Vulnerability Reports Are Not Special Anymore

A requirement for staying sane while working in public as an open source maintainer is realizing that every issue, PR, and piece of feedback is a present, not an obligation. You can accept it, ignore it, and use it partially or not at all. Except… For years, as lead of the Go Security team at the...

How to pay professional maintainers

I work on the Go team at Google, but this is my personal opinion as someone who built a career on Open Source both at and outside big companies. In a previous essay, Professional maintainers: a wake-up call, I argued that we need Open Source maintainers to professionalize into a role thats legibl...