What does Open Source mean? nesbitt.io/2026/04/04/w...

This is scary as hell. Be safe out there, folks. github.com/axios/axios/...

There is a ton in this report, like how @pypi.org is able to respond so quickly to malware thanks to our network of trusted reporters and how to keep yourself secure both as a maintainer and user of Python packages.

PSF Security developers have published incident reports on the LiteLLM & Telnyx #supplychain attacks. Read what happened, who's affected, and what developers & maintainers can do to prepare and protect themselves from future incidents. #security #python

Many thanks to @sethmlarson.dev and @miketheman.com for their ongoing work on securing the Python infrastructure.

Totally fine and normal 🔥

I fondly recall when I associated "SCA" with the Society for Creative Anachronism. Sadly, nowadays it's Supply Chain Attack.

@atls.city !set US-NY-NewYorkCity

Nerd sniped again, this time by @miketheman.com, into looking at how various package managers do mirroring: nesbitt.io/2026/03/20/p...

For those unfamiliar, this kind of funding is what makes my role currently possible. Thanks to all the donors, and keep of the good work!

Very excited for @pycon.us - there's an entire #Security focused track chaired by @juanitagomezr.bsky.social & @sethmlarson.dev Come on out to Long Beach, CA in May, listen to me talk about @pypi.org #SupplyChain Check it out here: us.pycon.org/2026/tracks/... #Python #PyCon #PyConUS #OpenSource

Python friends, it’s time. 🐍 The #PyConUS 2026 schedule is LIVE! Start planning your talks, meet the keynote speakers, and register for tutorials, summits & events! 🔗 us.pycon.org/2026/schedule/ Full details: pycon.blogspot.com/2026/03/laun...

wow. I voted on over 500 @europython.eu submissions, so cool how easy they made it to review and submit my opinion #Python #Conference #OpenSource

Thanks @fastly.com for taking some time to ask me questions and share my responses - it's quite unique to work on a system like this

That satisfying feeling when you scoop out precisely 12 grams of coffee beans for your first cup on first try

Deprecate confusing APIs like “os.path.commonprefix()”. After fixing a vulnerability in #pip, I started digging into the confusing API and found more than I expected. 👉 sethmlarson.dev/deprecate-co... #python #oss #opensource #security

We're hiring! The PSF is looking for a full-time, remote, US-based Infrastructure Engineer to help keep PyPI, python.org, docs.python.org, and PyCon US running for millions of Python users worldwide 🐍 Apply here:

Claude Code is improving faster than ever, and I'm impressed by their ability to make it better without me tinkering with MCPs, Skills, or other things. It knows when to enter planning mode, ask me very good, targeted questions to answering a batch before proceeding with some new design.

PyPI does not exist to be your personal or commercial software distribution platform, especially if you intentionally obfuscate your code. The @opensource.org definition includes: > Deliberately obfuscated source code is not allowed. More: opensource.org/osd

Since you can never be everywhere at #FOSDEM, sometimes you have to watch back some of the dev room talks you missed. @lawngno.me from the @rustfoundation.org gave a great talk: A phishy case study - attacks on crates.io and others (namely @pypi.org and npmjs.com ) Watch fosdem.org/2026/schedul...

If you are on an AI transformation journey, don't make the mistake of reducing the Intelligence from your team by removing employees, focusing on the Artificial part

I know, sometimes that's just how it is

One effect of vibe coding is likely to be a widening gap between "usable" and "excellent" software

While the squeaky wheel gets the grease, the nail that sticks up gets hammered down. Something to think about.

@anthropic.com is investing $1.5 million in the PSF, focused on security. These funds will make an enormous impact on the PSF and the security of millions of #Python and @pypi.org#Pythonusers. Please join us in thanking Anthropic for this landmark gift! Read more on our blog:

I filled out the 2026 @Answers4AWS survey. You should too! answersforaws.com/survey/ #aws

One of the most impactful concepts I ever learned was to "figure out how to get things done when you're not watching." Apply this in process automation, systems resilience engineering, financial management, and other areas. If you need to be present, **you** are the bottleneck.

2025 was another eventful year for PyPI! Critical security enhancements, powerful new org features, a better overall user experience, and transparent security incident response 🎉👏 Thank you, PyPI team & community! Learn more on our blog: blog.pypi.org/posts/2025-1...

Reminder: Don't freak out when all your YTD queries and graphs show pretty much nothing today. Happy New Year! 🎊🎈🍷

🎆🎇WINNER🎇🎆 2025 HEADLINE OF THE YEAR

On days when I get sad about how much malware and trash folks upload to PyPI that I end up sifting through, I'll take a moment and search for posts with #PyPI on social platforms.

Working on my ancient blog tech, and going through to filter out ancient junk is quite satisfying. It's been over 20 years, and I've definitely eased off the publishing speed over time, to the point where I post one or two a year, and that's partly because I didn't enjoy the author experience.

If we focused as hard on training humans as hard as we currently train machines, who knows what new heights humanity could achieve

Well, that was nice. I was traveling for work and play for a few weeks, and Auto-Quarantine caught over 50% of all inbound malware reports, protecting the ecosystem. Even when I'm not there, our growing network of security researchers/reporters are constantly watching. 👀 #SupplyChain #Security

You did it—AGAIN! Thanks to you, we hit our second fundraiser goal of $400k 🤯 everyone at the PSF is feeling heaps of astonishment & gratitude for our community’s generosity. Words can’t fully capture how grateful we are, but we’ll try: Thank you 💝 Thank YOU 💙💛 THANK YOU 🥰🐍🥰 #PythonForEveryone

There's still time to propose a talk for #PyConUS 2026 before the CFP closes tomorrow. If you're part of the Python community and the topic interests you you're probably not alone. It doesn't need to be about Python specifically, just of interest to the community. us.pycon.org/2026/speakin...

⏰⏰ Time is running out! Make sure you grab @pycharm.dev Pro at 30% off- ALL proceeds go to the PSF, thanks to @jetbrains.com 💝 Already have PyCharm? Use discount code PYCHARM4PYTHON to renew your subscription at 30% off! lp.jetbrains.com/support-python/ #PythonForEveryone

Oddest public restroom decor I think I've encountered in quite some time

Now That's What I Call Shakshuka

This piece by @clickhouse.com shares a great #OpenSource story - how they evaluated existing solutions, contacted current maintainers, and worked collaboratively to reach a well-licensed solution for their users, including sharing author credit. Well done! 👏 clickhouse.com/blog/introdu...

Visiting Israel for my niece's wedding, gotta snag a good Shakshuka

From one thing to the next - I'm honored and excited to share some ideas and thoughts on Moving Mountains with the @tlv.community on the main stage in a few more days! tlvcommunity.dev/devopsdays/a... #DevOpsDaysTLV #TLVCommunity #DevOpsDays #DevOps #Python #Migrations

My Road to re:Invent has begun. Today: NYC to LAX Tomorrow: Board a bus with the Royal Blue team, find out the theme of our hackathon, and hack until Las Vegas. Maybe stop along the way to check out a spooky town for Kiro's ghost pals? 👻 Wish us luck!

Getting in the right mindset for my 13th #AWS #reInvent conference in Las Vegas. It's much longer than the early 3-day conference style, with a new idea this year - a hackathon on a bus all day Sunday Watch and cheer for our team Royal Blue! 👑💙 builder.aws.com/content/3515...

There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects. TL,DR: Adopt Trusted Publishing 🔐🚀📦 blog.pypi.org/posts/2025-1...

🚨 New for #PyConUS 2026! 🚀 We’re adding 2 dedicated Talk tracks: 🔒 Trailblazing Python Security – making Python & PyPI safer 🤖 The Future of AI with Python – AI tools, ethics, & learning Submit your talk before December 19! pycon.blogspot.com/2025/11/trai...

Vacation was amazing, heading home now. Hope I don't freeze!

Since 2015, the PSF Grants Program has awarded over $3M to support Pythonistas worldwide. The program’s on pause, but you can keep that impact alive and help bring us closer towards reopening 💛💙 Read grantee stories and donate today: donate.python.org #Python #PythonForEveryone

New @pypi.org blog TL, DR: - Trusted Publishing used for 25% of all files uploaded in Oct 2025 - @gitlab.com Self-Managed now in beta - Pending Publishers can be added for Organizations, too! #Python #SupplyChain #Security Read it here: blog.pypi.org/posts/2025-1...