Finally home. Seven speaking spots across seven days, three conferences in two states, many miles apart. Now some rest. #PyConUS #OSSummit #OpenSSFCommunity

@miketheman.com and @sethmlarson.dev share some of the accomplishments of the PSF security team this year. That’s a lot of work for two people! And shoutout to the sponsors who make it possible to fund their roles.

Woo! @sethmlarson.dev and I got a selfie with the #PyConUS Keynote speaker amada casari! The keynote starts in 15 minutes, followed by a #security update

The community mosaic at the PSF booth at #PyConUS 2026 is looking awesome 🐍🎨 🤩 Come help us and color a tile (or a few) before the expo hall closes at the end of the day (no art skills required, we promise!) #PythonIsForEveryone

🔐 Catch PSF's PyPI Safety and Security Engineer, @miketheman.com, talking Trusted Publishing at #OSSummit next week! Learn how to eliminate long-lived credentials from your #PyPI release workflow: no tokens, no secrets, just secure deploys. Tue May 19 @ 11am CDT #Python #SupplyChain #Security

If you're attending #PyConUS and want to find me, I'm likely to be found: - Thursday evening Reception, PSF Booth - Friday afternoon, Packaging Summit - Saturday, before lunch, #Security Track - Saturday, after lunch, Maintainers Summit - Sunday morning, Keynote Stage, Update from Security Engineers

TFW you're almost done with all of your #PyConUS preparation, which includes wayyyy too many things for one year, but you're busting with excitement to see everyone

First #rollerderby home league scrimmage practice now done! Feels good to be back on wheels in #NYC

Have you been on the fence about coming to #PyConUS in Long Beach? Well, get off that fence and come on out! I'll be speaking at the new #security track, dissecting #PyPI phishing campaigns, speaking at maintainer and packaging summits, and looking forward to hanging out with you all

Open Infrastructure Is Not Free Part II 10 trillion open source package downloads in 2026. Still running on donations and volunteers. AI is accelerating attacks. The Sustaining Package Registries WG is here to help. openssf.org/blog/2026/05... #PreserveOpenSource

It has a name! Sayre's Law en.wikipedia.org/wiki/Sayre%2...

Learning just a little bit more about sports team player draft picks, and the difference in fairness pick order types, depending on many factors like player scoring, team-wide scoring vs league -wide averages and imbalance in team pick slots. The inputs can very much change the process itself!

📣 Security Track Spotlight: A real phishing campaign targeted PyPI maintainers. 😱 @miketheman.com's "Anatomy of a Phishing Campaign" breaks down cloned infrastructure, 2FA failures & how phishing-resistant auth stopped the attack. #PyConUS #security us.pycon.org/2026/schedul...

Right before a double header @ Garden State

🗓️ We're officially counting down—26 days till #PyConUS! Will we see you there? Don't miss out—get your ticket today! us.pycon.org/2026/attend/...

If I took the time to write about every malware campaign, their tactics, IOCs, expansion, behaviors, I'd never get through more than 10% of the crazy I see What's more important? Putting out fires, or telling people about fires, or prevention? The real answer: all 3 The "costs" is human effort 💰

⚠️ Good news alert! We were able to get TWO #PyConUS conference hotels to extend their deadlines: You now have 'til April 28th to book your room in our block at the Hyatt and 'til April 30th at the Westin. Book now and get your first choice! We'll see you in the lobby 😁 us.pycon.org/2026/account...

I made a thing, a soundscape based on #PyPI package data feed updates 🎶🐍📦🎶 Maybe you'll enjoy it too? miketheman.github.io/listen-to-py...

It's still awesome to me that I get to work on some really hard problems for the common good. This was a lot of work, hope you enjoy the read!

I've seen it all now. AI writes code, submits PR. AI reads PR, detects AI-written code, rejects it. AI rewrites code to avoid detection by AI. /loop I can't help but wonder when we all burn up in a fiery blaze of greenhouse gases, will the AI-of-then harvest the energy and continue?

Standing on the shoulders of Homebrew: nesbitt.io/2026/04/14/s...

Any time I see something like this in a #Python REPL, I can't help but smile for two reasons: 1. Yes, yes I did forget. 🙈 2. I know some of the folks who worked so hard to make that message do exactly what I want it to do. Thanks to @pablogsal.com, @lukasz.langa.pl, and so many others! #OpenSource

Book in the official #PyCon2026 hotel block and get a mystery swag item. We can't tell you what it is. (That's why it's called mystery swag.) Only way to get it is to book in the block. us.pycon.org/2026/venue/hotels/#PyCon2026 #Python

I'll be speaking at @pycon.us 2026! Come on out to Long Beach California for an excellent #Python community event, and maybe listen to me talk about #OpenSource #SupplyChain #Security from #PyPI perspective us.pycon.org/2026/schedul...

What does Open Source mean? nesbitt.io/2026/04/04/w...

This is scary as hell. Be safe out there, folks. github.com/axios/axios/...

There is a ton in this report, like how @pypi.org is able to respond so quickly to malware thanks to our network of trusted reporters and how to keep yourself secure both as a maintainer and user of Python packages.

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python

Many thanks to @sethmlarson.dev and @miketheman.com for their ongoing work on securing the Python infrastructure.

Totally fine and normal 🔥

I fondly recall when I associated "SCA" with the Society for Creative Anachronism. Sadly, nowadays it's Supply Chain Attack.

@atls.city !set US-NY-NewYorkCity

Nerd sniped again, this time by @miketheman.com, into looking at how various package managers do mirroring: nesbitt.io/2026/03/20/p...

For those unfamiliar, this kind of funding is what makes my role currently possible. Thanks to all the donors, and keep of the good work!

Very excited for @pycon.us - there's an entire #Security focused track chaired by @juanitagomezr.bsky.social & @sethmlarson.dev Come on out to Long Beach, CA in May, listen to me talk about @pypi.org #SupplyChain Check it out here: us.pycon.org/2026/tracks/... #Python #PyCon #PyConUS #OpenSource

Python friends, it’s time. 🐍 The #PyConUS 2026 schedule is LIVE! Start planning your talks, meet the keynote speakers, and register for tutorials, summits & events! 🔗 us.pycon.org/2026/schedule/ Full details: pycon.blogspot.com/2026/03/laun...

wow. I voted on over 500 @europython.eu submissions, so cool how easy they made it to review and submit my opinion #Python #Conference #OpenSource

Thanks @fastly.com for taking some time to ask me questions and share my responses - it's quite unique to work on a system like this

That satisfying feeling when you scoop out precisely 12 grams of coffee beans for your first cup on first try

Deprecate confusing APIs like “os.path.commonprefix()”. After fixing a vulnerability in #pip, I started digging into the confusing API and found more than I expected. 👉 sethmlarson.dev/deprecate-co... #python #oss #opensource #security

We're hiring! The PSF is looking for a full-time, remote, US-based Infrastructure Engineer to help keep PyPI, python.org, docs.python.org, and PyCon US running for millions of Python users worldwide 🐍 Apply here:

Claude Code is improving faster than ever, and I'm impressed by their ability to make it better without me tinkering with MCPs, Skills, or other things. It knows when to enter planning mode, ask me very good, targeted questions to answering a batch before proceeding with some new design.

PyPI does not exist to be your personal or commercial software distribution platform, especially if you intentionally obfuscate your code. The @opensource.org definition includes: > Deliberately obfuscated source code is not allowed. More: opensource.org/osd

Since you can never be everywhere at #FOSDEM, sometimes you have to watch back some of the dev room talks you missed. @lawngno.me from the @rustfoundation.org gave a great talk: A phishy case study - attacks on crates.io and others (namely @pypi.org and npmjs.com ) Watch fosdem.org/2026/schedul...

If you are on an AI transformation journey, don't make the mistake of reducing the Intelligence from your team by removing employees, focusing on the Artificial part

I know, sometimes that's just how it is

One effect of vibe coding is likely to be a widening gap between "usable" and "excellent" software

While the squeaky wheel gets the grease, the nail that sticks up gets hammered down. Something to think about.

@anthropic.com is investing $1.5 million in the PSF, focused on security. These funds will make an enormous impact on the PSF and the security of millions of #Python and @pypi.org#Pythonusers. Please join us in thanking Anthropic for this landmark gift! Read more on our blog:

I filled out the 2026 @Answers4AWS survey. You should too! answersforaws.com/survey/ #aws