Nils Adermann

Co-Founder of Packagist
/ https://packagist.com and Co-Creator of #composerphp - he/him

Last Notes

2026-10-22 14:43:42 GMT

If all the governments shutting down their servers for a PHP vulnerability, all the hosting companies and enterprises terrified by the vuln, would give $100k, heck only $50k a year to the PHP Foundation, things could look very differently. Go make your employer sponsor *today* https://thephp.foundation/sponsor/ #php #phpc @nprofile…9pgr

2026-10-21 15:58:43 GMT

So I guess now is the moment where I start thinking about the fact I'm supposed to give a talk on PHP supply chain security at MeetMagento DE tomorow and in the midst of all this haven't really prepared a talk yet? 😆 Guess worst case it's an AMA

2026-10-21 14:54:13 GMT

Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
#nevent1q…7ffv

2026-05-06 12:41:18 GMT

Open infrastructure isn't free. 🌱
Packagist/Composer signed a joint
OpenSSF letter with PyPI, crates, Maven, CPAN, etc on real cost of running package registries.
Packagist needs to finance staff, not just hardware and bandwidth. Contact me if your company's interested in joining our sponsorship program for its launch this month while we work on long term solutions.
#php #phpc #composerphp #softwaresupplychain #PreserveOpenSource #FreeSoftwareIsntFree #OpenSource #Sustainability
#nevent1q…c8n7

2025-05-27 12:02:03 GMT

Will you be in Amsterdam June 17th, or can you make it there? Join us to celebrate PHP turning 30 🎂 after #phpverse at Café Restaurant Dauphine with AmsterdamPHP from 6:30pm - RSVP https://www.meetup.com/amsterdamphp/events/307306474/ #php #phpc

2025-02-03 08:27:15 GMT

Stop by our @nprofile…y04j booth at #LaraconEU and have a chat about Composer, Packagist, Conductor or anything else relating to dependency management and supply chain security! #Laravel #Laracon
https://media.phpc.social/media_attachments/files/113/939/002/239/860/731/original/5676879e94658f18.jpg

2025-02-01 17:19:15 GMT

Great overview of security pitfalls in GitHub Actions that should be required viewing for anyone working with GHA by @nprofile…sp92 - read the detailed slides at https://fosdem.org/2025/schedule/event/fosdem-2025-6543-hunting-for-github-actions-bugs-with-zizmor/ #FOSDEM

2025-02-01 13:35:24 GMT

After the panel on "when are AI systems free/open" at #FOSDEM I struggle to see why we don't just equate ML/training to compilers. They take data (source code for compiler, corpus for AI) and turn them into a decision making program (machine code for compiler, weights for AI model). Clearly a program doesn't become open source by distributing it in binary form/weights, and a whole AI system can only be open source if all of its components are: compiler (ML/training process) and program (model)?

2024-12-12 11:05:15 GMT

Wrote down my thoughts on PHP Property Hooks added in 8.4 - ironically while I am a fan of the feature I think of it as a kind of insurance, you're best off if you don't need it at all - https://blog.naderman.de/2024/12/12/php-property-hooks-a-cost-of-change-insurance/
#php #phpc

2024-03-30 00:06:02 GMT

The sad part about today's xz/liblzma discovery is that again critical infrastructure was maintained by overworked volunteers without sufficient assistance or support. We, as professional software engineers, or even we, as society, relying on their volunteer work, failed them.
https://www.mail-archive.com/[email protected]/msg00567.html