Author: Shai Almog Original post on Foojay: Read More Years ago I wrote a piece called Open Source Bait and Switch. The short version: a project is released as open source while it has no business model, a community forms around it, and then the bill comes due. The project either rots into abandonware because nobody can afford to maintain …

Author: Muhammad Usman Original post on Foojay: Read More I pointed a scanner I have been building at an old Spring project, and it flagged javax.activation. The bump was 1.1-rev-1 to 1.1.1. Prior releases carried a GPG signature. This one did not. If you have read the post-mortems of real supply-chain attacks, that pattern should make you sit up. A …

Author: Cristobal Escobar Original post on Foojay: Read More Every application eventually has to deal with deeply nested data. JSON API responses with payloads six levels deep. Configuration files where the key you need is buried inside an array of objects, one of which has a null for the field you thought was required. Module metadata structures that nobody wrote …