Creating Monsters

The speaker, who leads security testing at a company and maintains the ffuf web fuzzer, starts by contrasting offensive tooling that often breaks with the stable, predictable software he wanted. The project began when an existing tool's maintainers asked contributors to pause during a large refactor, so the feature he needed was built independently. Early growth came from conference talks and social media, and the design choices were shaped by open discussion with a growing community.

The middle of the talk looks at the less pleasant side of maintenance. Clear bug reports, documentation and tutorials help the project, while vague reports, repeated basic questions and entitlement consume time. Rejecting well-meant pull requests that clash with the tool's vision is described as the hardest part, although one persistent contributor changed his mind about automatic CSRF token handling. He also raises the tool's misuse in a government report about attacks on Ukrainian targets, which he says raises ethical questions he cannot answer neatly.

Finally, he notes that open-source maintenance rarely pays a living, with sponsorship income small and a one-year sponsorship from a training provider a notable exception. His takeaways are to hold a shared vision, communicate it openly, stay objective toward contributors, be kind, and maintain projects out of passion rather than for money.