Vlad Miricioiu on the Software Stewardship Lab: Binary Dependencies, Burnout, & the Bernies

Recorded live at IBM TechXchange 2026 in Atlanta, RedMonk's Kate Holterhoff talks with Rich Larin, Director of Z DevX & Platform Engineering at IBM, about bringing modern, AI-powered tools to mainframe developers. Rich explains why mainframes still power credit card transactions and airline reservations, and how Bob and the Premium Package for Z help teams understand, modernize and extend COBOL applications using the same agentic IDE other developers use. They discuss deployment options, including SaaS, hybrid and air-gapped on-prem, for customers protecting source code. Rich also covers Z code scan, a deterministic security check that Bob can remediate automatically, and a data dictionary that captures experts' knowledge and shortens onboarding from years to months. He closes with advice to try a proof of concept and a hint at upcoming releases. The conversation also touches on token spend, developer skills, and making mainframe careers attractive to the next generation of developers.This RedMonk video is sponsored by IBM.Show notes: https://redmonk.com/videos/rich-larin/Chapters0:00 Intro: Rich Larin and IBM Z software0:55 Why mainframes still power the global economy1:55 AI and the z17: modernizing decades-old applications3:12 Why customers still love COBOL4:23 Breaking down the mainframe silo5:10 Bob inside the same IDE for Z developers6:23 SaaS, hybrid and air-gapped on-prem AI options8:35 Shifting security left with Z code scan9:56 Closing the skills gap with the data dictionary12:03 Attracting the next generation of mainframers12:55 What's coming next

Recorded at IBM TechXchange 2026 in Atlanta, RedMonk's Kate Holterhoff chats with Markus Eisele, AI Developer Strategist at IBM, about the keynote announcements around Bob 2.0. They discuss Bob Desktop, which extends the tool beyond developers to information workers, and the Bob Bazaar, a vetted marketplace for sharing skills, plugins and connections without the risk of installing random MCP servers. Markus explains the new DevSecOps premium package, a security assistant that helps developers shift security left, and why on-prem deployment matters for regulated environments. They also discuss why Bob has no model picker, how that reduces cognitive load and cost, and how the same harness powers the IDE, desktop and Bob Shell. Markus shares how he uses the CLI for automation in GitHub Actions and containers, and why asking Bob about Bob is an underrated feature.This RedMonk video is sponsored by IBM.Show notes: https://redmonk.com/videos/markus-eisele/Chapters0:00 Welcome to TechXchange 20260:22 Bob's glow-up: first reactions to the keynote0:49 Bob Desktop: from developer tool to every role1:32 Bob Bazaar: shareable skills, plugins and connections3:17 Vetted skills and avoiding risky MCP servers4:10 Bob DevSecOps: shifting security left5:32 Do developers actually care about security?7:01 Supply chain risks and invisible vulnerabilities8:23 Running Bob on-prem for regulated environments10:33 Why Bob has no model picker13:32 Model choice as the new cognitive load13:57 CLI vs. IDE vs. desktop: three surfaces, one harness18:17 Moving sessions between shell and IDE18:39 What else sets Bob 2.0 apart19:33 Asking Bob questions about Bob20:37 Wrap-up and thanks

Recorded live at Cloudflare Connect 2026 in San Francisco, RedMonk’s Kate Holterhoff and James Governor sit down with Rita Kozlov, Cloudflare’s VP of Developers and AI, as Workers turns ten. Rita traces how the platform began, from custom edge code written for enterprise customers to a sandboxed runtime built on isolates with no cold starts. She also explains how Cloudflare decides which primitives to build without simply rebuilding AWS. The conversation then turns to the agentic internet. Agents now generate more than half of web traffic, so what changes for identity, content compensation, payments, and discoverability through AEO? Rita also covers the acquisitions of Astro, Deno, and VoidZero, and Cloudflare’s responsibility as an open source steward. Other topics include Cloudflare’s first models, the vinext “slop fork” of Next.js, the future of Durable Objects and self-hosting, why Git and CI/CD are straining under agent-driven velocity, and why Cloudflare is the real neocloud.This RedMonk video is sponsored by Cloudflare.Show notes: https://redmonk.com/videos/rita-kozlov/Chapters1:12 Workers turns ten and Rita’s background3:44 How Workers was born: the 10-year overnight success7:03 Isolates, sandboxes, and choosing primitives10:16 AWS, Vercel, and the rivalry question12:39 Never say never: the free tier, R2, and entering new markets16:19 The agentic internet: agents now outnumber humans22:23 Agent identity and delegation24:40 Who pays? Content creators, compensation, and AEO30:35 “Where are my Workers?” Agent-first developer experience32:37 Acquiring Astro, Deno, and VoidZero35:16 Favorite launch: Cloudflare’s first models38:00 The vinext “slop fork” of Next.js41:05 Connect sessions and the Lovable demo45:00 The future of Durable Objects and self-hosting48:22 Git, CI/CD, and Artifacts for agents53:27 Call to action: how is your cloud serving you?55:10 Neoclouds and wrap-up

On this RedMonk conversation, Vlad Miricioiu, Director of the Software Stewardship Lab, chats with Kate Holterhoff about improving open source sustainability, security, and supporting maintainers through innovative funding models. In addition to sharing the Software Stewardship Lab's mission, Miricioiu discusses supply chain issues, mental health challenges, and the importance of open collaboration.Show notes: https://redmonk.com/videos/vlad-miricioiu/Chapters00:04 Introduction to Open Source Stewardship02:59 The Open Source Pledge and Its Impact06:04 The Mission of the Software Stewardship Lab08:53 Funding Models for Open Source Maintainers12:00 Challenges Faced by Open Source Maintainers14:57 The Role of Companies in Supporting Open Source17:37 Security in Open Source Software20:32 The Future of Open Source Collaboration24:34 Navigating Conflicts of Interest in Open Source29:25 The Role of Funding and Grants in Open Source35:17 AI and Burnout: The Impact on Open Source Maintainers40:07 Understanding 'Bernies': The Challenge of Unmaintained Projects45:07 Building Partnerships for Open Source Sustainability

In this episode of the MonkCast, James Governor sits down with Sanjay Sarathy, SVP of Developer Experience at Cloudinary, to discuss developer trust, and why it still matters in the agentic software development era. With more than four million developers signed up, and 40% of new registrations now coming from agents, Cloudinary is rethinking what trust means, but maintaining true to its core values. Sanjay walks through the principles guiding that work: products that work as promised every time, human support that scales, accuracy in AI-assisted answers, transparency, long-term API stability, keeping the developer voice in the product loop, and investing in education for students and early-career developers.The RedMonk video is sponsored by Cloudinary.Show notes: https://redmonk.com/videos/sanjay-sarathy/Chapters00:07 Introduction to trust in developer platforms00:51 Why trust is crucial in a rapidly changing environment02:05 Cloudinary's longstanding focus on trust04:50 Principle 1: Consistency in product performance08:40 Scaling support for millions of developers12:58 Ensuring AI-assisted accuracy and trust17:40 Transparency as a trust foundation21:02 Long-term API commitment and stability24:42 Listening to the developer voice28:58 Supporting developer education and growth34:18 Summary and closing thoughts

In this RedMonk Conversation, Anne Bertucio de Hollembeak, COO of ROOST (Robust Open Online Safety Tools) , chats with Kate Holterhoff about the importance of open source tools in trust and safety, especially in the age of AI. She shares insights on building safety tools, the role of open source, and how these efforts can create a safer online environment for everyone.Show notes: https://redmonk.com/videos/anne-bertucio-de-hollembeak/Chapters00:04 Introduction to Roost and Ambertuccio's Background02:53 Understanding Trust and Safety in Online Spaces05:44 The Role of Open Source in Trust and Safety08:43 Child Safety Tools and Their Impact11:29 Mila's Suicide Prevention Guardrail Project14:21 AI Contributions and Community Engagement17:20 Maintainer Burnout and AI Slop Management26:13 Introduction to Bug Bounty and Security Processes26:57 Understanding Osprey: The Tool for Safety and Investigation28:18 The Story Behind Osprey and Its Origins30:22 Roost: A Nonprofit Approach to Open Source Safety32:04 Partnerships and Collaborations in the Safety Space33:46 Blue Sky: A Case Study in Collaboration35:21 Challenges in Decentralized Safety Solutions37:14 Addressing the Bot Issue and AI Challenges43:47 Open Source Policies and Their Implications45:49 Conclusion and Resources for Further Engagement

Why do some teams see massive speedups from AI coding agents while others barely notice a difference? In this RedMonk New Builders Conversation with AWS, Kate Holterhoff talks with Liam Greenamyre, Principal PM of Developer Platforms at AWS, about the uneven impact of AI on software development and how to restructure work so agents can succeed. Liam explains why making tasks verifiable is the single biggest lever, then walks through the Agent Toolkit for AWS: a remote MCP server, 100+ skills, plugins, and a rules file that work with Claude Code, Codex, Kiro, and more. They dig into how a single RunScript tool covers 15,000+ AWS APIs token-efficiently, how IAM context keys separate human and agent actions, how agents discover new services like Aurora DSQL, and why isolated dev accounts make safe sandboxes for autonomous agents. Liam closes with a bold prediction: the biggest changes ahead are organizational, not technological.This New Builders conversation is sponsored by AWS.Show notes: https://redmonk.com/videos/liam-greenamyre/Chapters00:04 Introduction to AI in Software Development03:07 The Uneven Adoption of AI in Development Teams06:20 Strategies for Successful AI Integration10:09 Exploring the AWS Agent Toolkit17:01 Guardrails and Context for AI Agents20:10 The Impact of AI on FinOps and Cost Management24:28 Evolution of Agent Tooling32:17 Enhancing Discoverability in AWS35:56 Guardrails and Safety in AWS Operations41:03 Future of AI in Software Development

Most of an enterprise application stack is open source that nobody is paid to maintain. Gunnar Hellekson of Red Hat puts it at 60 to 70 percent, and that gap is what IBM's Lightwell is built for. He walks James Governor through the mechanics: members scan and triage their own dependencies, submit what they find with the source identity stripped out, and get fixes back after an embargo period before those fixes reach a wider network and, where a maintainer still exists, the upstream project. Financial services goes first. Hellekson is candid that plenty of customers cannot use the service yet, because joining would only lengthen a patch backlog already measured in months. Mythos, the two agree, mostly revealed how bad things already were. They also work through token economics, why nobody needs to scan OpenSSL separately, and why a fix should end up as deterministic code rather than something an AI keeps rediscovering.Red Hat is a RedMonk client, but this is free and independent content.Show notes: https://redmonk.com/videos/gunnar-hellekson/Chapters00:00 Introduction: IBM's big bet on open source security03:18 A win-win for customers and the open source community05:27 The problem: 60–70% of the stack is unsupported open source07:15 Carry your own fork or hope upstream fixes it09:17 Eat your vegetables first: hardened images and paid platforms09:45 How Lightwell works11:57 Scope: application dependencies12:57 Network effects, industry clearinghouses, and identity washing14:34 When to move off orphaned projects16:04 Mythos showed how bad things already were19:51 Delivery via Maven, PyPI, and npm20:33 Attackers vs. defenders at machine speed21:44 Why fixes should be deterministic code, not endless AI23:06 Token economics and shared remediation24:05 Nobody needs to scan OpenSSL separately25:08 Will every enterprise build its own software?27:38 Wrap-up

In this RedMonk conversation, Pankaj Gupta, Senior Director of Product Marketing, VCF Division, at Broadcom, chats Platform Engineering in the AI era with Stephen O'Grady. Gupta explains that more than 90% of organizations run an internal platform, but despite widespread adoption, Gupta thinks most platforms are hitting two ceilings. They were built, in his phrase, "AI blind," and they were built for exactly one user, the developer. AI has already moved the bottleneck from writing code to getting it into production, and the user base is about to change shape.  Also in this episode: when golden paths harden into golden cages, why FinOps and security can no longer be bolted on, and Gupta's five pillars for platform engineering 2.0.The RedMonk conversation is sponsored by Broadcom.Show notes: https://redmonk.com/videos/pankaj-gupta/Chapters00:04 Introduction to Sponsorships00:08 Introduction to Platform Engineering02:52 Current State and Challenges of Platform Engineering05:47 The Evolution of Platform Engineering08:33 AI's Impact on Platform Engineering11:23 The Rise of Agent Personas14:52 Five Pillars of Modern Platform Engineering17:47 Next Steps for Platform Engineers

In this episode, David Pollak, founder and CEO of Spice Labs, and Allan Friedman, Senior Technical Advisor at the Institute for Security and Technology, discuss the importance of software supply chain security, bills of materials, and the emerging field of post-quantum cryptography with Kate Holterhoff. Friedman, "the godfather of SBOMs," gives a state of play for 2026: where the tooling has matured, where it still falls short, and why the Cyber Resilience Act is about to make this everybody's problem. From there the conversation moves to CBOMs and post-quantum cryptography. Pollak argues PQC stopped being a 2035 problem in June, when the White House, the US military and French standards bodies all pulled their deadlines forward by five years. Also covered: whether developers should have to think about security at all, what the IPv6 transition taught us, and the 360,000 Maven packages carrying vulnerable code nobody disclosed. This RedMonk conversation is sponsored by Spice Labs.Show notes: https://redmonk.com/videos/david-pollak-allan-friedman/Chapters00:04 Introduction to the Guests and Topics06:29 The State of SBOMs in 202613:46 Understanding Cryptographic Bills of Materials22:12 The Intersection of Security and Development31:25 The CBOM Approach and Its Importance33:23 Post-Quantum Cryptography: A Future Concern?38:55 Navigating Regulations and Compliance43:57 Finding vs. Fixing Vulnerabilities in Open Source49:58 AI's Role in Security and Vulnerability Management53:31 Lessons from IPv6 and Cryptography Libraries