← Feed

Posts

• Post #4501958

  following PEP 833, Python packaging now considers the HTML index representation frozen! I’m really happy we got this out: IMO it’s a small but very important step towards nudging clients to prefer the JSON index, which is better in every regard. https://blog.pypi.org/posts/2026-08-11-html-index-is-frozen/

• Post #4386177

  my keynote from europython is online! https://youtu.be/wMPe_KepOjc #python #europython

• Post #3859774

  README, not https://blog.yossarian.net/2026/07/16/README-not #ai #oss

• Post #3719373

  why tf am I a shower head

• Post #3649022

  You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss

• Post #3543838

  i think people grossly underestimate the importance/value of psychological safety in tool/systems design. the single biggest contributor to whether I feel like I'm interacting with a janky system is when there are multiple conflicting sources of truth/"correct" solutions and no obvious decision procedure for selecting among them.

• Post #3497801

  intuition check: what would you expect this Rust snippet to print? ``` use itertools::Itertools; fn main() { let p = std::path::Path::new("/a/b/c"); let s = p.components().map(|c| c.as_os_str().to_string_lossy()).join("/"); println!("s={s:?}"); } ```

• Post #3404077

  GitHub just shipped parallel step support in GHA, which means I get to combine my two favorite things about computing: CI/CD security and race conditions

• Post #3142662

  huge thanks to @veeso_dev for sponsoring me on GitHub! (sponsors are part of what keeps zizmor sustainable. please consider sponsoring!)

• Post #3142661

  @trailofbits recently spent several months contributing to zizmor, and wrote up their improvements here: https://blog.trailofbits.com/2026/05/22/we-hardened-zizmors-github-actions-static-analyzer/ This work was really great: they got into some of the low and ugly bits that I’ve been procrastinating on, and in the process made zizmor significantly more correct and useful. Thanks to @DarkaMaul in particular for his hard and thoughtful work on anchors and expression parsing correctness!

• Post #3142660

  I actually can't think of a more frustrating place to put this button

• Post #3142659

  gentleman's medium, n.: assigning a low-sev vulnerability a medium to get the reporter to stop quoting CVSS metrics as you

• Post #3142658

  this repo's issue indexing has been broken for over two weeks

• Post #3142657

• Post #3142656

  on one hand, the competitive market is a compelling theory. on the other hand, billions of dollars have failed to produce an EDR that doesn’t suck shit

• Post #3142655

  copilot was already pretty mid, impressive how they’ve managed to make me dislike it even more by exhausting my quota on nothing except inline suggestions in…24 hours

• Post #3142654

  this MSRC saga seems destined to be canonized as an almost flawless example of how to implode community trust in a security setting through entirely unforced errors

• Post #3142653

  slopping my hogs (prompting my agents)

• Post #2543529

  it's not pull_request_target there's no way it's pull_request_target it was pull_request_target

• Post #2015765

  people somewhat frequently complain about Python packaging’s assumption that each package can only resolve to a single version, but I actually think that was a pretty great outcome compared to having 3+ incompatible versions of the same package in your dep tree. Good example of constraints (even unintended ones) being liberating

• Post #1936422

  my team at @trailofbits is adding verifiable build provenance to @homebrew, in partnership with Alpha-Omega and the @openssf! this work will secure the packages that millions of macOS and Linux developers depend on: https://blog.trailofbits.com/2023/11/06/adding-build-provenance-to-homebrew/

• Post #1936418

  i'm really happy this is finally public: we at @trailofbits did an audit of @homebrew last summer: https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/ you can read our full report here: https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf

• Post #1849796

  it's cool when you spend 10 minutes writing an issue and GitHub decides to route it straight to hell instead

• Post #1849795

  Registering my dissatisfaction with GitHub https://blog.yossarian.net/2026/04/29/Registering-my-dissatisfaction-with-GitHub #oss

• Post #1590325

  I'm starting to think that the civic/community/sustainability risks around LLMs in open source are a little more of the "eternal September" variety than I originally believed

• Post #1590324

  the best part about filing taxes in NYC is getting grilled about yonkers

• Post #1308239

  zizmor 1.24 is released! lots of bugfixes and features/enhancements: https://docs.zizmor.sh/release-notes/#1240

• Post #1090636

  Brocards for vulnerability triage https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerability-triage #security #oss

• Post #1052603

  zizmor 1.9.0 is released! this is not a very big release in terms of visible features, but it comes with a handful of bugfixes and a lot of internal changes. in particular, the `template-injection` audit should both be faster overall *and* more correct/sensitive to true findings, thanks to a significant internal refactor. full release notes here: https://docs.zizmor.sh/release-notes/#190 #opensource #rust #security

• Post #1038128

  the last two weeks have been ~exciting~ in terms of open source security! I've put together a post on Astral's blog about how we think about open source security: https://astral.sh/blog/open-source-security-at-astral