Brett Cannon

#Python core developer; snarky #Canadian

Sponsor: https://github.com/sponsors/brettcannon/
Blog: https://snarky.ca
GitHub: https://github.com/brettcannon/
Notes: https://opensource.snarky.ca

Public Key

npub139gmplm2d5syujhrat2gx6gutampwx5cz9el7qr02a6r0tj3xycsrjcwvw

NIP-05 Address

brettcannon_at_mastodon.social@momostr.pink

Profile Code

nprofile1qqsgj5dsla4x6gzwft3744yrdyw97ashr2vpzullqph4waph4egnzvgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsushcdl

Publishing to

offchain.pub

relay.damus.io

nos.lol

Author Public Key

npub139gmplm2d5syujhrat2gx6gutampwx5cz9el7qr02a6r0tj3xycsrjcwvw

Show more details

Last Notes

2026-05-25 23:35:25 UTC

That feeling when you're well into your 5th month of debating how to manage virtual environments.
You would think it's a simple thing, but that's probably why everyone has an opinion about it and some of those opinions are "get off my lawn" strong.

2026-05-07 20:21:27 UTC

RE: https://infosec.exchange/@mttaggart/116533391495608629
This coupled with https://www.selc.org/news/xai-built-an-illegal-power-plant-to-power-its-data-center/ makes it extra bad for the environment based on how xAI had unpermitted gas turbines at Colossus 1 initially.
#note1260…k8qh

2026-04-27 23:07:30 UTC

RE: https://mastodon.social/@sethmlarson/116477240088086817
Note the "install from pylock.toml"! It's experimental, but having PEP 751 reaching this point is big!
#note1rtq…z3cv

2026-03-28 19:36:48 UTC

- reply

trusted != uptime; it just means PyPI expects that security is at a certain level around identity

2026-03-28 02:38:20 UTC

- reply

First, I work at MS; I don't expect you to necessarily agree with the trajectory of the company but it did pay for that blog post, so please keep the insults civil.
Two, you can work with whomever you have hosting your code to become trusted enough to use trusted publishing. Or you can work to make a system where trusted publishing isn't a prerequisite.

2026-03-26 04:05:46 UTC

RE: https://fosstodon.org/@jni/116287554201659198
I said digital attestations and `pylock.toml` would have helped with the litellm attack. People asked for more details, so I wrote a blog post explaining why. It also hopefully acts at motivation for people to use:
- Trusted publishing
- Digital attestations
- Lock files, and `pylock.toml` specifically
https://snarky.ca/why-pylock-toml-includes-digital-attestations/
So yes, @npub1ks8…5wm6 , I have a "human-readable intro" because I wrote one for you (and the other folks asking me questions on the subject). 😁
#note1f7f…h4dr

2026-03-24 17:27:23 UTC

RE: https://infosec.exchange/@dangoodin/116285175398594132
Notice how the compromised releases were directly uploaded. This is why `pylock.toml` includes attestation data and trusted publishing is important. If the project used trusted publishing then their the lack of attestation data could have been noticed in a diff of the lock file as it would have suddenly disappeared (which is also why `pylock.toml` was designed to be human-readable).
#note19jl…gtsu

2026-01-28 20:57:07 UTC

https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7115 is a petition for the Canadian government to set up secure coding guidelines.

2026-01-25 21:20:42 UTC

Something I noticed lately is people having at least separate sections on their website if not a separate site entirely to split blog posts/articles from short thoughts/social media posts. Do people like that for the separate RSS feeds so you can ignore the short stuff? Hate it because now it's 2 feeds to follow if you wants everything from someone? Don't care since it all just funnels into a single place here and you don't use RSS feeds?

2026-01-21 22:51:35 UTC

My bet is that safety-critical code will be the last place to pick up AI due to auditing needs.

2026-01-09 00:15:17 UTC

I got an external drive for backing up my home directory on my Linux machine. I want to do rolling updates in case I want to go back for a file I deleted or edited, space permitting. Is rsync still the best option for this sort of thing?

2025-12-18 19:33:34 UTC

https://doesjitgobrrr.com/ now has a goal line for the Python JIT in 3.15 (at well as 3.16 and a custom line as well), and Arm support crossed the goal for the first time!

2025-11-14 20:35:19 UTC

- reply

Is that image available as a wallpaper?

2025-10-11 03:48:10 UTC

In case you prefer text over video, the blog post version of my EuroPython keynote about why it took 4 years to get a lock files specification is now up at https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/ .

2025-09-10 03:18:09 UTC

If you work for a remote-friendly company and have wanted to hire US-based Microsoft employees, now is a good time to try (other countries will probably come up next year).
https://blogs.microsoft.com/blog/2025/09/09/flexible-work-update/

2025-09-05 19:33:17 UTC

PEP 794 (Import Name Metadata) has been accepted!
https://peps.python.org/pep-0794/
https://discuss.python.org/t/pep-794-import-name-metadata/94567/85

2025-08-27 22:11:40 UTC

The Python documentary premieres tomorrow @ 10:00 PT / 19:00 CET!
https://www.youtube.com/watch?v=GfH4QL4VqJ0

2025-08-26 17:14:35 UTC

The Python documentary by cult.repo is going to be debuting live on YouTube on Thursday the 28th at 7pm CET/10am PT! https://www.youtube.com/@cultrepo
I'll share a link the day before to the doc that will have a countdown to the debut. I'm planning to be in the live chat during the debut.
I saw a full length cut a month ago (which was great!), but I am purposefully holding off on watching the final cut with the rest of you so I get to have a little bit of a surprise 😁.

2025-08-12 05:39:10 UTC

Annual reminder for Canadian #Mullvad users that vouchers from Amazon are cheaper than buying from Mullvad directly and keep you anonymous to Mullvad.

2025-07-31 19:53:09 UTC

PSA: do NOT create a virtual environment in the directory you're keeping your code in (or the corollary: don't create a virtual environment and put your code into it). You should NEVER do `python3 -m venv .`.
Brought to you by people who did `python3.13 -m venv .` and discovered their `.gitignore` file got overwritten with venv's `.gitignore` file or that suddenly all of their files were being ignored.
And no, we are not removing the `.gitignore` file from venv.

2025-07-30 03:30:30 UTC

A throwaway line I said while walking with @npub1qph…t7nc @npub1zgm…dan3 @npub1xvu…jmp8 and Nicholas Tollervey to the EuroPython social event in reference to people relaxing about potential breakage in a release and just lean into bumping the version instead.
Credit to Claude for helping me make the image.
https://files.mastodon.social/media_attachments/files/114/940/060/503/271/242/original/684484ea7b514daa.png

2025-07-06 19:42:03 UTC

Does anyone have a recommendation for a travel eSIM?
It will primarily be for EU, UK, and US travel. I prefer better/easier UX over cheapest price. I won't be tethering, so this is for data on my phone while I'm out and about. Bonus if there's some way to have multiple eSIMs on one family account. And while this shouldn't matter, I'm on Android.
(And for anyone curious as to how outrageous Canadian telecoms are, US roaming is CAD$14/day, CAD$16/day everywhere else.)

2025-06-24 19:54:35 UTC

https://www.cbc.ca/news/world/trump-supreme-court-deportations-1.7568872
Does this mean that if I visit the US and they decide to kick me out via deportation (let's say there's a disagreement over whether I'm performing work or not while in the States), they could legally send me to South Sudan instead of Canada?

2025-06-17 20:39:48 UTC

For a PEP discussion, it's been eerily quiet...
I don't want to be more specific since I don't want people to find a reason to say something, but it is a good sign I covered everything in the latest version and people are generally happy with the outcome.