How to Serve Open Source Maintainers Without Annoying Them?
summary
OpenRefactory scans the top 10,000 Java, Python and Go projects with Intelligent Code Repair (iCR) and other static analyzers, manually triages only high/medium findings, and reports bugs through a semi-automated triage portal that follows each project’s disclosure norms. In four months 900 repos yield 168 reports (about 80 security issues), fixes are synthesized for ~140, and roughly 40% of reported fixes are merged, with private disclosure and human handles used to reduce maintainer friction.
AI-written summary · about
chapters (12)
- 0:00Serving maintainers
- 2:56Securing open source
- 5:02Bug fixing strategies
- 9:07Drive-by PRs annoy
- 12:43Maintainer insights
- 14:09Semi-automated bug reports
- 18:29Security and reliability focus
- 20:57Vulnerability reporting
- 22:43Bug fixing communication
- 25:31Project status
- 28:41Takeaways and future
- 29:25Q&A
related talks
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories- 45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
16mPerformance improvements: exposing hidden security fixes in Open Source
22mFinding Future Maintainers
24mThe Cathedral, the Bazaar, and the Coffeehouse
41mManaging the risk and growth of using Open Source Software