Sustain

Guest

Vlad-Stefan Harbuz

Panelist

Richard Littauer | Eriol Fox | Abby Cabunoc Mayes

Show Notes

“Today we’re launching the Software Stewardship Lab.” - Vlad-Stefan

In this episode, Richard, Abby, and Eriol welcome Vlad-Stefan Harbuz - University of Edinburgh PhD student, Executive Director of the Software Stewardship Lab, and Director of the Open Source Pledge - to talk about the Open Source Pledge and the newly launched Software Stewardship Lab. They discuss how companies can better support the open source software they depend on, why it can be difficult to know where funding should go, and how the lab hopes to address issues like software security, hidden dependencies, and maintainer burnout. Press download now to hear more!

[00:02:03] Richard introduces Vlad and his background, and Vlad shares his path into open source research.

[00:03:30] Vlad explains how the Open Source Pledge works.

[00:06:17] The conversation turns to how the funding goes directly to maintainers.

[00:07:57] Vlad discusses why open source funding becomes a popularity contest.

[00:10:05] We hear about challenges for large companies joining the pledge.

[00:13:16] Vlad tells us about the Software Stewardship Lab.

[00:15:09] The conversation highlights the importance of design, user experience, copywriting, localization, data collection, and other essential work that is frequently overlooked or poorly funded.

[00:17:59] Vlad discusses potential partnerships with the Software Sustainability Institute and researchers studying open source, research software, and community health.

[00:20:58] We hear how the lab plans to fund its work and the hidden risk of binary dependencies.

[00:25:49] The lab’s work extends beyond dependency mapping to research on maintainer burnout, the effects of AI, mental health, and governance structures that encourage sustainable participation.

[00:28:48] Vlad urges employees and decision-makers to recognize that supporting open source is both a public good and a practical business investment that can prevent critical infrastructure from breaking.

Quotes

[00:09:12] “These metrics are at best proxies currently.”

[00:17:47] “We need more educational resources to show people that this stuff is really important and it’s not just lines of code.”

[00:28:19] “It’s about creating a larger space that focused on more general questions in open source sustainability.”

[00:28:53] “I would like to tell people that work for large companies to tell their employers that their corporate commercial work relies more on open source software that people develop for free in their free time, the work is tremendously important for their business, and there are other organizations that are doing work to help create resources to make this infrastructure more sustainable.”

[00:29:31] “Try to convince your boss that this stuff is worth funding, and not just for the social good! It’s also in the company’s interest, so you have two very good reasons to do it.”

Spotlight

[00:31:15] Eriol’s spotlight is Paloma Oliveira’s book, Diversifying Open Source.

[00:31:48] Abby’s spotlight is Ben Balter’s book, Open and Async.

[00:32:25] Richard’s spotlight is the Generative AI Risk Register.

[00:33:01] Vlad’s spotlight is Chad Whitacre and Open Path Episode 4.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

SustainOSS YouTube

Richard Littauer Socials

Eriol Fox Website

Abby Cabunoc Mayes Website

Vlad-Stefan Harbuz LinkedIn

Vlad-Stefan Harbuz Website

Software Stewardship Lab

Software Stewardship Lab Contribute (Open Collective)

Open Source Pledge

UK Research and Innovation: Apply for funding

npmx

Open Technology Research

Open Source in war-torn Ukraine and around the world—join me on an epic journey ❧ Open Path #4

PEP 725 – Specifying external dependencies in pyproject.toml

PEP 770 – Improving measurability of Python packages with Software Bill-of-Materials

PEP 804 –An external dependency registry and name mapping mechanism

Sustain Podcast: Episode 247- Chad Whitacre on the Open Source Pledge

Sustain Podcast: 3 episodes featuring guest Chad Whitacre

Sustain Podcast: 3 episodes featuring guest Andrew Nesbitt

Sustain Podcast: 2 episodes featuring guest Kailash Nadh

Sustain Podcast: 1 episode featuring guest Neil Chue Hong

Sustain Podcast: 1 episode featuring guest Stuart Geiger

Sustain Podcast: 1 episode featuring guest Sean Goggins

Sustain Podcast: 1 episode featuring guest James Howison

Sustain Podcast: 1 episode featuring guest Kaitlin Thaney

Sustain Podcast: 1 episode featuring guest Miranda Heath

Report on Burnout in Open Source Software (Miranda Heath Website)

Diversifying Open Source: An Open Standards Playbook for Inclusive and Equitable Tech Projects by Paloma Oliveira

About empires, pirates, and the small files that undo power (LinkedIn post by Paloma Oliveira)

Open and Async by Ben Balter

Generative AI Risk Register

Open Path Episode 4 (YouTube)

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Guest

Chelsea Finnie

Panelist

Richard Littauer

Show Notes

In this episode of Sustain, Richard talks with Chelsea Finnie, Chairperson of Python New Zealand and a Senior Network DevOps Engineer at REANNZ, about the serious behind-the-scenes work required to keep open source communities alive. Chelsea shares how they moved from Python conference volunteer to community leader, then walks through Python New Zealand’s financial crisis after discovering improper use of funds, the legal and governance challenges that followed, and how Linux Australia helped keep the organization and Kiwi PyCon alive. It’s a candid conversation about trust, accountability, burnout, community rescue, and why open source leadership is about much more than code. Press download now to hear more!

[00:01:47] Chelsea explains their work at REANNZ and their role as a senior network DevOps engineer including Python-based network automation and the PANDA initiative for advancing network device automation.

[00:03:08] Chelsea talks about contributing an open source “glue” service connecting Prometheus Alertmanager to Argus using Flask.

[00:04:21] Chelsea takes us through how they got involved with Python New Zealand, helping rescue AV production for a Kiwi PyCon event, and realizing they might be capable of helping run a conference themselves.

[00:06:58] They share the lighter side of joining the Python NZ committee, including a sea shanty lightning talk and an election promise to write a Python-based sea shanty.

[00:08:35] Richard shifts into the central issue: Python New Zealand leadership had been dealing with a major financial and governance crisis and Chelsea explains discovering the budget hole, seeking legal advice, reviewing the transactions, and what happened when Linux Australia stepped in.

[00:14:43] Chelsea reflects on Linux Australia’s role as a lifeline and why having financially stable open source organizations matters.

[00:15:46] Richard highlights the often-overlooked legal and financial responsibility that comes with serving on nonprofit or open source boards and Chelsea shares where Python NZ stands now.

[00:18:26] They tell us about the new safeguards and governance checks and notes that better accounting systems, such as Xero, would likely have exposed the financial problems earlier

[00:20:31] Chelsea shares how they stay motivated through heavy work and the value of open source leadership.

[00:21:57] Richard points out that Chelsea was not only helping fix financial and governance issues but also continuing to lead Python New Zealand and run events. Chelsea talks about the decision to run Kiwi PyCon on the “West Island.”

[00:25:08] Chelsea says one of their goals as chairperson is to identify and support the next people who will lead Python New Zealand and future events.

[00:26:14] Richard closes by encouraging listeners to get involved in their local open source communities, whether Python New Zealand or any other regional group.

Spotlight

[00:26:51] Richard’s spotlight is, The Book of Knights.

[00:27:17] Chelsea’s spotlight is the video game, Outer Wilds.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Chelsea Finnie LinkedIn

REANNZ

Python New Zealand

Catalyst

Danny Adair GitHub

Frank Keating LinkedIn

Simon Merrick LinkedIn

Kiwi PyCon

ponekeshantyclub

Tom Eastman LinkedIn

Linux Australia

The Book of Knights by Yves Meynard

Outer Wilds

Prometheus-argus-glue

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Chelsea Finnie.

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.”

00:00 UN Open Source Week

00:58 Meet Andrew Nesbitt

01:45 AI Models Meet Dependency Data

04:05 The Hidden Transitive Risk

07:02 Abandoned Packages Crisis

08:34 Why It Matters Now

09:44 Responsible Disclosure Shrinks

11:48 What You Can Do Today

13:10 Support Maintainers Better

15:30 Wrap Up and Call to Action
Special Guest: Andrew Nesbitt.

Guest

Courtney Miller

Panelist

Richard Littauer

Show Notes

In this episode of Sustain, Richard welcomes back Courtney Miller to unpack her PhD research on one of open source’s most overlooked problems: what happens when widely used software is abandoned. Courtney explains why abandonment is not always simple, or even always bad, but can create real risks for the developers and projects that depend on it. From npm package research and downstream impact to Abandabot, AI-assisted tooling, maintainer burnout, and responsible sunsetting, this conversation explores how the open source ecosystem can better understand, detect, and respond when the software we rely on stops being maintained. Press download now!

[00:01:28] Courtney explains the focus of her dissertation.

[00:02:34] Courtney defines abandonment.

[00:03:44] Her ecosystem-wide analysis focused on the npm JavaScript ecosystem, looking specifically at widely used packages.

[00:05:23] The first part of the dissertation involved interviews with maintainers who rely on abandoned packages and often lack tools or clear processes for responding.

[00:06:31] Courtney describes two types of abandonment: Explicit Notice Abandonment and Activity Based Abandonment.

[00:09:27] Courtney explains the third and final chapter called, Designing Abandabot.

[00:11:10] Richard raises the point that some software can be “done” and still function fine. Courtney agrees, noting that not all abandonment matters and beyond alerts remediation matters.

[00:13:22] The conversation expands into under-resourced and under-maintained projects, which can also become supply chain risks before they are fully abandoned.

[00:14:53] Richard brings up the “Whale Fall” idea and Courtney agrees and points to responsible sunsetting as an important research area.

[00:17:39] We learn about Courtney’s experience bringing AI into the dissertation, especially for building Abandabot’s prediction system.

[00:20:54] Richard asks whether AI is already making abandonment more common.

[00:24:52] Courtney talks about staying grounded in real practitioner problems as the open source and AI landscape changes quickly.

[00:26:30] Final Takeaways: Courtney argues that abandonment needs to be addressed now, especially through software composition analysis tools that can help developers understand and respond to real dependency risk.

Quotes

[00:01:35] “The title of my dissertation is: “Supporting the Sustainable Use of Open Source Software.”

[00:07:10] “There is no right answer how to define abandonment.”

[00:07:26] “Explicit Notice Abandonment”- where the maintainers of a package publicly express their intent to no longer do so.”

[00:07:42] “The other type of abandonment was called “Activity Based Abandonment” -commonly used as a way of identifying abandonment in open source sustainability literature.”

[00:08:26] “Out of the widely used packages, around 15% had abandonment issues.”

[00:11:38] “Not all abandonment matters. If left pad is abandoned, who cares?”

[00:21:35] “Maybe projects never have to die. You can create a fork and maintain it on your own.”

Spotlight

[00:27:20] Richard’s spotlight is the translation feature on iPhone in Books.

[00:28:20] Courtney’s potlight is her dog, Chanel, and SAFE-MCP.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Courtney Miller Website

Courtney Miller LinkedIn

Sustain Podcast-Episode 140: Courtney Miller and Hongbo Fang on Toxicity and Information Flow in Open Source Communities

Supporting the Sustainable Use of Open Source Software by Courtney Elta Miller

Whale Fall (Andrew Nesbitt blog)

Michael Winser LinkedIn

SAFE-MCP

SustainOSS - AI, FLOSS, and Sustainability Virtual Forum Registration

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Courtney Miller.

Guest

Jeff Young | Daniel Shown

Panelists

Richard Littauer | Eriol Fox

Show Notes

In this episode of Sustain, Richard Littauer and Eriol Fox talk with Jeff Young from Georgia Tech and Daniel Shown from Saint Louis University (SLU) about how academic OSPOs are bringing students into open source in meaningful, sustainable ways. They discuss experiential learning, research software engineering, near-peer mentorship, student motivation, maintainer burnout, and how universities can help students build real-world skills while strengthening open source communities. Press download now!

[00:01:46] Jeff describes Georgia Tech’s OSPO focus.

[00:03:49] Daniel explains SLU’s experiential learning model.

[00:05:29] Daniel and Jeff share how many students they’re working with in their programs.

[00:06:13] Jeff talks about how students engage with open source and Daniel describes meeting students and the wide range of student experience levels.

[00:09:33] They discuss what the students bring to the sustainability of open source software and the value of seeing open source as a community effort.

[00:13:05] Richard asks how academic programs connect students with maintainers when many open source maintainers are already overwhelmed. Daniel explains how SLU uses internal tech leads as near-peer mentors and describes training student maintainers.

[00:15:26] Daniel describes training student maintainers.

[00:16:45] Jeff discusses Georgia Tech’s growing mentor model.

[00:18:55] Eriol asks the guests what their “dream programs” would be if they had more resources.

[00:23:44] Richard asks how to excite universities, funders, administrators, teachers, students, and other stakeholders about open source education. They discuss open source, AI, student excitement, grounded storytelling, and real impact.

[00:28:24] Find out where you can learn more about Georgia Tech and SLU’s OSPOs programs online.

Quotes

[00:05:24] “I call the students developers. They’re not students, they’re actual developers.”

[00:10:50] “Those students may not be the greatest developers, but they still have a great perspective and insight that helps grow and diversify some of these open source projects.”

[00:13:20] “Our project is fun in that I don’t have to put pressure on upstream projects to find maintainers to support the contributions from students.”

[00:13:57] “It helps create a sense of empathy for maintainers of bigger projects that are out there.”

[00:26:39] “I had a student tell me at the end of last semester: 'More grounded, fewer aspirations.'"

[00:27:18] “You wouldn’t have stoplights without OSS.”

Spotlight

[00:29:19] Eriol’s spotlight is ScienceUX.org.

[00:29:53] Richard’s spotlight is Logeion, a project out of UChicago.

[00:30:34] Jeff’s spotlight is the App, iNaturalist and iNat INQUIRE Project.

[00:31:13] Daniel’s spotlight is Processing.org.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Eriol Fox Website

Jeffrey Young LinkedIn

Jeffrey Young Website

Daniel Shown LinkedIn

Georgia Tech Open Source Program Office

Georgia Tech OSPO Virtual Summer Internship Program (VSIP)

GT Open Source Program Office LinkedIn

Saint Louis University

Open Source with SLU

Open Source with SLU-Opening Skills & Solutions

Open Source with SLU LinkedIn

ScienceUX

logeion

iNaturalist

iNat x INQUIRE Project- GT Center for Scientific Software Engineering

iNatInq ML Pipeline-GitHub

Processing

Sustain Podcast-Episode 274: Qianqian Ye on p5.js

SustainOSS – AI, FLOSS, and Sustainability Virtual Forum (11 June 2026)

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guests: Daniel Shown and Jeff Young.