← Feed

Posts

• Post #4262040

  Can Claude design a secure system that even Claude cannot break into?

• Post #3017153

  Finally home. Seven speaking spots across seven days, three conferences in two states, many miles apart. Now some rest. #PyConUS #OSSummit #OpenSSFCommunity

• Post #3017152

  @AlSweigart here's a bad one: "Free apps" == "fapps"

• Post #3017151

  I wonder who I know that knows someone at HackerOne that can convey the message that PyPI explicitly disallows security research packages, and bans users who upload them. Put that in a notice to your users somewhere prominent - since it's become pervasive and a drain on resources. This also takes time away from legitimate security incident response - so it's a net negative for the world.

• Post #3017150

  One behavioral modification of doing career switches between individual contributor and manager (and back!) is that manager-speak trains you to use "we" when referring to the work your team has accomplished, since it's not "you" per se - giving credit where credit is due The problem is when you then work somewhere as a team-of-one, like #PyPI #Security. It's astonishing how many folks think there's a whole team here, when it's...

• Post #3017149

  RE: https://mastodon.social/@andrewnez/116652324434840347 Excellent blog on the turducken problem of package managers

• Post #3017148

  What do I do on a day off? Spend time on non-security work, refactoring #OpenSource projects to try a new idea I had. Sometimes it's really hard to turn the brain off...

• Post #2543532

  If you're attending #PyConUS and want to find me, I'm likely to be found: - Thursday evening Reception, PSF Booth - Friday afternoon, Packaging Summit - Saturday, before lunch, #Security Track - Saturday, after lunch, Maintainers Summit - Sunday morning, Keynote Stage, Update from Security Engineers Find these and more on the PyCon US Mobile app. Pro Tip: sign in with your registration details to favorite sessions: https://us.pycon.org/2026/attend/onsite-information/#:~:text=PyC...

• Post #2093717

  There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects. TL,DR: Adopt Trusted Publishing 🔐🚀📦 https://blog.pypi.org/posts/2025-11-26-pypi-and-shai-hulud/

• Post #1686511

  Does your org run a self-managed version of GitLab and publish your own #Python packages to @pypi ? If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.

• Post #1262315

  RE: https://fosstodon.org/@pypi/116414611218430369 It's still awesome to me that I get to work on some really hard problems for the common good. This was a lot of work, hope you enjoy the read!

• Post #1131899

  Incident Report of the recent #PyPI Phishing Campaign TL,DR: • PyPI was not breached • PyPI users were targeted with phishing emails • A single project saw uploads with malicious code and those releases have been removed https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/ #Python #OpenSource #Security

• Post #1112139

  Any time I see something like this in a #Python REPL, I can't help but smile for two reasons: 1. Yes, yes I did forget. 2. I know some of the folks who worked so hard to make that message do exactly what I want it to do. Thanks to Pablo, @ambv, and so many others! #OpenSource

• Post #803868

  Whoa. Cool

• Post #803867

  I really liked this notice that the @biomejs maintainers put in one of their discussions on GitHub. Hopefully folks read it, sadly I suspect the abusers won't #OpenSource #Maintainer #Sustainability

• Post #803866

  RE: https://fosstodon.org/@pypi/116165865450616991 Thanks @fastlydevs for taking some time to ask me questions and share my responses - it's quite unique to work on a system like this

• Post #803865

  <personal-rant> Publishing projects to PyPI without a source distribution, links to a source codebase, or other indications of "what might be in this binary package"? is definitely a smell to me when I'm evaluating which projects I want to rely upon. So many projects advertise an #OpenSource License like MIT and Apache-2.0 and do not supply any sources in the "obvious" spots. </personal-rant>

• Post #803862

  There are many problems with trust-based systems. We can add all the cryptographic proofs we want, all the monitors and witnesses, but ultimately if the end-consumer doesn't understand well enough how these layers add trustworthiness, they won't trust the trust system itself, much less the original system. So we're back to where we started, but we added piles of complexity, ossification of protocols and interchanges. Ultimately, you kind of have to trust someone or somet...

• Post #803861

  Pro tip: If you use @ohmyzsh #python plugin, AND use https://starship.rs/ for prompt decorations, AND set `PYTHON_AUTO_VRUN=true` to automatically activate a virtualenv when you enter a directory, you may see your starship prompt lose it's style when navigating away in certain circumstances. The fix is to tell the python plugin to leave the prompt alone since starship will handle it with: `VIRTUAL_ENV_DISABLE_PROMPT=1` in your .zshrc #shell

• Post #777189

  RE: https://hachyderm.io/@sustainoss/115707191758680464 This is a great podcast that discusses some of the details by @lorenipsum and @BajoranEngineer on @ThePSF 's rejection of the NSF grant conditions. "We are ALL spine 🐍 " --Loren

• Post #324036

  New @pypi blog TL, DR: - Trusted Publishing used for 25% of all files uploaded in Oct 2025 - GitLab Self-Managed now in beta - Pending Publishers can be added for Organizations, too! #Python #SupplyChain #Security Read it here: https://blog.pypi.org/posts/2025-11-10-trusted-publishers-coming-to-orgs/

• Post #282779

  Twas the day before #FOSDEM

• Post #282776

  On my way home from #FOSDEM The sheer amount of passion that is created by thousands of people from so many diverse backgrounds and perspectives, with so many ideas and opinions about #OpenSource is infectious and magical, even if for only a short time. It was great seeing old friends and making new ones, hope to see you in the commit logs soon!

• Post #282775

  Since you can never be _everywhere_ you want to be at #FOSDEM, sometimes you have to watch back some of the dev room talks you missed. @a from the @rustfoundation gave a great talk: A phishy case study - attacks on crates.io and others (namely @pypi and npmjs.com ) https://fosdem.org/2026/schedule/event/GFA3RJ-a_phishy_case_study/ Go watch it.

• Post #282773

  PyPI does not exist to be your personal or commercial software distribution platform, especially if you intentionally obfuscate your code. The @osi definition includes: > Deliberately obfuscated source code is not allowed. More: https://opensource.org/osd