#557: Security of everything at PyCon 2026
Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.
On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.
We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.
Episode sponsors
Sentry Error Monitoring, Code talkpython26
Talk Python Courses
Links from the show
Guests
Juanita Gomez: linkedin.com
Mike Fiedler: miketheman.dev
Seth Michael Larson: sethmlarson.dev
Trailblazing Python Security: us.pycon.org
Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com
Dependency Cooldowns: cooldowns.dev
Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com
FedRAMP: www.gsa.gov
Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com
Rust for CPython project: blog.python.org
pre-PEP: discuss.python.org
Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com
SBOMit: github.com
Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com
Volatility: volatilityfoundation.org
Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com
zizmor: docs.zizmor.sh
GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io
andrew/pycon: data & analysis for the GitHub Actions security talk: github.com
GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com
gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com
PyCon US YouTube channel: www.youtube.com
SBOMit: adding verification to SBOMs (OpenSSF): openssf.org
Ecosystems: ecosyste.ms
Watch this episode on YouTube: youtube.com
Episode #557 deep-dive: talkpython.fm/557
Episode transcripts: talkpython.fm
Theme Song: Developer Rap
🥁 Served in a Flask 🎸: talkpython.fm/flasksong
---== Don't be a stranger ==---
YouTube: youtube.com/@talkpython
Bluesky: @talkpython.fm
Mastodon: @talkpython@fosstodon.org
X.com: @talkpython
Michael on Bluesky: @mkennedy.codes
Michael on Mastodon: @mkennedy@fosstodon.org
Michael on X.com: @mkennedy
Helping Securing the Python with Mike Fiedler
On this Screaming in the Cloud In this episode of Screaming in the Cloud, Corey Quinn is joined by AWS container hero and security engineer at the Python Software Foundation, Mike Fiedler. They delve into the intricacies of Python's ecosystem, discussing the evolution of PyPI, its significance, and the ongoing battles against security threats like account takeover attacks and typo-squatting. Mike sheds light on his role in maintaining the security and reliability of the Python Package Index, the importance of 2FA, and the collaborative efforts with security researchers. Corey and Mike also explore the challenges and philosophies surrounding legacy systems versus greenfield development, with insights on maintaining critical infrastructure and the often-overlooked aspects of social engineering.
Show Highlights
(0:00) Introduction
(0:47) The Duckbill Group sponsor read
(1:21) Breaking down the Python nomenclature and its usability
(5:49) Figuring out how Boto3 is one of the most downloaded packages
(6:43) Why Mike is the only full-time security and safety engineer at the Python Software Foundation
(9:53) How the Python Software Foundation affords to operate
(14:17) Mike's stack security work
(16:14) The Duckbill Group sponsor read
(16:57) Having the "impossible job" of stopping supply chain attacks
(21:00) The dangers of social engineering attacks
(24:44) Why Mike prefers to work on legacy systems
(33:30) Where you can find more from Mike
About Mike Fiedler
Mike Fiedler is a highly analytical, forward-thinking Information Technology professional. His broad-based background includes systems administration and engineering in global environments. Mike is technically astute and versatile with ability to quickly learn, master, and leverage new technologies to meet business needs and has a track record of success in improving performance, stability, and security for all infrastructure and product initiatives.
Mike is also bilingual, speaks English and Hebrew, and he loves solving puzzling problems.
Links
Mike’s Mastadon: https://hachyderm.io/@miketheman
Mike’s Bluesky: https://bsky.app/profile/miketheman.com
Mike’s Python Software Foundation blog posts: https://blog.pypi.org/
The Python Package Index Safety & Security Engineer: First Year in Review: https://blog.pypi.org/posts/2024-08-16-safety-and-security-engineer-year-in-review/
Sponsor
The Duckbill Group: duckbillgroup.com
Who’s Keeping the Python Ecosystem Safe?
Mike Fiedler, a PyPI safety and security engineer at the Python Software Foundation, prefers the title “code gardener,” reflecting his role in maintaining and securing open source projects. Recorded at PyCon US, Fiedler explains his task of “pulling the weeds” in code—handling unglamorous but crucial aspects of open source contributions. Since August, funded by Amazon Web Services, Fiedler has focused on enhancing the security of the Python Package Index (PyPI). His efforts include ensuring that both packages and the pipeline are secure, emphasizing the importance of vetting third-party modules before deployment.
One of Fiedler’s significant initiatives was enforcing mandatory two-factor authentication (2FA) for all PyPI user accounts by January 1, following a community awareness campaign. This transition was smooth, thanks to proactive outreach. Additionally, the foundation collaborates with security researchers and the public to report and address malicious packages.
In late 2023, a security audit by Trail of Bits, funded by the Open Technology Fund, identified and quickly resolved medium-sized vulnerabilities, increasing PyPI's overall security. More details on Fiedler's work are available in the full interview video.
Learn more from The New Stack about PyPl:
PyPl Strives to Pull Itself Out of Trouble
How Python Is Evolving
Poisoned Lolip0p PyPI Packages
Join our community of newsletter subscribers to stay on top of the news and at the top of your game.
Welcoming PyPI's Safety & Security Engineer Mike Fiedler
<p>You may remember a recent Python Package Index (PyPI) announcement about hiring a full-time security engineer. We’ve also mentioned several current security initiatives from PyPI. This week on the show, we talk with Mike Fiedler about accepting this new role and securing accounts on PyPI.</p>
<p>Mike talks about how he started as a contributor to PyPI and eventually became a maintainer. We dig into why he fits this new role well and what his responsibilities are.</p>
<p>We discuss the initiative to secure accounts using two-factor authentication (2FA) methods. Mike also explains how package maintainers can adopt a new, more secure publishing method called trusted publishing that doesn’t require long-lived passwords.</p>
<p>We also discuss Mike’s recent talk called “How to Give Back to Open Source Without Losing Your Mind.” Mike shares advice and resources for finding your own contribution entry points.</p>
<div class="alert alert-primary" role="alert">
<p><strong>Course Spotlight:</strong> <a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></p>
<p>In this video course, you’ll learn how to create a Python package for your project and how to publish it to PyPI, the Python Package Index. Quickly get up to speed on everything from naming your package to configuring it using <code>setup.cfg</code>.</p>
</div>
<p>Topics:</p>
<ul>
<li>00:00:00 – Introduction</li>
<li>00:02:11 – PyPI Safety and Security Engineer</li>
<li>00:05:21 – Why did you initially become a PyPI contributor?</li>
<li>00:11:26 – What are you most excited about in your new role?</li>
<li>00:12:02 – Current security concerns</li>
<li>00:15:07 – Focus on malicious package reporting</li>
<li>00:16:30 – 2FA enforcement and building trust</li>
<li>00:26:51 – Managing credentials and password managers</li>
<li>00:29:24 – Forms of 2FA </li>
<li>00:31:48 – Trusted publishers</li>
<li>00:38:08 – Video Course Spotlight</li>
<li>00:39:28 – Updating an older project</li>
<li>00:41:44 – Evolution of security</li>
<li>00:43:06 – Typosquatting and evolving security</li>
<li>00:49:13 – How To Give Back to Open Source Without Losing Your Mind</li>
<li>00:52:48 – What are you excited about in the world of Python?</li>
<li>00:54:45 – What do you want to learn next?</li>
<li>00:57:06 – How can people follow your work online?</li>
<li>00:57:37 – Thanks and goodbye</li>
</ul>
<p>Show Links:</p>
<ul>
<li><a href="https://blog.pypi.org/posts/2023-08-04-pypi-hires-safety-engineer/">PyPI hires a Safety & Security Engineer - The Python Package Index</a></li>
<li><a href="https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/">Inbound Malware Volume Report - The Python Package Index</a></li>
<li><a href="https://blog.pypi.org/posts/2023-08-08-2fa-enforcement-for-new-users/">2FA Enforcement for New User Registrations - The Python Package Index</a></li>
<li><a href="https://pypi.org/security-key-giveaway/">PyPI 2FA Security Key Giveaway - PyPI</a></li>
<li><a href="https://www.ntia.gov/page/software-bill-materials">Software Bill Of Materials - National Telecommunications and Information Administration</a></li>
<li><a href="https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/">Introducing ‘Trusted Publishers’ - The Python Package Index</a></li>
<li><a href="https://docs.pypi.org/trusted-publishers/">Trusted Publishers - Getting Started - PyPI Docs</a></li>
<li><a href="https://vbrownbag.com/2023/05/episode-followup-how-to-give-back-to-open-source-without-losing-your-mind/">How To Give Back to Open Source Without Losing Your Mind – vBrownBag</a></li>
<li><a href="https://goodfirstissues.dev">Good First Issues - OpenSauced</a></li>
<li><a href="http://goodfirstissues.com/">Good First Issues</a></li>
<li><a href="https://hacktoberfest.com/participation/">Participation - Hacktoberfest 2023</a></li>
<li><a href="https://www.python.org/downloads/release/python-3120/">Python Release Python 3.12.0 - Python.org</a></li>
<li><a href="https://htmx.org/"></> htmx - high power tools for html</a></li>
<li><a href="https://www.djangoproject.com/">The web framework for perfectionists with deadlines - Django</a></li>
<li><a href="https://blog.pypi.org/">The Python Package Index - Blog</a></li>
<li><a href="https://fosstodon.org/@miketheman@hachyderm.io">Mike Fiedler, Code Gardener (@miketheman@hachyderm.io) - Fosstodon</a></li>
<li><a href="https://twitter.com/mikefiedler">Mike Fiedler, Code Gardener (@mikefiedler) / X</a> </li>
<li><a href="https://mike.fiedler.me/">Mike Fiedler’s personal website</a></li>
</ul>
<p>Level up your Python skills with our expert-led courses:</p>
<ul>
<li><a href="https://realpython.com/courses/what-is-pip/">A Beginner's Guide to pip</a></li>
<li><a href="https://realpython.com/courses/packaging-with-pyproject-toml/">Everyday Project Packaging With pyproject.toml</a></li>
<li><a href="https://realpython.com/courses/pypi-publish-python-package/">Publishing Python Packages to PyPI</a></li>
</ul> <p><a rel="payment" href="https://realpython.com/join">Support the podcast & join our community of Pythonistas</a></p>