Kade Morton

Richard Littauer | Eriol Fox

In this Maintainers Month episode of Sustain, host Richard Littauer and co-host Eriol Fox talk with cybersecurity expert Kade Morton from Arachne Digital. The conversation dives into how Kade’s unconventional path through criminology and international relations led him into cybersecurity and open source. They explore the unique challenges of sustaining open source security tools, particularly for human rights activists and under-resourced groups, the tension between proprietary and open solutions, and how geopolitical contexts and human motivations influence modern digital threat landscapes. Hit download now to hear more!

[00:01:41] Kade explains his work is split between a day job working security operations and a startup he runs called Arachne Digital.

[00:02:51] Kade tells us about his background, how he got into cybersecurity through self-teaching and open source, and how his criminology and international relations studies informed his interest in cyber threats.

[00:05:17] Kade discusses the open source projects he maintains, specifically ‘Thread.’

[00:06:50] We learn about the difficulty of getting others invested in better tools and Kade discusses challenges explaining open source values to corporate environments.

[00:12:26] Richard asks whether closed-source software is more secure and Kade highlights how most real world exploits target proprietary software.

[00:14:57] Eriol brings up security perceptions in non-tech orgs using digital tools. Kade shares how Arachne Digital offers free services to vetted human rights orgs and he they discuss challenges balancing funding and access in human rights cybersecurity.

[00:19:17] Richard reflects on monetization models for sustaining open source cybersecurity. Kade explains his company avoids fear-based marketing and promotes awareness instead.

[00:22:40] Kade outlines how their threat-informed defense model works.

[00:25:42] Eriol asks what changes could help improve open source sustainability. Kade discusses feeling out of place in both government and open source spaces and emphasizes cross-pollination between sectors to reduce polarity.

[00:28:29] Richard introduces the concept of “digital sovereignty.” Kade warns of the risks of splintering the internet through nationalism and advocates for a balanced middle ground between centralization and fragmentation.

[00:31:41] Kade shares where you can find his work on the web.

[00:13:44] “It’s mostly proprietary software that’s being hacked.”

[00:29:40] “The internet is the world’s largest shared resource.”

Special Guest: Kade Morton.

Support Sustain

Ben Nickolls | Andrew Nesbitt

Richard Littauer

In this episode of Sustain, host Richard is joined by guests Ben Nickolls and Andrew Nesbitt to discuss the ecosyste.ms project. They explore how ecosyste.ms collects and analyzes metadata from various open-source projects to create a comprehensive database that can help improve funding allocation. The discussion covers the importance of funding the most critical open-source projects, the existing gaps in funding, and the partnership between ecosyste.ms and Open Source Collective to create funding algorithms that support entire ecosystems. They also talk about the challenges of maintaining data, reaching out to project maintainers, and the broader implications for the open-source community. Hit the download button now!

[00:01:58] Andrew and Ben explain ecosyste.ms, what it does, and how it compares to Libraries.io.

[00:04:59] Ecosyste.ms tracks metadata, not the packages themselves, and enriches data via dependency graphs, committers, issues, SBOMs, and more.

[00:06:54] Andrew talks about finding 1,890 Git hosts and how many critical projects live outside GitHub.

[00:08:37] There’s a conversation on metadata uses and SBOM parsing.

[00:12:49] Richard inquires about the ecosystem.ms funds on their website which Andrew explains it’s a collaboration between Open Collective and ecosyste.ms. that algorithmically distributes funds to the most used, not most popular packages.

[00:15:45] Ben shares how this is different from previous projects and brings up a past project, “Back Your Stack” and explains how ecosyste.ms is doing two things differently.

[00:18:59] Ben explains how it supports payouts to other platforms and encourages maintainers to adopt funding YAML files for automation. Andrew touches on efficient outreach, payout management, and API usage (GraphQL).

[00:25:36] Ben elaborates on how companies can fund ecosyste.ms (like Django) instead of curating their own lists and being inspired by Sentry’s work with the Open Source Pledge.

[00:29:32] Andrew speaks about scaling and developer engagement and emphasizes their focus is on high-impact sustainability.

[00:32:48] Richard asks, “Why does it matter?” Ben explains that most current funding goes to popular, not most used projects and ecosyste.ms aims to fix the gap with data backed funding, and he suggests use of open standards like 360Giving and Open Contracting Data.

[00:35:46] Andrew shares his thoughts on funding the right projects by improving 1% of OSS, you uplift the quality of millions of dependent projects with healthier infrastructure, faster security updates, and more resilient software.

[00:38:35] Find out where you can follow ecosyste.ms and the blog on the web.

[00:11:18] “I call them interesting forks. If a fork is referenced by a package, it’ll get indexed.”

[00:22:07] We’ve built a service that now moves like $25 million a year between OSS maintainers on OSC.”

[00:33:23] “We don’t have enough information to make collective decisions about which projects, communities, maintainers, should receive more funding.”

[00:34:23] “The NSF POSE Program has distributed hundreds of millions of dollars of funding to open source communities alone.”

[00:35:47] “If you have ten, twenty thousand really critical open source projects, that actually isn’t unachievable to make those projects sustainable.”

Special Guests: Andrew Nesbitt and Benjamin Nickolls.

Support Sustain

Marianne Bellotti | Greg Wilson

Richard Littauer

In this episode of Sustain, host Richard Littauer talks with Marianne Bellotti, author of *Kill It with Fire, *and Greg Wilson, co-founder of the Carpentries, about what happens to your code when you leave your job and how to make sure it survives. They discuss their new paper, "10 quick tips for making your software outlive your job," and share practical strategies for protecting, documenting, and sustaining code in open source, research, and civil service environments. Whether you're preparing for a job change or want to future-proof your work, this conversation offers real-world advice for developers and researchers alike. Hit the download button now!

[00:03:04] Greg and Marianne talk about challenges in code sustainability.

[00:05:46] Greg speaks about how scientists often prototype rather than build production quality code.

[00:09:48] We start with Step 1 in the paper: “Consider your threat mode.” Greg explains the different plans needed for individual vs. systematic departures, Marianne speaks about the importance of understanding code lifecycle-some code has a “fruit fly” lifespan others a “tortoise” one, and Richard adds to think about reframe threat modeling around future usefulness.

[00:15:53] There’s a discussion on Step 2: “Get sign-off on releasing it publicly.”

[00:21:30] Greg discusses Step 3: “Choose an open license” and emphasizes to stick to well-known licenses (MIT, BSD), don’t write your own, and he shares a funny story.

[00:25:29] Richard talks about Step 4: “Put your code somewhere safe” and shares to upload code to GitHub, Codeberg, OSF, Zenodo, etc. Greg suggest peer-to-peer methods like torrents could help long-term preservation and Marianne emphasizes the importance of verified identities when sharing.

[00:29:21] Marianne introduces Step 5: “Document your code.” Greg shares that most documentation goes unread and LLMs could help mine useful documentation from conversation records and Marianne emphasizes to focus on “how to run it” first and tests are a part of your documentation.

[00:35:17] Step 6: “Make your code reproducible.” Greg and Marianne discuss using tools like Docker, uv for Python lockfiles, etc., for dependency management.

[00:36:23] Step 7: “Make your code citable” and Step 8: “Encourage community adoption.” Richard mentions to add a CITATION.cff file so others can cite your code and Greg mentions a great book he read that changed the way he viewed this called, Marketing for Scientists, by Marc Kuchner.

[00:38:49] Step 9: “Write a succession or sunsetting plan.” Marianne shares to define success and failure criteria for projects explicitly.

[00:40:36] Step 10: “Talk about what you’re doing.” Greg emphasizes to celebrate and grieve project endings properly and Richard encourages listeners to check out the paper, read it, and if you see something missing you can contribute back.

[00:43:12] Fnal thoughts from Greg and Marianne: Organize collectively to protect science and code sustainability and find your team.

[00:12:10] “Weapons begin as toys.”

[00:14:09] “All code is throwaway code.”

[00:27:34] “Sooner or later every library burns.”

[00:29:44] “Most documentation is never read by anybody because it’s not answering the questions that you actually have.”

[00:41:05] “Take some time to celebrate and to grieve.”

Special Guests: Greg Wilson and Marianne Bellotti.

Support Sustain

Dirkjan Ochtman

Richard Littauer

In this special Maintainer Month episode of Sustain, host Richard speaks with Dirkjan Ochtman, a long-time open source contributor and Rust advocate. They dive deep into what it's like maintaining critical infrastructure libraries, the motivations behind taking over "abandonware," and how funding ecosystems like GitHub Sponsors and thanks.dev help sustain low-level dependencies. Dirkjan also reflects on how Rust’s design lends itself well to long-term maintainability and shares thoughts on the challenges of burnout, context switching, and ensuring project continuity. Hit the download button now!

[00:01:33] Dirkjan explains how he chooses which projects he’s maintaining, being passionate about memory safety via Rust, and maintaining tools like Rustls, Hickory DNS, and Quinn.

[00:03:14] Dirkjan describes his motivation for maintaining abandonware and sees it as providing value to the community.

[00:04:23] ISRG funds Dirkjan’s work on memory-safe DNS and TLS libraires, and they are replacing C-based libraires with Rust equivalents.

[00:05:33] Dirkjan uses thanks.dev to help fund maintainers through the full dependency graph and revenue is limited but promising.

[00:08:06] Richard brings up Tidelift and Dirkjan mentions it’s not yielding results for Rust projects yet because the Rust ecosystem is smaller.

[00:09:30] We hear Dirkjan’s journey into Rust, starting in Python but frustrated by lack of type safety and performance, and creating his own compiler before appreciating Rust’s complexity.

[00:12:20] Dirkjan talks about his transition from Python to Rust.

[00:13:39] Dirkjan uses PyO3 to create Python bindings for Rust libraries.

[00:15:31] Richard wonders why projects become unmaintained and Dirkjan responds that people have life events, job changes, or shifting interests.

[00:17:11] How are unmaintained projects flagged? Dirkjan uses the RustSec Advisory DB to detect projects with no active maintainers.

[00:18:47] Dirkjan avoids burnout as a maintainer by keeping the scope narrow, only responds to PRs, doesn’t overcommit, and focuses on high-efficiency, low-effort maintenance.

[00:19:51] Rust has a strong system, built-in unit tests, great CI support, and Dirkjan encourages atomic commits to simplify code review.

[00:21:28] Dirkjan speaks about languages that are more maintainer safe.

[00:22:18] Richard brings up attack vectors and the ‘left-pad incident.’ Dirkjan shares how he builds trust via his public GitHub record.

[00:24:17] We hear Dirkjan’s offboarding and succession planning as he explains handing off projects like Askama and promoting multiple maintainers to reduce bus factor.

[00:26:08] Dirkjan’s long-term vision for OSS sustainability is he hopes to move higher in the stack and wants to make high-quality software easier to build.

[00:27:38] Dirkjan explains why he prefers to do asynchronous collaboration over pair programming.

[00:28:52] Dirkjan discusses Rust’s long-term ecosystem stability.

[00:31:09] Find out where you can follow Dirkjan on the web.

[00:03:23] “You call it abandonware and I call it a dependency that has a million users.”

[00:19:02] “[When I take on a project], I don’t take on the burden of proactively improving the project.”

[00:19:11] “I will be there when someone submits a PR."

[00:20:37] “I ask folks to make small changes: atomic commits.”

Special Guest: Dirkjan Ochtman.

Support Sustain

Michelle Barker

Richard Littauer

In this episode of Sustain, host Richard Littauer welcomes Michelle Barker, Director of the Research Software Alliance (ReSA), for an in-depth conversation about the critical yet often overlooked role of research software in open science. Michelle shares her journey from sociologist to open science advocate, unpacking how ReSA fosters global collaboration to support software developed for research. Together, they explore what it means to build “social infrastructure” in the open source ecosystem, the challenges of aligning international stakeholders, and how ReSA is shaping the future of research through strategy, connection, and community-driven solutions. Press the download button now to hear more!

[00:01:58] Michelle explains how she got involved in open science and open source software.

[00:04:35] Why Research Software? Michelle shares that ReSA was founded to coordinate globally on research software, which lacked unified international representation unlike open data.

[00:07:21] We hear about ReSA’s engagement strategy and the three main strategies: knowledge sharing, stakeholder collaboration, and governance evolution.

[00:09:37] ReSA includes RSEs as one of many stakeholders and works broadly across funders, policymakers, infrastructure providers, and more.

[00:10:26] Research software is defined as software developed within a research context to solve a research problem and most is open source but not all.

[00:13:12] Richard asks about tracking engagement, and Michelle shares it’s hard to quantify outcomes, but standard metrics include newsletter subs, citations, and forum attendance.

[00:15:08] Michelle explains the role of social infrastructure.

[00:17:37] What’s hard about being a social infrastructure? Michelle talks about the challenge of how to motivate groups of people to work together.

[00:19:52] Michelle shares her personal approach to networking: research, targeting key individuals, emotional engagement, and strategic planning for conferences.

[00:24:35] A new strategy plan is rolling out and Michelle shares what’s different.

[00:27:32] ReSA is working to establish research software as its own recognized field.

[00:29:57] Michelle recognizes shared challenges of both open source and research sectors. The keys to success are spotlight wins and demonstrate value through supported infrastructure and recognized contributions.

[00:30:40] Find out where you can find out more about ReSA.

Special Guest: Michelle Barker.

Support Sustain

Eriol Fox | Allen “Gunner” Gunn | Leslie Hawthorn | Abby Cabunoc Mayes

Richard Littauer

In this special episode of Sustain, Richard has a discussion with guests and fellow hosts Eriol Fox, Abby Cabunoc Mayes,

[00:01:45] Gunner shares an event summary starting on the evolution of SustainOSS, and talks about the

[00:03:34] Everyone shares their personal takeaway from the event.

[00:09:57] We hear about the conversations that were missed at the event and what everyone would like to

[00:17:56] Gunner briefs us on the next event with a possibility of another forum focused entirely on AI,

[00:19:39] We end with final thoughts from everyone: Gunner expresses gratitude for the community, Abby is

Support Sustain

Sean Goggins

Richard Littauer

In this episode of Sustain, host Richard Littauer chats with guest Sean Goggins, a tenured full Professor of Computer Science at the University of Missouri. Sean discusses his extensive involvement in the open source community, particularly through his work with the CHAOSS Project, a Linux Foundation initiative focused on understanding and improving open-source project sustainability. Their conversation covers Sean's academic background, his role in CHAOSS, the importance of distributed leadership, and how metrics can impact the sustainability of open source projects. Sean also shares insights into his teaching methods, the challenges of maintaining open source software, and the future direction of his work on CHAOSS and Augur. Hit the download button now!

[00:01:25] Sean shares that he’s a professor specializing in software engineering, algorithms, data science, and visualization, and he discusses his tenure status and passion for research and open source work.

[00:02:41] Sean explains how open source leadership is distributed rather than centralized.

[00:04:45] We hear how the CHAOSS Project emerged from studying open source governance and leadership. Sean and Matt Germonprez started working on open source collaboration data and a metrics-focused discussion at a Linux Foundation Summit that led to the founding of the CHAOSS Project in 2017.

[00:08:23] Richard asks Sean how he balances research, teaching, and open source. Sean discusses how he splits time between research (40%), teaching (40%), and service (20%), with CHAOSS being a major part of his research efforts.

[00:13:27] Sean explains that the Augur Project was born out of a need for structured open source data tracking.

[00:15:18] Richard asks Sean if he teaches his students about open source, and he explains that he uses CHAOSS and Auger to teach students about GitHub collaboration, pull requests, and open source workflows.

[00:19:25] Sean shares his insights on research and open source. He emphasizes his involvement in maintaining software and aiding organizations in making sense of CHAOSS metrics through Augur, which has given him a deep understanding of open source development.

[00:20:44] Sean explains why he thinks metrics help make projects more sustainable and how the CHAOSS community has benefitted from fostering a welcoming environment for both technical and non-technical contributors.

[00:25:23] We hear some challenges within CHAOSS where it’s been difficult to build a strong developer community around CHAOSS software tools and maintaining open source software requires significant effort.

[00:28:11] He goes further to explain how to be a better project and that there’s potential for improving project sustainability through structured mentoring and governance.

[00:35:07] Sean shares CHAOSS Project’s future and research goals.

[00:03:46] “Distributed leadership: this exists in most of open source. There’s not often a single individual who drives an entire project.”

[00:09:18] “You have 40% of your time for teaching, 40% of your time for research, and 20% of your time for service.”

[00:12:15] “There’s a challenge of being a university professor. The advantage is you can do what you want, the challenge is that you have to set your own boundaries.”

[00:23:12] “A leading indicator for community health is how many newcomers you have coming in over time.”

[00:28:14] “How can I have a better project? It’s the same as going to a family reunion and saying, ‘How can we be a better family’?”

Special Guest: Sean Goggins.

Support Sustain

Neil Chue Hong

Richard Littauer | Justin Dorfman

In this episode of Sustain, hosts Richard Littauer and Justin Dorfman talk with Neil Chue Hong, Director of the Software Sustainability Institute (SSI). They discuss the SSI's mission to sustain software used in research, the institute's history and funding, the role of research software engineers, and the newly launched Research Software Maintenance Fund (RSMF) with £4.8 million dedicated to supporting research software. Neil shares insights into the collaboration, training initiatives, and policy work done by the SSI to promote sustainability in software development. The episode also touches on the impact of large funding initiatives like those from the Chan Zuckerberg Initiative and the evolving role of software development in the age of large language models (LLMs). Hit the download button now!

[00:01:44] Neil explains SSI’s mission and purpose.

[00:02:27] Richard inquires about SSI’s funding model and how long SSI has existed. Neil explains SSI is a government funded collaboration via UK Research and Innovation (UKRI), and it was founded in 2010 and is funded through 2028.

[00:05:03] Richard highlights SSI’s impact and Neil discusses how SSI helped establish “Research Software Engineer (RSE)’ as a recognized role.

[00:08:20] SSI’s annual Collaborations Workshop (May 13-15 in Stirling, UK) is mentioned, and Neil recalls a pivotal collaboration with Greg Wilson (Software Carpentry), which expanded training programs.

[00:11:16] Neil explains that the SSI has evolved from consultancy to training, community initiatives, and policy advocacy to scale its impact and ensure long-term sustainability in research software.

[00:13:57] Richard introduces SSI’s new £4.8M Research Software Maintenance Fund (RSMF). Neil explains it supports maintaining existing research software and it’s funded by the UK’s Digital Research Infrastructure Programme (UKRI).

[00:16:54] A question comes up about the geopolitical impact of this funding and Neil states the UK is maintaining leadership in research software sustainability, not just focusing on national capability.

[00:20:54] Neil defines research software products being targeted by the RSMF as software used beyond its original development team.

[00:22:54] Richard asks if £4.8M is a significant investment and Neil explains this is comparable to past UK research software grants..

[00:25:10] Neil acknowledges Chan Zuckerberg Initiative (CZI) for improving funding models for research software.

[00:29:45] Justin asks how LLMs are changing research software engineering. Neil compares LLMs’ impact on software development to smartphones revolutionizing photography.

[00:34:05] Find out where you can connect with UKRI, SSI, and with Neil on the web.

[00:02:07] “We’ve got this motto: Better Software, Better Research.”

[00:29:03] “You can define what is clearly sci-fi, you can define what is clearly research software, but making an arbitrary cut-off point is really hard.”

Special Guest: Neil Chue Hong.

Support Sustain

Alison Hill

Richard Littauer

We’re kicking off the new year of Sustain with host Richard Littauer discussing sustaining open source software with guest, Alison Hill, VP of Product at Anaconda, and a cognitive scientist with a PhD in psychology. Alison shares her journey from academia to industry, emphasizing the importance of statistics and data science in her career. She explains her role at Anaconda, focusing on developing secure and compatible distribution of Python packages and managing the community repository, Anaconda.org. The conversation covers the significance of product management in open source projects, particularly those with corporate backing, and how these roles can help in balancing user needs and business goals. In addition, Alison shares her thoughts on the challenges and strategies for maintaining open source projects without corporate support and touches on the ‘palmer penguins’ project. Click to download now!

[00:01:13] Alison discusses her transition from academic research in cognitive science to industry and data science, emphasizing her passion for statistics and education.

[00:02:41] Alison explains her work at Anaconda, focusing on product management and the Anaconda distribution, aiming to ease the use of Python and R packages in the industry and academia. She also elaborates on other projects she oversees, including Anaconda.org and its role in supporting open source projects and enterprise needs.

[00:05:17] We hear how Anaconda sustains itself financially through enterprise offerings and the balance of supporting open source while maintaining a business model.

[00:07:14] Alison shares her previous experience as the first PM of data science communication at Posit (formerly RStudio) and her role in enhancing data science education and product development.

[00:12:49] Richard and Alison explore the challenges of sustaining open source projects without corporate backing and strategies for maintaining personal and project health in the open source community. Alison discusses common mistakes companies make by confusing project management with product management in open source projects.

[00:17:18] Richard asks about the skills needed for developers to adopt a product-oriented approach. Alison suggests that successful product-oriented developers often have high empathy for end-users and experience with the pain points at scale, which helps them anticipate and innovate solutions effectively.

[00:20:49] Richard expresses concerns about the sustainability of smaller, community-led open source projects that lack corporate backing and the structured support that comes with it. Alison acknowledges her limited experience with non-corporate open source projects but highlights the difficulty in maintaining such projects without institutional support, and she shares her personal challenges with keeping up with open source project demands.

[00:27:41] Alison stresses the importance of clear goals and understanding the implications of joining larger ecosystems, reflects on the need for clarity about the desired outcomes when joining larger ecosystems, and shares examples of successful and unsuccessful engagements in such settings.

[00:29:52] She discusses alternative sustainability models, including paid support and subscriptions.

[00:33:00] Alison brings up the example of Apache Arrow and the challenges it faced with corporate sponsorship.

[00:34:23] We wrap up with Richard acknowledging that not all open source projects require significant funding or formal business models, and Alison explains the ‘palmerpenguins’ project she did at the beginning of COVID.

[00:37:07] Find out where you can follow Alison on the web.

[00:22:18] “What is the minimum level of support you need to not feel like you’re drowning?”

Special Guest: Alison Hill.

Support Sustain

Brian Muenzenmeyer

Richard Littauer | Abbigail Cabunoc Mayes

In this episode of Sustain, host Richard Littauer is joined by co-host Abigail Cabunoc Mayes and guest Brian Muenzenmeyer, a seasoned open source contributor. Brian shares his journey in web development, his experiences with burnout, and insights from his new book, Approachable Open Source. Some key topics discussed include contributing to open source projects, community building, maintaining balance, and funding models for sustainability. This episode emphasizes the role of diverse contributions and the importance of creating accessible avenues for all kinds of contributions in open source. Press download now to hear more!

[00:01:40] Brian discusses his book, which offers practical advice for navigating open source. He reflects on his career journey, from early contributions to burnout and recovery. He shares his humble beginnings with jQuery Mobile and the steps that led him to maintain major projects like Pattern Lab.

[00:04:21] Brian opens up about his experience with burnout and how it influenced the writing of his book.

[00:06:42] Brian emphasizes the importance of designing sustainable open source communities.

[00:08:41] Richard, Brian, and Abby explore the concept of “pace layers” in open source, highlighting the dynamic balance between innovation and stability.

[00:14:10] Chapter 7 in Brian’s book is discussed where Brian advocates for corporate contributions to open source and shares tips for individuals looking to get involved.

[00:20:04] Brian provides practical advice for maintainers, including time management, fostering diverse roles, and creating approachable entry points for contributors.

[00:25:01] The conversation delves into the challenges of improving diversity in open source communities and the importance of celebrating successes.

[00:28:39] Find out where you can get Brian’s book, Approachable Open Source. Digital copies are available worldwide, and physical copies shipping to the U.S. and Canada.

[00:05:29] “There isn’t a dichotomy between consumption and contribution.”

[00:13:48] “The work that we’re doing isn’t really for us. If you’re making open source, it’s not really for you, you’re sharing it with the world.”

[00:20:28] “If you look at a mature open source project and try to emulate it at the outset, you’re going to be disappointed and you’re going to feel like you’re always behind.”

[00:23:09] “You don’t need permission to do your job.”

[00:23:41] “You’re already empowered to fix things that you see are broken.”

[00:23:57] “Instead of buying a maintainer a coffee, spend a coffee cup’s amount of time looking at their issue log.”

Special Guest: Brian Muenzenmeyer.

Support Sustain