Pretty much a read-only account now due to this platform being a dumpster fire. https://xitter.cf/t.co/yU9hlC68Ng
Portland, Oregon
Joined April 2007
- Tweets13.4K
- Following565
- Followers1.4K
- Likes11.9K
Very stoked to get this one out into the world - install-time attacks like shai-hulud are a huge problem. I'll be demoing this capability next week at @githubuniverse - come check it out reg.githubuniverse.com/flow/…
A package firewall is available in public preview to inspect npm package metadata and downloads for malware before they reach endpoints like CI/CD hosts or coding agents.
github.blog/changelog/2026-1…
eric sorenson retweeted
Behind the scenes with @ahpook and @dependabot today at the @ch9 studios.
It's all about supply chain security.
@github #developer #security
We've been working on this for a while and I'm very excited to get it out into the world - check out the blog post, which goes into more detail about the GitHub OSPO's "customer zero" experience with License Compliance github.blog/enterprise-softw… – at Portland, OR
Open source license compliance is now in public preview, enabling enterprise-wide license policy enforcement with automated checks on dependencies before merging.
• New policy role allows teams to review and approve exceptions
github.blog/changelog/2026-0…
There's a new way to export SBOMs from your GitHub repos and it works wayyyy better than the old one. So I'm trying to encourage everyone to shift over. The UI is already using it; this is a 6-month deprecation announcement for the API endpoint. More details below: – at Vancouver, WA
The synchronous SBOM API is deprecated and will be removed by November 13, 2026.
• Update scripts to use the new asynchronous SBOM API that returns a report URL to poll for completion.
github.blog/changelog/2026-0…
Breaking my twitter silence to say I'm very happy to help this get out into the world. Check out my blog post about it and let me know in the linked discussion if it's working the way you expect #npmjs #github #sbom – at Portland, OR
track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️
github.blog/changelog/2025-0…
My team's been rocking on this cool open source @github App that manages private mirrors of public upstream repos, outside of the upstream's fork network.
This lets orgs review PRs for secrets, IP, policy, etc and squash history in private, without risking leaks. Check it out! – at Portland, OR
Looking to contribute to open source at your organization?
The new Private Mirrors App allows you to do so with greater peace of mind. Check out the changelog to learn more. ⬇️
github.blog/changelog/2024-0…
ALT Graphic showing a balance scale with "Benefits" on the left and "Risks" on the right, related to "Open Source Program Offices." The scale is tipping towards "Benefits." Above is text that reads, "What's the problem?"
Easily one of the best US black metal albums ever released. austin/panopticon joining the live show at cascadian midsummer was so epic.
youtube.com/watch?v=VyguxO0D…
You used to be able to monger pretty much everything, but today this is all that's left.
Because of woke.
New hobby: Going in to the coffee shop near a crypto convention (apparently that's still a thing?!) and giving my name as "S B F" ... – at Austin, TX
Finally someone applying the appropriate amount of methodological rigor to the burning question of our day: What is a salad?
saladtheory.github.io/
(very curious to get @nick_lewis take on this)
Kowloon Walled City. That's it, that's the tweet.
youtu.be/Ce0UqD4rYAM?si=pNHe…
The whole middle section is pretty loose and a ton of fun - they also did "My Way" in there, and the "Rock the Casbah" cover was sort of a gag, Bono forgot the words to the verse and started ad-libbing.
One of the best big shows I've ever seen #u2uvsphere
U2 at Sphere Las Vegas (28/40)
All I Want Is You
Two Hearts Beat As One
Seconds
Don't Dream It's Over
A long snippet of 'Rock The Casbah'
Thanks to Nadia for the stream
#U2Sphere #U2SphereLasVegas #U2UVSphere #setlistgeek @u2gigs
Come find me at #GitHubUniverse to chat open source and governance. (Or if you want your badge hacked!)
ALT A raspberry pi powered badge with my twitter/github handle and the sign of the horns.
PDX come thru! Star Theater next Sunday - we've got a killer lineup of electronic artists w/ @THIEF_SOUNDS headlining. This album has been on repeat, it's a wicked trip-hop/NiN vibe and I can't wait to push it through the big subs
ticketweb.com/event/thief-wi…
thief-official.bandcamp.com/…
