korrents
Simon Willison

What Simon Willison thinks about open source

@simon-willison · 41 positions · 0 changes of mind

Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.

Everything they publish, on ppll ↗

Simon Willison did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

3 dated positions, 2026, in their own words. Our reading of what Simon Willison has said — not written or endorsed by them.

3 positions so far — this page is not yet offered to search engines.

  1. Our readingAny software that depends on open source has a network of humans with package publishing rights who are potential attack vectors.

    Their wordsAny piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.

    ↗Be alert: targeted attacks on prominent Rustaceanssimonwillison.net

  3. Our readingDependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers.

    Their wordsI guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.

    ↗Be alert: targeted attacks on prominent Rustaceanssimonwillison.net

  4. 6 months earlier

  5. Our readingOpen-source projects are now so flooded with junk contributions that maintainers are asking GitHub for something it has never offered: a way to switch pull requests off.

    Their wordsprojects are flooded with junk contributions at the moment to the point that people are trying to convince GitHub to disable pull requests, which is something GitHub have never done.

    ↗Simon Willison: Engineering practices that make coding agents work - The Pragmatic Summityoutube.com 18th of 18 in this recording