Evidence Over Certificates: John Ellis on the Eclipse Trustable Software Framework

Generated code is arriving faster than maintainers can read it. RedMonk's Steve O'Grady discusses this new reality with Jason Brooks and Brian Proffitt, both managers in Red Hat's Open Source and AI Program Office. Proffitt's teams are adding what he calls human speed bumps upstream: PR templates that ask whether AI wrote the patch, and if so, what the prompt was. The point is transparency, not blocking the flow. Brooks argues for the importance of human decision makers because writing code may cost close to nothing now, but getting another person to accept it still costs plenty, and someone always pays the token bill. The conversation also touches on maintainer burnout, why saying "no" is still a legitimate answer to a pull request, Fedora Hummingbird and its agentically assembled packages, and the thing Proffitt worries about most: trust.This RedMonk video is sponsored by Red Hat.Show notes: https://redmonk.com/videos/brian-proffitt-jason-brooks/Chapters00:04 Introduction to AI and Open Source Governance00:32 Guest Introductions: Jason Brooks and Brian Proffitt02:10 AI's Ubiquity and Industry Impact03:06 Guardrails for AI Code Quality in Projects04:22 Implementing Human Speed Bumps for AI Contributions05:17 Encouraging Transparency in AI Contributions06:46 Automated Review and Guardrails in Open Source07:50 Verifying AI-Generated Code in Fedora09:10 Human Oversight in AI Processes13:39 Developer Burnout and Managing Contribution Floods16:09 Trust and Transparency in AI-Driven Ecosystems18:30 Evolving Policies for AI in Fedora20:16 Future Challenges and Community Trust in AI21:11 Closing Remarks and Future Outlook

In this conversation recorded at Fastly Xcelerate, James Governor talks with Jefferson Frazer, Director of AI at Shutterstock, about how a two-decade-old media company reinvented itself for the age of foundation models. Frazer explains how Shutterstock's long history of human-reviewed, meticulously labeled content left it uniquely positioned when hyperscalers began seeking diverse, web-scale datasets for multimodal training. Frazer digs into the technical backbone too: a 100-plus petabyte footprint, cloud-agnostic architecture built on Fastly's private fiber and Wasm-based edge compute, and the discipline of tracking data provenance through standards like C2PA and SynthID. Looking ahead, he makes the case that unified embedding spaces and portable metadata—not any single model provider—will define the next chapter of AI-ready content.This RedMonk video is sponsored by Fastly.Show notes: https://redmonk.com/videos/jefferson-frazer/Chapters00:00 Introduction to Shutterstock and AI04:14 Data Scale and Infrastructure07:25 Fastly's Role in Data Management10:28 The Future of AI and Business Models13:28 Regulation and Provenance in AI16:35 Excitement for Unified Embedding Spaces

Why does ChatGPT recommend one DevTool over another, and what can founders do about it? In this RedMonk Conversation, Kate Holterhoff sits down with Adam DuVander, Principal Consultant at EveryDeveloper and author of Developer Marketing Does Not Exist, to explore how AI assistants are transforming software discovery. They discuss Adam’s LLM Rank research, which tracks how models like ChatGPT, Claude, and Gemini recommend developer tools, and why those recommendations often differ. The conversation covers the practical steps DevTool companies can take to improve AI discoverability, from documentation and developer experience to use-case positioning and contextual content. Along the way, Kate and Adam examine the expanding definition of “developer,” the rise of AI-assisted builders, and why developer marketing is evolving rather than disappearing. Whether you’re building a developer product or rethinking your go-to-market strategy, this episode offers a practical framework for succeeding in an LLM-first world.Show notes: https://redmonk.com/videos/adam-duvander/Chapters00:00 Defining the Modern Developer04:25 The Role of Every Developer09:38 Marketing to the New Breed of Developers12:37 Understanding LLM Rank and AI in Development19:57 The Evolution of Documentation and Developer Experience22:06 Understanding Developer Context and Use Cases25:31 Navigating AI Recommendations for Developer Tools28:55 The Importance of Language and Phrasing in Queries31:50 The Long Game of SEO and LLM Rankings36:44 Addressing Outdated Documentation and Bad Advice42:20 The Distinction Between Discoverability and Developer Success47:51 The Future of Developer Marketing in an AI World

Most conversations about AI agents stay on what agents can do. Less attention goes to what they leave behind: logs, traces, and tool-call chains at a volume nobody's pipeline was built for. Nikhil Mungel, Head of AI R&D at Cribl, talks with Kate Holterhoff about why that is becoming observability's cost and noise problem. They discuss why token prices keep falling while total spend climbs, how employee spend differs from the tokens a product burns serving customers, credit-based versus outcome-based billing, why users always reach for the priciest model, and how the Open Cybersecurity Schema Framework (OCSF) standardizes what agents emit. Underneath all of it sits the question the industry keeps dodging, which is whether to keep scaling the backend or get stricter about what gets collected at all.This RedMonk conversation is sponsored by Cribl.Show notes: https://redmonk.com/videos/nikhil-mungel/Chapters00:25 Leading AI research and development at Cribl01:46 Token prices fell, token bills grew03:39 The research agent that thought all night06:54 More software, more agents, more telemetry09:37 Employee spend versus cost of goods sold12:05 Credits, outcomes, and other ways to bill for agents14:46 Shadow AI and the cloud governance rerun17:00 Writing policy: cost, access, and blast radius17:49 Local models and regulated industries18:40 What Cribl collects, plus Cribl Guard21:24 Token gateways as the enforcement point24:56 Model anxiety and automatic routing27:29 What OCSF is and why it caught on30:15 Observability as an information compression problem33:48 Zero data retention versus model safety35:45 Should agents know what they cost?36:35 Where to find Nikhil and Cribl's research

James Governor sits down with Jason Willeford, Global Lead for Secure Global Support at Red Hat, to dig into digital sovereignty and why it's become such a big deal for European enterprises. Jason explains Red Hat's Confirmed Sovereign Support, launched last year, which keeps EU customer data and the engineers handling it inside the EU. They cover what sovereignty actually means, why banks and telcos now care about it as much as public sector agencies do, and how AI complicates the picture when you don't know where a model was trained or what data it consumed on the way there. The conversation also touches on IBM's Sovereign Core, Project Lightwell, and RHEL for SAP.This RedMonk conversation is sponsored by Red Hat.Show notes: https://redmonk.com/videos/jason-willeford/Chapters00:00 Introduction to Digital Sovereignty02:26 Understanding Sovereignty: Definitions and Spectrum05:31 The Complexity of Sovereignty in Europe08:21 Data Sovereignty and Support Models11:28 AI Sovereignty and Its Implications14:15 Operational Sovereignty and Customer Engagement17:20 The Role of Red Hat in Sovereignty20:40 Sovereign Core and Global Expansion23:36 Mindset Shift Towards Sovereignty26:22 Engaging Developers and Enterprises on Sovereignty29:36 The Future of Sovereignty and Open Source

In this RedMonk conversation, Stephen O'Grady sits down with Boris Bialek, VP of Industries at MongoDB, and Raman Jatkar, Head of Product Management for Purple Fabric at Intellect Design, to examine where agentic AI and data platforms converge. The discussion makes the case that data, not models, determines enterprise outcomes. Raman reframes hallucination as a data architecture and sequencing problem, solved through deliberate ingestion, chunking, and retrieval strategies rather than model swaps. Boris stresses governance, lineage, guardrails, and the often-overlooked security risks of agent-to-agent interactions like open banking. Both argue that data and AI platforms should be treated as one interconnected capability, with governance built in rather than bolted on. The conversation closes on the renewed importance of operational, real-time data, what Boris calls OLTP returning to center stage, and keeping the human customer at the end of every workflow.This RedMonk conversation is sponsored by MongoDB.Show notes: https://redmonk.com/videos/boris-bialek-raman-jatkar/Chapters00:00 Introduction to the AI Agentic Era01:58 Understanding Purple Fabric and Its Tech Stacks05:52 Addressing Hallucinations in AI Models09:26 Governance and Compliance in AI Systems12:33 Challenges and Opportunities in Data and AI Integration

What does it mean to trust software? For this RedMonk Conversation, Kate Holterhoff sits down with John Ellis, President of Codethink and the contributor to the Eclipse Trustable Software Framework, to pull that question apart. Ellis leans on an old image: the bridge builders who once slept under their own bridges to prove the work was sound. Modern software rarely faces that kind of test, even when it steers a car or flies a plane. He explains where trust tends to break, especially the integration step where hidden dependencies finally show themselves, and points out that a safety certificate almost never uses the word "safe." Rather than pass-or-fail box-ticking, the framework asks teams to state their confidence and back it with evidence that others can inspect and challenge. They also dig into AI-written code, the EU Cyber Resilience Act, and why rising software recalls suggest current habits fall short.This RedMonk video is sponsored by the Eclipse Foundation.Show notes: https://redmonk.com/videos/john-ellis/Chapters00:04 Introduction to the Eclipse Trustable Software Framework02:57 Understanding Trust in Software05:59 The Integration Moment of Truth08:54 Challenges in Software Development Lifecycle11:25 The Role of the Eclipse Trustable Software Framework14:39 Managing Change in Software Development17:20 Versioning and Continuous Improvement20:01 Risk Analysis and Trustworthiness in Software24:39 Automating Testing and Confidence in Software25:23 Bridging the Gap with Regulators27:15 The Complexity of Software and Safety Standards29:18 Understanding Certification and Safety Claims31:12 The Need for a Shift in Mindset32:16 The Role of the Eclipse Trustable Software Framework34:18 Navigating the EU Cyber Resilience Act37:41 The Journey of Compliance and Awareness39:16 AI's Impact on Software Provenance43:34 Future Directions for the Eclipse Trustable Software Framework

In this MonkCast conversation, Rachel Stephens talks with Sehjung Hah, a product marketing engineer at Broadcom, about how VMware Cloud Foundation 9.1 is shifting private cloud operations from click-driven dashboards toward programmable, API-first workflows.Hah walks through the expanded VCF API surface that lets developers pull network details, vSphere diagnostics, and real-time infrastructure health in a self-service fashion. They also discuss a new fleet management capability that centralizes password rotation, certificate updates, and identity management across massive compute footprints.This RedMonk video is sponsored by VMware by Broadcom. Show notes: https://redmonk.com/videos/vcf9dot1-dashboards-to-apis-sehjung-hah/Chapters00:00 Intro00:30 Removing Developer Friction in Private Cloud02:44 Fleet Management for Platform Engineers04:23 From Dashboards to Telemetry-as-Code08:27 Killing Static Credentials and Shrinking the Blast Radius11:29 AI Workloads, Sovereignty, and Cost Visibility14:56 The 3 AM Scenario17:27 Putting It All Together

AI agents are writing code faster than anyone can build, test, and ship it. James Governor talks with Helen Altshuler, CEO and co-founder of EngFlow, about why the bottlenecks that once happened at Google scale are now showing up everywhere. Helen traces the story back to Google's 2008 push for five-minute builds, which produced Blaze and eventually Bazel, and explains why that system is finally having its moment a decade after it was open sourced. The numbers are hard to ignore: EngFlow's customers went from 250 million build actions a week to nearly 2 billion in a single year. Companies like Snowflake, Databricks, and Tinder are using Bazel, managed by EngFlow to keep up. James and Helen also dig into agent-ready documentation, why verification is increasingly automated or even ignored, and what happens once people stop using pull request workflows. We're about to hit a wall of AI created scale, and companies are going to fundamentally rethink architectures and approaches if the want to make it.This RedMonk video is sponsored by EngFlow.Show notes: https://redmonk.com/videos/helen-altshuler/Chapters00:04 Introduction and Context Setting01:25 Challenges of Build Management at Scale04:29 Google's Historical Perspective on Build Management07:15 The Impact of AI on Software Development10:19 Bazel's Role in Modern Development13:23 Community Growth and Open Source Collaboration16:36 Enhancing Developer Experience with AI19:22 Customer Insights and Scaling Challenges22:34 Bazel's Unique Advantages and Market Position25:21 Multi-Cloud Strategies and Infrastructure Flexibility29:36 Scaling Software Development with Data33:06 Investing in Developer Infrastructure36:37 Embracing GitHub and CI Challenges42:13 The Evolution of Code Review Practices47:11 The Future of Build Management at Scale

Open source has a new problem: you often can't tell whether the contributor on the other end is a person or an agent working on their behalf. In this RedMonk Conversation, Kate Holterhoff talks with Angie Byron, Senior Manager of Community and Advocacy at Temporal and lead of applied AI at Drupal, about AI's effects on open source communities. They discuss the issue of AI-generated slop on maintainers, the credit and trust systems AI breaks, and the policies projects are testing, from disclosure rules to outright bans. Angie also makes the case for the upside: tools that let product managers and marketers ship real code, security work that surfaces decades-old bugs, and a much lower bar for who gets to contribute. Underneath all of it sits a harder question about identity, and what happens to developers who built a career on the craft of writing code.Show notes: https://redmonk.com/videos/angie-byron/Chapters00:00 Introduction to Angie Byron and Temporal02:47 AI's Impact on Open Source Communities05:57 Trust and Contribution in Drupal08:40 Navigating AI in Open Source Contributions11:40 Demographic Shifts in Open Source Contributions14:30 The Role of AI in Contributor Onboarding17:29 The Future of Open Source with AI20:30 Challenges and Opportunities in AI Contributions23:49 Conclusion and Future Outlook27:46 Navigating AI in Code Review29:22 Challenges of Incentivization in Open Source Contributions30:14 The Bug Bounty Dilemma31:08 AI's Role in Security Vulnerability Detection32:30 Onboarding and Community Engagement in Open Source35:09 The Impact of AI on Content Management Systems38:40 AI Integration in Drupal and CMSs41:21 The Future of CMS in an AI-Driven World45:02 Call to Action for Open Source Collaboration