HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
andrew
nesbitt.io
JavaScript2025–2026
andrew / nesbitt.io

nesbitt.io

Personal blog built with Jekyll and hosted on GitHub Pages. I write about package management, software supply chain security, and open source infrastructure.

3Distinct people
3Mentions
0Explicit recommenders
39GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Personal blog built with Jekyll and hosted on GitHub Pages. I write about package management, software supply chain security, and open source infrastructure.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week3 dated mentions

Observed mentions: 2025-12-27 01:43:04 UTC to 2026-05-11 05:19:19 UTC. Weeks start Monday, UTC.

0122025-12-22 00:00:00 UTC to 2025-12-29 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 commentsDec 222025-12-29 00:00:00 UTC to 2026-01-05 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-05 00:00:00 UTC to 2026-01-12 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-12 00:00:00 UTC to 2026-01-19 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-19 00:00:00 UTC to 2026-01-26 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-26 00:00:00 UTC to 2026-02-02 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-02-02 00:00:00 UTC to 2026-02-09 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-02-09 00:00:00 UTC to 2026-02-16 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-02-16 00:00:00 UTC to 2026-02-23 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-02-23 00:00:00 UTC to 2026-03-02 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-03-02 00:00:00 UTC to 2026-03-09 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsMar 22026-03-09 00:00:00 UTC to 2026-03-16 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-03-16 00:00:00 UTC to 2026-03-23 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-03-23 00:00:00 UTC to 2026-03-30 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-03-30 00:00:00 UTC to 2026-04-06 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-04-06 00:00:00 UTC to 2026-04-13 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-04-13 00:00:00 UTC to 2026-04-20 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-04-20 00:00:00 UTC to 2026-04-27 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-04-27 00:00:00 UTC to 2026-05-04 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-05-04 00:00:00 UTC to 2026-05-11 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-05-11 00:00:00 UTC to 2026-05-18 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsMay 11

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Dec 222025-12-22 00:00:00 UTC2025-12-29 00:00:00 UTC202
Dec 292025-12-29 00:00:00 UTC2026-01-05 00:00:00 UTC000
Jan 52026-01-05 00:00:00 UTC2026-01-12 00:00:00 UTC000
Jan 122026-01-12 00:00:00 UTC2026-01-19 00:00:00 UTC000
Jan 192026-01-19 00:00:00 UTC2026-01-26 00:00:00 UTC000
Jan 262026-01-26 00:00:00 UTC2026-02-02 00:00:00 UTC000
Feb 22026-02-02 00:00:00 UTC2026-02-09 00:00:00 UTC000
Feb 92026-02-09 00:00:00 UTC2026-02-16 00:00:00 UTC000
Feb 162026-02-16 00:00:00 UTC2026-02-23 00:00:00 UTC000
Feb 232026-02-23 00:00:00 UTC2026-03-02 00:00:00 UTC000
Mar 22026-03-02 00:00:00 UTC2026-03-09 00:00:00 UTC000
Mar 92026-03-09 00:00:00 UTC2026-03-16 00:00:00 UTC000
Mar 162026-03-16 00:00:00 UTC2026-03-23 00:00:00 UTC000
Mar 232026-03-23 00:00:00 UTC2026-03-30 00:00:00 UTC000
Mar 302026-03-30 00:00:00 UTC2026-04-06 00:00:00 UTC000
Apr 62026-04-06 00:00:00 UTC2026-04-13 00:00:00 UTC000
Apr 132026-04-13 00:00:00 UTC2026-04-20 00:00:00 UTC000
Apr 202026-04-20 00:00:00 UTC2026-04-27 00:00:00 UTC000
Apr 272026-04-27 00:00:00 UTC2026-05-04 00:00:00 UTC000
May 42026-05-04 00:00:00 UTC2026-05-11 00:00:00 UTC000
May 112026-05-11 00:00:00 UTC2026-05-18 00:00:00 UTC101

What Hacker News says

3 sources
I never used Pangram before today, but since I've seen it mentioned many times on HN and I enjoyed reading the OP, I decided to try it. I am only using the free plan so let me know if I'm missing something. I am assuming the parent was referring to the tool hosted at pangram.com and not some other tool of the same name. Pangram indeed claims the OP is 76% AI-generated. It has "high confidence" (EDIT: some parts are "medium confidence") that the early portions of the text were created by AI, and "medium confidence" that some of the later potions were written by a human. EDIT: I was especially dismayed to see that the dog might have been an AI creation :( When I use the "supporting evidence" option, the main piece of evidence Pangram provides is the frequent use of em-dashes. Each timestamp is followed by an em-dash. Personally I think the
Read the rest
em-dashes could be a copy-pasted em-dash or inserted by a markdown to HTML converter. nesbitt.io is apparently using Jekyll [0] - any Jekyll users know anything about this?? Pangram's "supporting evidence" feature also considers → and € to be "unusual Unicode". Personally, to me it looks like the "supporting evidence" feature still needs some work because Pangram's AI detection is probably a lot more sophisticated than a grep for Unicode symbols. In fact the feature even has a notice claiming that "These patterns aren't used to determine our AI score; they help you see why AI text often reads differently." As for the rest of the OP's content, it would be interesting to compare the Pangram results to a timeline of a real vulnerability. I tried doing so, but exhausted my free "Pangram credits" - apparently the first 1000 words of this article [1] about the log4j vulnerability is considered 100% human. [0] https://github.com/andrew/nesbitt.io [1] https://www.csoonline.com/article/571797/the-apache-log4j-vu...
In Incident Report: CVE-2024-YIKES
What is wrong with you? You berated and name-called open source volunteers because a blog post taught you that package managers using Git are "bad." Let me be clear: a 3 minute read of a blog post offers neither moral superiority nor technical insights that surpass those of actual maintainers. Contrary to the snap conclusion you drew from the article, there are design trade-offs involved when it comes to package managers using Git. The article's favored solution advocates for databases, which in practice, makes the package repository a centralized black box that compromises package reproducibility. It may solve some problems, but still sucks harder in some ways. The article is also flat-out wrong regarding Nixpkgs. The primary distribution method for Nixpkgs has always been tarballs, not Git. Although the article has attempted to backpeda
Read the rest
l [1], it hasn't entirely done so. It's now effectively criticizing collaboration over Git while vaguely suggesting that maybe it’s a GitHub problem. And you think what, that collaboration over Git is "unethical"??? On one side, there are open-source maintainers contributing their time and effort as volunteers. On the other, there are people like you attacking them, labeling them "lazy" and bemoaning that you're "forced" to rely on the results of their free labor, which you deride as "slow, bug-riddled garbage" without any real understanding. I know whose side I'm on. [1]: https://github.com/andrew/nesbitt.io/commit/8e1c21d96f4e7b3c...
In Package managers keep using Git as a database, it never works out

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.