Hi, I'm Andrew! 👋

I am a Principal Engineer at MITRE, where I work on a few different things:

• ⚠️ Contribute to CVE, the world's largest system for tracking vulnerabilities in software and hardware — including authn/authz improvements, Package URL (pURL) support in CVE Records, and the Quality Working Group.
• 🔍 Lead the development of Hipcheck, a tool for automated supply chain risk assessment of software repositories.
• 🖇️ Previously served on the OmniBOR (formerly GitBOM) Core Team, including leading creation of the Rust library and CLI.

Sometimes I Write

• 🛡️ Wrote "Memory Safety for Skeptics," published in ACM Queue and Communications of the ACM.
• 📝 Wrote "Open Source Software and Corporate Influence," on how corporations gain power in open source projects and how to build resilience to it.
• 🗒️ Write on my personal blog about memory safety, Rust, open source, software supply chain security, and AI/agentic tooling.
• 🦀 Write at Possible Rust with intermediate-level articles teaching what's possible in the Rust programming language.

Slightly Less Big Things

• 🗨️ Keep a list of languages written in Rust.
• ⁉️ Maintain woah, a Result type that separates errors you can handle from errors you can't.
• 🏷️ Maintain semver-explain, a CLI tool for explaining SemVer requirements.
• 🛑 Maintain replace_err, which adds a replace_err method for Result.
• 🏗️ Maintain pathbuf, a convenient macro for building PathBufs.
• 🪄 Created FindCargo.cmake, a CMake module for interoperating with Cargo.
• ⏲️ Wrote dcalc, a CLI duration calculator.
• 🐱 Wrote good-cat, a cat that hates pipes.
• 📎 Wrote gccarch, a tool for getting info on GCC's supported architectures.
• 📆 Wrote skej, a little analyzer for concurrent schedules.

Past Projects

• ⛓️ Built the first FFI interface for Pact, a framework for testing APIs.
• 🖋️ Wrote the old Rust FAQ.
• 👨‍🏫 Taught programming language theory to undergrads.
• 🎒 Spoke at RustConf 2017 about teaching Rust in a programming language theory class.
• 📖 Spoke at Rust Belt Rust 2016 about how to write good documentation.
• 🎤 Spoke on a panel at VulnCon 2025 about software identification in CVE.
• 🪲 Spoke about how memory safety will impact vulnerabilities at the Cal Poly Pomona SWIFT Tech Symposium 2025.