Top all-time · #689
Andrew Nesbitt
Personal blog · nesbitt.ioprogrammingsystems
Andrew Nesbitt's personal blog at nesbitt.io covers programming and systems. Since 2024, 93 different Hacker News readers have linked it 174 times, most often “How uv got so fast”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Sometimes recommended · 12 of 31 sampled comments recommend it?
Why HN links it
HN readers link Andrew Nesbitt's blog for package-management writing: uv performance, Git in Postgres, supply-chain security, and satirical incident reports.
- Recommended for · 12 comments
- Called very entertaining, insightful, useful, a good overview and explainer, a nice write-up; formatting praised.
Summarised by Claude from a sample of 31 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
Most-linked posts?
- How uv got so fast8 people · 8 mentions · first linked 2025-12-26
- GitHub Actions has a package manager, and it might be the worst7 people · 7 mentions · first linked 2025-12-06
- Package Managers Need to Cool Down5 people · 5 mentions · first linked 2026-03-04
- Incident CVE-2026-LGTM4 people · 4 mentions · first linked 2026-06-26
- Package managers keep using Git as a database, it never works out4 people · 4 mentions · first linked 2025-12-24
- Git in Postgres4 people · 4 mentions · first linked 2026-02-26
- The Many Flavors of Ignore Files3 people · 4 mentions · first linked 2026-02-12
- How to Ruin All of Package Management3 people · 3 mentions · first linked 2025-12-27
- Signing Is for the Bad Days3 people · 3 mentions · first linked 2026-05-24
- Now Hiring: Senior Open Source Maintainer3 people · 3 mentions · first linked 2026-08-28
What Hacker News says?
> I can imagine a truce This is very entertaining writing on that subject: https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm....
Comment linking /2026/06/26/incident-report-cve-2026-lgtm.html
on “PHP 8.2.35”Submitted GitHub Actions has a package manager, and it might be the worst as a story · 444 points
HN discussionMaybe with this "investment" will get an actual solution for Github Actions sh*t version management of actions[1] after just closing the Immutable Actions issue with a "sucks to be you" comment[2]. AI-Native Github action Agentic package management for Copilot /s [1] https://nesbitt.io/2025/12/06/github-actions-package-manager... [2] https://github.com/github/roadmap/issues/592
Comment linking /2025/12/06/github-actions-package-manager.html
on “Pricing Changes for GitHub Actions”Submitted Git Submodules as a Package Manager as a story · 91 points
HN discussionInsightful comment I fully agree that the hardest part needs to be automated fully, there's plenty of DNS providers with API access so it can be done. Naming is oftentimes the hardest part we have in tech, I dream of a future we are more decentralized and we have alternatives to DNS to access ressources,see this great text by Andrew Nesbitt about the subject of naming: https://nesbitt.io/2026/03/03/package-managemen…
Comment linking /2026/03/03/package-management-is-naming-all-the-way-down.html
on “Cloud in a Bottle: making self-hosting accessible to everyone”Submitted Could lockfiles just be SBOMs? as a story · 48 points
HN discussionhttps://nesbitt.io/2025/12/26/how-uv-got-so-fast.html
Comment linking /2025/12/26/how-uv-got-so-fast.html
on “Astral to Join OpenAI”Submitted GitHub Actions Has a Package Manager, and It Might Be the Worst as a story · 20 points
HN discussionAll of them (well - no HPUX in 15+ years, and I've never used uv in Solaris, or AIX) - but the major two client side environments that I use 'uv' in would be WSL2+Ubuntu/ext4 (work) and macOS/APFS at home. But - neither the speed nor constant issues with pip/virtualenvwrappers are really a function of the OS/File System. A frequent theme in this thread (probably most clearly described in https://news.ycombinator.com…
Comment linking /2025/12/26/how-uv-got-so-fast.html
on “Astral to Join OpenAI”Submitted Now Hiring: Senior Open Source Maintainer as a story · 9 points
HN discussionI was using poetry pretty happily before uv came along. I’d probably go back. Note that uv is fast because — yes, Rust, but also because it doesn’t have to handle a lot of legacy that pip does[1], and some smart language independent design choices. If uv became unavailable, it’d suck but the world would move on. [1] https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html
Comment linking /2025/12/26/how-uv-got-so-fast.html
on “Astral to Join OpenAI”Submitted Cursed Bundler: Using go get to install Ruby Gems as a story · 7 points
HN discussionI ended up finding my own answer (after reading the above). https://nesbitt.io/2026/02/26/git-in-postgres.html Following another recent theme, the answer for Forgejo seems to be - just use Postgres.
Comment linking /2026/02/26/git-in-postgres.html
on “Codefloe Is a Professionally Hosted Public Git Forge”Submitted Now Hiring: Senior Open Source Maintainer as a story · 6 points
HN discussionBecause @apache/solr would be easier to disambiguate vs @randomuser/solr. You should really build namespaces in from the start, or at least reserve the capability to do so in the future. Unless you want to speed run all the lessons already learned. https://nesbitt.io/2026/02/14/package-management-namespaces....
Comment linking /2026/02/14/package-management-namespaces.html
on “Why stdx is not on crates.io”Submitted Dumb Ways for an Open Source Project to Die as a story · 5 points
HN discussion> Yeah, and ultimately no body cares. More like hiding their heads in the sand in circumstances that are outside of their ability to fix. None of the tooling or practices out there push you in the direction of not being at risk, or even provide you with easy ways to stay completely safe: no external packages needed to develop software with everything you NEED being provided out of the box, or a flow where pulling in…
Comment linking /2026/03/04/package-managers-need-to-cool-down.html
on “Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library”Submitted The Biggest Conspiracy Theories in Open Source as a story · 4 points
HN discussionhttps://nesbitt.io - mostly writing about package management
Comment linking /
on “Ask HN: Could you share your personal website here?”Submitted The Package Management Landscape as a story · 4 points
HN discussionAh yes. It is clear that the root cause of this CVE last month is a lack of spend. Lessons learned: 2.1 trillion tokens is insufficient to detect obvious malware; increase token spend by 10x. https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm....
Comment linking /2026/06/26/incident-report-cve-2026-lgtm.html
on “Build your own vulnerability harness”Submitted Good Morning, Your Toaster Is Compromised as a story · 3 points
HN discussionThat's not a good interpretation of Astral and uv. uv is way more than a rewrite in Rust of Poetry or pip - it has a metric ton of smart design decisions that are independent of the language it was written in, both in terms of what it does and how it speeds things up under the hood. https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html is a useful review of some of the architectural tricks they came up with.
Comment linking /2025/12/26/how-uv-got-so-fast.html
on “Thoughts on OpenAI acquiring Astral and uv/ruff/ty”Submitted --end-of-options (git flag) as a story · 3 points
HN discussionSo I've been thinking about this a lot since it happened. I've already added dependency cooldowns https://nesbitt.io/2026/03/04/package-managers-need-to-cool-... to every part of our monorepo. The obvious next thought is "am I just dumping the responsibility onto the next person along"? But as you point out it just needs to give automated scanners enough time to pick up on obvious signs like the .pth file in this ca…
Comment linking /2026/03/04/package-managers-need-to-cool-down.html
on “My minute-by-minute response to the LiteLLM malware attack”Submitted What Happened to Tea.xyz as a story · 3 points
HN discussionI like the formatting and readability of https://nesbitt.io/2026/05/28/protestware-for-coding-agents.... though I wish it loaded faster.
Comment linking /2026/05/28/protestware-for-coding-agents.html
on “Ask HN: Favorite text heavy blogs the are a joy to read”Submitted Protestware for Coding Agents as a story · 3 points
HN discussionRelevant reading: https://nesbitt.io/2026/02/16/changelog.html > Removed: mathjs dependency. 14MB, 200+ functions. Twelve functions used. Added: Custom math utilities module (src/math-utils.js). Addition, subtraction, multiplication, division, a handful of trig functions. Co-authored-by: chatgpt. Changed: Bundle size reduced by 68%. Build time down from 12s to 4s. Module: 47 lines across 1 file. 0 tests. 0 dependenc…
Comment linking /2026/02/16/changelog.html
on “Yt-dlp – [Announcement] Bun support is now limited and deprecated”Submitted Standing on the Shoulders of Homebrew as a story · 3 points
HN discussion
