GR-OSS OUT Podcast

In this episode of the GR-OSS Out Podcast, host Jay Faulkner talks with Juan Escalada, maintainer of GitProxy at G-Research Open Source Software, about a serious vulnerability in GitProxy that allowed a second branch push to bypass every security check the tool was designed to enforce. Juan explains how the bug was found through a security audit, why it went unnoticed in production for years, and how the G-Research team handled responsible disclosure — being transparent about the flaw even when it wasn't the easiest choice from a marketing standpoint. The conversation also covers how GitProxy works as a network-level proxy for Git requests, unpacking and validating Git pack files, auditing pushes, and blocking data exfiltration before code reaches remotes like GitHub or GitLab. Juan and Jay discuss a new single-push approval workflow in development, and where artificial intelligence (AI) tools help — and where they still fall short — in software architecture and system design. Juan also shares his path from Major League Hacking (MLH) Fellow to full-time GitProxy maintainer in under two years, the mindset shift required to go from writing code to being responsible for reviewing other people's code, working through imposter syndrome as a new maintainer, and practical advice for engineers applying to the MLH Fellowship — including why a well-lit, professional video call setup matters more than people expect. GitProxy - https://git-proxy.finos.org/ Open WebUI - https://openwebui.com/ MLH Fellowship - https://fellowship.mlh.com/ "Developers" - https://www.youtube.com/watch?v=8fcSviC7cRM G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies. For a video version of this podcast, check out https://youtu.be/zNUTa4s0l3k. The GR-OSS OUT Podcast is produced by Ben Wiley.Special Guest: Juan Escalada.

In this episode of the GROSS Out Podcast, host Tabitha DiDomenico talks with CID, a software engineer and maintainer on the OpenStack Ironic project at G-Research. CID explains what OpenStack Ironic does — provisioning and managing bare metal (physical) servers the same way you'd manage a cloud instance — covering the full server lifecycle from enrollment and cleaning to firmware updates and deployment. CID also share his journey from ALX (African Leadership X), the MLH Fellowship to full-time open source maintainer of OpenStack Ironic and how it changed his life. The conversation covers: What OpenStack Ironic is and the problem it solves for bare metal provisioning Runbooks, a feature for predefining and scoping automation steps across servers, and the upcoming Version 2 (V2) improvements Why this release cycle has focused heavily on security advisories and vulnerability backports across four stable release branches CID's path from the Major League Hacking (MLH) Fellowship and the African Leadership Experience (ALX) software engineering program to becoming a full-time open source maintainer The realities of open source code review, the anxiety of working in public, and why backward compatibility is one of the most overlooked but critical skills in maintaining large infrastructure projects CID's advice for anyone facing rejection from a fellowship or open source community Links CID's Blog - https://auditorical.com/ OpenStack Ironic - https://opendev.org/openstack/ironic MLH Fellowship - https://fellowship.mlh.com/ ALX - https://www.alxafrica.com/ Eventlet - https://evenlet.net/ Runbooks - https://docs.openstack.org/ironic/latest/admin/runbooks.html G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies. For a video version of this podcast, check out https://youtu.be/fbsI8l-MaFA. The GR-OSS OUT Podcast is produced by Ben Wiley.Special Guest: CID.

Major Hayden — longtime Fedora packager and Red Hat engineer, formerly of Rackspace — joins host Jay Faulkner to talk about imposter syndrome in tech, and the framework he's used for over a decade to work through it: the OODA loop (Observe, Orient, Decide, Act), originally developed for fighter pilot decision-making. Major explains why imposter syndrome tends to resurface with every new team or stretch role, why that's often a sign of growth rather than a warning sign, and how he mentors engineers moving into core maintainer roles. He also shares his personal rule for using AI responsibly in open source work — if he can't independently explain a piece of code, he won't submit it — and tells the story of a kernel patch that drew a detailed, frustrated response from Linux kernel maintainer Alan Cox. Also discussed: reading audience reaction after a talk that didn't land, the culture of the Fedora Linux community, and why documenting tribal knowledge is easier to justify now that AI coding agents rely on it too. Important Links Major Hayden's Blog https://major.io/ Zellij - https://zellij.dev Pytorch - https://pytorch.org G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies. For a video version of this podcast, check out https://youtu.be/MFU-0hZ47zU. The GR-OSS OUT Podcast is produced by Ben Wiley.Special Guest: Major Hayden.

Lori Lorusso, Director of Outreach at the Rust Foundation, and David Wood, a Rust Project Director and engineer at ARM, join host Jay Faulkner to talk about what the Rust Foundation actually does behind the scenes — funding infrastructure, employing security engineers, and running a maintainer funding program for contributors who aren't backed by a sponsoring company. The conversation covers Rust's path from a Mozilla research project to safety-critical infrastructure in operating systems, browsers, and even vehicles, plus a deep dive into why a single compiler feature (the standard library rebuild, or "build-std") took 11 years and a major communication breakdown within the project to finally ship. Lori and David also share two candid "gross moments": a non-technical presenter's conference talk gone sideways, and the long, frustrating road to getting a stalled feature back on track. This episode is for developers, maintainers, and engineers who work with Rust (or are deciding whether to) and want to understand the people and politics behind the language, not just the syntax. The Rust Foundation - https://rustfoundation.org/ Rust Project Goals - https://rust-lang.github.io/rust-project-goals/2026/build-std.html ARM - https://www.arm.com/ G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies. For a video version of this podcast, check out https://youtu.be/GCSn4kjSRRo. The GR-OSS OUT Podcast is produced by Ben Wiley.

You can't fire a volunteer. So how do you lead one? Vicky Brasseur — author, OSS strategist, and "open source minister without portfolio" — joins Jay Faulkner on the GROSS Out Podcast to discuss wielding influence without authority: ethical manipulation, director-ready business cases, and the succession planning most projects ignore until it's too late. Plus, Vicky's unflinching take on how the LLM boom is damaging open source — flooding maintainers with low-quality PRs, gutting mentorship, and burning resources without accountability. No fluff. Just the long game. G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies. For a video version of this podcast, check out https://youtu.be/CEp-I7st02A. The GR-OSS OUT Podcast is produced by Ben Wiley.