Nils Adermann

@vanamerongen What's a few hundred million installations of a maintainer-less SDK between friends 🤷

@naderman Ah the joys of open source in corporate

So I'm trying to contact a bunch of enterprises with SDKs on packagist to help with sponsorships. But what I'm finding instead is that their SDKs are mostly owned by ex-employee accounts with private email addresses or bouncing corporate emails. 😵‍💫

@chacon Sorry it's late 🤷

My kids new ball cap I think is titled “German T-Rex at a stop light, trying to see if the light is green.”

Also ich würde hier ja 500.000 Eigentumswohnungen hinstellen, but who am I?

are you a junior "AI native" developer? i'd love to know how you work and learn! post below, hit my DMs, or write an old man email to contact@mariozechner.at.

@mitsuhiko There's OS223 7 days a week at 7am? Or still too late? With the FEX now actually deserving the express title takes 20 mins to central station, so eta 9:15am ish? Assuming BER manages to let you off the plane which is probably the most common delay there 😆

Why are there no early morning flights to Berlin from Vienna? Someone explain this to me. I always forget how annoying it is to get there.

@tomasfejfar @1Password Yeah use environments or scoped service account tokens, rather keep cli access disabled on the dektop app really 1password.dev/environments

Hey @1Password I thought that "op" is intended to use to securely access secrets via agents, but IIUC it unlocks the whole account 😱 In my book that's worse for security than putting the secrets to temp files for agents 😢

📌 Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, deletions are tracked with a reason and recoverable, and everything is recorded on the public transparency log. #php #phpc #composerphp

I promised myself I'd record a demo of Memo this week. Demo is not as good as I wanted it to be, but I'd rather ship it than wait another week. ✨ Memo is a shared space for notes and context between all your different AI tools! Would love for you to check it out!

It's gotten to the point where when I want to understand some project (e.g. remix 3 this morning), I search for a SKILLS.md file in the repo and read that I don't understand why this is kept separate (and often duplicative) from "main" documentation for humans

If you're curious about what our Ecosystem Security Team has been up to the past month, you're in luck! Volker Dusch has provided an update in our recent blog post. thephp.foundation/blog/2026/06/2… #php #phpc #phpsecurity

@jonas On one side seems like an artifact from a time when servers ran different platforms than local dev envs, but isn't the best way to verify the proof of test to have the tests run independently? May just need to think of "CI" more like a review step from a separate agent?

If all our code is written by agents with a computer, then why do we have separate computers spun up for GitHub actions? What if the agent just ran tests on their own machine and then uploaded proof of tests passing to a central system that gates e.g. GitHub mergeability? Would b lots faster and less config

@dhicking @laravelphp @LaravelLiveUK Yes we get it, you are hurt, that someone once questioned if PHP was dead, they recalled their own crappy PHP code from 2009 & blamed PHP for their inexperience. You are making it an in-joke. But everyone who isn't "in" just sees you hurt and thinks there may be truth to it.

@dhicking @laravelphp @LaravelLiveUK I just can't take this crap anymore. liamhammett.com/think-of-an-el… The reason people outside of PHP think PHP may be dead is: anytime they see a PHP dev post about PHP they start by debating if PHP is dead or not. This isn't helping, you're actively stopping devs from adopting PHP 😢

PHP IS DEAD /// LONG LIVE PHP Available at the @laravelphp booth at @LaravelLiveUK

Busy times: Here are my slides on Composer & Packagist Supply Chain Security from #PHPVerse: naderman.de/slippy/slides/… Thanks @jetbrains for a great online event! Videos soon! Follow blog.packagist.com for updates. #php #phpc #composerphp #supplychainsecurity

🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins. #php #phpc #composerphp

What if you could have 1,000 tools exposed from your MCP server? Sentry doesn't have a thousand, but now we give you a lot more out of the box, with no real degredation in usability or always-on context. cra.mr/a-bigger-toolb…

⚠️ Real PHP packages. Real attacks. Real consequences. @naderman is live in 5 mins at #PHPverse 2026 breaking down how supply chain attacks hit the PHP ecosystem – and everything Packagist has done to fight back. If you use #composerphp, this is required viewing 👉 bit.ly/4aEOWCv