#557: Security of everything at PyCon 2026
Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.
On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.
We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.
Episode sponsors
Sentry Error Monitoring, Code talkpython26
Talk Python Courses
Links from the show
Guests
Juanita Gomez: linkedin.com
Mike Fiedler: miketheman.dev
Seth Michael Larson: sethmlarson.dev
Trailblazing Python Security: us.pycon.org
Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com
Dependency Cooldowns: cooldowns.dev
Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com
FedRAMP: www.gsa.gov
Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com
Rust for CPython project: blog.python.org
pre-PEP: discuss.python.org
Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com
SBOMit: github.com
Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com
Volatility: volatilityfoundation.org
Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com
zizmor: docs.zizmor.sh
GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io
andrew/pycon: data & analysis for the GitHub Actions security talk: github.com
GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com
gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com
PyCon US YouTube channel: www.youtube.com
SBOMit: adding verification to SBOMs (OpenSSF): openssf.org
Ecosystems: ecosyste.ms
Watch this episode on YouTube: youtube.com
Episode #557 deep-dive: talkpython.fm/557
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @talkpython@fosstodon.org
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @mkennedy@fosstodon.org
Michael on X.com: @mkennedy
Improving Python Through PEPs and Protocols
<p>Have you ever been confused by the naming of modules you’re importing from a package? Is there a standard way to organize and name your Python virtual environments? This week on the show, Brett Cannon returns to discuss the Python Enhancement Proposals (PEPs) he’s been working on recently.</p>
<p>We start with PEP 794, which extends the metadata fields for Python packages to specify the import names a project provides. The metadata will help developers identify the correct project to install when they know the import name or the importable module names a project provides once installed.</p>
<p>We dive back into WebAssembly to discuss PEP 816, which specifies the WASI support in CPython releases. We also wade into the controversy around PEP 832, which proposes standards around naming and the discovery of virtual environments.</p>
<p>Brett shares his motivation for being a prolific author and supporter of PEPs. We discuss his promotion of standards and protocols to simplify the Python ecosystem for current and future developers.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/tapping-into-the-zen-of-python/">Tapping Into the Zen of Python</a></p>
<p>Explore the Zen of Python and its 19 guiding principles for writing readable, practical code. Learn its history, jokes, and meaning.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:01 – Prolific PEP creation</li>
<li>00:03:37 – Improving the future of Python through standards</li>
<li>00:09:30 – PEP 794 - Import Name Metadata</li>
<li>00:30:12 – PEP 816 - WASI (WebAssembly System Interface) Support</li>
<li>00:40:55 – Why the interest in WASI?</li>
<li>00:45:23 – Video Course Spotlight</li>
<li>00:47:07 – PEP 832 - Virtual Environment Discovery</li>
<li>01:10:02 – Type Server Protocol</li>
<li>01:17:41 – How can people follow your work online?</li>
<li>01:19:12 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/">Tall, Snarky Canadian</a></li>
<li><a href="https://peps.python.org/pep-0794/">PEP 794 – Import Name Metadata</a></li>
<li><a href="https://jcgoran.github.io/2025/11/18/python-import-names.html">Towards fixing Python project names and import modules - Goran et al.</a></li>
<li><a href="https://peps.python.org/pep-0816/">PEP 816 – WASI Support</a></li>
<li><a href="https://snarky.ca/state-of-wasi-support-for-cpython-march-2026/">State of WASI support for CPython: March 2026</a></li>
<li><a href="https://peps.python.org/pep-0011/">PEP 11 – CPython platform support</a></li>
<li><a href="https://www.infoworld.com/article/4150052/how-python-is-getting-serious-about-wasm.html">PEP 816: How Python is getting serious about WASM - InfoWorld</a></li>
<li><a href="https://peps.python.org/pep-0832/">PEP 832 – Virtual environment discovery</a></li>
<li><a href="https://discuss.python.org/t/pep-832-virtual-environment-discovery/106998/51">Discussions on Python.org - PEP 832: virtual environment discovery</a></li>
<li><a href="https://github.com/microsoft/pylance-release/discussions/7180">Type Server Protocol = Abstract out type information</a></li>
<li><a href="https://github.com/microsoft/pylance-release/blob/main/docs/tsp/type-server-protocol.md">type-server-protocol.md - GitHub - microsoft/pylance-release</a></li>
<li><a href="https://opensource.snarky.ca/About+Me/Frequently+Asked+Questions">Frequently Asked Questions - Open Source by Brett Cannon</a></li>
<li><a href="https://mastodon.social/@brettcannon">Brett Cannon - mastodon.social</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/uv-vs-pip-packaging-dependency-management/">uv vs pip: Python Packaging and Dependency Management</a></li>
<li><a href="https://realpython.com/courses/tapping-into-the-zen-of-python/">Tapping Into the Zen of Python</a></li>
<li><a href="https://realpython.com/courses/writing-beautiful-python-code-pep-8/">Writing Beautiful Pythonic Code With PEP 8</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
#539: Catching up with the Python Typing Council
You're adding type hints to your Python code, your editor is happy, autocomplete is working great. But then you switch tools and suddenly there are red squiggles everywhere. Who decides what a float annotation actually means? Or whether passing None where an int is expected should be an error? It turns out there's a five-person council dedicated to exactly these questions -- and two brand-new Rust-based type checkers are raising the bar. On this episode, I sit down with three members of the Python Typing Council -- Jelle Zijlstra, Rebecca Chen, and Carl Meyer -- to learn how the type system is governed, where the spec and the type checkers agree and disagree, and get the council's official advice on how much typing is just enough.
Episode sponsors
Sentry Error Monitoring, Code talkpython26
Agentic AI Course
Talk Python Courses
Links from the show
Guests
Carl Meyer: github.com
Jelle Zijlstra: jellezijlstra.github.io
Rebecca Chen: github.com
Typing Council: github.com
typing.python.org: typing.python.org
details here: github.com
ty: docs.astral.sh
pyrefly: pyrefly.org
conformance test suite project: github.com
typeshed: github.com
Stub files: mypy.readthedocs.io
Pydantic: pydantic.dev
Beartype: github.com
TOAD AI: github.com
PEP 747 – Annotating Type Forms: peps.python.org
PEP 724 – Stricter Type Guards: peps.python.org
Python Typing Repo (PRs and Issues): github.com
Watch this episode on YouTube: youtube.com
Episode #539 deep-dive: talkpython.fm/539
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @talkpython@fosstodon.org
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @mkennedy@fosstodon.org
Michael on X.com: @mkennedy
Han shot first (Friends)
Our ol’ friend, Brett Cannon, is back to talk all things Python. But first! Star Wars, Machete Order, Lost, Babylon 5, Game of Thrones, Murderbot, Ted Lasso, Project Hail Mary, David Attenborough, perpetual voice rights, and the AI uncanny valley.
Join the discussion
Changelog++ members save 4 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Namespace – Speed up your development and testing workflows using your existing tools. (Much) faster GitHub actions, Docker builds, and more. At an unbeatable price.
Tiger Data – Postgres for Developers, devices, and agents The data platform trusted by hundreds of thousands from IoT to Web3 to AI and more.
Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes.
Featuring:
Brett Cannon – Website, GitHub, LinkedIn, Bluesky, Mastodon
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
What is the Star Wars Machete Order?
Pep 665 (lock file format)
python-build-standalone
Astral: high-performance Python tooling
Pypi: Page Not Found
Incus documentation
Python/prebuilt-cpython
Something missing or broken? PRs welcome!
Python 3.14 with Łukasz Langa
Python 3.14 is here and continues Python’s evolution toward greater performance, scalability, and usability. The new release formally supports free-threaded, no-GIL mode, introduces template string literals, and implements deferred evaluation of type annotations. It also includes new debugging and profiling tools, along with many other features.
Łukasz Langa is the CPython Developer in Residence at the Python Software Foundation, and he joins Sean Falconer to discuss the 3.14 release, the future of free threading, type system improvements, Python’s growing role in AI, and how the language continues to evolve while maintaining its commitment to backward compatibility.
Sean’s been an academic, startup founder, and Googler. He has published works covering a wide range of topics from AI to quantum computing. Currently, Sean is an AI Entrepreneur in Residence at Confluent where he works on AI strategy and thought leadership. You can connect with Sean on LinkedIn.
Please click here to see the transcript of this episode.
Sponsorship inquiries: sponsor@softwareengineeringdaily.com
The post Python 3.14 with Łukasz Langa appeared first on Software Engineering Daily.
#532: 2025 Python Year in Review
Python in 2025 is in a delightfully refreshing place: the GIL's days are numbered, packaging is getting sharper tools, and the type checkers are multiplying like gremlins snacking after midnight. On this episode, we have an amazing panel to give us a range of perspectives on what matter in 2025 in Python. We have Barry Warsaw, Brett Cannon, Gregory Kapfhammer, Jodie Burchell, Reuven Lerner, and Thomas Wouters on to give us their thoughts.
Episode sponsors
Seer: AI Debugging, Code talkpython26
Talk Python Courses
Links from the show
Python Software Foundation (PSF): www.python.org
PEP 810: Explicit lazy imports: peps.python.org
PEP 779: Free-threaded Python is officially supported: peps.python.org
PEP 723: Inline script metadata: peps.python.org
PyCharm: www.jetbrains.com
JetBrains: www.jetbrains.com
Visual Studio Code: code.visualstudio.com
pandas: pandas.pydata.org
PydanticAI: ai.pydantic.dev
OpenAI API docs: platform.openai.com
uv: docs.astral.sh
Hatch: github.com
PDM: pdm-project.org
Poetry: python-poetry.org
Project Jupyter: jupyter.org
JupyterLite: jupyterlite.readthedocs.io
PEP 690: Lazy Imports: peps.python.org
PyTorch: pytorch.org
Python concurrent.futures: docs.python.org
Python Package Index (PyPI): pypi.org
EuroPython: tickets.europython.eu
TensorFlow: www.tensorflow.org
Keras: keras.io
PyCon US: us.pycon.org
NumFOCUS: numfocus.org
Python discussion forum (discuss.python.org): discuss.python.org
Language Server Protocol: microsoft.github.io
mypy: mypy-lang.org
Pyright: github.com
Pylance: marketplace.visualstudio.com
Pyrefly: github.com
ty: github.com
Zuban: docs.zubanls.com
Jedi: jedi.readthedocs.io
GitHub: github.com
PyOhio: www.pyohio.org
Watch this episode on YouTube: youtube.com
Episode #532 deep-dive: talkpython.fm/532
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @talkpython@fosstodon.org
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @mkennedy@fosstodon.org
Michael on X.com: @mkennedy
Supporting the Python Package Index
<p>What goes into supporting more than 650,000 projects and nearly a million users of the Python Package Index? This week on the show, we speak with Maria Ashna about her first year as the inaugural PyPI Support Specialist.</p>
<p>Maria has a varied background in creative arts and neuroscience. She decided to apply for the PyPI support position, defying common misconceptions about who can take on roles inside the Python Software Foundation, and challenging imposter syndrome along the way. </p>
<p>Her recent talks at PyCon US 2025 and EuroPython 2025 were about her experiences in the role. She describes tackling the backlogs of account recovery and PEP 541 requests, and we also discuss PyPI community and company organizations.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></p>
<p>In this video course, you’ll learn how to create a Python package for your project and how to publish it to PyPI, the Python Package Index. Quickly get up to speed on everything from naming your package to configuring it using <code>setup.cfg</code>.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:42 – What led you to learn Python?</li>
<li>00:08:09 – PyCon 2025 talk about the first year at PyPI</li>
<li>00:11:06 – Embracing asking questions</li>
<li>00:13:55 – Being willing to say “I don’t know, let’s find out”</li>
<li>00:15:06 – What is PEP 541 and resolving name retention issues</li>
<li>00:23:22 – Video Course Spotlight</li>
<li>00:24:40 – Addressing the account recovery backlog</li>
<li>00:26:43 – PyPI Organizations</li>
<li>00:30:54 – Moving beyond the hesitancy to submit a package to PyPI</li>
<li>00:40:43 – Getting past imposter syndrome and applying</li>
<li>00:45:07 – What are you excited about in the world of Python?</li>
<li>00:46:10 – What do you want to learn next?</li>
<li>00:47:52 – How can people follow your work online?</li>
<li>00:49:03 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://www.youtube.com/watch?v=f6CEURXBa_M">Adventures in Account Recovery, PEP 541 & More As Inaugural PyPI Support Specialist - Maria Ashna - YouTube</a></li>
<li><a href="https://us.pycon.org/2025/schedule/presentation/165/">PyCon US 2025 - A PEP Talk: Adventures in Account Recovery, PEP 541, And More As the Inaugural PyPI Support Specialist</a></li>
<li><a href="https://ep2025.europython.eu/">EuroPython 2025 - July 14th-20th 2025 - Prague, Czech Republic & Remote</a></li>
<li><a href="https://pypi.org/">PyPI - The Python Package Index</a></li>
<li><a href="https://peps.python.org/pep-0541/">PEP 541 – Package Index Name Retention</a></li>
<li><a href="https://blog.pypi.org/posts/2023-04-23-introducing-pypi-organizations/">Introducing PyPI Organizations - The Python Package Index Blog</a></li>
<li><a href="https://packaging.python.org/en/latest/tutorials/packaging-projects/">Packaging Python Projects - Python Packaging User Guide</a></li>
<li><a href="https://www.thetravelingguitar.net/">The Traveling Guitar</a></li>
<li><a href="https://www.instagram.com/thespi_brain/">Maria Ashna (@thespi_brain) - Instagram</a></li>
<li><a href="https://github.com/thespi-brain">Thespi-Brain (thespibrain) - GitHub</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/python-sphinx/">Documenting Python Projects With Sphinx and Read the Docs</a></li>
<li><a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></li>
<li><a href="https://realpython.com/courses/closures-examples-use-cases/">Exploring Python Closures: Examples and Use Cases</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Going Beyond requirements.txt With pylock.toml and PEP 751
<p>What is the best way to record the Python dependencies for the reproducibility of your projects? What advantages will lock files provide for those projects? This week on the show, we welcome back Python Core Developer Brett Cannon to discuss his journey to bring PEP 751 and the pylock.toml file format to the community.</p>
<p>Brett has been working on a way to move beyond the <code>requirements.txt</code> file for over six years. He was on the show previously to discuss his work on PEP 665, which was rejected. He decided to continue to push forward, authoring PEP 751 last year, which was accepted at the end of March this year.</p>
<p>The PEP calls for a new file format to record your project’s dependencies. The goal was to have a standardized immutable record for what should be installed to reproduce your project in a virtual environment. He discusses working with other packaging projects and the compromises involved in creating a standard.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/python-subprocess-module/">Using the Python subprocess Module</a> </p>
<p>In this video course, you’ll learn how to use Python’s subprocess module to run and control external programs from your scripts. You’ll start with launching basic processes and progress to interacting with them as they execute.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:38 – Brett’s roles within the Python community</li>
<li>00:05:41 – How to move beyond requirement.txt?</li>
<li>00:10:58 – What does the community use as project artifacts?</li>
<li>00:15:28 – Building on the success of pyproject.toml</li>
<li>00:17:44 – Introducing PEP 665</li>
<li>00:19:49 – Software Bills of Materials and security</li>
<li>00:25:20 – Back to lock files and security</li>
<li>00:31:08 – Video Course Spotlight</li>
<li>00:32:27 – Not giving up on the idea</li>
<li>00:34:01 – Leading into PEP 751</li>
<li>00:38:54 – Working toward a single multi-platform file</li>
<li>00:43:02 – The final push</li>
<li>00:48:54 – Leaving room for flexibility</li>
<li>00:53:50 – And it’s done, PEP 751 accepted unconditionally</li>
<li>00:58:06 – Keynote speaker at EuroPython 2025</li>
<li>00:58:45 – What are uv workspaces?</li>
<li>01:01:02 – Considering the use of lock files in data science</li>
<li>01:05:23 – Updates about Python for WASI and Emscripten</li>
<li>01:13:51 – Clarification on WASI </li>
<li>01:20:28 – Future conversation about Python launcher</li>
<li>01:23:04 – What are you excited about in the world of Python?</li>
<li>01:24:25 – What do you want to learn next?</li>
<li>01:28:41 – What’s the best way to follow your work online?</li>
<li>01:31:00 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/">Tall, Snarky Canadian</a></li>
<li><a href="https://www.youtube.com/watch?v=wgxBHuUOmjA">BREAKING: Guido van Rossum Returns as Python’s BDFL - YouTube</a></li>
<li><a href="https://packaging.python.org/en/latest/">Python Packaging User Guide</a></li>
<li><a href="https://peps.python.org/pep-0751/">PEP 751 – A file format to record Python dependencies for installation reproducibility</a></li>
<li><a href="https://peps.python.org/pep-0665/#file-format">PEP 665 – A file format to list Python dependencies for reproducibility of an application</a></li>
<li><a href="https://packaging.python.org/en/latest/specifications/pylock-toml/#pylock-toml-spec">pylock.toml Specification - Python Packaging User Guide</a></li>
<li><a href="https://packaging.python.org/en/latest/specifications/inline-script-metadata/">Inline script metadata - Python Packaging User Guide</a></li>
<li><a href="https://peps.python.org/pep-0723/">PEP 723 – Inline script metadata</a></li>
<li><a href="https://docs.astral.sh/uv/concepts/projects/workspaces/">Using workspaces - uv</a></li>
<li><a href="https://www.youtube.com/watch?v=UTduy7Qkvk8">Do you have a flag? - Eddie Izzard - YouTube</a></li>
<li><a href="http://www.openmathlib.org/OpenBLAS/">OpenBLAS : An optimized BLAS library</a></li>
<li><a href="https://ep2025.europython.eu/">EuroPython 2025 - July 14 to 20, 2025 - Prague, Czech Republic & Remote</a></li>
<li><a href="https://bytecodealliance.org/">Bytecode Alliance</a></li>
<li><a href="https://bytecodealliance.zulipchat.com/">Recent conversations - Bytecode Alliance - Zulip</a></li>
<li><a href="https://snarky.ca/my-impressions-of-gleam/">My impressions of Gleam</a></li>
<li><a href="https://snarky.ca/my-impressions-of-rescript/">My impressions of ReScript</a></li>
<li><a href="https://exercism.org/tracks/python">Python on Exercism</a></li>
<li><a href="https://letterboxd.com/nothingbutsnark/films/">Brett Cannon’s Films - Letterboxd</a></li>
<li><a href="https://opensource.snarky.ca/About+Me/Media+I+Like">Media I Like - Open Source by Brett Cannon</a></li>
<li><a href="https://bsky.app/profile/snarky.ca">Brett Cannon (@snarky.ca) — Bluesky</a></li>
<li><a href="https://fosstodon.org/@brettcannon">Brett Cannon (@brettcannon@fosstodon.org) - Fosstodon</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/basics-exercises-install-packages-with-pip/">Python Basics Exercises: Installing Packages With pip</a></li>
<li><a href="https://realpython.com/courses/packaging-with-pyproject-toml/">Everyday Project Packaging With pyproject.toml</a></li>
<li><a href="https://realpython.com/courses/python-subprocess-module/">Using the Python subprocess Module</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Helping Securing the Python with Mike Fiedler
On this Screaming in the Cloud In this episode of Screaming in the Cloud, Corey Quinn is joined by AWS container hero and security engineer at the Python Software Foundation, Mike Fiedler. They delve into the intricacies of Python's ecosystem, discussing the evolution of PyPI, its significance, and the ongoing battles against security threats like account takeover attacks and typo-squatting. Mike sheds light on his role in maintaining the security and reliability of the Python Package Index, the importance of 2FA, and the collaborative efforts with security researchers. Corey and Mike also explore the challenges and philosophies surrounding legacy systems versus greenfield development, with insights on maintaining critical infrastructure and the often-overlooked aspects of social engineering.
Show Highlights
(0:00) Introduction
(0:47) The Duckbill Group sponsor read
(1:21) Breaking down the Python nomenclature and its usability
(5:49) Figuring out how Boto3 is one of the most downloaded packages
(6:43) Why Mike is the only full-time security and safety engineer at the Python Software Foundation
(9:53) How the Python Software Foundation affords to operate
(14:17) Mike's stack security work
(16:14) The Duckbill Group sponsor read
(16:57) Having the "impossible job" of stopping supply chain attacks
(21:00) The dangers of social engineering attacks
(24:44) Why Mike prefers to work on legacy systems
(33:30) Where you can find more from Mike
About Mike Fiedler
Mike Fiedler is a highly analytical, forward-thinking Information Technology professional. His broad-based background includes systems administration and engineering in global environments. Mike is technically astute and versatile with ability to quickly learn, master, and leverage new technologies to meet business needs and has a track record of success in improving performance, stability, and security for all infrastructure and product initiatives.
Mike is also bilingual, speaks English and Hebrew, and he loves solving puzzling problems.
Links
Mike’s Mastadon: https://hachyderm.io/@miketheman
Mike’s Bluesky: https://bsky.app/profile/miketheman.com
Mike’s Python Software Foundation blog posts: https://blog.pypi.org/
The Python Package Index Safety & Security Engineer: First Year in Review: https://blog.pypi.org/posts/2024-08-16-safety-and-security-engineer-year-in-review/
Sponsor
The Duckbill Group: duckbillgroup.com
Why Beginning Developers Love Python
Deb Nicholson, executive director of the Python Software Foundation, attributes Python’s popularity to its minimal syntactical complexity, which appeals to beginners and seasoned developers alike. Python allows flexibility for those exploring coding without a specific focus, unlike purpose-built languages. Since her leadership began in 2022, Nicholson has overseen the foundation’s role in managing Python’s fiscal and operational needs, including the package index that hosts over half a million add-ons. This open ecosystem enables contributions from large corporations and individual developers while demanding vigilant security measures.
Nicholson envisions Python's future advancements, particularly in improving multi-threading and expanding usage in mobile development. She acknowledges Python’s critical role in AI and data science but remains cautious about AI’s pervasive application, likening it to a temporary trend. On open source in the enterprise, Nicholson critiques companies profiting from open-source tools while adopting restrictive licenses. Instead, she admires models like Red Hat’s, which leverage open source sustainably without compromising accessibility or innovation.
Learn more from The New Stack about Python:
Python 3.13: Blazing New Trails in Performance and Scale
The Top 5 Python Packages and What They Do
Python Mulls a Change in Version Numbering
Join our community of newsletter subscribers to stay on top of the news and at the top of your game.
Free-threaded Python (Interview)
Jerod is joined by the co-hosts of core.py , Pablo Galindo & Łukasz Langa, a podcast about Python internals by people who work on Python internals. Python 3.13 is right around the corner, which means the Global Interpeter Lock (GIL) is now experimentally optional! This is a huge deal as Python is finally free-threaded. There’s more to discuss, of course, so we get into all the gory details.
Join the discussion
Changelog++ members save 12 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Sentry – Code breaks, fix it faster. Don’t just observe. Take action. Sentry is the only app monitoring platform built for developers that gets to the root cause for every issue. 100,000+ growing teams use sentry to find problems fast. Use the code CHANGELOG when you sign up to get $100 OFF the team plan.
Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes.
Coder.com – Instantly launch fully configured cloud development environments (CDE) and make your first commit in minutes. No need to traverse README files or await onboarding queues. Learn more at Coder.com
Unblocked – Other developer tools can’t tell you how your codebase works and why. Unblocked can. We augment your code with context from Slack, Confluence, Jira, and more, so you get accurate answers without having to search for them. Sign up for free at getunblocked.com
Featuring:
Pablo Galindo – GitHub, X
Łukasz Langa – Website, GitHub, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
core.py
What’s New In Python 3.13
Free-threaded compatibility status tracking
🧵 Free-Threaded Wheels
Something missing or broken? PRs welcome!
Who’s Keeping the Python Ecosystem Safe?
Mike Fiedler, a PyPI safety and security engineer at the Python Software Foundation, prefers the title “code gardener,” reflecting his role in maintaining and securing open source projects. Recorded at PyCon US, Fiedler explains his task of “pulling the weeds” in code—handling unglamorous but crucial aspects of open source contributions. Since August, funded by Amazon Web Services, Fiedler has focused on enhancing the security of the Python Package Index (PyPI). His efforts include ensuring that both packages and the pipeline are secure, emphasizing the importance of vetting third-party modules before deployment.
One of Fiedler’s significant initiatives was enforcing mandatory two-factor authentication (2FA) for all PyPI user accounts by January 1, following a community awareness campaign. This transition was smooth, thanks to proactive outreach. Additionally, the foundation collaborates with security researchers and the public to report and address malicious packages.
In late 2023, a security audit by Trail of Bits, funded by the Open Technology Fund, identified and quickly resolved medium-sized vulnerabilities, increasing PyPI's overall security. More details on Fiedler's work are available in the full interview video.
Learn more from The New Stack about PyPl:
PyPl Strives to Pull Itself Out of Trouble
How Python Is Evolving
Poisoned Lolip0p PyPI Packages
Join our community of newsletter subscribers to stay on top of the news and at the top of your game.
Welcoming PyPI's Safety & Security Engineer Mike Fiedler
<p>You may remember a recent Python Package Index (PyPI) announcement about hiring a full-time security engineer. We’ve also mentioned several current security initiatives from PyPI. This week on the show, we talk with Mike Fiedler about accepting this new role and securing accounts on PyPI.</p>
<p>Mike talks about how he started as a contributor to PyPI and eventually became a maintainer. We dig into why he fits this new role well and what his responsibilities are.</p>
<p>We discuss the initiative to secure accounts using two-factor authentication (2FA) methods. Mike also explains how package maintainers can adopt a new, more secure publishing method called trusted publishing that doesn’t require long-lived passwords.</p>
<p>We also discuss Mike’s recent talk called “How to Give Back to Open Source Without Losing Your Mind.” Mike shares advice and resources for finding your own contribution entry points.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></p>
<p>In this video course, you’ll learn how to create a Python package for your project and how to publish it to PyPI, the Python Package Index. Quickly get up to speed on everything from naming your package to configuring it using <code>setup.cfg</code>.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:11 – PyPI Safety and Security Engineer</li>
<li>00:05:21 – Why did you initially become a PyPI contributor?</li>
<li>00:11:26 – What are you most excited about in your new role?</li>
<li>00:12:02 – Current security concerns</li>
<li>00:15:07 – Focus on malicious package reporting</li>
<li>00:16:30 – 2FA enforcement and building trust</li>
<li>00:26:51 – Managing credentials and password managers</li>
<li>00:29:24 – Forms of 2FA </li>
<li>00:31:48 – Trusted publishers</li>
<li>00:38:08 – Video Course Spotlight</li>
<li>00:39:28 – Updating an older project</li>
<li>00:41:44 – Evolution of security</li>
<li>00:43:06 – Typosquatting and evolving security</li>
<li>00:49:13 – How To Give Back to Open Source Without Losing Your Mind</li>
<li>00:52:48 – What are you excited about in the world of Python?</li>
<li>00:54:45 – What do you want to learn next?</li>
<li>00:57:06 – How can people follow your work online?</li>
<li>00:57:37 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://blog.pypi.org/posts/2023-08-04-pypi-hires-safety-engineer/">PyPI hires a Safety & Security Engineer - The Python Package Index</a></li>
<li><a href="https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/">Inbound Malware Volume Report - The Python Package Index</a></li>
<li><a href="https://blog.pypi.org/posts/2023-08-08-2fa-enforcement-for-new-users/">2FA Enforcement for New User Registrations - The Python Package Index</a></li>
<li><a href="https://pypi.org/security-key-giveaway/">PyPI 2FA Security Key Giveaway - PyPI</a></li>
<li><a href="https://www.ntia.gov/page/software-bill-materials">Software Bill Of Materials - National Telecommunications and Information Administration</a></li>
<li><a href="https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/">Introducing ‘Trusted Publishers’ - The Python Package Index</a></li>
<li><a href="https://docs.pypi.org/trusted-publishers/">Trusted Publishers - Getting Started - PyPI Docs</a></li>
<li><a href="https://vbrownbag.com/2023/05/episode-followup-how-to-give-back-to-open-source-without-losing-your-mind/">How To Give Back to Open Source Without Losing Your Mind – vBrownBag</a></li>
<li><a href="https://goodfirstissues.dev">Good First Issues - OpenSauced</a></li>
<li><a href="http://goodfirstissues.com/">Good First Issues</a></li>
<li><a href="https://hacktoberfest.com/participation/">Participation - Hacktoberfest 2023</a></li>
<li><a href="https://www.python.org/downloads/release/python-3120/">Python Release Python 3.12.0 - Python.org</a></li>
<li><a href="https://htmx.org/"></> htmx - high power tools for html</a></li>
<li><a href="https://www.djangoproject.com/">The web framework for perfectionists with deadlines - Django</a></li>
<li><a href="https://blog.pypi.org/">The Python Package Index - Blog</a></li>
<li><a href="https://fosstodon.org/@miketheman@hachyderm.io">Mike Fiedler, Code Gardener (@miketheman@hachyderm.io) - Fosstodon</a></li>
<li><a href="https://twitter.com/mikefiedler">Mike Fiedler, Code Gardener (@mikefiedler) / X</a> </li>
<li><a href="https://mike.fiedler.me/">Mike Fiedler’s personal website</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/what-is-pip/">A Beginner's Guide to pip</a></li>
<li><a href="https://realpython.com/courses/packaging-with-pyproject-toml/">Everyday Project Packaging With pyproject.toml</a></li>
<li><a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
There's a whole PEP about that (Friends)
Brett Cannon (our unofficial ambassador to the Python community) is here to help alleviate our pip install anxiety. Along the way, we ask him about Python 4, removing the GIL, what he thinks about Chris Lattner’s Mojo project, Rust in the Python world & way more (of course).
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You literally can’t get any faster!
Featuring:
Brett Cannon – Website, GitHub, LinkedIn, Bluesky, Mastodon
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
In response to the Changelog #526
Raku
Perl Mongers
pipx
Ultimate Tic-Tac-Toe
Mojo.🔥
Why Mojo
Astral
RustPython: A Python Interpreter written in Rust
Something missing or broken? PRs welcome!
Virtual Environment Structure & Surveying the Packaging Ecosystem
<p>How do Python virtual environments work under the hood? How does understanding these concepts help you with managing them for your projects? This week on the show, CPython core developer Brett Cannon returns to discuss his recent articles about virtual environments and the Python packaging landscape.</p>
<p>Brett talks about his recent article “How Virtual Environments Work.” He was researching the topic to solve an issue with a Linux Python distribution that doesn’t provide the tools to create virtual environments. We talk about how he solved the problem by creating a tiny library named microvenv.</p>
<p>We also take a look at the Python packaging ecosystem. Brett talks about the early days of Python, when these tools didn’t exist. He contrasts that with the current packaging solution explosion and how each one attempts to solve unique problems. We also discuss the Python Packaging User Survey and the plans for packaging summits at PyCon US. Note that we recorded this episode two weeks before PyCon US 2023.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/python-repl/">Getting the Most Out of the Python Standard REPL</a></p>
<p>In this video course, you’ll learn how to use the Python standard REPL (Read-Eval-Print Loop) to run your code interactively. This tool will allow you to test new ideas, explore and experiment with new tools and libraries, refactor and debug your code, try out examples, and more.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:58 – Virtual environments</li>
<li>00:07:10 – PEP 704 & virtual environment workflows</li>
<li>00:26:57 – Experimenting with not including <code>pip</code> </li>
<li>00:34:44 – Video Course Spotlight</li>
<li>00:36:35 – What are you using for packaging?</li>
<li>00:43:32 – Python Packaging User Survey & the history of packaging</li>
<li>00:48:40 – Packing only gets complex when it’s not pure Python code</li>
<li>01:01:22 – Outcomes after the survey and the packaging summit</li>
<li>01:03:56 – What are you excited about in the world of Python?</li>
<li>01:05:28 – What’s something you want to learn next?</li>
<li>01:07:12 – How can people follow the work that you do?</li>
<li>01:08:14 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/how-virtual-environments-work/">How virtual environments work</a></li>
<li><a href="https://peps.python.org/pep-0704/">PEP 704 – Require virtual environments by default for package installers - peps.python.org</a></li>
<li><a href="https://pypi.org/project/microvenv/">microvenv - PyPI</a></li>
<li><a href="https://github.com/brettcannon/python-launcher">python-launcher: Python launcher for Unix - GitHub</a></li>
<li><a href="https://bootstrap.pypa.io/">bootstrap.pypa.io</a></li>
<li><a href="https://snarky.ca/classifying-python-virtual-environment-workflows/">Classifying Python virtual environment workflows</a> </li>
<li><a href="https://drive.google.com/file/d/1U5d5SiXLVkzDpS0i1dJIA4Hu5Qg704T9/view">Python Packaging User Survey - Results PDF</a></li>
<li><a href="https://pradyunsg.me/blog/2023/01/21/thoughts-on-python-packaging/">Thoughts on the Python packaging ecosystem - Pradyun Gedam</a></li>
<li><a href="https://github.com/pypa/packaging">pypa/packaging: Core utilities for Python packages - GitHub</a></li>
<li><a href="https://flit.pypa.io/en/latest/">Flit 3.8.0 - Flit 3.8.0 documentation</a></li>
<li><a href="https://pypi.org/project/hatch/">hatch - PyPI</a></li>
<li><a href="https://pypi.org/project/hatchling/">hatchling - PyPI</a></li>
<li><a href="https://realpython.com/podcasts/rpp/93/">Episode #93: Launching Python, Virtual Environments, and Locking Dependencies With Brett Cannon – The Real Python Podcast</a></li>
<li><a href="https://peps.python.org/pep-0665/">PEP 665 – A file format to list Python dependencies for reproducibility of an application - peps.python.org</a></li>
<li><a href="https://www.oreilly.com/library/view/programming-rust-2nd/9781492052586/">Programming Rust, 2nd Edition</a></li>
<li><a href="https://snarky.ca/">Tall, Snarky Canadian - Brett’s Blog</a></li>
<li><a href="https://devblogs.microsoft.com/python/">Microsoft Python Blog</a></li>
<li><a href="https://code.visualstudio.com/blogs/">Visual Studio Code Blog</a></li>
<li><a href="https://fosstodon.org/@brettcannon">Brett Cannon (@brettcannon@fosstodon.org) - Mastodon</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/python-repl/">Getting the Most Out of the Python Standard REPL</a></li>
<li><a href="https://realpython.com/courses/working-python-virtual-environments/">Working With Python Virtual Environments</a></li>
<li><a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Targeting WebAssembly Platforms & Distilling a Minimum Viable Python
<p>Are you familiar with the different versions of WebAssembly? Could WASM be the “write once, run everywhere” solution that developers have searched for? Where does distributing Python applications fit in the narrative? This week on the show, we have CPython core developer Brett Cannon to discuss his recent articles about WebAssembly and MVPy.</p>
<p>Brett has completed his syntactic sugar series, which we discussed in a previous episode. He details the origin of the series and his process of unearthing a minimum viable version of Python. Brett shares how he updated his PyCon US talk on the subject after feedback from presenting it at PyCascades.</p>
<p>We also dig deep into WebAssembly, specifically WebAssembly System Interface (WASI). Brett explains the concept of a “platform target triple” and the importance of defining which system CPython is compiled for. We also discuss WebAssembly becoming a ubiquitous distribution system.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/python-basics-class/">Python Basics: Building Systems With Classes</a></p>
<p>In this video course, you’ll learn how to work with classes to build complex systems in Python. By composing classes, inheriting from other classes, and overriding class behavior, you’ll harness the power of object-oriented programming (OOP).</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:05 – PyCascades 2023 </li>
<li>00:02:56 – Using social media for polls and checking interest</li>
<li>00:06:02 – Completing the syntactic sugar blog series</li>
<li>00:15:29 – Minimum Viable Python (MVPy) and WebAssembly</li>
<li>00:19:29 – Other teams focusing on WebAssembly</li>
<li>00:21:31 – Sponsor: Courier</li>
<li>00:22:13 – Stack of technology</li>
<li>00:26:50 – WebAssembly and its platform targets</li>
<li>00:32:35 – WASI and connecting to a runtime</li>
<li>00:38:33 – Extension modules and dynamic libraries</li>
<li>00:47:29 – Overcoming road blocks and envisioning a new WASI assignment</li>
<li>00:51:51 – Video Course Spotlight</li>
<li>00:53:26 – PEP 11 & CPython platform support for WASI</li>
<li>01:03:11 – Machine-specific runtime </li>
<li>01:04:57 – Write once, run everywhere</li>
<li>01:13:14 – Talks and summits planned for PyCon 2023</li>
<li>01:18:00 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/mvpy-minimum-viable-python/">MVPy: Minimum Viable Python</a></li>
<li><a href="https://us.pycon.org/2023/schedule/presentation/41/">Python’s Syntactic Sugar - PyCon US 2023</a></li>
<li><a href="https://realpython.com/podcasts/rpp/47/">Episode #47: Unraveling Python’s Syntax to Its Core With Brett Cannon – The Real Python Podcast</a></li>
<li><a href="https://snarky.ca/tag/syntactic-sugar/">syntactic sugar - Tall, Snarky Canadian</a></li>
<li><a href="https://fosstodon.org/@brettcannon">Brett Cannon (@brettcannon@fosstodon.org) - Fosstodon</a></li>
<li><a href="https://wasi.dev/">WASI - wasi.dev</a></li>
<li><a href="https://snarky.ca/webassembly-and-its-platform-targets/">WebAssembly and its platform targets</a></li>
<li><a href="https://medium.com/disney-streaming/introducing-the-disney-application-development-kit-adk-ad85ca139073">Introducing the Disney+ Application Development Kit (ADK) - Mike Hanley</a></li>
<li><a href="https://developer.fastly.com/learning/compute/">Compute@Edge services using WebAssembly - Fastly Developer Hub</a></li>
<li><a href="https://marketplace.visualstudio.com/items?itemName=ms-vscode.vscode-python-web-wasm&ssr=false#overview">Experimental - Python for the Web - Visual Studio Marketplace</a></li>
<li><a href="https://peps.python.org/pep-0011/">PEP 11 – CPython platform support - peps.python.org</a></li>
<li><a href="https://snarky.ca/testing-a-project-using-the-wasi-build-of-cpython-with-pytest/">Testing a Python project using the WASI build of CPython with <code>pytest</code></a></li>
<li><a href="https://www.infoworld.com/article/3651503/the-rise-of-webassembly.html">The rise of WebAssembly - InfoWorld</a></li>
<li><a href="https://adlrocha.substack.com/p/adlrocha-can-wasm-become-the-new">Can WASM become the new Docker?</a></li>
<li><a href="https://github.com/bytecodealliance/wasmtime">bytecodealliance/wasmtime: A fast and secure runtime for WebAssembly</a></li>
<li><a href="https://emscripten.org/">Emscripten - Dev Documentation</a></li>
<li><a href="https://pyscript.net/">PyScript - Run Python in your HTML</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/python-basics-oop/">Python Basics: Object-Oriented Programming</a></li>
<li><a href="https://realpython.com/courses/inheritance-composition-python/">Inheritance and Composition: A Python OOP Guide</a></li>
<li><a href="https://realpython.com/courses/python-basics-class/">Python Basics: Building Systems With Classes</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Evaluating Python Packages & Celebrating 20 Years of PyCon US
<p>Have you ever installed a Python package without knowing anything about it? What best practices should you employ to ensure the quality of your next package installation? Christopher Trudeau is back this week, bringing another batch of PyCoder’s Weekly articles and projects. We also have Python Software Foundation executive director, Deb Nicholson, to share details about PyCon US 2023.</p>
<p>We cover a recent Real Python tutorial by Philipp Acsany on evaluating the quality of Python packages. The piece provides a tool kit for researching the traits, history, software license, and current condition of external Python packages. We also discuss the techniques that we personally use before selecting a package for our Python projects.</p>
<p>We share several other articles and projects from the Python community, with topics such as the underlying structure of virtual environments, the overhead of Python <code>asyncio</code> tasks, documentation for Python projects with Sphinx and Read the Docs, a project for creating <code>argparse</code> boilerplate, and a way to generate seemingly realistic fake numbers using Benford’s law.</p>
<p>Deb Nicholson is also here to talk about the 20th anniversary of PyCon US, hosted in Salt Lake City. We dig into the details of the upcoming conference, including keynote speakers, tutorials, scheduled talks, and improvements to the hybrid online experience.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/python-sphinx/">Documenting Python Projects With Sphinx and Read the Docs</a></p>
<p>In this video series, you’ll create project documentation from scratch using Sphinx, the de facto standard for Python. You’ll also hook your code repository up to Read The Docs to automatically build and publish your code documentation.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:46 – How to Evaluate the Quality of Python Packages</li>
<li>00:11:35 – Overhead of Python <code>asyncio</code> Tasks</li>
<li>00:14:53 – Sponsor: Courier</li>
<li>00:15:37 – How Virtual Environments Work</li>
<li>00:23:48 – Documenting Python Projects With Sphinx and Read the Docs</li>
<li>00:28:29 – duckargs: Code Generator for <code>argparse</code> Boilerplate</li>
<li>00:30:46 – Video Course Spotlight</li>
<li>00:32:04 – Are Those Numbers Realistic or Fake? Try Using Benford’s Law</li>
<li>00:34:37 – Introduction for Deb Nicholson</li>
<li>00:36:33 – What is your role with PyCon US?</li>
<li>00:37:28 – Hybrid conference and dates</li>
<li>00:39:07 – Tutorials</li>
<li>00:40:30 – Education Summit and Typing Summit</li>
<li>00:42:06 – Keynote speakers</li>
<li>00:42:57 – Lightning talks, posters, and job fair</li>
<li>00:45:04 – 20th anniversary of PyCon US</li>
<li>00:46:56 – Resources for proposals and talks</li>
<li>00:49:22 – Previous podcast guests and talks</li>
<li>00:51:26 – Mentored sprints for diverse beginners </li>
<li>00:53:12 – PyLadies auction</li>
<li>00:54:29 – COVID policy</li>
<li>00:56:50 – What are you excited about in the world of Python?</li>
<li>00:58:07 – What do you want to learn next?</li>
<li>00:59:24 – How to follow the PSF and PyCon US?</li>
<li>00:59:55 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://realpython.com/python-package-quality/">How to Evaluate the Quality of Python Packages</a> – Just like you shouldn’t download any file from the Internet, you shouldn’t install third-party Python packages without evaluating them first. This tutorial will give you the tool set to evaluate the quality of external Python packages before you incorporate them into your Python projects.</li>
<li><a href="https://textual.textualize.io/blog/2023/03/08/overhead-of-python-asyncio-tasks/">Overhead of Python Asyncio Tasks</a> – The Textual library uses a lot of asyncio tasks. In order to determine whether to spend time optimizing them, Will measured the cost of creating asyncio tasks. TLDR; optimize something else. This article also spawned a conversation on <a href="https://news.ycombinator.com/item?id=35073136">Hacker News</a>.</li>
<li><a href="https://snarky.ca/how-virtual-environments-work/">How Virtual Environments Work</a> – This article attempts to demystify virtual environments, specifically why they exist and how they work. It even delves into why Brett is heading down this alley and how running into challenges with cross-platform tools has prompted the creation of <code>microvenv</code>.</li>
<li><a href="https://realpython.com/courses/python-sphinx/">Documenting Python Projects With Sphinx and Read the Docs</a> – In this video series, you’ll create project documentation from scratch using Sphinx, the de facto standard for Python. You’ll also hook your code repository up to Read The Docs to automatically build and publish your code documentation.</li>
</ul>
<p>Projects:</p>
<ul>
<li><a href="https://github.com/eriknyquist/duckargs">duckargs: Code Generator for <code>argparse</code> Boilerplate</a></li>
<li><a href="https://www.softwarepragmatism.com/benfords-law">Are Those Numbers Realistic or Fake? Try Using Benford’s Law</a> – How can you tell whether a set of figures is trustworthy? It’s not always simple, but Benford’s Law gives you one way to find out. There’s even a Python Package to help you check: <a href="https://pypi.org/project/randalyze/">randalyze</a>.</li>
</ul>
<p>PyCon US 2023 Links:</p>
<ul>
<li><a href="https://us.pycon.org/2023/">Welcome to PyCon US 2023</a></li>
<li><a href="https://www.python.org/psf-landing/">Python Software Foundation</a></li>
<li><a href="https://us.pycon.org/2023/attend/information/">Registration Information - PyCon US 2023</a></li>
<li><a href="https://us.pycon.org/2023/schedule/talks/">Talks Schedule - PyCon US 2023</a></li>
<li><a href="https://us.pycon.org/2023/schedule/tutorials/">Tutorials Schedule - PyCon US 2023</a></li>
<li><a href="https://us.pycon.org/2023/events/education-summit/">Education Summit - PyCon US 2023</a></li>
<li><a href="https://docs.google.com/forms/d/e/1FAIpQLSfI1o7vX9ELrxpPn88GhhMTgucz825g8Oc99UIS2WKhFlM5Gw/viewform">PyCon US Stories Slideshow</a></li>
<li><a href="https://us.pycon.org/2023/speaking/guidelines/">Proposal Guidelines - PyCon US 2023</a></li>
<li><a href="https://us.pycon.org/2023/events/pyladies-auction/">PyLadies Auction - PyCon US 2023</a></li>
<li><a href="https://us.pycon.org/2023/volunteers/volunteering/">Volunteering - PyCon US 2023</a></li>
</ul>
<p>Additional Links:</p>
<ul>
<li><a href="https://libraries.io/">Libraries.io - The Open Source Discovery Service</a></li>
<li><a href="https://choosealicense.com/licenses/">Licenses - Choose a License</a></li>
<li><a href="https://realpython.com/python-virtual-environments-a-primer/">Python Virtual Environments: A Primer – Real Python</a></li>
<li><a href="https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act">EU Cyber Resilience Act - Shaping Europe’s digital future</a></li>
<li><a href="https://pyfound.blogspot.com/2022/11/where-is-psf.html">Python Software Foundation News: Where is the PSF?</a></li>
<li><a href="https://python.us19.list-manage.com/subscribe?u=5697f493c3a48994f504d4deb&id=a0a3bd5663">Signup for the Python Software Foundation Newsletter</a></li>
<li><a href="https://www.meetup.com/bostonpython/">The Boston Python User Group (Cambridge, MA) - Meetup</a></li>
<li><a href="https://pyladies.com/">PyLadies – Women Who Love Coding in Python</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/building-project-documentation-mkdocs/">Building Python Project Documentation With MkDocs</a></li>
<li><a href="https://realpython.com/courses/python-sphinx/">Documenting Python Projects With Sphinx and Read the Docs</a></li>
<li><a href="https://realpython.com/courses/documenting-python-code/">Documenting Code in Python</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
#341 – Guido van Rossum: Python and the Future of Programming
Guido van Rossum is the creator of Python programming language. Please support this podcast by checking out our sponsors:
– GiveDirectly: https://givedirectly.org/lex to get gift matched up to $1000
– Eight Sleep: https://www.eightsleep.com/lex to get special savings
– Fundrise: https://fundrise.com/lex
– InsideTracker: https://insidetracker.com/lex to get 20% off
– Athletic Greens: https://athleticgreens.com/lex to get 1 month of fish oil
EPISODE LINKS:
Guido’s Twitter: https://twitter.com/gvanrossum
Guido’s Website: https://gvanrossum.github.io/
Python’s Website: https://python.org
PODCAST INFO:
Podcast website: https://lexfridman.com/podcast
Apple Podcasts: https://apple.co/2lwqZIr
Spotify: https://spoti.fi/2nEwCF8
RSS: https://lexfridman.com/feed/podcast/
YouTube Full Episodes: https://youtube.com/lexfridman
YouTube Clips: https://youtube.com/lexclips
SUPPORT & CONNECT:
– Check out the sponsors above, it’s the best way to support this podcast
– Support on Patreon: https://www.patreon.com/lexfridman
– Twitter: https://twitter.com/lexfridman
– Instagram: https://www.instagram.com/lexfridman
– LinkedIn: https://www.linkedin.com/in/lexfridman
– Facebook: https://www.facebook.com/lexfridman
– Medium: https://medium.com/@lexfridman
OUTLINE:
Here’s the timestamps for the episode. On some podcast players you should be able to click the timestamp to jump to that time.
(00:00) – Introduction
(07:26) – CPython
(12:38) – Code readability
(17:00) – Indentation
(33:36) – Bugs
(45:04) – Programming fads
(1:00:15) – Speed of Python 3.11
(1:25:09) – Type hinting
(1:30:27) – mypy
(1:35:43) – TypeScript vs JavaScript
(1:51:42) – Best IDE for Python
(2:01:43) – Parallelism
(2:19:36) – Global Interpreter Lock (GIL)
(2:29:14) – Python 4.0
(2:41:31) – Machine learning
(2:51:13) – Benevolent Dictator for Life (BDFL)
(3:02:49) – Advice for beginners
(3:09:21) – GitHub Copilot
(3:12:47) – Future of Python
Launching Python, Virtual Environments, and Locking Dependencies With Brett Cannon
<p>Would you like a simple command to launch your Python programs using the newest version of the language installed on your machine? This week on the show, we continue our conversation with Brett Cannon. Brett discusses his project, the Python Launcher for Unix.</p>
<p>We dive into Brett’s workflow to set up projects, virtual environments, and prepare for distribution. He shares some of the tools he employs and reasons for keeping things simple. </p>
<p>We also talk about PEP 665, which specifies a file format to list an application’s Python package installation requirements. Brett shares why he co-authored the PEP and a bit of the community’s reaction. It leads to a deeper conversation about going beyond ‘requirements.txt’ to lock files.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/data-viz-with-dash/">Data Visualization Interfaces in Python With Dash</a> </p>
<p>In this course, you’ll learn how to build a dashboard using Python and Dash. Dash is a framework for building data visualization interfaces. It helps data scientists build fully interactive web applications quickly.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:43 – Python Launcher for Unix</li>
<li>00:09:36 – Hiding a virtual environment directory</li>
<li>00:13:30 – Sponsor: Scout APM</li>
<li>00:14:17 – Environment managers and being an editor vs an IDE person</li>
<li>00:17:32 – PEP 665, lock files, and Brett’s dependency workflow</li>
<li>00:20:56 – The hurdles of source distributions and version control repositories</li>
<li>00:25:07 – Drawbacks of requirements files and standardizing lock files</li>
<li>00:28:19 – Why PEP 665 is controversial and the changes to setuptools</li>
<li>00:33:48 – Video Course Spotlight</li>
<li>00:35:16 – Are these examples of growing pains?</li>
<li>00:37:51 – Unfair comparisons to packaging in Rust or other languages</li>
<li>00:42:35 – What are you excited about in the world of Python?</li>
<li>00:43:54 – What do you want to learn next?</li>
<li>00:49:23 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/introducing-the-python-launcher-for-unix/">Introducing the Python Launcher for Unix</a></li>
<li><a href="https://github.com/brettcannon/python-launcher">brettcannon/python-launcher: Python launcher for Unix</a></li>
<li><a href="https://marketplace.visualstudio.com/items?itemName=ms-python.python">Python Extension for VSCode</a></li>
<li><a href="https://flit.readthedocs.io/en/latest/rationale.html">Why use Flit? — Flit 3.5.1 documentation</a></li>
<li><a href="https://github.com/jazzband/pip-tools/">pip-tools: A set of tools to keep your pinned Python dependencies fresh.</a></li>
<li><a href="https://www.python.org/dev/peps/pep-0665/">PEP 665 – A file format to list Python dependencies for reproducibility of an application | Python.org</a></li>
<li><a href="https://docs.python.org/3/library/venv.html">venv — Creation of virtual environments — Python 3.10.1 documentation</a></li>
<li><a href="https://pypi.org/project/virtualenvwrapper/">virtualenvwrapper · PyPI</a></li>
<li><a href="https://pypi.org/project/pdm/">pdm - Python Development Master · PyPI</a></li>
<li><a href="https://pypi.org/project/pyflow/">pyflow - Streamlines working with Python projects and files · PyPI</a></li>
<li><a href="https://pypi.org/project/pipenv/">pipenv · PyPI</a></li>
<li><a href="https://snarky.ca/thoughts-on-a-tooling-workflow/">Thoughts on where tools fit into a workflow</a></li>
<li><a href="https://snarky.ca/what-to-do-when-you-botch-a-release-on-pypi/">What to do when you botch a release on PyPI</a></li>
<li><a href="https://realpython.com/python-virtual-environments-a-primer/">Python Virtual Environments: A Primer – Real Python</a></li>
<li><a href="https://blog.ganssle.io/tag/setuptools.html#summary">Why you shouldn’t invoke setup.py directly | Paul Ganssle</a></li>
<li><a href="https://github.com/ethanhs/python-wasm">python-wasm: Build scripts and configuration for building CPython for Emscripten</a></li>
<li><a href="https://pyodide.org/en/stable/">Pyodide — A Python distribution for the browser and Node.js based on WebAssembly</a></li>
<li><a href="https://webassembly.org/">WebAssembly</a></li>
<li><a href="https://www.oreilly.com/library/view/programming-rust-2nd/9781492052586/">Programming Rust, 2nd Edition</a></li>
<li><a href="https://twitter.com/brettsky/status/1481069172314550276">Brett Cannon on Twitter: “PEP 665 got rejected today 😞”</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/what-is-pip/">A Beginner's Guide to pip</a></li>
<li><a href="https://realpython.com/courses/data-viz-with-dash/">Data Visualization Interfaces in Python With Dash</a></li>
<li><a href="https://realpython.com/courses/working-with-pipenv/">Working With Pipenv</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Continuing to Unravel Python's Syntactic Sugar With Brett Cannon
<p>A year ago, we had Brett Cannon on the show to discuss his blog series about unravelling Python’s syntactic sugar. Brett has written 15 more entries in the series, and he returns to the show this week to continue our conversation. We dive into unravelling ‘async’ and ‘await’ statements and their relationship with Python’s generators.</p>
<p>While working through the series, he has uncovered some issues lying under the surface of CPython. We discuss a couple of these discoveries and how the core developers resolved them.</p>
<p>Brett was recently re-elected to the Python Steering Council, and he talks about how the current direction of the council is shifting. We also discuss how Brett uses Twitter polls to gauge community sentiment and factors it into development decisions.</p>
<p>This conversation covered so many topics that we split it into two episodes. Next week’s episode will continue our discussion.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/speed-python-concurrency/">Speed Up Python With Concurrency</a> </p>
<p>Learn what concurrency means in Python and why you might want to use it. You’ll see a simple, non-concurrent approach and then look into why you’d want threading, asyncio, or multiprocessing.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:54 – Python Steering Council Reelection</li>
<li>00:06:06 – Python Extension for VSCode and the Language Server Protocol (LSP)</li>
<li>00:10:38 – Using twitter polls to gauge sentiment</li>
<li>00:19:19 – Sponsor: Honeybadger</li>
<li>00:20:04 – Unravelling Python’s syntactic sugar series </li>
<li>00:25:30 – The desugar GitHub repo and unearthing problems in CPython</li>
<li>00:29:48 – Why have <code>__iter__()</code> for an iterator?</li>
<li>00:32:47 – Is discovering and showcasing these “issues” stressful?</li>
<li>00:35:19 – A reverse chronology of some Python features</li>
<li>00:38:34 – How the heck does async/await work in Python</li>
<li>00:51:29 – Video Course Spotlight</li>
<li>00:52:54 – Using “spam” vs “foo” and metasyntactic variables</li>
<li>00:57:30 – Goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://discuss.python.org/t/2022-python-steering-council-election-results/12581">2022 Python Steering Council Election Results - Python.org</a></li>
<li><a href="https://microsoft.github.io/language-server-protocol/">Official Page for Language Server Protocol</a></li>
<li><a href="https://twitter.com/brettsky/status/1471264518885937152">Brett Cannon on Twitter: “If I were creating a protocol/interface for a spammy object, what naming convention would you expect?”</a></li>
<li><a href="https://realpython.com/podcasts/rpp/88/">Episode #88: Discussing Type Hints, Protocols, and Ducks in Python – The Real Python Podcast</a></li>
<li><a href="https://twitter.com/brettsky/status/1471227326797021185">Brett Cannon - Twitter Poll: “Which of these ‘pip install’ flags to you usually specify?”</a></li>
<li><a href="https://realpython.com/podcasts/rpp/47/">Episode #47: Unraveling Python’s Syntax to Its Core With Brett Cannon – The Real Python Podcast</a></li>
<li><a href="https://snarky.ca/unravelling-break-and-continue/">Unravelling ‘break’ and ‘continue’</a></li>
<li><a href="https://snarky.ca/unravelling-for-statements/">Unravelling ‘for’ statements</a></li>
<li><a href="https://github.com/brettcannon/desugar">GitHub - brettcannon/desugar: Unravelling Python source code</a></li>
<li><a href="https://snarky.ca/a-reverse-chronology-of-some-python-features/">A reverse chronology of some Python features</a></li>
<li><a href="https://journal.stuffwithstuff.com/2015/02/01/what-color-is-your-function/">What Color is Your Function? – journal.stuffwithstuff.com</a></li>
<li><a href="https://snarky.ca/unravelling-async-and-await/">Unravelling ‘async’ and ‘await’</a></li>
<li><a href="https://snarky.ca/how-the-heck-does-async-await-work-in-python-3-5/">How the heck does async/await work in Python 3.5?</a></li>
<li><a href="https://realpython.com/podcasts/rpp/39/">Episode #39: Generators, Coroutines, and Learning Python Through Exercises – The Real Python Podcast</a></li>
<li><a href="https://realpython.com/introduction-to-python-generators/">How to Use Generators and yield in Python – Real Python</a></li>
<li><a href="https://realpython.com/async-io-python/">Async IO in Python: A Complete Walkthrough – Real Python</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/python-for-loop/">For Loops in Python (Definite Iteration)</a></li>
<li><a href="https://realpython.com/courses/python-generators/">Python Generators 101</a></li>
<li><a href="https://realpython.com/courses/speed-python-concurrency/">Speed Up Python With Concurrency</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
#339: Making Python Faster with Guido and Mark
See the full show notes for this episode on the website at talkpython.fm/339
Welcoming the CPython Developer in Residence
<p>Earlier this year, the Python Software Foundation announced the creation of the Developer in Residence role. The first Visionary Sponsors of the PSF have provided funding for this new role for one year. What development responsibilities does this job address? This week on the show, we talk to previous guest Łukasz Langa about becoming the first CPython Developer in Residence.</p>
<p>We talk about how the first months in this role are shaping up. Łukasz discusses the need to address the backlog of open issues and pull requests. He also talks about how he is working to help the project’s volunteers move their contributions forward. </p>
<p>We cover his PyCon 2021 talk about generating real-time FM audio synthesis in Python. He also shares his experience developing a similar synthesis engine for an embedded hardware project.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/speech-recognition-python/">Speech Recognition With Python</a></p>
<p>In this course, you’ll cover the fundamentals of speech recognition with Python. You’ll learn which speech recognition library gives the best results and build a full-featured “Guess The Word” game with it.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:51 – PyCon 2021 talk</li>
<li>00:20:54 – CPython Developer in Residence: Why did you want the role?</li>
<li>00:29:23 – Sponsor: DataStax Astra DB</li>
<li>00:29:55 – What were the expected responsibilities of the role?</li>
<li>00:35:47 – Working through BPO issues and GitHub pull requests</li>
<li>00:42:14 – Moving to migrate the systems</li>
<li>00:51:10 – Video Course Spotlight</li>
<li>00:52:26 – What trends can you see currently?</li>
<li>00:57:28 – Do you feel the amount of activity is increasing due to the role being in place?</li>
<li>01:03:46 – What skills would you look for in a person in this role?</li>
<li>01:07:26 – If there was a team of people how would things be different?</li>
<li>01:11:00 – How to follow along with the journey?</li>
<li>01:13:35 – Gathering and sharing data about the process</li>
<li>01:18:45 – What are you excited about in the world of Python?</li>
<li>01:25:04 – What do you want to learn next?</li>
<li>01:26:41 – Shout outs and plugs</li>
<li>01:31:36 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://www.youtube.com/watch?v=eKEjkB2bXK4">Generate buzz with realtime FM audio synthesis: PyCon 2021 Talk - YouTube</a></li>
<li><a href="https://polyend.com/medusa/">Limited Edition Medusa Black: Polyend</a></li>
<li><a href="https://lukasz.langa.pl/a072a74b-19d7-41ff-a294-e6b1319fdb6e/">I am the new CPython Developer in Residence</a></li>
<li><a href="https://lukasz.langa.pl/9f43819d-e9a5-4237-9ef6-a1f3b9a60b08/">Weekly Report, October 4 - 10: Łukasz Langa’s Blog</a></li>
<li><a href="https://talkpython.fm/episodes/show/331/meet-the-python-developer-in-residence-lukasz-langa">Meet the Python Developer in Residence: Lukasz Langa - Talk Python Podcast</a></li>
<li><a href="https://docs.python.org/3/howto/clinic.html">Argument Clinic How-To: Python docs</a></li>
<li><a href="https://www.python.org/dev/peps/pep-0594/">PEP 594 – Removing dead batteries from the standard library</a></li>
<li><a href="https://datasette.io">Datasette: An open source multi-tool for exploring and publishing data</a></li>
<li><a href="https://realpython.com/podcasts/rpp/80/">Episode 80: Make Your Python App Interactive With a Text User Interface (TUI)</a></li>
<li><a href="https://www.willmcgugan.com/blog/tech/post/doing-open-source-full-time/">Why I’m working on Open Source full time: Will McGugan</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/cool-new-features-python-310/">Cool New Features in Python 3.10</a></li>
<li><a href="https://realpython.com/courses/speech-recognition-python/">Speech Recognition With Python</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
#331: Meet the Python Developer in Residence: Lukasz Langa
See the full show notes for this episode on the website at talkpython.fm/331
Securing Your Python Software Supply Chain With Dustin Ingram
<p>How well do you know your software supply chain? When you PIP install a package, what steps can you take to minimize the risk of installing something malicious? This week on the show, we have Dustin Ingram, a director of the Python Software Foundation (PSF) and a maintainer of the Python Package Index (PyPI).</p>
<p>We talk about Dustin’s PyCon 2021 talk titled “Secure Software Supply Chains for Python”. Dustin shares the types of attacks you should be aware of and how you can make your supply chain more trustworthy. We cover tools, techniques, and best practices.</p>
<p>Dustin also discusses what it takes to keep the Python Package Index running and the players working to keep it going into the future.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/what-is-pip/">A Beginner’s Guide to Pip</a></p>
<p>This course is a great introduction to pip for those who are getting started Python, and for those who want to understand more about what is happening when you install new packages into your environment. It’s a worthy investment of your time to understand the fundamentals of pip.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:51 – Developer Advocate at Google</li>
<li>00:04:34 – A director of the PSF</li>
<li>00:06:27 – A maintainer of PyPI</li>
<li>00:12:29 – Secure Software Supply Chains for Python - PyCon 2021</li>
<li>00:15:53 – Do I need to be a security expert as a Python developer?</li>
<li>00:17:23 – Typo-squatting of package names</li>
<li>00:19:46 – Sponsor: Scout APM</li>
<li>00:20:52 – Dependency confusion and private repos</li>
<li>00:26:00 – What are some best practices?</li>
<li>00:31:55 – How to lessen the scale of “I don’t know what I don’t know”?</li>
<li>00:36:33 – Tools and techniques that can help </li>
<li>00:44:11 – Video Course Spotlight</li>
<li>00:45:30 – Namespaces on PyPI</li>
<li>00:53:03 – What does it take to power the Python Package Index?</li>
<li>01:01:57 – What are you excited about in the world of Python?</li>
<li>01:03:55 – What do you want to learn next?</li>
<li>01:05:52 – What is something you thought you knew about Python, but were wrong about it?</li>
<li>01:08:46 – Shout outs and social information</li>
<li>01:10:16 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://dustingram.com/">Dustin Ingram: Personal Website</a></li>
<li><a href="https://cloud.google.com/python/">Python on Google Cloud</a></li>
<li><a href="https://cloud.google.com/run">Cloud Run: Develop and deploy highly scalable containerized applications on a fully managed serverless platform</a></li>
<li><a href="https://www.python.org/psf-landing/">Python Software Foundation</a></li>
<li><a href="https://www.python.org/psf/membership/">PSF Membership FAQ</a></li>
<li><a href="https://pypi.org/">PyPI: The Python Package Index</a></li>
<li><a href="https://www.youtube.com/watch?v=VWWgkF-0cDQ">Secure Software Supply Chains for Python: PyCon 2021 - YouTube</a></li>
<li><a href="https://pip.pypa.io/en/latest/user_guide/#requirements-files">pip Documentation: Requirements Files</a></li>
<li><a href="https://pip.pypa.io/en/latest/cli/pip_install/#hash-checking-mode">pip Documentation: Hash-Checking Mode</a></li>
<li><a href="https://www.python.org/dev/peps/pep-0440/#direct-references">PEP-0440: Direct references for pip</a></li>
<li><a href="https://pypi.org/project/pip-tools/">pip-tools: pip-tools keeps your pinned dependencies fresh</a></li>
<li><a href="https://packaging.python.org/">PyPA: Python Packaging User Guide</a></li>
<li><a href="https://theupdateframework.io/">The Update Framework (TUF)</a></li>
<li><a href="https://pypi.org/project/tuf/">tuf: A secure updater framework for Python</a></li>
<li><a href="https://pypi.org/project/pipx/">pipx: Install and Run Python Applications in Isolated Environments</a></li>
<li><a href="https://realpython.com/pypi-publish-python-package/">How to Publish an Open-Source Python Package to PyPI - Real Python Article</a></li>
<li><a href="https://python-poetry.org/">Poetry: Python packaging and dependency management made easy</a></li>
<li><a href="https://pyup.io/">PyUp: Python Dependency Security</a></li>
<li><a href="https://dependabot.com/">Dependabot: Automated dependency updates</a></li>
<li><a href="https://caremad.io/posts/2013/07/packaging-signing-not-holy-grail/">Why Package Signing is not the Holy Grail: Donald Stufft</a></li>
<li><a href="https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610">Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies</a></li>
<li><a href="https://realpython.com/what-is-pip/">What Is Pip? A Guide for New Pythonistas - Real Python Article</a></li>
<li><a href="https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack">A ‘Worst Nightmare’ Cyberattack: The Untold Story Of The SolarWinds Hack</a></li>
<li><a href="https://pythonspeed.com/articles/docker-python-security-scan/">Security scanners for Python and Docker: from code to dependencies</a></li>
<li><a href="https://dustingram.com/articles/2021/04/14/powering-the-python-package-index-in-2021/">What does it take to power the Python Package Index?</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/what-is-pip/">A Beginner's Guide to pip</a></li>
<li><a href="https://realpython.com/courses/how-to-publish-your-own-python-package-pypi/">How to Publish Your Own Python Package to PyPI</a></li>
<li><a href="https://realpython.com/courses/python-modules-packages/">Python Modules and Packages: An Introduction</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Expanding the International Python Community With the PSF
<p>The popularity of Python is continuing to grow Developers across the globe are embracing the language. How is Python being used in all of these different countries? How does an organization like the Python Software Foundation (PSF) work toward the goals in its mission statement for supporting and growing this international community? This week on the show, we have Marlene Mhangami, a PSF board member and part of the Diversity and Inclusion Work Group.</p>
<p>Marlene lives in Zimbabwe on the continent of Africa. She has been organizing events not only locally in Zimbabwe but across all of Africa. She is the chair of Pycon Africa and has given talks at Pycon US, Pycon UK, and Pycon India. </p>
<p>She has been working locally as an organizer and educator. We talk about the challenges of teaching technology and programming to a population of young people. Some of these students don’t have access to computers.</p>
<p>She is also currently pursuing a computer science degree with the University of London. Along with her studies, she is also interning with NVidia. She is working with them on the RAPIDS project with a focus on the cuDF library.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Spotlight:</strong> <a href="https://realpython.com/courses/intro-sorting-algorithms/">Introduction to Sorting Algorithms in Python</a></p>
<p>In this course, you’ll learn all about five different sorting algorithms in Python from both a theoretical and a practical standpoint. You’ll also learn several related and important concepts, including Big O notation and recursion.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:05 – Connecting during PyCon 2021</li>
<li>00:03:08 – Roles with the Python Software Foundation (PSF)</li>
<li>00:05:39 – Python in Africa</li>
<li>00:10:31 – School overseas and return to Zimbabwe to build a Python community</li>
<li>00:13:47 – Teaching technology and Python to students who don’t have computers</li>
<li>00:22:14 – Sponsor: Digital Ocean’s App Platform</li>
<li>00:22:50 – Work with the PSF and building geographic diversity</li>
<li>00:27:49 – PSF work groups</li>
<li>00:32:10 – Organizing PyCon Africa 2019 and bringing a continent of communities together</li>
<li>00:35:51 – How is Python being used in Africa?</li>
<li>00:38:05 – Video Course Spotlight</li>
<li>00:39:24 – Working with NVidia RAPIDS and cuDF</li>
<li>00:43:57 – What are you excited about in the world of Python?</li>
<li>00:46:12 – What do you want to learn next?</li>
<li>00:52:45 – What is something you thought you knew about Python but were wrong about it?</li>
<li>00:59:41 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="http://marlenemhangami.com/">Marlene Mhangami: Personal Website</a></li>
<li><a href="https://www.python.org/psf-landing/">Python Software Foundation</a></li>
<li><a href="https://www.python.org/psf/membership/">PSF Membership</a></li>
<li><a href="https://www.youtube.com/playlist?list=PL2Uw4_HvXqvYk1Y5P8kryoyd83L_0Uk5K">PyCon US 2021: YouTube Playlist</a></li>
<li><a href="https://realpython.com/interview-marlene-mhangami/">Real Python Interview With Marlene Mhangami</a></li>
<li><a href="https://www.youtube.com/watch?v=43wJnYZ6Zd0&list=PLxhxnAekZnZB5VA-4Twr7daw5PPuEJ3WM">PyCon Africa Conference 2019 Highlights & Interviews: YouTube</a></li>
<li><a href="https://djangogirls.org/">Django Girls</a></li>
<li><a href="https://rapids.ai/">RAPIDS: Open GPU Data Science</a></li>
<li><a href="https://developer.nvidia.com/blog/10-minutes-to-data-science-transitioning-between-rapids-cudf-and-cupy-libraries/">10 Minutes to Data Science: Transitioning Between RAPIDS cuDF and CuPy Libraries</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/gradebook-using-pandas-python/">Using pandas to Make a Gradebook in Python</a></li>
<li><a href="https://realpython.com/courses/python-3-concurrency-asyncio-module/">Hands-On Python 3 Concurrency With the asyncio Module</a></li>
<li><a href="https://realpython.com/courses/intro-sorting-algorithms/">Introduction to Sorting Algorithms in Python</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Every commit is a gift (Interview)
Maintainer Week is finally here and we’re excited to make this an annual thing! If Maintainer Week is new to you, check out episode #442 with Josh Simmons and Kara Sowles.
Today we’re talking Brett Cannon. Brett is Dev Manager of the Python Extension for VS Code, Python Steering Council Member, and core team member for Python. He recently shared a blog post The social contract of open source, so we invited Brett to join us for Maintainer Week to discuss this topic in detail.
Thank a maintainer on us! We’re printing a limited run t-shirt that’s free for maintainers, and all you gotta do is thank them, today!
Join the discussion
Changelog++ members save 4 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
InfluxDB – InfluxDB empowers developers to build IoT, analytics, and monitoring software. It’s purpose-built to handle massive volumes and countless sources of time-stamped data produced by sensors, applications, and infrastructure. Learn about the wide range of use cases of InfluxDB at influxdata.com/changelog
Retool – Retool is a low-code platform built specifically for developers that makes it fast and easy to build internal tools. Instead of building internal tools from scratch, the world’s best teams, from startups to Fortune 500s, are using Retool to power their internal apps. Learn more and try it for free at retool.com/changelog
CloudZero – For software-driven companies focused on growing margins, CloudZero is the only cloud cost intelligence platform that puts engineering in control by connecting technical decisions to business results. Visit cloudzero.com/changelog to get started.
Grafana Cloud – Our dashboard of choice Grafana is the open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.
Featuring:
Brett Cannon – Website, GitHub, LinkedIn, Bluesky, Mastodon
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
The social contract of open source
github/maintainerweek
Upstream
Global Maintainer Summit also accessible via maintainerds.com
Something missing or broken? PRs welcome!
#221 Pattern matching and accepting change in Python with Brett Cannon
Topics covered in this episode:
Keeping up with Rich
12 requests per second
Python Launcher for Unix reaches RC (probably 😉)
Build a text editor with Python and curses
Pattern matching and accepting change in Python
A Quick Intro to Structural Pattern Matching in Python
Extras
Joke
See the full show notes for this episode on the website at pythonbytes.fm/221
Unraveling Python's Syntax to Its Core With Brett Cannon
<p>Do you feel like you understand how Python works under the hood? What is syntactic sugar, and how much of it should be in Python? This week on the show, we have Brett Cannon. Brett is a Python core developer and he’s been working on a series of articles where he is unraveling the syntax of Python. His series is a fantastic resource for those wanting to learn how Python is structured and works at its core.</p>
<p>Brett wants to see a version of Python that can run in web browsers, so he started to breakdown Python into its syntactic elements to try to answer the question, what are core elements of Python? His detailed series takes the reader along for the ride.</p>
<p>Brett also works at Microsoft as the dev manager for the Python extension for VS Code. Brett is also serving his third term on the Python steering council, and we discuss recent Python enhancement proposals (PEP) that the council is considering.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/cool-new-features-python-39/">Cool New Features in Python 3.9</a> </p>
<p>In this course, you’ll explore some of the coolest and most useful features in the newly released Python 3.9. You’ll learn how Python 3.9 makes it easier to work with time zones, dictionaries, decorators, and several other techniques that will make your code cleaner and more efficient.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:01:43 – Working on the Python extension for VSCode</li>
<li>00:04:17 – Microsoft and the Python community</li>
<li>00:07:19 – How long have worked on core Python? </li>
<li>00:11:49 – Ways to contribute to core Python</li>
<li>00:14:19 – Upcoming features and PEPs </li>
<li>00:15:41 – Pattern matching PEPs</li>
<li>00:17:48 – Sponsor: Digital Ocean</li>
<li>00:18:29 – Being a member of the Python Steering Council </li>
<li>00:21:10 – Unravelling Python’s syntatic sugar series</li>
<li>00:24:39 – Magic methods, dunder methods, or special methods</li>
<li>00:27:07 – Are there ways that syntatic sugar can be overused?</li>
<li>00:33:31 – WebAssembly and Python being available in the browser</li>
<li>00:45:51 – Does Circuit Python or MicroPython show a path?</li>
<li>00:52:37 – Video Course Spotlight</li>
<li>00:53:41 – Taking Python syntax down to the implementation layer</li>
<li>01:03:21 – Taking apart Python’s syntax </li>
<li>01:16:07 – What other parts of Python syntax will you be unravelling?</li>
<li>01:24:04 – What are you excited about in the world of Python?</li>
<li>01:26:46 – What do you want to learn next?</li>
<li>01:31:24 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://snarky.ca/">snarky.ca : Brett Cannon’s Blog</a></li>
<li><a href="https://snarky.ca/tag/syntactic-sugar/">syntactic sugar series: Brett Cannon’s Blog </a></li>
<li><a href="https://github.com/brettcannon/desugar">desugar: Unravelling Python’s Syntactic Sugar Source Code</a></li>
<li><a href="https://code.visualstudio.com/">Visual Studio Code</a></li>
<li><a href="https://code.visualstudio.com/docs/languages/python">Python in Visual Studio Code</a></li>
<li><a href="https://mail.python.org/mailman3/">Python Mailing Lists</a></li>
<li><a href="https://www.python.org/community/lists/">Python Community: Mailing Lists</a></li>
<li><a href="https://www.python.org/dev/peps/pep-0013/">PEP-0013 - Python Language Governance</a></li>
<li><a href="https://www.python.org/dev/peps/">PEP 0 – Index of Python Enhancement Proposals (PEPs)</a></li>
<li><a href="https://webassembly.org/">WebAssembly (WASM)</a></li>
<li><a href="https://docs.python.org/3/library/ast.html">ast — Abstract Syntax Trees: Python Documentation</a></li>
<li><a href="https://docs.pytest.org/en/stable/">pytest: helps you write better programs</a></li>
<li><a href="https://www.youtube.com/watch?v=R31NRWgoIWM">From Source to Code: How CPython’s Compiler Works - Brett Cannon - YouTube</a></li>
<li><a href="https://www.youtube.com/watch?v=Nsg886UOahw&list=PL4S0lvhXvdhIV2C28Ia_DeIeloBrsQBOW&index=2">How Import Works - Brett Cannon - PyConAr 2012</a></li>
<li><a href="https://www.youtube.com/watch?v=-Nk-8fSJM6I&list=PL4S0lvhXvdhIV2C28Ia_DeIeloBrsQBOW&index=17">Brett Cannon: Setting Expectations for Open Source Participation - PyCascade 2018</a></li>
<li><a href="https://realpython.com/inner-functions-what-are-they-good-for/">Python Inner Functions: What Are They Good For? - Real Python Article</a></li>
<li><a href="https://realpython.com/podcasts/rpp/22/">E22: Create Cross-Platform Python GUI Apps With BeeWare</a></li>
<li><a href="https://realpython.com/podcasts/rpp/18/">E18: Ten Years of Flask: Conversation With Creator Armin Ronacher</a></li>
<li><a href="https://realpython.com/podcasts/rpp/7/">E7: AsyncIO + Music, Origins of Black, and Managing Python Releases</a></li>
<li><a href="https://2021.pycascades.com/">PyCascades 2021</a></li>
<li><a href="https://elixir-lang.org/">Elixir: A Dynamic, Functional Language Designed for Building Scalable and Maintainable Applications</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/python-decorators-101/">Python Decorators 101</a></li>
<li><a href="https://realpython.com/courses/managing-python-dependencies/">Managing Python Dependencies</a></li>
<li><a href="https://realpython.com/courses/cool-new-features-python-39/">Cool New Features in Python 3.9</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>
Naomi Ceder Interview - 20 Years with Python (part 2)
🌎 Naomi On the Web
About
The Quick Python Book
Twitter
Personal Website
The Python Software Foundation
📮 Ask a Question
If you enjoyed this episode and would like me to discuss a question that you have on the show, drop it over at: developertea.com.
🧡 Leave a Review
If you're enjoying the show and want to support the content head over to iTunes and leave a review! It helps other developers discover the show and keep us focused on what matters to you.
Naomi Ceder Interview - 20 Years with Python (part 1)
🌎 Naomi On the Web
About
The Quick Python Book
Twitter
Personal Website
📮 Ask a Question
If you enjoyed this episode and would like me to discuss a question that you have on the show, drop it over at: developertea.com.
🧡 Leave a Review
If you're enjoying the show and want to support the content head over to iTunes and leave a review! It helps other developers discover the show and keep us focused on what matters to you.
