**Location:** Lincoln, Nebraska, USA **Employment type:** Volunteer **Term:** Permanent **Compensation:** $0 **Reports to:** The community **Direct reports:** None **Start date:** Immediate We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend on every single day. If you thrive on autonomy, love working in the open, and want to wear many hats in a fast-paced environment, we’d love to hear from you. **About the role** As Senior Open Source Maintainer you will be the primary technical owner and public face of the project. You’ll drive the roadmap, ship releases, support a global user base, and champion the project across the wider industry. This is a highly visible individual contributor role with enormous scope. No two days are the same, and you’ll have full autonomy to decide how you spend your time. **What you’ll do** * Own the technical roadmap and long-term architectural direction * Review and merge contributions from a diverse, global community of open source developers * Triage and prioritise the issue tracker and feature request backlog * Maintain comprehensive documentation, examples, migration guides, and API references * Ensure project websites and documentation meet current accessibility standards * Cut releases across all supported major version lines and write the release notes * Own the CI pipeline, release automation, and package publishing infrastructure * Keep dependencies current and promptly action automated update pull requests * Support users on GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email * Ensure compatibility across all current runtimes, operating systems, and architectures * Preserve backwards compatibility, including widely relied-upon undocumented behaviour * Coordinate release timing with downstream distributions, registries, and redistributors **You’ll also** * Participate in the on-call rotation for incidents at downstream production deployments * Support enterprise consumers where project issues block business-critical systems * Define and communicate support, deprecation, and end-of-life policies for all release lines * Provide migration guidance to adopters upgrading from end-of-life releases * Coordinate advisories, CVE records, disclosure timelines, and researcher credits * Ship embargoed CVE patches across all supported version lines within the disclosure window * Produce SBOMs, VEX statements, and signed provenance attestations for every release * Maintain reproducible builds and independently verifiable release artifacts * Complete supplier security assessments and questionnaires for enterprise consumers * Remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms **As well as** * Review high volumes of contributions from AI coding agents and automated refactoring tools * Triage vulnerability reports generated by commercial AI security scanners * Champion the project at international conferences, on podcasts, and across social media * Moderate all community spaces and enforce the Code of Conduct * Engage constructively with feedback shared on social media and public forums * Represent the project in working groups, standards bodies, and regulatory consultations * Prepare grant applications and quarterly reports for current and prospective funders * Administer domains, trademarks, signing keys, cloud accounts, and social media * Advise enterprise legal teams on licensing, patent, warranty, and export control matters * Own the succession plan: identify, recruit, and onboard your replacement **How we’ll measure success** * GitHub stars * Time to first response on issues and pull requests * Release cadence and mean time to patch for disclosed vulnerabilities * Open issue and stale pull request backlog * Dependency freshness * OpenSSF Scorecard result and other automated project scoring * Community sentiment across public channels * Downstream adoption * Bus factor **What we’re looking for** * 8+ years of professional software engineering experience * Deep expertise in one systems language and professional proficiency in at least four others * Written communication pitched to audiences from first-time contributors to Fortune 500 CISOs * Consistent release cadence with minimal dependency churn and no breaking changes * Comfortable across engineering, support, security, community, marketing, finance, and legal * Balances contributors, enterprises, security researchers, regulators, and automated systems * Comfortable receiving direct public feedback and turning it into improvements * Availability overlapping core business hours in AMER, EMEA, and APAC * Able to respond to time-sensitive security matters outside normal working hours * Provides own hardware, reliable internet, and test environments for all supported platforms **Nice to have** * Prior experience in technical writing, developer relations, or community management * Experience migrating existing codebases to memory-safe languages * Working knowledge of licence compatibility and international trademark registration * Grant writing and nonprofit financial reporting experience * Media training * An established personal audience on at least one major social platform * Conversational proficiency in a second and third language * A second job **What we offer** * 100% remote, work from anywhere in the world * Complete flexibility over your working hours * High-impact work depended on by startups and Fortune 500 companies alike * Exceptional visibility and personal brand building opportunities * Regular speaking slots at leading industry events * The opportunity to develop close working relationships with several national CERTs * A passionate, highly engaged global user community * GitHub Sponsors enabled on the repository **How to apply** Please submit a CV, a link to your GitHub profile, and a short cover letter telling us what ownership means to you. Our interview process consists of a recruiter screen, a technical interview, a system design round, a take-home exercise, and a final community panel. If you don’t meet every requirement listed above, we’d still encourage you to apply. We are committed to building a diverse and inclusive community and welcome applicants from all backgrounds. This position will remain open until filled. Due to the volume of applications received, we are unable to respond to every candidate individually. _This role is not eligible for relocation assistance or visa sponsorship._

A resource management optimization puzzle game with metaprogression under a guise of an RPG. Explore the towers, get high scores, obtain gems and push the scores even further beyond!

Microsoft has terminated an account associated with VeraCrypt, a popular and long-running piece of encryption software, throwing future Windows updates of the tool into doubt, VeraCrypt’s developer told 404 Media. The move highlights the sometimes delicate supply chain involved in the publication of open source software, especially software that relies on big tech companies even tangentially. “I didn't receive any emails from Microsoft nor any prior warnings,” Mounir Idrassi, VeraCrypt’s developer, told 404 Media in an email. 💡 ****Do you know anything else about this termination or others like it? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.**** VeraCrypt is an open-source tool for encrypting data at rest. Users can create encrypted partitions on their drives, or make individual encrypted volumes to store their files in. Like its predecessor TrueCrypt, which VeraCrypt is based on, it also lets users create a second, innocuous looking volume if they are compelled to hand over their credentials. Last week, Idrassi took to the SourceForge forums to explain why he had been absent for a few months. The most serious challenge, he wrote, “is that Microsoft terminated the account I have used for years to sign Windows drivers and the bootloader.” “Regarding VeraCrypt, I cannot publish Windows updates. Linux and macOS updates can still be done but Windows is the platform used by the majority of users and so the inability to deliver Windows releases is a major blow to the project,” he continued. “Currently I'm out of options.” Idrassi told 404 Media the termination happened in mid-January. “I was surprised to discover that I could no longer use my account,” he said. On the forum and in the email to 404 Media, Idrassi shared what he said was the only message he received connected to the account shutdown. “Based on the information you have provided to date, we have determined that your organization does not currently meet the requirements to pass verification. There are no appeals available, we have closed your application,” it reads. Idrassi told 404 Media the message is concerning his company IDRIX. “As you can read in their message, they say that the organization (IDRIX) doesn't meet their requirements, but I don't see which requirement IDRIX suddenly stopped meeting,” he said. The message Idrassi said he received. Idrassi said he has tried contacting Microsoft support, but he received automated responses that he believes contained AI-generated text. “This is frustrating because they could at least explain what's wrong,” Idrassi said. “The lack of communication by Microsoft when they take such decisions adds uncertainty about the future, combined with automated AI feedback which gives an inhuman aspect to such decisions,” Idrassi said. According to a post on Hacker News, the popular VPN client WireGuard is facing the same issue. “No warning at all, no notification. One day I sign in to publish an update, and yikes, account suspended,” Jason Donenfeld, the creator of WireGuard, wrote. Microsoft acknowledged a request for comment but did not provide a response in time for publication.

I wish I could recommend this piece more, because it makes a bunch of great points, but the "normal technology" case feels misleading to me. It's not _wrong_, exactly, but radium paint was also a "normal technology" according to this rubric, and I still very much don't want to get any on me and especially not in my mouth