Notices by Andrew Nesbitt (andrewnez@mastodon.social)

Dumb Ways for an Open Source Project to Die: https://nesbitt.io/2026/05/19/dumb-ways-for-an-open-source-project-to-die.html

I don't even know what is real anymore

GitHub Actions have consequences

RE: https://mastodon.social/@andrewnez/116430573551428386

31 new CVEs on openclaw this morning, I'm going to need to update my slides again: https://days-since-openclaw-cve.com/

*slaps roof*

You can fit so many vulnerabilities in this baby!

This talk is only 30 minutes, I'm going to speed running this thing too!

Researching Clawhub for a conference talk at the moment.

It’s like they are speed running every package manager security flaw from the past 20 years 😅

Another fun one, ClawHub has an auto-hide feature if enough users report a skill as problematic.

Anyone want to guess how many unique GitHub accounts you would need to completely hide every skill in the registry?

Definitely not investigation how worm-able clawhub is right now.

<this-is-fine.gif>

We've got lockfiles! https://github.com/search?q=path%3A.clawhub%2Flock.json&type=code

(no manifest file to go along with it though)

This talk started out with a single slide about ClawHub, at this point there's about 3 vulnerability reports I need to make before I can even give the talk :blobsweats:

Note to self: must stop tooting zero days

Oh fun, if a user gets banned, all their skills are hard deleted...

LEFTPAD.md

https://github.com/openclaw/clawhub/security#bans

Semantic Vibing (semvib) is where you version your SKILL.md files with semver (1.2.3) like it makes any difference to the reproducibility or determinism of your prompts.

Instead of using git as a database, what if you used database as a git?

https://nesbitt.io/2026/02/26/git-in-postgres.html

https://nesbitt.io/xkcd-2347/

What happens when a large open source project dies?

https://nesbitt.io/2026/02/21/whale-fall.html

I'm not as excited about https://github.blog/changelog/2026-02-13-new-repository-settings-for-configuring-pull-request-access/ as many are today.

1. This should have been a feature in GitHub 10 years ago
2. Shutting off the community because of a problem that GitHub has heavily pushed onto the oss community seems like closing the barn door after the horse has bolted.

Yesterday’s post I forgot to share: https://nesbitt.io/2025/12/27/how-to-ruin-all-of-package-management.html

Package manager devroom was accepted for FOSDEM 🎉 (Saturday morning)

CFP coming soon