Sustain

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.”

00:00 UN Open Source Week

00:58 Meet Andrew Nesbitt

01:45 AI Models Meet Dependency Data

04:05 The Hidden Transitive Risk

07:02 Abandoned Packages Crisis

08:34 Why It Matters Now

09:44 Responsible Disclosure Shrinks

11:48 What You Can Do Today

13:10 Support Maintainers Better

15:30 Wrap Up and Call to Action
Special Guest: Andrew Nesbitt.

Guest

Courtney Miller

Panelist

Richard Littauer

Show Notes

In this episode of Sustain, Richard welcomes back Courtney Miller to unpack her PhD research on one of open source’s most overlooked problems: what happens when widely used software is abandoned. Courtney explains why abandonment is not always simple, or even always bad, but can create real risks for the developers and projects that depend on it. From npm package research and downstream impact to Abandabot, AI-assisted tooling, maintainer burnout, and responsible sunsetting, this conversation explores how the open source ecosystem can better understand, detect, and respond when the software we rely on stops being maintained. Press download now!

[00:01:28] Courtney explains the focus of her dissertation.

[00:02:34] Courtney defines abandonment.

[00:03:44] Her ecosystem-wide analysis focused on the npm JavaScript ecosystem, looking specifically at widely used packages.

[00:05:23] The first part of the dissertation involved interviews with maintainers who rely on abandoned packages and often lack tools or clear processes for responding.

[00:06:31] Courtney describes two types of abandonment: Explicit Notice Abandonment and Activity Based Abandonment.

[00:09:27] Courtney explains the third and final chapter called, Designing Abandabot.

[00:11:10] Richard raises the point that some software can be “done” and still function fine. Courtney agrees, noting that not all abandonment matters and beyond alerts remediation matters.

[00:13:22] The conversation expands into under-resourced and under-maintained projects, which can also become supply chain risks before they are fully abandoned.

[00:14:53] Richard brings up the “Whale Fall” idea and Courtney agrees and points to responsible sunsetting as an important research area.

[00:17:39] We learn about Courtney’s experience bringing AI into the dissertation, especially for building Abandabot’s prediction system.

[00:20:54] Richard asks whether AI is already making abandonment more common.

[00:24:52] Courtney talks about staying grounded in real practitioner problems as the open source and AI landscape changes quickly.

[00:26:30] Final Takeaways: Courtney argues that abandonment needs to be addressed now, especially through software composition analysis tools that can help developers understand and respond to real dependency risk.

Quotes

[00:01:35] “The title of my dissertation is: “Supporting the Sustainable Use of Open Source Software.”

[00:07:10] “There is no right answer how to define abandonment.”

[00:07:26] “Explicit Notice Abandonment”- where the maintainers of a package publicly express their intent to no longer do so.”

[00:07:42] “The other type of abandonment was called “Activity Based Abandonment” -commonly used as a way of identifying abandonment in open source sustainability literature.”

[00:08:26] “Out of the widely used packages, around 15% had abandonment issues.”

[00:11:38] “Not all abandonment matters. If left pad is abandoned, who cares?”

[00:21:35] “Maybe projects never have to die. You can create a fork and maintain it on your own.”

Spotlight

[00:27:20] Richard’s spotlight is the translation feature on iPhone in Books.

[00:28:20] Courtney’s potlight is her dog, Chanel, and SAFE-MCP.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Courtney Miller Website

Courtney Miller LinkedIn

Sustain Podcast-Episode 140: Courtney Miller and Hongbo Fang on Toxicity and Information Flow in Open Source Communities

Supporting the Sustainable Use of Open Source Software by Courtney Elta Miller

Whale Fall (Andrew Nesbitt blog)

Michael Winser LinkedIn

SAFE-MCP

SustainOSS - AI, FLOSS, and Sustainability Virtual Forum Registration

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Courtney Miller.

Guest

Jeff Young | Daniel Shown

Panelists

Richard Littauer | Eriol Fox

Show Notes

In this episode of Sustain, Richard Littauer and Eriol Fox talk with Jeff Young from Georgia Tech and Daniel Shown from Saint Louis University (SLU) about how academic OSPOs are bringing students into open source in meaningful, sustainable ways. They discuss experiential learning, research software engineering, near-peer mentorship, student motivation, maintainer burnout, and how universities can help students build real-world skills while strengthening open source communities. Press download now!

[00:01:46] Jeff describes Georgia Tech’s OSPO focus.

[00:03:49] Daniel explains SLU’s experiential learning model.

[00:05:29] Daniel and Jeff share how many students they’re working with in their programs.

[00:06:13] Jeff talks about how students engage with open source and Daniel describes meeting students and the wide range of student experience levels.

[00:09:33] They discuss what the students bring to the sustainability of open source software and the value of seeing open source as a community effort.

[00:13:05] Richard asks how academic programs connect students with maintainers when many open source maintainers are already overwhelmed. Daniel explains how SLU uses internal tech leads as near-peer mentors and describes training student maintainers.

[00:15:26] Daniel describes training student maintainers.

[00:16:45] Jeff discusses Georgia Tech’s growing mentor model.

[00:18:55] Eriol asks the guests what their “dream programs” would be if they had more resources.

[00:23:44] Richard asks how to excite universities, funders, administrators, teachers, students, and other stakeholders about open source education. They discuss open source, AI, student excitement, grounded storytelling, and real impact.

[00:28:24] Find out where you can learn more about Georgia Tech and SLU’s OSPOs programs online.

Quotes

[00:05:24] “I call the students developers. They’re not students, they’re actual developers.”

[00:10:50] “Those students may not be the greatest developers, but they still have a great perspective and insight that helps grow and diversify some of these open source projects.”

[00:13:20] “Our project is fun in that I don’t have to put pressure on upstream projects to find maintainers to support the contributions from students.”

[00:13:57] “It helps create a sense of empathy for maintainers of bigger projects that are out there.”

[00:26:39] “I had a student tell me at the end of last semester: 'More grounded, fewer aspirations.'"

[00:27:18] “You wouldn’t have stoplights without OSS.”

Spotlight

[00:29:19] Eriol’s spotlight is ScienceUX.org.

[00:29:53] Richard’s spotlight is Logeion, a project out of UChicago.

[00:30:34] Jeff’s spotlight is the App, iNaturalist and iNat INQUIRE Project.

[00:31:13] Daniel’s spotlight is Processing.org.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Eriol Fox Website

Jeffrey Young LinkedIn

Jeffrey Young Website

Daniel Shown LinkedIn

Georgia Tech Open Source Program Office

Georgia Tech OSPO Virtual Summer Internship Program (VSIP)

GT Open Source Program Office LinkedIn

Saint Louis University

Open Source with SLU

Open Source with SLU-Opening Skills & Solutions

Open Source with SLU LinkedIn

ScienceUX

logeion

iNaturalist

iNat x INQUIRE Project- GT Center for Scientific Software Engineering

iNatInq ML Pipeline-GitHub

Processing

Sustain Podcast-Episode 274: Qianqian Ye on p5.js

SustainOSS – AI, FLOSS, and Sustainability Virtual Forum (11 June 2026)

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guests: Daniel Shown and Jeff Young.

Guest

Alan Rubin

Panelist

Richard Littauer

Show Notes

On this episode of Sustain, Richard Littauer sits down with computational biologist Alan Rubin to explore how open source software supports scientific research, clinical genetics, and cancer-related data infrastructure. Their conversation centers on MaveDB, a project that began as a way to organize hard-to-find variant data from research papers and has since evolved into a valuable resource for both scientists and clinicians. Along the way, they discuss infrastructure funding, research software sustainability, and why open source communities and academic researchers have a lot to learn from each other. Press download now to hear more!

[00:01:24] Alan explains his role leading a research group focused on genomics, cancer medicine, and improving patient care through genetics.

[00:02:46] We learn more about what MaveDB does.

[00:06:52] Alan details why a database was needed.

[00:08:26] Alan shares how the project grew out of collaboration, PyCon AU inspiration, Django, and Python tooling that let a small team build a practical research database.

[00:11:54] There’s a discussion on the infrastructure funding problem and Alan explains a major theme is how hard it is to fund scientific infrastructure, since most grants favor new discoveries rather than maintaining shared tools and databases.

[00:17:55] The project took a major turn when clinical geneticists began using the data to interpret patient variants, pushing the team to rethink the interface and user needs.

[00:21:13] Alan describes the new clinical-facing interface, Mave for Medicine (MaveMD), designed to help doctors evaluate specific variants for diagnosis and treatment decisions.

[00:22:02] Alan talks about managing the project through a distributed team, shared responsibilities, and a role that now centers more on direction, priorities, and community than day-to-day coding.

[00:23:36] They discuss why research software rarely attracts hobbyist contributors, even when the mission is compelling, and how scientific projects often function more like small product teams.

[00:27:44] Alan makes the case that scientists often learn more about improving their software craft at events like PyCon than at discipline-specific conferences.

[00:30:38] Alan highlights how academic software depends heavily on mature, well-documented open source tools and encourages more connection between technical communities and scientific work.

[00:34:15] Find out where you can learn more about MaveDB and Alan’s work.

Quotes

[00:10:04] “We quite literally followed the Django Girls tutorial, but instead of a building a blog, we built a database for research scientists.”

[00:12:35] “Infrastructure is something everybody wants to have it exist and nobody wants to pay for.”

[00:26:08] “I have never been successful in engaging the broader open source community, despite having tried many times to contribute to this or any other scientific project.”

[00:31:01] “I think people who work in OSS should be excited about the kind of stuff that their work is enabling, even if they don’t really hear about it.”

Spotlight

[00:35:44] Richard’s spotlight is the book, News of the Dead.

[00:36:22] Alan’s spotlight is The Global Alliance for Genomics & Health (GA4GH) and all the good work they’re doing.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Alan Rubin LinkedIn

Dr. Alan Rubin Website (The University of Melbourne)

PyCon AU 2026, Brisbane, August 26-30

Sustain Podcast- Episode 286: Jack Skinner of PyCon AU and Regional Confs

Sustain Podcast- Episode 176: Maintainer Month with Russell Keith-Magee & Uriel Ofir

Django Girls

PyCon AU 2023-“Building a biological database with Python”- Alan Rubin (YouTube)

Sustain Podcast- Episode 135: Tracy Hinds on Node.js’s CommComm and PMs in Open Source

Sustain Podcast-Episode 190: Karen Sandler on Software Freedom Conservancy (SFC)

Original database paper (Pub Med)

Database update paper (Pub Med)

Preprint on the clinician-oriented interface

Variant scoring tools for deep mutational scanning (Pub Med)

Atlas of Variant Effects

MaveDB

News of the Dead

Global Alliance for Geonomics & Health (GA4GH)

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Alan Rubin.

Guest

Jack Skinner

Panelist

Richard Littauer

Show Notes

In this episode of Sustain, host Richard Littauer talks with Jack Skinner, PyCon AU organizer and freelance consultant/fractional CTO, to explore why regional conferences matter so much to the long-term health of open source communities. Their conversation looks at how events like PyCon AU do far more than host talks, they create local connections, nurture future leaders, support first-time speakers, and help sustain the broader Python ecosystem in ways that global conferences alone cannot. Drawing on Jack’s experience as a conference organizer and community builder, the episode offers a behind-the-scenes look at the challenges of running volunteer-led events, from sponsorships and logistics to burnout, accessibility, and building a stronger pipeline of future organizers. Press download now to hear more!

[00:01:49] Jack shares his background and how he got involved in Python and event organizing.

[00:02:48] We hear about Jack’s first PyCon AU experience.

[00:04:14] Jack describes PyCon AU, who it serves, and how it’s changed after COVID.

[00:07:01] Why do regional conferences exist alongside PyCon US?

[00:09:24] Jack talks about what makes Australia and New Zealand different as conference communities.

[00:10:55] PyCon AU’s attendance goals are discussed as Jack mentions his big goal is to bring attendance back to roughly 500-600 people, restoring pre-pandemic strength.

[00:12:04] The discussion turns to conference structure: tracks, workshops, and sponsor interest, with Jack emphasizing sponsorship is not just about money.

[00:14:54] Richard asks how organizers know whether conferences help people learn, connect, or build community. Jack explains how they’re measuring community impact beyond “good vibes” and rebuilding local Python communities.

[00:17:34] Jack explains PyCon AU is trying to build a future organizer pipeline by letting people observe how conference planning works and introduces his proposed program/project, “shadow team.”

[00:19:09] Another project Jack is working on is documenting the behind-the-scenes work of organizing the conference through long-form writing.

[00:20:38] Jack admits he feels imposter syndrome because he’s not paid to write Python, his contribution is centered on the sociotechnical side.

[00:23:20] PyCon AU’s independence from government and institutions is discussed, and how the conference community is globally aware, even if locally focused.

[00:27:05] Call for proposals details, deadline is March 29, and the in-person focus for this year’s event are mentioned. Richard discusses the return of the academic track and Jack details more info on poster sessions and workshop submissions.

[00:32:08] Volunteering and buying tickets are explained and why you should buy tickets early if you can.

Quotes

[00:32:20] “Volunteering is an awesome way to be involved in PyCon.”

Spotlight

[00:35:16] Richard’s spotlight is two of his lecturers at the University of Edinburgh, Simon Kirby and Andrew Smith, who introduced him to Python.

[00:35:55] Jack’s spotlight is two companion projects: pretalx and pretix.

Links

SustainOSS

podcast@sustainoss.org

richard@sustainoss.org

SustainOSS Discourse

SustainOSS Mastodon

SustainOSS Bluesky

SustainOSS LinkedIn

Open Collective-SustainOSS (Contribute)

Richard Littauer Socials

Jack Skinner LinkedIn

Jack Skinner Website

PyCon AU, August 26-30, 2026, Brisbane

PyCon AU News & Updates

Sustain Podcast-Episode 75: Deb Nicholson on the OSI, the future of open source, and SeaGL

Sustain Podcast-Episode 137: A How-to Guide for Contributing to Open Source as an Employee, for Corporations (featuring Deb Nicholson as Host)

Guido van Rossum

Whale song shows language-like statistical structure Simon Kirby (co-lead author)

pretalx (GitHub)

pretix (GitHub)

Sponsor

CURIOSS

Credits

Produced by Richard Littauer

Edited by Paul M. Bahr at Peachtree Sound

Show notes by DeAnn Bahr Peachtree Sound

Special Guest: Jack Skinner.