In this episode of the GR-OSS Out Podcast, host Jay Faulkner talks with Juan Escalada, maintainer of GitProxy at G-Research Open Source Software, about a serious vulnerability in GitProxy that allowed a second branch push to bypass every security check the tool was designed to enforce.

Juan explains how the bug was found through a security audit, why it went unnoticed in production for years, and how the G-Research team handled responsible disclosure — being transparent about the flaw even when it wasn't the easiest choice from a marketing standpoint.

The conversation also covers how GitProxy works as a network-level proxy for Git requests, unpacking and validating Git pack files, auditing pushes, and blocking data exfiltration before code reaches remotes like GitHub or GitLab. Juan and Jay discuss a new single-push approval workflow in development, and where artificial intelligence (AI) tools help — and where they still fall short — in software architecture and system design.

Juan also shares his path from Major League Hacking (MLH) Fellow to full-time GitProxy maintainer in under two years, the mindset shift required to go from writing code to being responsible for reviewing other people's code, working through imposter syndrome as a new maintainer, and practical advice for engineers applying to the MLH Fellowship — including why a well-lit, professional video call setup matters more than people expect.

GitProxy - https://git-proxy.finos.org/
Open WebUI - https://openwebui.com/
MLH Fellowship - https://fellowship.mlh.com/
"Developers" - https://www.youtube.com/watch?v=8fcSviC7cRM

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/zNUTa4s0l3k.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Juan Escalada.

In this episode of the GROSS Out Podcast, host Tabitha DiDomenico talks with CID, a software engineer and maintainer on the OpenStack Ironic project at G-Research. CID explains what OpenStack Ironic does — provisioning and managing bare metal (physical) servers the same way you'd manage a cloud instance — covering the full server lifecycle from enrollment and cleaning to firmware updates and deployment.

CID also share his journey from ALX (African Leadership X), the MLH Fellowship to full-time open source maintainer of OpenStack Ironic and how it changed his life.

The conversation covers:

• What OpenStack Ironic is and the problem it solves for bare metal provisioning
• Runbooks, a feature for predefining and scoping automation steps across servers, and the upcoming Version 2 (V2) improvements
• Why this release cycle has focused heavily on security advisories and vulnerability backports across four stable release branches
• CID's path from the Major League Hacking (MLH) Fellowship and the African Leadership Experience (ALX) software engineering program to becoming a full-time open source maintainer
• The realities of open source code review, the anxiety of working in public, and why backward compatibility is one of the most overlooked but critical skills in maintaining large infrastructure projects
• CID's advice for anyone facing rejection from a fellowship or open source community

Links
CID's Blog - https://auditorical.com/
OpenStack Ironic - https://opendev.org/openstack/ironic
MLH Fellowship - https://fellowship.mlh.com/
ALX - https://www.alxafrica.com/
Eventlet - https://evenlet.net/
Runbooks - https://docs.openstack.org/ironic/latest/admin/runbooks.html

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/fbsI8l-MaFA.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: CID.

Major Hayden — longtime Fedora packager and Red Hat engineer, formerly of Rackspace — joins host Jay Faulkner to talk about imposter syndrome in tech, and the framework he's used for over a decade to work through it: the OODA loop (Observe, Orient, Decide, Act), originally developed for fighter pilot decision-making.

Major explains why imposter syndrome tends to resurface with every new team or stretch role, why that's often a sign of growth rather than a warning sign, and how he mentors engineers moving into core maintainer roles. He also shares his personal rule for using AI responsibly in open source work — if he can't independently explain a piece of code, he won't submit it — and tells the story of a kernel patch that drew a detailed, frustrated response from Linux kernel maintainer Alan Cox.

Also discussed: reading audience reaction after a talk that didn't land, the culture of the Fedora Linux community, and why documenting tribal knowledge is easier to justify now that AI coding agents rely on it too.

Important Links

• Major Hayden's Blog https://major.io/
• Zellij - https://zellij.dev
• Pytorch - https://pytorch.org

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/MFU-0hZ47zU.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Major Hayden.

Lori Lorusso, Director of Outreach at the Rust Foundation, and David Wood, a Rust Project Director and engineer at ARM, join host Jay Faulkner to talk about what the Rust Foundation actually does behind the scenes — funding infrastructure, employing security engineers, and running a maintainer funding program for contributors who aren't backed by a sponsoring company.

The conversation covers Rust's path from a Mozilla research project to safety-critical infrastructure in operating systems, browsers, and even vehicles, plus a deep dive into why a single compiler feature (the standard library rebuild, or "build-std") took 11 years and a major communication breakdown within the project to finally ship. Lori and David also share two candid "gross moments": a non-technical presenter's conference talk gone sideways, and the long, frustrating road to getting a stalled feature back on track.

This episode is for developers, maintainers, and engineers who work with Rust (or are deciding whether to) and want to understand the people and politics behind the language, not just the syntax.

The Rust Foundation - https://rustfoundation.org/
Rust Project Goals - https://rust-lang.github.io/rust-project-goals/2026/build-std.html
ARM - https://www.arm.com/

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/GCSn4kjSRRo.

The GR-OSS OUT Podcast is produced by Ben Wiley.

You can't fire a volunteer. So how do you lead one? Vicky Brasseur — author, OSS strategist, and "open source minister without portfolio" — joins Jay Faulkner on the GROSS Out Podcast to discuss wielding influence without authority: ethical manipulation, director-ready business cases, and the succession planning most projects ignore until it's too late. Plus, Vicky's unflinching take on how the LLM boom is damaging open source — flooding maintainers with low-quality PRs, gutting mentorship, and burning resources without accountability. No fluff. Just the long game.

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/CEp-I7st02A.

The GR-OSS OUT Podcast is produced by Ben Wiley.

For our two-year anniversary, Tabatha DiDomenico turns the mic around and puts GROSS Out Podcast founder Jay Faulkner in the hot seat.

Jay is a self-taught technologist who never wanted computers as a career — and ended up shaping infrastructure that runs the world as Ironic's project lead and a decade-long OpenStack contributor. In this conversation, he's honest about how that happened, what it actually looks like from the inside, and what he'd tell anyone trying to find their footing in open source.
In this episode:

• Why people skills matter more than code in open source communities
• How to give feedback people can actually trust — and why toxic positivity damages projects
• What maintainership really looks like versus open source leadership
• The moment he walked away from a job over an ethical line he wasn't willing to cross
• Why Gentoo might be the best learning environment for a young Linux developer right now
• The one piece of career advice almost nobody in tech actually follows

Links and references:

• Ironic Project: https://ironicbaremetal.org
• OpenStack: https://www.openstack.org
• Gentoo Linux: https://www.gentoo.org
• G-Research Open Source: https://www.gresearch.com/open-source

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/H6OXeKyHJ-g.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Jay Faulkner.

Nick Vidal, Community Manager at the Open Source Initiative (OSI), joins host Tabitha to discuss one of the hardest questions in open source right now: what does Open Source AI actually mean, and who gets to decide?

At the center of it all is the OSI's effort to build community consensus around a definition that satisfies both developers and data scientists — two groups who don't always see eye to eye. Nick also shares what more than 50 maintainer stories revealed about the state of open source health, including the rise of AI-generated noise flooding maintainer workflows, the pressure of legislation like the EU Cyber Resilience Act, and why one prominent maintainer published a piece titled "We Don't Owe You Anything."

Nick reflects on his journey from organizing Drupal communities across Latin America to working at the heart of open source policy, and why bringing diverse cultural perspectives into open source development is how the best ideas actually get discovered.

Topics include the Open Source AI Definition, maintainer burnout, the Maintainers book at maintainers.rs, the EU Cyber Resilience Act, software freedom, and the human side of open source sustainability.

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/7irm9Wt7aEM.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Nick Vidal.

Tabitha sits down with Andrew Block, Distinguished Architect at Red Hat
and maintainer of Helm — the package manager powering Kubernetes
deployments worldwide — to talk about what it really took to ship
Helm 4.

They cover the 12-month journey to a major release, what got left on
the cutting room floor, how the team nearly broke a huge chunk of the
community with one dependency change, and why Andy thinks open source
is one of the most powerful forces for bringing people together —
regardless of what's happening in the world.

They also get into the bigger questions: maintainer burnout, the role
AI is starting to play in open source workflows, and what it means to
build software that outlasts the hype cycle.

If you use Helm — or you care about the humans behind the tools you
depend on — this one's worth your time.

Find Helm on GitHub, or join the community on Kubernetes Slack in

12:30 ET.

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/mVKrrWOpMYM.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Andrew Block.