Patrick Smyth

Patrick Smyth is a principal developer relations engineer at Chainguard, where he works on AI and software supply chain security. He previously founded Iota, a consultancy focused on accessible technical training and infrastructure. His career spans digital humanities, research computing, accessibility, and the security of the tools developers build on.

From digital humanities to research computing

At CUNY’s Graduate Center, Smyth worked on DH Box, a cloud-based digital humanities laboratory, and designed curriculum for the Digital Humanities Research Institute. He subsequently joined Columbia University’s Foundations for Research Computing, working there from January 2019 to August 2021. He managed a team that delivered more than 85 technical workshops for over 3,000 researchers, with programming ranging from Unix and Python fundamentals to natural-language processing and machine learning. These roles combined software development with teaching researchers how to use computational methods in their own work. His CV traces that progression.

His 2018 guide to building web APIs with Python and Flask makes his teaching approach concrete. It takes humanities researchers from a basic web application to a database-backed API, explaining how predictable requests, working examples, and documentation help other people use the data. It also addresses what happens after publication: changing an API’s URLs can break applications built on it, so versioning and continued support belong in the design.

Smyth earned his PhD in English at CUNY’s Graduate Center in 2021. His dissertation, Negotiated Access: Haccessibility, Autonomy, and Infrastructure in the Age of the Abstraction, asks how people exercise autonomy within systems they cannot control. Drawing on digital humanities, disability studies, and science and technology studies, it develops haccessibility: individual workarounds, tools, and practices that let people navigate inaccessible physical and social structures.

Making scientific tools usable

Smyth founded Iota after his work at Columbia. Through the consultancy, he worked with Space Telescope Science Institute, pandas, and Sigstore, extending his teaching and accessibility work into scientific infrastructure and open-source documentation. He helped improve web-based notebook exports for astronomy researchers and replatformed Sigstore’s documentation as a Google Season of Docs technical writer. His Iota consulting work ran from August 2021 to March 2025, overlapping with his move to Chainguard.

The Astronomy Notebooks for All initiative paired work on accessible HTML outputs from Jupyter Notebooks with accessibility training for researchers, administrators, and technologists. Iota’s announced collaboration included Space Telescope Science Institute, Quansight Labs, and Project Jupyter. Its scope addressed both the software researchers publish and the practices surrounding it.

Iota’s 2024 nonvisual data science workshop series, supported by pandas and NumFOCUS, taught a working method that did not depend on charts or graphical notebooks. Participants used the NVDA screen reader and IPython to explore and prepare data with pandas, then used Astronify to represent data through sound. The curriculum attended to details that conventional introductions can overlook, such as limiting query output so screen-reader users are not overwhelmed by a large table.

Smyth also maintained Eloud, a lightweight screen reader for Emacs. It uses speech synthesis to read characters, words, lines, and sentences as the user navigates. Users can switch speech on when needed; the project explicitly distinguishes that lightweight approach from the broader coverage of Emacspeak.

Security defaults and meaningful vulnerability reports

Smyth joined Chainguard as a staff developer relations engineer in March 2024 and became a principal developer relations engineer in October 2025. His work there includes technical education, tutorials, deep dives, and customer work. His writing examines the infrastructure beneath AI applications: model files, dependencies, containers, and the paths software artifacts take into production.

• Build security into ML infrastructure. In his analysis of the ML infrastructure maturity gap, Smyth argues that protections familiar elsewhere in software engineering have not become routine defaults in machine-learning tools. He advocates safer model serialization, artifact signing and verification, tighter dependency management, and smaller container images. The distinction is practical: individual teams can adopt these defenses, but infrastructure providers can make them part of the ordinary path to deployment.

• Distinguish delayed fixes from unaffected software. With Adrian Mouat, Smyth examines how distribution release schedules and vulnerability metadata shape container scan results. Their analysis of upstream distributions and hidden CVEs challenges the treatment of Debian’s decision not to prioritize an immediate security update as evidence that a downstream image is unaffected. Their argument is that a clean scan should reflect the software’s condition, rather than hide an outstanding vulnerability through its advisory metadata.

Giving agents a desktop interface

Smyth’s Tine project applies accessibility infrastructure to AI computer use. The alpha-stage command-line tool connects agents to a GNOME Wayland desktop, combining structured accessibility-tree information with screenshots and optional optical character recognition. When an application exposes its interface through accessibility APIs, an agent can inspect named elements and act on them; when that structure is sparse, labeled screenshot grids and recognized text provide alternatives.

Tine supplies keyboard and mouse input through Linux’s input subsystem. It requires configured input access and a GNOME Shell extension for screenshots and window management, allowing agent workflows to operate without repeated Wayland portal consent dialogs. Its current scope is Linux with GNOME on Wayland, and its interface may change before a stable release.