Securing npm is table stakes (Interview)

Securing npm is table stakes (Interview)

Author: Changelog Media January 29, 2026 Duration: 1:21:11
As the creator and long-time maintainer of ESLint, Nicholas Zakas is well-positioned to criticize GitHub's recent response to npm's insecurity. He found the response insufficient, and has other ideas on how GitHub could secure npm better. On this episode, Nicholas details these ideas, paints a bleak picture of npm alternatives like JSR, and shares our frustration that such a critical piece of internet infrastructure feels neglected.

Each week, the team at Changelog Media sifts through the noise of the software world to bring you a thoughtful mix of news, analysis, and conversation. The Changelog: Software Development, Open Source is more than a weekly brief; it’s a long-form dialogue with the developers, maintainers, and thinkers who are shaping the future of technology. You’ll hear in-depth technical interviews that go beyond surface-level takes, exploring the real challenges and triumphs behind significant open source projects and industry trends. The discussion is grounded in the daily reality of building software, making the content immediately relevant whether you’re a seasoned engineer or deeply curious about the craft. This podcast operates with the belief that open source is more than code-it’s about the people and the communities that sustain it. By tuning in, you join a conversation that values depth over hot takes and substance over speed, all while keeping a pulse on the weekly developments that matter. It’s a consistent source for anyone who wants to understand not just what is changing in software development, but why it matters and how it all fits together.
Author: Language: en-us Episodes: 50

The Changelog: Software Development, Open Source
Podcast Episodes
Setting Docker Hardened Images free (Interview) [not-audio_url] [/not-audio_url]

Duration: 1:16:49
In May of 2025, Docker launched Hardened Images, a secure, minimal, production-ready set of images. In December, they made DHI freely available and open source to everyone who builds software. On this episode, we're join…
The tech monoculture is finally breaking (News) [not-audio_url] [/not-audio_url]

Duration: 8:46
Jason Willems believes the tech monoculture is finally breaking, Don Ho shares some bad Notepad++ news, Tailscale's Avery Pennarun pens a great downtime apology, Milan Milanović explains why you can only code 4 hours per…
Natural born SaaS killers (Friends) [not-audio_url] [/not-audio_url]

Duration: 1:13:12
We discuss the buzz around Clawdbot / MoltBot / OpenClaw, how app subscriptions are turning into weekend hacking projects, why SaaS stocks are crashing on Wall Street, and what it all means.
Clawdbot triggers a run on Mac Minis (News) [not-audio_url] [/not-audio_url]

Duration: 6:50
Clawdbot drives Mac Mini sales, Swizec Teller on the future of software engineering being SRE, Daniel Stenberg decided to end curl's bug bounty program, zerobrew takes some of the best ideas from uv and applies them to H…
The state of homelab tech (2026) (Friends) [not-audio_url] [/not-audio_url]

Duration: 2:02:50
Techno Tim joins Adam to dive deep into the state of homelab'ing in 2026. Hardware is scarce and expensive due to the AI gold rush, but software has never been better. From unleashing Claude on your UDM Pro to building c…
The era of the Small Giant (Interview) [not-audio_url] [/not-audio_url]

Duration: 1:38:13
Damien Tanner (founder of Pusher, now building Layercode) is back for a reunion 17 years in the making. Damien officially returns to The Changelog to discuss the seismic shift happening in software development. From the…
Agent psychosis: are we going insane? (News) [not-audio_url] [/not-audio_url]

Duration: 6:14
Armin Ronacher thinks AI agent psychosis might be driving us insane, Dan Abramov explains how AT Protocol is a social filesystem, RepoBar keeps your GitHub work in view without opening a browser, Ethan McCue shares some…
Kaizen! Let it crash (Friends) [not-audio_url] [/not-audio_url]

Duration: 1:41:07
Gerhard is back for Kaizen 22! We're diving deep into those pesky out-of-memory errors, analyzing our new Pipedream instance status checker, and trying to figure out why someone in Asia downloads a single episode so much…
The GitHub problem (and other predictions) (Friends) [not-audio_url] [/not-audio_url]

Duration: 1:41:28
Mat Ryer is back and he brought his impromptu musical abilities with him! We discuss Rob Pike vs thankful AI, Microsoft's GitHub monopoly (and what it means for open source), and Tom Tunguz' 12 predictions for 2026: agen…
Linus Torvalds gets the AI coding bug (News) [not-audio_url] [/not-audio_url]

Duration: 5:05
Linus Torvalds pushes AI generated code, Jordan Fulghum thinks this is the year of self-hosting, FracturedJson formats for compact / human readability, Scott Werner believes a flood of adequate software is coming, and Se…