Mikael Barbero

Here's a thought I'm having today. One of the reasons so many of us are ready to give our jobs away to AI is because we know they have always been bullshit jobs. For a long time now, we've been inventing jobs for people to do because we still require everybody to have a job to survive.

Trusted publishing is now available on Open VSX 🎉 mikael.barbero.tech/blog/post/20...

In case it’s hard to tell what I’m actually saying here: Slowing down vulnerability disclosure is to cybersecurity as drinking sea water is to dehydration. Might feel better if you’re desperate but it will greatly accelerate your doom. This isn’t a fix for vuln process saturation

Hardware scarcity is our new reality — and spells growing difficulty for mid-sized businesses, managed hosting providers, and many open source communities.

I'm joining Jenn Gile and Paul McCarty on The @opensourcemalware.bsky.social Show to talk about securing Open VSX and the Eclipse Foundation! 🗓️ Thu, July 9, 2:35pm PST LinkedIn event: www.linkedin.com/events/74785... YouTube livestream: youtube.com/live/l3YE9Yi...

Go learn, for free, what the CRA entails with this great resource. It should be your top learning priority for the summer!

Who am I, if not a wetware agent running legacy autonomy software?

AI-assisted vulnerability reports should not just include polished findings. They should include the prompt, model details, context, tools, repo state, and validation method. For maintainers, provenance is the new reproduction step. Start with the prompt! mikael.barbero.tech/blog/post/20...

On June 2, the Eclipse Foundation will make optional identity verification generally available for Eclipse Foundation committers. Read more in this blog by Mikaël Barbero 👉 blogs.eclipse.org/post/mika%C3... #opensource #security #committers

We've been part of the Glasswing Project since its inception. To our knowledge, we're the only EU-domiciled organisation participating in the initiative, giving us a unique vantage point on how frontier AI capabilities are reshaping software security. Read more 👉 blogs.eclipse.org/post/mike-mi...

Open source maintainers at profitable companies: stop asking permission to fix what your employer already depends on. No paperwork. No programme. No manager’s blessing. Just maintain it on the clock.

“I will NOT sacrifice the Oxford comma. We've made too many compromises already; too many retreats. They assimilate the em dash and we fall back. They capture ‘not just X but y’ and we fall back. Not again. The line must be drawn here! This far, no further!”

I just published part 2! Don't become the next Trivy: how to make your releases, tags, and automation resistant to compromise mikael.barbero.tech/blog/post/20... #security #supplychain

I published a blog post that lists recommendations and outlines concrete steps that open source projects can (should?) take to reduce the risk of supply chain breaches similar to the recent Trivy incident: mikael.barbero.tech/blog/post/20...

R.I.P. Tony Hoare (11 January 1934 - 5 March 2026). It's a good day to read (or re-read) his wonderful 1980 Turing Award lecture. It's every bit as relevant today as it was in 1980. dl.acm.org/doi/10.1145/...

I've been working on a unified cli that works for github, gitlab, gitea/forgejo and bitbucket. So you (or a coding agent) doesn't need to learn 4 different sets of commands for what are basically all doing the same things: github.com/git-pkgs/forge

Let's do this. www.youtube.com/watch?v=KtQ9...

today’s one-sentence horror: sudo has been largely maintained by a single person for ~30+ years

+10000 the safety rules to manage this new ecosystem isn’t here yet and is critical. We’ll need safe ways to share these new artifacts (skills, plugins, MCP …)

From curl | bash off the internet… …to docker run some random image… …to /plugin install in coding agents. Same vibes, bigger blast radius. Supply chain management for plugins, anyone? :)

So I wrote a thing redmonk.com/jgovernor/on...

The recording is available and, as expected, it is exceptionally good! It will genuinely ignite (or re-ignite) your enthusiasm for being an engineer! Thank you, @bcantrill.bsky.social www.youtube.com/watch?v=Cum5...

Single most desirable feature from Supply Chain Security PoV

I had a great time chatting with @josh.bressers.name! Go check out what’s happening on the security front at the Eclipse Foundation (@eclipse.org)

And it gets even worse when the metrics are averages rather than percentiles!

I can’t wait for the video of this one, the deck is already so bonkers! Love it! Also, no mention of LLM ;)

To implement robust mitigations across Geomys, I did a survey of open source project compromises in 2024/2025. Three root causes dominate: phishing, control handoff, and unsafe GitHub Actions triggers. All three can be systematically avoided. words.filippo.io/compromise-s...

🏷️ Reason #3.7.2 why it's critical to clearly and publicly define your #OpenSource project #Governance, for code, distributions, trademarks, and domain names. And, of course, not breaking norms and cosplaying a public charity while bowing to a sole sponsor over the community. 😢

The future of digital innovation depends on sustainable #opensource infrastructure. Learn how businesses can help ensure long-term sustainability in #EclipseFdn Executive Director Mike Milinkovich’s latest blog: hubs.la/Q03Kz6D50 #PreserveOpenSource #SoftwareSupplyChain #OpenSourceResponsibility

#OCX26 is where the future of open source takes shape. Do you want to be part of it? As an #OCX26 sponsor, you get to align your brand with the communities shaping tomorrow’s tech all in one place. 👉 Get the prospectus or get in touch with our team directly: www.ocxconf.org/event/2026/b...

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting So I wrote a blog post about it An absolutely ridiculous amount of open source is one person projects. I have the data to prove it opensourcesecurity.io/2025/08-oss-...

Stand by this: www.politico.com/newsletters/...

🇺🇸Happy Fourth of July🇺🇸 This year, I'm wearing my 𝐑𝐞𝐬𝐢𝐬𝐭 shirt to show my patriotism. I'm reading the declaration of independence as I always do on this occasion. Several of King George's offenses against the colonies resonate this year. Here they are, verbatim:

Iwata Satoru was an unconventional CEO. In all the best ways that could imply!

I will be damned if I allow a bunch of Confederate-waving January 6th apologists give the American people a lecture on flag waving. There is ZERO reason to enter an argument about patriotism with people who still worship traitors to America 150+ years later. They. Are. Breaking. The. Law.

🗓 On 4 June, the ORC community was represented by some of its members in the CRA Expert Group meeting hosted by @ec.europa.eu We’re grateful to @ec.europa.eu for facilitating this discussion and to everyone involved. @j-rico.bsky.social @tobie.bsky.social @mikael.barbero.tech @apache.org

📢 Calling developers, users, and committers! The Eclipse Foundation Security team is offering a new security training focused on vulnerability management and related subjects. Register for Day 2 (June 10 on 4PM CEST): eclipse.zoom.us/meeting/regi... ➡️ blogs.eclipse.org/post/marta-r...

On June 3rd and 10th with my colleagues from the Eclipse Foundation we will be running a free security training on vulnerability management and related subject. More details and registration links on blogs.eclipse.org/post/marta-r...

🔒 Master vulnerability management! Our security training on 3 June and 10 June covers CVE reporting, embargoes, dependency evaluation, and SBOMs. 📅 Day 1: eclipse.zoom.us/meeting/regi... 📅 Day 2: eclipse.zoom.us/meeting/regi...

The days of Google Docs are ending; we enter the age of Docs, made by France's Interministerial Directorate for Digital Affairs and Germany's Center for Digital Sovereignty of Public Administration. We need more governments to collaborate on public software projects to achieve digital sovereignty.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Nailed it :D

VulnCon is a quite unique conference focus on software (and not only) vulnerability management. It is happening at the beginning of April and I will be speaking twice.