2026-06-04T22:36:25Z https://yabu.me Brett Cannon https://yabu.me/npub139gmplm2d5syujhrat2gx6gutampwx5cz9el7qr02a6r0tj3xycsrjcwvw https://files.mastodon.social/accounts/avatars/114/633/944/987/767/035/original/2e86a8d32c447ae6.jpeg https://files.mastodon.social/accounts/avatars/114/633/944/987/767/035/original/2e86a8d32c447ae6.jpeg https://yabu.me/nevent1qqspz3m0z6nhxvqd66rtc7sfdyetsjc68z9j4xp8njpnygrxe897cwgzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz6tayw6 That feeling when you&#39;re well into your 5th month of debating how to manage virtual environments.<br/><br/>You would think it&#39;s a simple thing, but that&#39;s probably why everyone has an opinion about it and some of those opinions are &#34;get off my lawn&#34; strong. 2026-05-25T23:35:25Z https://yabu.me/nevent1qqs8z90y3wjg9mvzuyssv00av44wk8lzhc6wezteaxsecwry9xu7rdgzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzjn4e60 RE: <a href="https://infosec.exchange/@mttaggart/116533391495608629">https://infosec.exchange/@mttaggart/116533391495608629</a><br/><br/>This coupled with <a href="https://www.selc.org/news/xai-built-an-illegal-power-plant-to-power-its-data-center/">https://www.selc.org/news/xai-built-an-illegal-power-plant-to-power-its-data-center/</a> makes it extra bad for the environment based on how xAI had unpermitted gas turbines at Colossus 1 initially.<br/>nostr:note12603vhxywprwvvrknn0h8zr9tz3pr0rv844pkyjeuvrcu6d50vysj4k8qh<br/> 2026-05-07T20:21:27Z https://yabu.me/nevent1qqsx3nl98l3n52ayw99k6nxs5yu6uzdnh8k07aav6759eylsjek7dtqzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzfyh5vh RE: <a href="https://mastodon.social/@sethmlarson/116477240088086817">https://mastodon.social/@sethmlarson/116477240088086817</a><br/><br/>Note the &#34;install from pylock.toml&#34;! It&#39;s experimental, but having PEP 751 reaching this point is big!<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1rtqm6jf0se47l2pzmplyyz2hy4atl9u4258m73vd4l03l4z2076qjtz3cv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1rtq…z3cv</a></span><br/> </div> pip 26.1 is an incredible release, thank you to the pip maintainers!! 💜<br/><br/>– Relative dependency cooldown support!<br/>– Installing from pylock.toml<br/>– Multiple security fixes<br/><br/>Read the full blog post by <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub185e0rsqgdquuefdupyg2e4f4vc880l9cv88pagswreqm0uwscqpq6zqezv" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Richard Si 🌺</span> (<span class="italic">npub185e…qezv</span>)</a></span><br/><br/><a href="https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/">https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/</a><br/><br/>#python #pypi #pip #security #oss #opensource </blockquote> 2026-04-27T23:07:30Z https://yabu.me/nevent1qqsflfpj5uha9mhuvsgxeh84fpa0z6f0wqpuf4t59e9awy45vl8lmuszyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz9tsnz7 In reply to <a href='/nevent1qqsphpdxvkn7dpnrn5xd0u4efyp7dvrnf4afzu0mswcjsn7ytk79xtc400zzu'>nevent1q…0zzu</a><br/>_________________________<br/><br/>trusted != uptime; it just means PyPI expects that security is at a certain level around identity 2026-03-28T19:36:48Z https://yabu.me/nevent1qqsfq8gt8e0fe7m75ww0uf8gzurcyca9juv5qsdar63pzeuppy3kv6qzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz2nuzm3 In reply to <a href='/nevent1qqsr5zutrys5ld7td0f5ntexdrt4y3hgmeh9cqkpeuufzuz33aektgc7h6vp3'>nevent1q…6vp3</a><br/>_________________________<br/><br/>First, I work at MS; I don&#39;t expect you to necessarily agree with the trajectory of the company but it did pay for that blog post, so please keep the insults civil.<br/><br/>Two, you can work with whomever you have hosting your code to become trusted enough to use trusted publishing. Or you can work to make a system where trusted publishing isn&#39;t a prerequisite. 2026-03-28T02:38:20Z https://yabu.me/nevent1qqsz2kh6z39k3e5ygkt85vc0zaw9tdc97wn27ktdd0f8smp9ppkylwczyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz85kdvw RE: <a href="https://fosstodon.org/@jni/116287554201659198">https://fosstodon.org/@jni/116287554201659198</a><br/><br/>I said digital attestations and `pylock.toml` would have helped with the litellm attack. People asked for more details, so I wrote a blog post explaining why. It also hopefully acts at motivation for people to use:<br/><br/>- Trusted publishing<br/>- Digital attestations<br/>- Lock files, and `pylock.toml` specifically<br/><br/><a href="https://snarky.ca/why-pylock-toml-includes-digital-attestations/">https://snarky.ca/why-pylock-toml-includes-digital-attestations/</a><br/><br/>So yes, <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ks8zvrz2qd8cz8uh8r72mvcax076jnuxykrlcrayz69twh668uys5t5wm6" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Juan Nunez-Iglesias</span> (<span class="italic">npub1ks8…5wm6</span>)</a></span> , I have a &#34;human-readable intro&#34; because I wrote one for you (and the other folks asking me questions on the subject). 😁<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1f7fghupr05203y2wx0q9fz370r0peqru2kld2qrd0txv440hadks9eh4dr" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1f7f…h4dr</a></span><br/> </div> do you have a human- (read: noob-) readable intro to these concepts? I don’t think we use pylock in any of the projects I lead. 😬 </blockquote> 2026-03-26T04:05:46Z https://yabu.me/nevent1qqsfp2y5jsft3dnn2y9afsqq5arlgfr5v6n2fwrpenrfmupn736nqjqzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzveckja RE: <a href="https://infosec.exchange/@dangoodin/116285175398594132">https://infosec.exchange/@dangoodin/116285175398594132</a><br/><br/>Notice how the compromised releases were directly uploaded. This is why `pylock.toml` includes attestation data and trusted publishing is important. If the project used trusted publishing then their the lack of attestation data could have been noticed in a diff of the lock file as it would have suddenly disappeared (which is also why `pylock.toml` was designed to be human-readable).<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note19jlxddccjltlghtk978epls33cn8cd20vads94rs0q88jnhgf0kqr7gtsu" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note19jl…gtsu</a></span><br/> </div> Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.<br/><br/>Folks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.<br/><br/><a href="https://news.ycombinator.com/item?id=47501729">https://news.ycombinator.com/item?id=47501729</a> </blockquote> 2026-03-24T17:27:23Z https://yabu.me/nevent1qqs8su7yjesu0xag4780lj23hvalmhh9gx93t7e4f9l9zdx7r532djgzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzhjpx0z <a href="https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7115">https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7115</a> is a petition for the Canadian government to set up secure coding guidelines. 2026-01-28T20:57:07Z https://yabu.me/nevent1qqszpgjk58pq4rtt433wr9vtssjpy6rqk72fl4w5y4zdptea82xkanszyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz0mn8qr Something I noticed lately is people having at least separate sections on their website if not a separate site entirely to split blog posts/articles from short thoughts/social media posts. Do people like that for the separate RSS feeds so you can ignore the short stuff? Hate it because now it&#39;s 2 feeds to follow if you wants everything from someone? Don&#39;t care since it all just funnels into a single place here and you don&#39;t use RSS feeds? 2026-01-25T21:20:42Z https://yabu.me/nevent1qqstjwpyxd7kys07j4auked0mqh65ysyqc57eg47xzslx7mympxwh2qzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz9jaqux My bet is that safety-critical code will be the last place to pick up AI due to auditing needs. 2026-01-21T22:51:35Z https://yabu.me/nevent1qqsg8qk6tykg49a905eqztzf7d8g4etrqemgalxg9cklqhgn8qqp0eszyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnze5qah4 I got an external drive for backing up my home directory on my Linux machine. I want to do rolling updates in case I want to go back for a file I deleted or edited, space permitting. Is rsync still the best option for this sort of thing? 2026-01-09T00:15:17Z https://yabu.me/nevent1qqs0l53nvrsx556tpx34cggpkhrphswjqfv3dpygvzzunch22gm0f8qzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz5kj50e <a href="https://doesjitgobrrr.com/">https://doesjitgobrrr.com/</a> now has a goal line for the Python JIT in 3.15 (at well as 3.16 and a custom line as well), and Arm support crossed the goal for the first time! 2025-12-18T19:33:34Z https://yabu.me/nevent1qqspyusmc9n7xzkpy96657nagjgcf0rrgseeyrkxuu57gnm4zarl4uqzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz8dc82c In reply to <a href='/nevent1qqszc52su2cwmgaxvfelrs6tu5pw36twjaw4zd3238vcm45xsy2l44q0gf60z'>nevent1q…f60z</a><br/>_________________________<br/><br/>Is that image available as a wallpaper? 2025-11-14T20:35:19Z https://yabu.me/nevent1qqszdpwsh4xzsgz8f93zprhdssxwp2kqr64uy3tml0lq2qfsm35gsjczyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz9768f4 In case you prefer text over video, the blog post version of my EuroPython keynote about why it took 4 years to get a lock files specification is now up at <a href="https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/">https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/</a> . 2025-10-11T03:48:10Z https://yabu.me/nevent1qqsdn78hqhk67e6g7nqyx5dqmn63uf6v5am4cffhlp9eqc2wtuv2ucqzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnztt0k95 If you work for a remote-friendly company and have wanted to hire US-based Microsoft employees, now is a good time to try (other countries will probably come up next year).<br/> <a href="https://blogs.microsoft.com/blog/2025/09/09/flexible-work-update/">https://blogs.microsoft.com/blog/2025/09/09/flexible-work-update/</a> 2025-09-10T03:18:09Z https://yabu.me/nevent1qqszcnexgcjku5unpylqzq5m4d0wlyzzuv2sx54lwjvwkrjl569xs5czyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzxuw380 PEP 794 (Import Name Metadata) has been accepted!<br/><br/><a href="https://peps.python.org/pep-0794/">https://peps.python.org/pep-0794/</a><br/><a href="https://discuss.python.org/t/pep-794-import-name-metadata/94567/85">https://discuss.python.org/t/pep-794-import-name-metadata/94567/85</a> 2025-09-05T19:33:17Z https://yabu.me/nevent1qqsz3ja2mcc0dyd23npjzgtxh07x36qa467stxncy354g6j6lseajagzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz0cuu46 The Python documentary premieres tomorrow @ 10:00 PT / 19:00 CET!<br/><br/><a href="https://www.youtube.com/watch?v=GfH4QL4VqJ0">https://www.youtube.com/watch?v=GfH4QL4VqJ0</a> 2025-08-27T22:11:40Z https://yabu.me/nevent1qqszm9ghayrk452a36nfdjjrjvmdwf8f28g9hjzyv9r8jff0ty8wk4qzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzegwwek The Python documentary by cult.repo is going to be debuting live on YouTube on Thursday the 28th at 7pm CET/10am PT! <a href="https://www.youtube.com/@cultrepo">https://www.youtube.com/@cultrepo</a><br/><br/>I&#39;ll share a link the day before to the doc that will have a countdown to the debut. I&#39;m planning to be in the live chat during the debut.<br/><br/>I saw a full length cut a month ago (which was great!), but I am purposefully holding off on watching the final cut with the rest of you so I get to have a little bit of a surprise 😁. 2025-08-26T17:14:35Z https://yabu.me/nevent1qqswjwcle8zg3j7xczjw57e2anjk6seznqmt4867etku5hktuxavjggzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnz6qvtsl Annual reminder for Canadian #Mullvad users that vouchers from Amazon are cheaper than buying from Mullvad directly and keep you anonymous to Mullvad. 2025-08-12T05:39:10Z https://yabu.me/nevent1qqsxe7zumsck52u4mq09fktwqmg7qhqxezteax3g83deyfrr6w2p0cczyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzrs4aup PSA: do NOT create a virtual environment in the directory you&#39;re keeping your code in (or the corollary: don&#39;t create a virtual environment and put your code into it). You should NEVER do `python3 -m venv .`.<br/><br/>Brought to you by people who did `python3.13 -m venv .` and discovered their `.gitignore` file got overwritten with venv&#39;s `.gitignore` file or that suddenly all of their files were being ignored.<br/><br/>And no, we are not removing the `.gitignore` file from venv. 2025-07-31T19:53:09Z https://yabu.me/nevent1qqs9re5vaen2mamq03veddjyp20gynpf92kzsyzqgqvhatcslchs7vgzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzruzls4 A throwaway line I said while walking with <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1qph824u05udzjsft922etvxtpd3m0pfzkyxtf7yvs8x5k9h7384sfzt7nc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Jürgen Gmach</span> (<span class="italic">npub1qph…t7nc</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1zgmxv6u4uudnn5q8hjlphcy073patfm0u0cxzmh2ex6hlmzp8eqq4jdan3" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hynek Schlawack</span> (<span class="italic">npub1zgm…dan3</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xvuu4dsa9acew5d5ua5jpfgr40uefgyheua7c45f62jmguks36wqzsjmp8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hugo van Kemenade</span> (<span class="italic">npub1xvu…jmp8</span>)</a></span> and Nicholas Tollervey to the EuroPython social event in reference to people relaxing about potential breakage in a release and just lean into bumping the version instead.<br/><br/>Credit to Claude for helping me make the image.<br/> <img src="https://files.mastodon.social/media_attachments/files/114/940/060/503/271/242/original/684484ea7b514daa.png"> <br/> 2025-07-30T03:30:30Z https://yabu.me/nevent1qqsvm9skc050as6uyxh5xdqd4j79xkru67lk5c2w7q648xcluvz5uwqzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzt0k79f Does anyone have a recommendation for a travel eSIM?<br/><br/>It will primarily be for EU, UK, and US travel. I prefer better/easier UX over cheapest price. I won&#39;t be tethering, so this is for data on my phone while I&#39;m out and about. Bonus if there&#39;s some way to have multiple eSIMs on one family account. And while this shouldn&#39;t matter, I&#39;m on Android.<br/><br/>(And for anyone curious as to how outrageous Canadian telecoms are, US roaming is CAD$14/day, CAD$16/day everywhere else.) 2025-07-06T19:42:03Z https://yabu.me/nevent1qqsrt5er59vy6jcfw5g4jt6wl45n45j9003nu6j0mvgrqwckpxu9weszyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzpvem8p <a href="https://www.cbc.ca/news/world/trump-supreme-court-deportations-1.7568872">https://www.cbc.ca/news/world/trump-supreme-court-deportations-1.7568872</a><br/><br/>Does this mean that if I visit the US and they decide to kick me out via deportation (let&#39;s say there&#39;s a disagreement over whether I&#39;m performing work or not while in the States), they could legally send me to South Sudan instead of Canada? 2025-06-24T19:54:35Z https://yabu.me/nevent1qqsxpln4cemtrr5vvcmypxucrmelyd8u4qky3ppqawcynj4pn0mxxvgzyzy4rv8ldfkjqnj2u04dfqmfr30hv9c6nqgh8lcqdathgdaw2ycnzcsh37g For a PEP discussion, it&#39;s been eerily quiet...<br/><br/>I don&#39;t want to be more specific since I don&#39;t want people to find a reason to say something, but it is a good sign I covered everything in the latest version and people are generally happy with the outcome. 2025-06-17T20:39:48Z