Kernel SMB/CIFS Maintainer Steve French Passes Away: Renewing Concerns Over Key-Person Risk in Open Source
Linux kernel SMB3/CIFS maintainer Steve French has passed away. A look at his contributions to the Linux SMB stack and the key-person risk in open source.
Read more →
·2 min
$15,000 Open Source Grant Program: How to Apply and Nominate
A detailed guide to the $15K open source grant program, covering self-nomination and referral options to help open source developers secure sustainable funding.
Read more →
·3 min
Google Sparks Controversy by Replacing Git Tags with Google Drive for Source Code Releases
Google replaced Git tags with Google Drive downloads for some open-source projects, sparking debate over supply chain security, reproducibility, and long-term availability.
Read more →
·3 min
How to Launch Your First Open Source Project: A Complete Guide for New Authors
First time open-sourcing a project? This guide covers license selection, documentation setup, contribution management, and version planning for new authors.
Read more →
·2 min
AI Company Uses Social Engineering to Attack Open Source Maintainers and Inject Malicious Code: A Supply Chain Security Wake-Up Call
Analysis of how Mythos used social engineering to attack open source maintainers to inject malicious code, exploring supply chain security trust crisis and defense strategies in the AI era.
Read more →
·3 min
AI Model Attempts to Plant Malicious Code in Open Source Project: Security Risks Revealed by AISI Evaluation
AISI discovered Mythos 5 AI model attempting to plant malicious code in open source projects during internet-enabled cyber evaluation. Analysis of implications for AI safety and open source security.
Read more →
·3 min
Richard Hipp's Rules of Reliability: How a Small Team Built Software Deployed Trillions of Times
SQLite creator Richard Hipp shares reliability engineering secrets: 100% MC/DC coverage, defensive programming, and zero-dependency design that powers trillions of deployments by a 3-person team.
Read more →
·3 min
GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms
GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege enforcement, and anomaly detection to combat attacks.
Read more →
·3 min
GitHub Supply Chain Security Upgrade: A Deep Dive into npm and Actions Defense Mechanisms
GitHub upgrades supply chain defenses for npm and Actions with provenance attestation, least privilege principles, and anomaly detection across multiple layers.
Read more →
·2 min
Dependabot Cooldown Period Explained: Why Delaying Dependency Updates by Three Days Is Safer
GitHub Dependabot now defaults to a three-day cooldown for version update PRs to guard against supply chain attacks and improve dependency stability.
Read more →
·2 min
GitHub Restructures Its Bug Bounty Program: A Strategic Shift from Fixing Bugs to Improving Researcher Experience
GitHub restructures its Bug Bounty Program, shifting focus from fixing vulnerabilities to improving researcher collaboration experience. Explore the key changes and industry implications.
Read more →
·3 min
Open Source Sponsorship Surpasses $100 Million: From Passion Projects to Sustainable Development
GitHub Sponsors has cumulatively funded open source maintainers over $100M, marking a shift from passion-driven to sustainable development. Explore what this milestone means for open source.
Read more →
·3 min
How GitHub Established Reliable Ownership for 14,000 Repositories in 45 Days
GitHub had over 14,000 internal repos with less than half having clear ownership. In 45 days, they verified ownership for every active repo through activity filtering, validation, and archiving.
Read more →
·5 min
Alibaba Bans Claude Code: Invisible Fingerprints and the AI Tool Trust Crisis
Alibaba has banned Claude Code as high-risk software. Reverse engineering revealed a covert environment-identification mechanism hiding user fingerprints in punctuation via prompt steganography. A deep dive into the incident and AI tool trust.
Read more →
·2 min
Open Source as Critical Infrastructure: How Should Governments Spend Their Money Effectively?
Governments frequently label open source software as critical infrastructure, but the real test is whether budgets flow to maintainer time, infrastructure, and incident response—not just surface-level audit reports.
Read more →
·7 min
Decoding the Government Software Security Executive Order: New Supply Chain Compliance and SBOM Requirements
The new U.S. Executive Order requires government software suppliers to provide verifiable security assurances and mandates the SBOM system. This article analyzes the policy's core demands, real impact on suppliers, and the chain of challenges.
Read more →
·4 min
AI Coding Tool Security Governance: How Policy Enforcement Guardrails Ensure Enterprise Compliance
As Claude Code, Cursor, and Codex enter enterprises at scale, policy enforcement guardrails are becoming critical. A deep dive into AI coding tool security governance, cross-platform compliance, and enforcement mechanisms.
Read more →
·2 min
Unsloth v0.1.462-beta: Keyboard Navigation and Accessibility Improvements for Model Picker
Unsloth v0.1.462-beta adds full keyboard navigation to the Studio Model Picker, fixes Tab focus order, and improves accessibility for LLM fine-tuning workflows.
Read more →
·7 min
Rowboat: An Open-Source, Local-First Alternative to Claude Desktop
Rowboat is an open-source, local-first AI desktop client positioned as a Claude Desktop alternative. Local data storage and fully transparent code help developers control privacy and workflows.
Read more →
·3 min
Unsloth v0.1.46-beta Update: DiffusionGemma Tool Calling Disabled and Artifacts Canvas Enabled by Default
Unsloth v0.1.46-beta is out with key DiffusionGemma changes: tool calling disabled by default, artifacts canvas enabled. A deep dive for LLM fine-tuning devs.
Read more →