Open Source with Fexingo: Linux, GitHub, and Community-Driven Software Conversations

Episode 91 of Open Source with Fexingo tackles one of the messiest moments in community-driven software: deprecation. Lucas and Luna walk through the 2025 deprecation of the npm package 'left-pad' — yes, that one — and how Node.js maintainers handled removing a module that thousands of projects depended on. They break down the three-phase deprecation framework used by major projects like OpenSSL and curl: marking, warning, and removing. Luna asks why deprecation often sparks more conflict than technical disagreements, and Lucas explains the social contract between maintainers and downstream users. They discuss concrete strategies: deprecation timelines, migration guides, and the 'deprecation-as-documentation' approach from the Python ecosystem. A practical episode for anyone who has ever broken a build by running npm prune.

#Deprecation #LeftPad #NodeJS #OpenSSL #Curl #Python #NPM #SoftwareMaintenance #BackwardCompatibility #CommunityGovernance #OpenSource #Fexingo #FexingoBusiness #BusinessPodcast #Technology #SoftwareEngineering #APIDeprecation #MigrationGuides

Keep every episode free: buymeacoffee.com/fexingo

In this episode of Open Source with Fexingo, Lucas and Luna explore the delicate art of publishing security audit reports in open source projects. Using the 2025 curl audit as a case study—where 23 issues were found and disclosed transparently—they discuss the tension between full disclosure and responsible vulnerability handling. They cover how projects like curl, OpenSSL, and systemd structure their audit reports, redact sensitive details, and communicate risk without causing panic. Luna challenges Lucas on whether transparency can backfire if attackers read the reports too, and Lucas explains the mitigating controls like coordinated disclosure and fix-first timelines. The episode also touches on the role of third-party auditors like Cure53 and Trail of Bits, the cost of audits, and how small projects can afford them. If you build with open source or contribute to it, this episode will change how you think about security disclosures.

#SecurityAudit #OpenSourceSecurity #VulnerabilityDisclosure #Curl #OpenSSL #Systemd #Cure53 #TrailOfBits #CoordinatedDisclosure #Transparency #FexingoBusiness #BusinessPodcast #Technology #OpenSource #Linux #GitHub #CommunityDriven #InfoSec

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna explore how open source communities manage translation and internationalization at scale. Using the GNOME project's switch from Damned Lies to Weblate as a concrete case, they discuss the challenges of maintaining translations across hundreds of languages, the role of automated tooling, and why translation is both a technical and social problem. The episode also touches on how smaller projects can start i18n without overwhelming contributors.

#OpenSource #Internationalization #Translation #GNOME #Weblate #i18n #l10n #CommunityDriven #Localization #FOSS #Contribution #Language #Automation #Technology #Tech #FexingoBusiness #BusinessPodcast #OpenSourceWithFexingo

Keep every episode free: buymeacoffee.com/fexingo

Episode 88 of Open Source with Fexingo digs into the delicate art of security vulnerability disclosure in open source projects. Lucas and Luna walk through the process behind the recent critical patch in the Curl project — how a memory safety bug in the HTTP/3 stack was privately reported, triaged, and publicly released within a 90-day window. They break down the roles of the distros list, the CVE numbering process, and the tension between full transparency and responsible disclosure. Luna challenges whether the current embargo model favors big corporations over individual maintainers, and Lucas looks ahead to automated patch verification tools like Stacked Patches. A focused 10-minute conversation on what happens when someone finds a hole in the code we all depend on.

#Curl #SecurityVulnerability #ResponsibleDisclosure #CVE #OpenSourceSecurity #Embargo #DistrosList #MemorySafety #HTTP3 #BugBounty #PatchManagement #Automation #StackedPatches #MaintainerBurnout #TechPodcast #OpenSourceWithFexingo #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In Episode 87 of Open Source with Fexingo, Lucas and Luna tackle the uncomfortable question of money in open source. Using the concrete example of the curl project—which maintains one of the most widely-used tools on the internet on a shoestring budget—they explore how maintainers fund their work, why corporate sponsorship isn't always the answer, and what alternative models like Open Collective and GitHub Sponsors actually look like in practice. They also discuss the tension between sustainability and independence, and whether the 'do-ocracy' model can survive without a financial backbone. A grounded, pragmatic look at economics in community-driven software.

#OpenSource #Funding #Sustainability #Curl #DanielStenberg #OpenCollective #GitHubSponsors #MaintainerEconomics #FOSS #Technology #Podcast #FexingoBusiness #BusinessPodcast #SoftwareEconomics #CommunityDriven #TechSustainability #OpenSourceFunding #LucasAndLuna

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna explore the growing practice of treating documentation as code in open source projects, using the example of the Astro documentation rewrite in 2025 that reduced support tickets by 40 percent. They discuss how version-controlled docs, automated testing of code examples, and contribution workflows similar to pull requests improve accuracy and maintainability. The episode also covers challenges like onboarding technical writers and balancing prose with code, and includes a brief reflection on keeping the show ad-free.

#DocumentationAsCode #OpenSource #Astro #DocsAsCode #TechnicalWriting #ContributorExperience #Automation #VersionControl #Markdown #SoftwareDocumentation #Collaboration #Technology #FexingoBusiness #BusinessPodcast #Podcast #CommunityDriven #MaintainerTools #CodeExamples

Keep every episode free: buymeacoffee.com/fexingo

Episode 85 of Open Source with Fexingo dives into the tricky process of adding new maintainers to a project. Lucas and Luna explore why the Linux kernel uses a multi-year apprenticeship model, how Rust's core team rotates maintainers, and what happens when a project like Homebrew scales from 1 to 100 maintainers. They discuss concrete onboarding practices: shadowing, commit rights escalation, and the controversial 'bus factor' metric. The episode also touches on the emotional side: imposter syndrome among new maintainers and how experienced ones avoid burnout. A must-listen for anyone who contributes to open source or runs a community project.

#OpenSource #MaintainerOnboarding #LinuxKernel #RustLang #Homebrew #CommunityGovernance #BusFactor #ImposterSyndrome #Burnout #CommitRights #Apprenticeship #Technology #FexingoBusiness #BusinessPodcast #Podcast #Developer #DevOps #SoftwareEngineering

Keep every episode free: buymeacoffee.com/fexingo

When a project maintainer goes silent—or dies—what happens to the domains, social media handles, and package manager accounts they controlled? This episode of Open Source with Fexingo looks at the specific case of the 'Pretty Good Privacy' library OpenPGP.js, whose primary maintainer stopped responding in 2023. We walk through how the remaining contributors navigated domain renewal, transfer of the npm package ownership, and the psychological cost of 'waiting for a ghost.' Lucas and Luna also discuss the broader movement toward bus-factor documentation and the Linux Foundation's new Maintainer Succession template.

#OpenSource #MaintainerSuccession #OpenPGPjs #DigitalAssets #BusFactor #npm #DomainRenewal #LinuxFoundation #MaintainerBurnout #PackageOwnership #CommunityGovernance #FexingoBusiness #BusinessPodcast #TechPodcast #SoftwareEngineering #DevOps #Security #OpenSourceMaintenance

Keep every episode free: buymeacoffee.com/fexingo

In this episode of Open Source with Fexingo, Lucas and Luna unpack one of the messiest problems in open source: dependency hell. They use the 2024 xz utils backdoor as a concrete anchor — a single maintainer burnout nearly led to a supply-chain catastrophe. Then they zoom in on how tools like Dependabot, Renovate, and the npm audit ecosystem try to keep dependencies sane, and why the real fix is cultural, not technical. They discuss the tension between speed and security, the role of foundations like the Open Source Security Foundation (OpenSSF), and whether package managers should default to stricter sandboxing. A practical episode for anyone who has ever run 'npm install' and held their breath.

#OpenSource #DependencyHell #XzUtils #SupplyChainSecurity #Dependabot #Renovate #Npm #OpenSSF #Security #MaintainerBurnout #PackageManagers #Technology #FexingoBusiness #BusinessPodcast #LucasAndLuna #DevOps #SoftwareSupplyChain #CVE

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna explore the delicate balance open source projects face when promising API stability. Using the Linux kernel's 'no regressions' policy and the Node.js semver approach as contrasting case studies, they unpack how projects like Kubernetes and Python manage the tension between innovation and breaking changes. They discuss the real-world cost of instability for downstream consumers and the governance tools projects use to signal reliability without freezing development. Specific examples include the 2019 Python 2 sunset, the semver.org spec, and how the Apache Software Foundation handles versioning across hundreds of projects. A practical look at how maintainers think about trust, compatibility, and the social contract with users.

#APIStability #OpenSource #SemanticVersioning #LinuxKernel #NodeJS #Python #Kubernetes #ApacheSoftwareFoundation #SoftwareEngineering #Versioning #BackwardCompatibility #TechGovernance #DeveloperExperience #FexingoBusiness #BusinessPodcast #Technology #PodcastEpisode #OpenSourcePodcast

Keep every episode free: buymeacoffee.com/fexingo