Mikael Barbero
LightNews LightNews
banner
mikael.barbero.tech
Mikael Barbero
@mikael.barbero.tech
250 followers 190 following 290 posts
Head of Security @ Eclipse Foundation

We build our computers (systems) the way we build our cities: over time, without a plan, on top of ruins — Ellen Ullman
Posts Replies Media Videos
Reposted by Mikael Barbero
monkchips.com
So I wrote a thing redmonk.com/jgovernor/on...
On Cursor, Erich Gamma, VS Code forks and the surprising role of the Eclipse Foundation
I was writing this post today when the news dropped that Cursor has just raised a new round.   > We’re pleased to announce a new round of financing: our Series D of $2.3B at a $29.3B post-money valuat...
redmonk.com
November 14, 2025 at 5:49 PM
mikael.barbero.tech
The recording is available and, as expected, it is exceptionally good! It will genuinely ignite (or re-ignite) your enthusiasm for being an engineer! Thank you, @bcantrill.bsky.social
www.youtube.com/watch?v=Cum5...
November 13, 2025 at 10:54 PM
mikael.barbero.tech
Single most desirable feature from Supply Chain Security PoV
frenck.social Frenck | Home Assistant & Smart Home @frenck.social · 19d
Immutable releases announced at GitHub Universe!

Once tagged, releases can’t be changed. No more worrying about malicious actors swapping out assets or moving tags.

Single-use version tags with signed attestations. This is the supply chain protection open source really needs 🔒

#GitHubUniverse
October 29, 2025 at 7:39 AM
mikael.barbero.tech
I had a great time chatting with @josh.bressers.name! Go check out what’s happening on the security front at the Eclipse Foundation (@eclipse.org)
josh.bressers.name Josh Bressers @josh.bressers.name · 27d
I chat with @mikael.barbero.tech about security happenings at the Eclipse Foundation

My favorite project they have is helping projects generate #SBOMs, but there's a lot happening. If you want to see some public examples of how to do security right, give it a listen!
Eclipse Foundation SBOMs with Mikael Barbero
In this conversation, Josh speaks with Mikael Barbero, head of security at the Eclipse Foundation. They discuss the foundation’s role in enhancing the security posture of open source projects, the imp...
opensourcesecurity.io
October 20, 2025 at 2:38 PM
mikael.barbero.tech
And it gets even worse when the metrics are averages rather than percentiles!
lauriewired.bsky.social LaurieWired @lauriewired.bsky.social · Oct 17
You’re (probably) measuring application performance wrong.

Humans have a strong bias for throughput.

"I can handle X requests per second."

Real capacity engineers use response-time curves.
October 18, 2025 at 7:14 AM
mikael.barbero.tech
I can’t wait for the video of this one, the deck is already so bonkers! Love it! Also, no mention of LLM ;)
October 17, 2025 at 9:56 AM
mikael.barbero.tech
🎙 Just wrapped a fantastic conversation with @josh.bressers.name. We dive deep into enhancing open source security and how we do it at the @eclipse.org

Can't wait for you to hear the full episode, coming soon!
October 16, 2025 at 4:18 PM
Reposted by Mikael Barbero
filippo.abyssdomain.expert
To implement robust mitigations across Geomys, I did a survey of open source project compromises in 2024/2025.

Three root causes dominate: phishing, control handoff, and unsafe GitHub Actions triggers. All three can be systematically avoided.

words.filippo.io/compromise-s...
A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises
Project compromises have common root causes we can mitigate: phishing, control handoff, and unsafe GitHub Actions triggers.
words.filippo.io
October 10, 2025 at 2:34 PM
Reposted by Mikael Barbero
shanecurcuru.bsky.social
🏷️ Reason #3.7.2 why it's critical to clearly and publicly define your #OpenSource project #Governance, for code, distributions, trademarks, and domain names.

And, of course, not breaking norms and cosplaying a public charity while bowing to a sole sponsor over the community. 😢
September 25, 2025 at 12:22 PM
Reposted by Mikael Barbero
eclipse.org
The future of digital innovation depends on sustainable #opensource infrastructure.

Learn how businesses can help ensure long-term sustainability in #EclipseFdn Executive Director Mike Milinkovich’s latest blog: hubs.la/Q03Kz6D50 #PreserveOpenSource #SoftwareSupplyChain #OpenSourceResponsibility
September 23, 2025 at 3:04 PM
Reposted by Mikael Barbero
eclipse.org
#OCX26 is where the future of open source takes shape. Do you want to be part of it?

As an #OCX26 sponsor, you get to align your brand with the communities shaping tomorrow’s tech all in one place.

👉 Get the prospectus or get in touch with our team directly: www.ocxconf.org/event/2026/b...
September 3, 2025 at 8:00 AM
Reposted by Mikael Barbero
josh.bressers.name
The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting

So I wrote a blog post about it

An absolutely ridiculous amount of open source is one person projects. I have the data to prove it

opensourcesecurity.io/2025/08-oss-...
Open Source is one person
The Register recently published a story titled Putin on the code: DoD reportedly relies on utility written by Russian dev. They should be ashamed of this story, and the company behind the ambulance ch...
opensourcesecurity.io
August 28, 2025 at 1:41 AM
Reposted by Mikael Barbero
meredithmeredith.bsky.social
Stand by this: www.politico.com/newsletters/...
What’s a technology that you think is overhyped? I’m going to give a sideways answer to this, which is that the venture capital business model needs to be understood as requiring hype. You can go back to the Netscape IPO, and that was the proof point that made venture capital the financial lifeblood of the tech industry. Venture capital looks at valuations and growth, not necessarily at profit or revenue. So you don’t actually have to invest in technology that works, or that even makes a profit, you simply have to have a narrative that is compelling enough to float those valuations. So you see this repetitive and exhausting hype cycle as a feature in this industry. A couple of years ago, you would have been asking me about the metaverse, then last year, you would have asked me about Web3 and crypto, and for each of these inflection points there’s an Andreessen Horowitz manifesto. It’s not simply that one piece of technology is overhyped, it’s that hype is a necessary ingredient of the current business ecosystem of the tech industry. We should examine how often the financial incentive for hype is rewarded without any real social returns, without any meaningful progress in technology, without these tools and services and worlds ever actually manifesting. That’s key to understanding the growing chasm between the narrative of techno-optimists and the reality of our tech-encumbered world.
February 19, 2025 at 4:42 PM
Reposted by Mikael Barbero
joshbloch.bsky.social
🇺🇸Happy Fourth of July🇺🇸 This year, I'm wearing my 𝐑𝐞𝐬𝐢𝐬𝐭 shirt to show my patriotism. I'm reading the declaration of independence as I always do on this occasion. Several of King George's offenses against the colonies resonate this year. Here they are, verbatim:
He has refused his Assent to Laws, the most wholesome and necessary for the public good. He has endeavoured to prevent the population of these States; for that purpose obstructing the Laws for Naturalization of Foreigners. He has obstructed the Administration of Justice, by refusing his Assent to Laws for establishing Judiciary powers. He has made Judges dependent on his Will alone. He has erected a multitude of New Offices, and sent hither swarms of Officers to harass our people, and eat out their substance. He has affected to render the Military independent of and superior to the Civil power. For cutting off our Trade with all parts of the world For depriving us in many cases, of the benefits of Trial by Jury In every stage of these Oppressions We have Petitioned for Redress in the most humble terms: Our repeated Petitions have been answered only by repeated injury. A Prince, whose character is thus marked by every act which may define a Tyrant, is unfit to be the ruler of a free people.
July 4, 2025 at 5:51 PM
mikael.barbero.tech
Iwata Satoru was an unconventional CEO. In all the best ways that could imply!
July 3, 2025 at 7:00 AM
Reposted by Mikael Barbero
aoc.bsky.social
I will be damned if I allow a bunch of Confederate-waving January 6th apologists give the American people a lecture on flag waving.

There is ZERO reason to enter an argument about patriotism with people who still worship traitors to America 150+ years later.

They. Are. Breaking. The. Law.
June 11, 2025 at 1:21 AM
Reposted by Mikael Barbero
orcwg.org
🗓 On 4 June, the ORC community was represented by some of its members in the CRA Expert Group meeting hosted by @ec.europa.eu

We’re grateful to @ec.europa.eu for facilitating this discussion and to everyone involved.

@j-rico.bsky.social @tobie.bsky.social @mikael.barbero.tech @apache.org
June 5, 2025 at 10:25 AM
Reposted by Mikael Barbero
eclipse.org
📢 Calling developers, users, and committers! The Eclipse Foundation Security team is offering a new security training focused on vulnerability management and related subjects.

Register for Day 2 (June 10 on 4PM CEST): eclipse.zoom.us/meeting/regi...

➡️ blogs.eclipse.org/post/marta-r...
June 4, 2025 at 11:03 AM
Reposted by Mikael Barbero
mrybczyn.bsky.social
On June 3rd and 10th with my colleagues from the Eclipse Foundation we will be running a free security training on vulnerability management and related subject.

More details and registration links on blogs.eclipse.org/post/marta-r...
Announcing Security Training on Vulnerability Management, SBOM and related subjects
Do you want to know more about
blogs.eclipse.org
May 30, 2025 at 3:35 PM
Reposted by Mikael Barbero
eclipse.org
🔒 Master vulnerability management! Our security training on 3 June and 10 June covers CVE reporting, embargoes, dependency evaluation, and SBOMs.

📅 Day 1: eclipse.zoom.us/meeting/regi...
📅 Day 2: eclipse.zoom.us/meeting/regi...
May 26, 2025 at 8:20 AM
Reposted by Mikael Barbero
noahbarkin.bsky.social
Rubio publicly criticizing an ally for cracking down on right-wing extremism. And Germany hitting back. We are in a new world
May 2, 2025 at 8:39 PM
Reposted by Mikael Barbero
parismarx.com
The days of Google Docs are ending; we enter the age of Docs, made by France's Interministerial Directorate for Digital Affairs and Germany's Center for Digital Sovereignty of Public Administration.

We need more governments to collaborate on public software projects to achieve digital sovereignty.
France and Germany unveil Docs, a homegrown alternative to Google Docs
The Trump administration has set out to drastically reshape the relationship between the US and Europe. In response, Brussels is scrambling to adapt to this new reality,...
www.techspot.com
April 21, 2025 at 2:25 PM
Reposted by Mikael Barbero
tib3rius.bsky.social
BREAKING.

From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.
April 15, 2025 at 5:23 PM
Reposted by Mikael Barbero
annieabrams.bsky.social
move slowly and build things
April 7, 2025 at 4:19 PM
mikael.barbero.tech
Nailed it :D
April 8, 2025 at 12:21 AM