In this episode of the GR-OSS Out Podcast, host Jay Faulkner talks with Juan Escalada, maintainer of GitProxy at G-Research Open Source Software, about a serious vulnerability in GitProxy that allowed a second branch push to bypass every security check the tool was designed to enforce.

Juan explains how the bug was found through a security audit, why it went unnoticed in production for years, and how the G-Research team handled responsible disclosure — being transparent about the flaw even when it wasn't the easiest choice from a marketing standpoint.

The conversation also covers how GitProxy works as a network-level proxy for Git requests, unpacking and validating Git pack files, auditing pushes, and blocking data exfiltration before code reaches remotes like GitHub or GitLab. Juan and Jay discuss a new single-push approval workflow in development, and where artificial intelligence (AI) tools help — and where they still fall short — in software architecture and system design.

Juan also shares his path from Major League Hacking (MLH) Fellow to full-time GitProxy maintainer in under two years, the mindset shift required to go from writing code to being responsible for reviewing other people's code, working through imposter syndrome as a new maintainer, and practical advice for engineers applying to the MLH Fellowship — including why a well-lit, professional video call setup matters more than people expect.

GitProxy - https://git-proxy.finos.org/
Open WebUI - https://openwebui.com/
MLH Fellowship - https://fellowship.mlh.com/
"Developers" - https://www.youtube.com/watch?v=8fcSviC7cRM

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/zNUTa4s0l3k.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Juan Escalada.

In this episode of the GROSS Out Podcast, host Tabitha DiDomenico talks with CID, a software engineer and maintainer on the OpenStack Ironic project at G-Research. CID explains what OpenStack Ironic does — provisioning and managing bare metal (physical) servers the same way you'd manage a cloud instance — covering the full server lifecycle from enrollment and cleaning to firmware updates and deployment.

CID also share his journey from ALX (African Leadership X), the MLH Fellowship to full-time open source maintainer of OpenStack Ironic and how it changed his life.

The conversation covers:

• What OpenStack Ironic is and the problem it solves for bare metal provisioning
• Runbooks, a feature for predefining and scoping automation steps across servers, and the upcoming Version 2 (V2) improvements
• Why this release cycle has focused heavily on security advisories and vulnerability backports across four stable release branches
• CID's path from the Major League Hacking (MLH) Fellowship and the African Leadership Experience (ALX) software engineering program to becoming a full-time open source maintainer
• The realities of open source code review, the anxiety of working in public, and why backward compatibility is one of the most overlooked but critical skills in maintaining large infrastructure projects
• CID's advice for anyone facing rejection from a fellowship or open source community

Links
CID's Blog - https://auditorical.com/
OpenStack Ironic - https://opendev.org/openstack/ironic
MLH Fellowship - https://fellowship.mlh.com/
ALX - https://www.alxafrica.com/
Eventlet - https://evenlet.net/
Runbooks - https://docs.openstack.org/ironic/latest/admin/runbooks.html

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/fbsI8l-MaFA.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: CID.

Major Hayden — longtime Fedora packager and Red Hat engineer, formerly of Rackspace — joins host Jay Faulkner to talk about imposter syndrome in tech, and the framework he's used for over a decade to work through it: the OODA loop (Observe, Orient, Decide, Act), originally developed for fighter pilot decision-making.

Major explains why imposter syndrome tends to resurface with every new team or stretch role, why that's often a sign of growth rather than a warning sign, and how he mentors engineers moving into core maintainer roles. He also shares his personal rule for using AI responsibly in open source work — if he can't independently explain a piece of code, he won't submit it — and tells the story of a kernel patch that drew a detailed, frustrated response from Linux kernel maintainer Alan Cox.

Also discussed: reading audience reaction after a talk that didn't land, the culture of the Fedora Linux community, and why documenting tribal knowledge is easier to justify now that AI coding agents rely on it too.

Important Links

• Major Hayden's Blog https://major.io/
• Zellij - https://zellij.dev
• Pytorch - https://pytorch.org

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/MFU-0hZ47zU.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Major Hayden.