Your First Pull Request, Walked Through Slowly
A practical episode for people who want to contribute to open source and have never dared. Rafael and a first-time contributor from Recife go through her first merged change, step by step.
The Two a.m. Patch Half the Web Shipped
0:00 / 1:11
This episode is for members. Sign up free or log in to hear the whole episode.
Show notes
One maintainer, one bug, hundreds of thousands of projects
Ingrid Haugen maintains a string utility library most developers have never heard of and almost all of them depend on. When a security researcher sent a disclosure on a Friday night, she had hours to decide what to do. She tells Rafael the whole story.
- The disclosure email and how she verified it was real
- Fixing it alone versus telling the world first
- The release, the angry issues and the thank-you notes
- What the big companies using the library did and did not do
- Why she still has not accepted a second maintainer
Recorded over two sessions in Oslo and Sao Paulo.
Transcript
Ola, welcome to Fork and Maintain. I am Rafael Nogueira, and this is the show about the people who keep open source software alive, usually for free, usually at night. Today's guest is Ingrid Haugen. You have probably never heard of her library, and your project almost certainly uses it. One Friday evening a security researcher emailed her a bug that affected hundreds of thousands of projects, and she had to decide, alone, what to do before anyone else found it. We talk through that night hour by hour: the verification, the fix, the release, the angry issues, and the one company that actually said thank you. It is a story about responsibility that nobody asked her to carry. You are listening on Witspeak Podcasts. Let's open the issue.
Open as text