We’re thrilled to welcome our new #PyConUS Conference Co-Chair and future Conference Chair, Kattni! 🎉 Learn more about Kattni here: pycon.blogspot.com/2026/07/welc... 🗓️ Mark your calendars for #PyConUS 2027, May 12th-18th back in Long Beach, CA

Some days I wonder if the supply chain attackers are hoping I'll giggle before swinging the banhammer The creativity of some of these folks is wasted on scamming

Sunday morning, coffee's on, laptop open. Nobody asked me to fix this. It might still be broken Monday, sure. but it's broken **better**! #OpenSource: the sometimes unglamorous work, done in public, one commit at a time.

Very excited to share stories, insights, recommendations at my first @europython.eu I'll also be attending the Packaging and Language Summits, as well as any other opportunities to increase awareness of #Python and #PyPI #OpenSource #SupplyChain #Security initiatives. #EP2026 #TooManyHashtags

Great coverage from @lwndotnet.bsky.social of the PSF PyPI Safety & Security Engineer @miketheman.com's talk on Trusted Publishing at Open Source Summit. 36% of PyPI uploads now use Trusted Publishing. Is yours one of them? lwn.net/Articles/107... #Python #PyPI #OSSumit #Security

This is what collaborative, coordinated, responsible disclosure looks like. It was a pleasure to work with @gitguardian.com on this #PyPI #security investigation to help protect the global #Python #SupplyChain blog.gitguardian.com/hunting-leak...

Look! It's @sethmlarson.dev and I at the #UNOpenSourceWeek ! We presented, facilitated, and listened to others. #Python #OpenSource #Security #WhatAWeirdJob

Watch PSF PyPI Safety & Security Engineer @miketheman.com's talk from Open Source Summit NA 2026: Trusted Publishing uses OIDC to generate short-lived tokens from CI/CD. No passwords. No tokens to rotate. No secrets in repos. www.youtube.com/watch?v=i0BW... #Python #PyPI #OSSummit #Security

Join Mike Fiedler (@miketheman.com) at EuroPython for "Anatomy of a Phishing Campaign" talk: ep2026.europython.eu/NXNHSB

Building on last year’s success, we are bringing the #maintainathon back to #UNOpenSourceWeek 🇺🇳 Together with the United Nations Office for Digital and Emerging Technologies, the Sovereign Tech Agency is hosting the maintain-a-thon, facilitated and led by the experts from our delegation:

It was an honor to speak to a room full of people curious about how #phishing maintainers led to a #SupplyChain incident and some ideas on how to harden workflows to prevent

I'm starting to really think that the main benefit of the new waves of AI is exposing every business process weakness. Case and point: if you have terrible dev docs, test/validation steps, generative agents will produce about the same quality as an unguided junior dev

The PSF's Strategic Plan full draft is available and we want your feedback. After sharing high-level goals in May, we're opening a 3-week community feedback window. Read the full draft and tell us: Are these the right goals? Is anything missing? #Python #PyPI pyfound.blogspot.com/2026/06/psf-...

One behavioral modification of doing career switches between individual contributor and manager (and back!) is that manager-speak trains you to use "we" when referring to the work your team has accomplished, since it's not "you" per se - giving credit where credit is due

Let's go Liberty!

If you participated in PyCon US, please fill out the survey. It helps a lot. Remind your friends.

Finally home. Seven speaking spots across seven days, three conferences in two states, many miles apart. Now some rest. #PyConUS #OSSummit #OpenSSFCommunity

@miketheman.com and @sethmlarson.dev share some of the accomplishments of the PSF security team this year. That’s a lot of work for two people! And shoutout to the sponsors who make it possible to fund their roles.

Woo! @sethmlarson.dev and I got a selfie with the #PyConUS Keynote speaker amada casari! The keynote starts in 15 minutes, followed by a #security update

The community mosaic at the PSF booth at #PyConUS 2026 is looking awesome 🐍🎨 🤩 Come help us and color a tile (or a few) before the expo hall closes at the end of the day (no art skills required, we promise!) #PythonIsForEveryone

🔐 Catch PSF's PyPI Safety and Security Engineer, @miketheman.com, talking Trusted Publishing at #OSSummit next week! Learn how to eliminate long-lived credentials from your #PyPI release workflow: no tokens, no secrets, just secure deploys. Tue May 19 @ 11am CDT #Python #SupplyChain #Security

If you're attending #PyConUS and want to find me, I'm likely to be found: - Thursday evening Reception, PSF Booth - Friday afternoon, Packaging Summit - Saturday, before lunch, #Security Track - Saturday, after lunch, Maintainers Summit - Sunday morning, Keynote Stage, Update from Security Engineers

TFW you're almost done with all of your #PyConUS preparation, which includes wayyyy too many things for one year, but you're busting with excitement to see everyone

First #rollerderby home league scrimmage practice now done! Feels good to be back on wheels in #NYC

Have you been on the fence about coming to #PyConUS in Long Beach? Well, get off that fence and come on out! I'll be speaking at the new #security track, dissecting #PyPI phishing campaigns, speaking at maintainer and packaging summits, and looking forward to hanging out with you all

Open Infrastructure Is Not Free Part II 10 trillion open source package downloads in 2026. Still running on donations and volunteers. AI is accelerating attacks. The Sustaining Package Registries WG is here to help. openssf.org/blog/2026/05... #PreserveOpenSource

It has a name! Sayre's Law en.wikipedia.org/wiki/Sayre%2...

Learning just a little bit more about sports team player draft picks, and the difference in fairness pick order types, depending on many factors like player scoring, team-wide scoring vs league -wide averages and imbalance in team pick slots. The inputs can very much change the process itself!

📣 Security Track Spotlight: A real phishing campaign targeted PyPI maintainers. 😱 @miketheman.com's "Anatomy of a Phishing Campaign" breaks down cloned infrastructure, 2FA failures & how phishing-resistant auth stopped the attack. #PyConUS #security us.pycon.org/2026/schedul...

Right before a double header @ Garden State

🗓️ We're officially counting down—26 days till #PyConUS! Will we see you there? Don't miss out—get your ticket today! us.pycon.org/2026/attend/...

If I took the time to write about every malware campaign, their tactics, IOCs, expansion, behaviors, I'd never get through more than 10% of the crazy I see What's more important? Putting out fires, or telling people about fires, or prevention? The real answer: all 3 The "costs" is human effort 💰

⚠️ Good news alert! We were able to get TWO #PyConUS conference hotels to extend their deadlines: You now have 'til April 28th to book your room in our block at the Hyatt and 'til April 30th at the Westin. Book now and get your first choice! We'll see you in the lobby 😁 us.pycon.org/2026/account...

I made a thing, a soundscape based on #PyPI package data feed updates 🎶🐍📦🎶 Maybe you'll enjoy it too? miketheman.github.io/listen-to-py...

It's still awesome to me that I get to work on some really hard problems for the common good. This was a lot of work, hope you enjoy the read!

I've seen it all now. AI writes code, submits PR. AI reads PR, detects AI-written code, rejects it. AI rewrites code to avoid detection by AI. /loop I can't help but wonder when we all burn up in a fiery blaze of greenhouse gases, will the AI-of-then harvest the energy and continue?

Standing on the shoulders of Homebrew: nesbitt.io/2026/04/14/s...

Any time I see something like this in a #Python REPL, I can't help but smile for two reasons: 1. Yes, yes I did forget. 🙈 2. I know some of the folks who worked so hard to make that message do exactly what I want it to do. Thanks to @pablogsal.com, @lukasz.langa.pl, and so many others! #OpenSource

Book in the official #PyCon2026 hotel block and get a mystery swag item. We can't tell you what it is. (That's why it's called mystery swag.) Only way to get it is to book in the block. us.pycon.org/2026/venue/hotels/#PyCon2026 #Python

I'll be speaking at @pycon.us 2026! Come on out to Long Beach California for an excellent #Python community event, and maybe listen to me talk about #OpenSource #SupplyChain #Security from #PyPI perspective us.pycon.org/2026/schedul...

What does Open Source mean? nesbitt.io/2026/04/04/w...

This is scary as hell. Be safe out there, folks. github.com/axios/axios/...

There is a ton in this report, like how @pypi.org is able to respond so quickly to malware thanks to our network of trusted reporters and how to keep yourself secure both as a maintainer and user of Python packages.

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python

Many thanks to @sethmlarson.dev and @miketheman.com for their ongoing work on securing the Python infrastructure.

Totally fine and normal 🔥

I fondly recall when I associated "SCA" with the Society for Creative Anachronism. Sadly, nowadays it's Supply Chain Attack.

@atls.city !set US-NY-NewYorkCity

Nerd sniped again, this time by @miketheman.com, into looking at how various package managers do mirroring: nesbitt.io/2026/03/20/p...

For those unfamiliar, this kind of funding is what makes my role currently possible. Thanks to all the donors, and keep of the good work!