Seriously, have you actually LOOKED at a Software Bill of Materials? It's fragile project after fragile project all the way down.

If my life depended on remembering if GitHub-flavored Markdown used `---` or `===` for table headers, I'd be a goner.

On a scale of 4 to php how bad is it

The PSF is hiring a CPython Developer in Residence! Full-time, remote, $70K–170K (US) or comparable contractor rates abroad. Help keep Python’s core healthy and support the volunteers who maintain it. Apply by Nov 19:
https://pythonsoftwarefoundation.applytojob.com/apply/or9un7DlwI/CPython-Developer-In-Residence

#Python

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

The team at @ThePSF are looking for a developer in residence to work on CPython.

They are looking for someone to enable, strengthen and organise work of new and existing volunteers.

Global remote role, to $170K, apply by Nov 19

https://pythonsoftwarefoundation.applytojob.com/apply/or9un7DlwI/CPython-Developer-In-Residence

#FediHire #Fossjobs

At our #curl maintainer meeting tonight we decided to move forward with the "handle LOW/MED vuln reports openly on GitHub".

Now we just need to get the documentation and processes adjusted, then push the button to do this. Maybe write a blog post too. So, ideally within this week.

Stay tuned

From 1 ecosystem to 8. 🔐

GitHub expanded malware advisories using OpenSSF’s community-driven data, bringing broader coverage to developers with Dependabot malware alerts enabled.

See shared security infrastructure in action: https://openssf.org/blog/2026/10/16/case-study-github-expands-malware-advisories-across-eight-ecosystems-with-openssf/

If you participate in an open source project or community, when is the last time you actually read the code of conduct? 👀

If it’s been a while, I encourage you to go find and read it! It applies to everyone in the community, was written with care, and exists for a reason.

Community management and especially code of conduct enforcement is a tireless, oft-uncredited job. Help those folks out by reading, internalizing, and reiterating what they have written. 🙏

#OpenSource #community

men will make fun of women for being interested in stuff like tarot and then turn around and be so serious about believing in a rapture brought about by some machine god

This is wild - somebody did a deep dive into the real stories behind this famous XKCD:
https://sheets.works/data-viz/holding-up-the-internet

GitHub Security Advisories added a new feature: "Confidential Comments"! 🥳

This is both an awesome feature in general (no more having multiple channels for each report 🎉) and is hopefully a sign that more development on this critical feature will be coming soon.

#security #github

There are so few people that are just *good people*. Dolly was the best of them. What she did for the children of Appalachia is enough for a sainthood, not even touching on everything else. We are poorer for her loss, and so much richer for having had her among us.

Dolly Parton was someone who used their talent and work ethic to do genuine good in the world rather than retreating to a castle to try and ruin things for everyone else in this life.

I went to my local library in the UK last year and was surprised and delighted to see signs for her books for children program extending even here, well away from her home country. Her drive to do good, to spread the joy of reading and literacy knew no borders. Compare her life to her peers in music and celebrity and she stands out as an inspiration to us all.

On top of the child literacy program, she helped fund the Moderna covid vaccine, helping humanity in one of it's darkest points while other wealthy people were more interested in profiteering or like Bill Gates, fighting to make sure their donations can't fund anything that's public domain... Dolly just did what she did, no strings attached to anything but her guitar.

Her music was good too.

She will be missed.

I thought of a book title while making breakfast for the family this morning. It's free for anyone who wants to write it:

"This Flag Won't Hump Itself: a history of performative patriotism in America"

Love this quote from
@joestringer

"When automated tooling is too noisy in a human space, it converts the human space into non-human space and humans no longer interact with one another."

I am not a tool.

https://eng.hroncok.cz/2026/07/07/ai-tool

"My employer made me uncomfortable; I passed it on to a volunteer. What an outstanding open source citizen."

My very raw and honest thoughts on AI usage that did not fit in a toot.

#AI #LLM #Fedora #ethics #OpenSource

BACK IN MY DAY, AI STOOD FOR ADOBE ILLUSTRSTOR, AND WE HATED THAT TOO

Silently ignoring unrecognized configuration options is a security risk and should be treated as such.

https://nx.dev/blog/nx-console-v18-95-0-postmortem

Once again, I am Thursday tired on a Monday