@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@philip@mastodon.mallegolhansen.comIt strikes me that one of the things LLMs rob us of is the exact kind of serendipity that much of OSS relies on.
I was just looking something up on https://docs.python.org, which lead me to stumble on a line of documentation entirely irrelevant to what I was trying to do - But it caught my eye because…
@Techmeme@techhub.socialA medical student reverse-engineered AI tools used by medical colleges on suspicion they were filtering his applications, highlighting AI-driven hiring concerns (Todd Feathers/Wired)
https://www.wired.com/story/he-couldnt-land-a-job-interview-was-ai-to-blame/
@luca@social.luca.runAt work @…, we are testing a new format where everyone from the support team has a one on one with everyone else. I created a python script to create the combinations and dates. At home, I thought it would be nice to make it easier to use and get back into learning Vue. I re-created the script as a tiny web app: MatchICS.
You enter a list of entities (people, t…
@heiseonline@social.heise.deNoch ein paar der zuletzt hier besonders häufig geteilten #News:
„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python
@hynek@mastodon.sociali'm so fucking sick of it
i've got ONE extremely simple and extremely explicit contribution rule/brown m&m test: do not delete the PR checklist
since i'm busy getting structlog out, I’ve let the attrs bug tracker a bit off the leash
go & count for yourself how many PRs opened in the past month followed that instruction.
(and of course, this is not about bureaucracy; they violate many of the important items on that list)
@jamesthebard@social.linux.pizzaSo, decided to get them rookie `/queue` numbers up so did a quick bit of caching. For a 12-job queue, I went from 240 RPS (Python/Flask) to 680 (Golang/Gin) then to 3400 RPS with some proper caching. The `/workers` endpoint would benefit as well, but I think its performant enough though I may end up adding a bit of caching later.
#golang
@nobodyinperson@fosstodon.org
@veit@mastodon.socialIf uv is not available in a Python environment, you can still specify the versions using pylock.toml. We have described how to do this here: https://python-basics-tutorial.readthedocs.io/en/latest/libs/install.html#of-packages
@karlauerbach@sfba.socialA lot of open source projects take care to preserve compatibility with the past, so that changes do not break the projects of existing users.
But then there are others. In my list of "damn the past, full speed ahead on incompatible changes!!" are my most recent encounters:
- Python (not only was the Python 2 abandonment unforgivable and cost many of us a lot of useless conversion work, but the versions of Python 3 seem to change from one to the next to the degree that…
@michabbb@social.vivaldi.net
@stf@chaos.socialwtf does everytime a new v of #python is rolled out in linux distros, all virtual envs break, and i do have to rebuild them manually. we're now 13 minor versions since py v2.7 and everything became worse since then. i have a stable app, and if python would not fuck up this i would not have to touch it in a decade, but because of this, i feel like i'm in the java ecosystem where work is gener…
@rasterweb@mastodon.socialI tried to get someone’s Python code to work and could not due to errors and I did a few searches and then gave up.
I could try using some AI chatbot bullshit to help me out but fuck that… it’s easier to just give up and walk away. Oh well.
@mgorny@social.treehouse.systems1. Do random changes to cython-test-exception-raiser, and commit them as "initial code".
2. Move the extension module from the package directory into top-level "raiser.*.so", for no apparent reason.
3. Switch to CalVer, so that #Twisted newer upgrades to the new releases (it pins to <2).
4. I file a bug, because I'd like to finally remove the old version from #Gentoo.
#Python
@_tillwe_@mastodon.socialMir fehlte ein simples Tetris ohne Werbung, Irgendwas-Mode und Krimskrams. Geht (dank Python und der sehr praktischen pyGame-Library) auch ohne Vibecoding. Auch wenn's trivial ist: das Gefühl, selbst eine gute Lösung gefunden zu haben, wie sich etwas programmieren lässt, ist immer noch ein sehr gutes ;)
@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@heiseonline@social.heise.deEinige der zuletzt hier besonders häufig geteilten #News:
„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python
@gray17@mastodon.social> We introduce gpusnek, a fully functional Python interpreter ported to CUDA, enabling execution of arbitrary Python code directly on the GPU by running one whole interpreter on every CUDA core/thread. This is a tremendously bad idea, but for the duration of this paper we pretend that it is not
[Josef Dean in SIGBOVIK 2026]
@hynek@mastodon.socialHere’s my part in the great nogil/free-threading endeavor: build-and-inspect-python-package now will optionally add 3.14t and 3.15t to the generated matrix if a package indicates to support 3.14 or 3.15!
https://github.com/hynek/build-and-inspect-python-package…
@lpryszcz@genomic.social
@wraithe@mastodon.socialA user at a client contacted me over what transpired to be them trying to install a python library on a machine (that didn’t have python installed) to run an AI tool at the direction of ChatGPT.
After *I* get it installed:
User: “Ok, how does it work?”
Me: 🤷🏻♀️ (╯°□°）╯︵ ┻━┻ “never seen it before”
@tinoeberl@mastodon.online#Steady #Klimacrew
#BahnMonitor-Projekt: 7. Zufall ist nicht gleich Zufall. 🤭
Nach der Verspätungsmeldung kommt ein Wissenshäppchen. Der
@mot@chaos.socialSind User Sessions unter Python Web Frameworks wie Flask und FastAPI wirklich so beschissen, oder bilde ich mir das nur ein? Entweder es werden Session-Daten Client-seitig (signiert) in Cookies bzw. JWT gespeichert, oder die Server-seitigen Implementierungen brauchen aufgeblähte Datenbanken :(
@frankel@mastodon.top @nobodyinperson@fosstodon.org@… Yes, for a Python tutorium.
@qbi@freie-re.deThonny, Python IDE for beginners
#IDEsofMarch #python
@stf@chaos.socialwhy can't a minor version change not be goddamn backward compatible ffs.
#python
@berlinbuzzwords@floss.socialKafi Streams, built on (Py)DBSP, treats streaming like batch. Strongly consistent from day one. An open source Python library for the 80% of use cases that do not need extreme scale. Ralph Matthias Debusmann will be unveiling it at #bbuzz26.
Learn more: https://2026.berlinbuzzwords.de/session/kafi-streams-complex-stream-processing-made-simple/
@rasterweb@mastodon.social➡️ PyPI · The Python Package Index
#bookmarks
@mgorny@social.treehouse.systemsIt's always important to have a consistent #security policy.
For example, a policy of "If somebody filed a CVE, it's an important security issue, and we will fix it as such, no matter how meaningless the fix is. If nobody did, it's just a glorified bug fix, no matter how serious the bug was."
So we've just seen a #pip security release over "installing random packages can overwrite pip's files and pip can lazy-import some of them immediately afterwards", with a fix of "pip will no longer load them until you run it again" (leaving the underlying security issue of "any #Python package can override files installed by any other Python package" as intended behavior). As Eli Schwartz beautifully put it, you are not expected to be using the virtual environment; you should create it, install packages into it (at most once!), and then frame it and put it on the wall to admire.
Now we're seeing a "bug fix" for "malicious entry point names can write outside of virtual environment". If nobody filed a CVE, it's obviously not a security issue at all. At least upstream graced us with fixing it without correcting the spec to forbid that first.
https://github.com/pypa/pip/issues/14000
@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@cdonat@hostsharing.coopIs it only me, or has the hashtag #Python converted in to a LinkedIn-like wave of marketing bullshit? I really like Python, and use it a lot, but this is becoming unbearable.
@ellie@ellieayla.net
@tschfflr@fediscience.orgsurely a project that starts with converting a python script from 2 to 3 cannot go wrong #academicChatter
@Techmeme@techhub.socialGoogle releases macOS versions of AI Edge Gallery, which lets users run open models on their devices, and AI Edge Eloquent, an on-device voice dictation app (Google Developers Blog)
https://developers.googleblog.com/brin
@adlerweb@social.adlerweb.info @veit@mastodon.socialNow elementary-data has also been hit: for just under half a day, a malicious version 0.23.3 was available on PyPI, which had stolen credentials such as SSH keys, AWS login details, API tokens and wallet files. The attack was carried out via a script injection vulnerability in one of the GitHub Actions workflows. Cooldown helps protect against such attacks, as we have described here:
@nobodyinperson@fosstodon.org@… Yeah the students use Windows, but I of course also need to be able to use the IDE that's established in the course 😅 Took my a tad longer that I'd have liked to get it running, but as usual with NixOS, I now have something reprodicible and who knows how often I might need just that.
Python's strict indenting also trips me up and …
@stsquad@mastodon.org.uk @netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@fanf@mendeddrum.orgfrom my link log —
Towards scalable dataframe systems.
https://arxiv.org/abs/2001.00888
saved 2026-03-29 https://dotat.at/:/6GM7U.html
@kubikpixel@chaos.social«YubiKey Manager — Sicherheitslücke ermöglicht Ausführung untergeschobenen Codes:
Yubico warnt vor einer Suchpfad-Schwachstelle im YubiKey Manager, libfido2 und python-fido2. Updates korrigieren die Fehler.»
Eine IT-Security Meldung die wirklich sicher ist und Updates nun wirklich sofort vor dem Wochenende gemacht werden müssen.
🔐
@tinoeberl@mastodon.online#Steady #Klimacrew
#BahnMonitor-Projekt: 5. Automatisierte Skripte brauchen Kontrolle – besonders bei API-Aufrufen.
Jetzt bekommt das
@mgorny@social.treehouse.systemsThe #Gentoo #Python 3.14 switch / 3.11 3.13t removal PR is green. Doing some final testing locally before merging it (one that involves 350 "merge wait" packages, what could possibly go wrong…).
https://codeberg.org/gentoo/gentoo/pulls/1031
@floheinstein@chaos.socialUser A wrote a nifty little tool in Python. On Windows. Several weeks of work.
User B wants to use it as well.
They copy it, try to run it. Doesn't work.
Call me for help.
A: "It works on my machine. B must configure his python exactly like I do!"
Me: "Can't we run it in a virtual environment (venv). Or with a docker image?"
A: "Hm, I would have to learn how to do that. Is this really necessary?"
Me:
@dawid@social.craftknight.comMoje nowe odkrycie https://marimo.io/ - pythonowe notebooki jako pliky .py .
Bardzo sprytne narzędzie. To, co zrobimy w "notebooku" możemy też od razu jako skrypt uruchamiać.
#python #notebooks
@hynek@mastodon.socialI’d like to announce the most unlikely #Python package release:
service-identity 26.1.0, the best way to verify if a certificate is valid for a hostname, IP, or URI is out!
The main change is that we were able to switch from pyasn1 (thank you for more than a decade of great service! 🫡💛) to do everything within PyCA's cryptography.
@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@wraithe@mastodon.social“they stole my apes, Odo” — Still relevant
“I SEEM TO RECALL YOU TAKING GREAT GLEE IN EXPLAINING THAT CENTRALISED PLATFORMS WERE OBSOLETE THANKS TO NFT'S.”
“WELL-”
“BUT NOW YOU WANT THE AUTHORITIES HELP IN POLICING THE SALE OF THESE…THINGS.”
https://mastodon.social/@Wraithe/11159
@UlrikeHeiss@eldritch.cafeAusbeute eines wundervollen Ausflugs ins Naturkundemuseum Karlsruhe:
Die Python widme ich aus Gründen @…. Das Buch "Die Frau als Mensch" von @… lag dort im Museumsshop aus und ich habe es mir gleich gekauft - weil ich …
@krone@frawas.deLäufer knipste Python - Würgeschlange mitten in der Steiermark gesichtet #News #Nachrichten
@Techmeme@techhub.socialAnalysis: the share of entry-level hiring in India's tech sector fell to ~15% in 2025 from 28% in 2024 as companies shifted focus to AI and automation roles (Tanya Pandey/The Economic Times)
https://economictimes.i…
@arXiv_csOS_bot@mastoxiv.pageAgent libOS: A Library-OS-Inspired Runtime for Long-Running, Capability-Controlled LLM Agents
Yingqi Zhang
https://arxiv.org/abs/2606.03895 https://arxiv.org/pdf/2606.03895 https://arxiv.org/html/2606.03895
arXiv:2606.03895v1 Announce Type: new
Abstract: Large language model (LLM) agents are evolving from request-response assistants into long-running software actors: they maintain state across model calls, fork subtasks, wait for external events, request human authority, generate tools, and perform side effects that must be resumed and audited. This paper presents Agent libOS, a library-OS-inspired runtime substrate for LLM agents. Agent libOS runs above a conventional host operating system; it does not implement hardware drivers, kernel-mode isolation, or a POSIX-compatible operating system. Instead, it treats an agent as an AgentProcess: a schedulable execution subject with process identity, parent-child lineage, lifecycle state, a tool table derived from an AgentImage, typed Object Memory, explicit capabilities, human queues, checkpoints, events, and audit records. Its central design rule is tools are libc-like wrappers; runtime primitives are the authority boundary. Filesystem access, object access, sleeps, human approval, JIT tool registration, and external side effects are checked at primitive boundaries under explicit capabilities and policy.
We describe the design, threat model, Python prototype, and safety-oriented evaluation. The current prototype implements async scheduling, namespace-local Object Memory, runtime-integrated human approval, one-shot permission grants, per-process working directories, shell and image-registration primitives, Deno/TypeScript JIT tools over a libOS syscall broker, filesystem/object bridge tools, an injectable Resource Provider Substrate, deterministic demos, real-model smoke scripts, and 123 regression tests at the time of writing. Rather than improving planner accuracy, Agent libOS demonstrates a runtime substrate in which long-running LLM agents can be scheduled, authorized, resumed, and audited without treating tool dispatch as the trust boundary.
toXiv_bot_toot
@datascience@genomic.socialVideo tutorials for modern ideas and open source tools. #python
@compfu@mograph.socialMy current task for our #VFXPipeline is to accomodate Windows users in a Linux pipeline. Easiest option: give every Photoshop artist a Linux workstation for Nuke. Seems to be a common thing. But out of curiosity (and to be prudent with hardware) I‘m trying to get everything working on Windows. A constant source of sadness I have to say, worse than UTF8 strings in Python 2.
@tiotasram@kolektiva.socialIdea: statically typed language (or Python type checker?) Where types aren't declared, but can only be assigned by providing tests/examples that use that type. Examples could provide explicit type info where necessary, but code could not.
If it's not documented with an example, it's not safe to use with those types.
@grahamperrin@bsd.cafe@… thanks!
Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig — <https://www.
@inthehands@hachyderm.ioOne last example:
The first LLM code example that really made my eyes pop was early after the release of GPT, when somebody got it to combine Breakout with Conway’s Game of Life (a truly delightful idea). It worked!
Funny thing: the Breakout code and the Life code had a •completely• different style and flavor. Red flag. In about 15 minutes of web searching, I was able to find one of the projects (can’t remember if it was the Breakout or the Life half) which it had copied wholesale, with just a few variable renames. And the other half? It was in Python, but it used dictionaries where it really should have used objects — tons of `thing["prop"]` where it should have said `thing.prop`, and lots of other un-Pythonic stuff besides. It was a machine translate of code from another language, very likely Javascript.
The entire thing was a plagiarized Breakout and a plagiarized Game of Life, one transpiled, and all stuck together in a single run loop. To be fair, figuring out how to (1) run both halves of the logic from a single loop and (2) count the Life cells as Breakout bricks is work I'd cheer on from a second-semester intro CS student! It's not, however, quite what's being sold by these companies.
6/
@mgorny@social.treehouse.systems @netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@rasterweb@mastodon.social @philip@mastodon.mallegolhansen.com(I suspect the crowd on the fediverse will skew towards “yeah duh” on what I’m about to say - But I think there’s still value in saying it out loud)
As a Very Serious Enterprise Software Consultant I’m quite used to the lead time for running software to be Quite Long, for various Reasons.
So tonight for a change, I fired up my computer, opened up a new file with nano (Sorry vi vs. emarcs warriors) and just like… typed some python?
@heiseonline@social.heise.de @tinoeberl@mastodon.online#Steady #Klimacrew
#BahnMonitor-Projekt: 3. Klappt der erste Zugriff auf die Bahn-API?
Im nächsten Schritt wurde die API-Abfrage getestet udn geprüft, ob die zurückgelieferten Datenstru…
@michabbb@social.vivaldi.net#ZenOfAICoding: 16 theses on the future of #softwaredevelopment in the #AI era — a homage to the Zen of
@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@fanf@mendeddrum.orgfrom my link log —
Someone’s been messing with Python’s floating point subnormals!
https://moyix.blogspot.com/2022/09/someones-been-messing-with-my-subnormals.html
saved 2022-09-06
@mgorny@social.treehouse.systems @tinoeberl@mastodon.online#Steady #Klimacrew
#BahnMonitor-Projekt: 2. Welche Architektur sollte der Bot haben?
Bevor es ans Coden geht, ist etwas Grübeln über eine sinnvolle Gliederung der Module ratsam. Wie sie…
@hynek@mastodon.socialin a world of omnipresent shitty and baity talk/blog/video titles, I cannot appreciate @… 's talk enough:
"How to give your Python code to someone else”
It's perfect. 🥹
https://…
@Techmeme@techhub.socialOpenAI agrees to acquire Astral, which makes Python tools for developers, to integrate its team into Codex, and says Codex has 2M users, up 3x since January (Agnee Ghosh/Bloomberg)
https://www.bloomberg.com/news/articles/20
@netzschleuder@social.skewed.depython_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…
@mgorny@social.treehouse.systems> No significant changes.
Looks inside.
> Significant changes.
#Python
@tinoeberl@mastodon.online#Steady #Klimacrew
#BahnMonitor-Projekt: 1. Wie kommt man an Live-Daten der Deutschen Bahn?
Im November konnte ich per Zufall mit einem
@rasterweb@mastodon.social @Techmeme@techhub.socialStarlette, an open-source Python framework underpinning FastAPI, has a vulnerability, called BadHost, that can allow hackers to bypass authorization (Dan Goodin/Ars Technica)
https://arstechnica.com/information-te
@fanf@mendeddrum.orgfrom my link log —
Inside SPy: language semantics for a statically-typed compiled variant of Python.
https://antocuni.eu/2026/03/25/inside-spy-part-2-language-semantics/
saved 2026-05-23
@heiseonline@social.heise.de#TGIQF: „Das Leben des Brian“ — Das Quiz rund zu Monty Pythons Filmklassiker
Die Komödie "Das Leben des Brian" sorgte 1979 für reichlich Gelächter und kirchliche Pikiertheit. Wir würdigen den Monty-Python-Klassiker mit einem Quiz.
@hynek@mastodon.socialAnd while we're releasing, here's a double-feature, mostly to avoid GitHub Actions complaining about deprecated actions:
- https://github.com/hynek/build-and-inspect-python-package/releases/tag/v2.15.0
-
@mgorny@social.treehouse.systems#Python is just doing great. We're not having impossible constraints, as some projects need old #setuptools for pkg_resources, and other projects are starting to require newer setuptools for some fancy new features. And ofc after promising to release pkg_resources standalone over a month ago, setuptools upstream didn't deliver.
#Gentoo
@rasterweb@mastodon.social➡️ Beautiful Soup - Python Screen-Scraping
#bookmarks
@mgorny@social.treehouse.systemsFun case of circular logic in #Python #standards:
https://discuss.python.org/t/spaces-not-considered-a-valid-verbatim-character-for-glob-patterns/106463
1. Use "globs" in the specification.
2. Decide that "glob" may be ambiguous, so add severe restrictions on what's supported.
3. Because of the severe restrictions, people may have reinvented the wheel instead of using system `glob` module.
4. Since people may have used their custom implementations, just relaxing the spec is a problem.
@fanf@mendeddrum.orgfrom my link log —
Plotnine: grammar of graphics for Python.
https://plotnine.org/
saved 2026-04-20 https://dotat.at/:/96VP8.html…
@hynek@mastodon.socialI’m shocked I haven’t sold out PyTexas yet! What’s up Austin, I even got a fresh haircut! #Python
https://pretix.eu/pytexas/2026/
@Techmeme@techhub.socialTwo versions of LiteLLM, an interface for accessing LLMs, have been removed from PyPI after a supply chain attack injected them with credential-stealing code (Thomas Claburn/The Register)
https://www.theregister.com/2026/03/24/trivy_compromise_litellm/
@mgorny@social.treehouse.systemsI've been sad about the upcoming removal of #PyPy from #Gentoo, but given how many regressions I've been seeing recently in a variety of #Python packages, I'm eagerly waiting for the day when I'll remove the support and be able to stop having to deal with the test failures somehow. Not that at this point any other way of dealing besides skipping them makes any sense.
@rasterweb@mastodon.socialI was using the Python csv library for a script but decided I should dig into the pandas DataFrame stuff instead.
It was more complex, and it took me awhile to figure things out, and I had to read a bunch of web pages explaining things.
But in the end, I am 100% happy I did it that way.
I did not want to ask some AI/LLM for the answers, or to write the code for me.
Because for me, the struggle and the journey is part of creating something worthwhile.
@hynek@mastodon.socialHere’s stamina 26.1.0, my opinionated #Python retry package, that now supports more than 1024 retries for the cases when you need A LOT of stamina: https://github.com/hynek/stamina/releases/tag/26…
@mgorny@social.treehouse.systems @hynek@mastodon.socialMaintainer friends of wheel-heavy #Python packages: do we already have some practical, standard way to automatically upload all the cibuildwheel output across all architectures? My current workflow is a) a pain in the ass and b) requires me to have one last PyPI upload token.
@mgorny@social.treehouse.systems> #Python Stable ABI
> makes extensions unstable (they start segfaulting)
https://github.com/pikepdf/pikepdf/issues/723#issuecomment-4507472913
@mgorny@social.treehouse.systemsWell, we've finally packaged #Valkey (another #Redis fork) in #Gentoo, along with its #Python bindings.
Not that we wanted to, but #FakeRedis now started requiring it for tests so heavily that it was too much effort to patch it out. Just to be clear, it just requires the Python bindings, because its test suite happily runs against either Redis or Valkey, and literally doesn't support testing against both simultaneously. But to add the bindings, we needed the database to test them against. And since I've added the package too, I've put a lot of effort (and swearing) to test FakeRedis against both servers.
Should you be using Valkey? Well, let's put it like this. You shouldn't be using Redis, because it's enterprise quality shit. Valkey is roughly what happens when you fork enterprise quality shit and have no clue what you're doing. Though you are able to mostly get renaming right (one valkey-py test failed over the server calling itself "Valkey" rather than "Redis").
Disclaimer: I've only looked at the Python bindings. Maybe the maintainers are more knowledgeable with the server itself.
@hynek@mastodon.socialThis is such an end of an era that fresh Python programmers can’t even fathom.
PyPy used to be our hope! No major Python conference that didn’t suggest that they’re gonna fix the GIL and make time go backwards. And yeah, it’s really fast! I suspect the money-backed focus on performance in CPython combined with the compat paper cuts PyPy always came with has sealed its fate. I‘ve watched its decline over the years so I’m not surprised, but damn.
@mgorny@social.treehouse.systemsAlways appreciate #Python package developers being responsible about API stability, and… [checks notes]… raising the major version number over a "minor API tweak", then delaying the release until a security fix demanded one.
#packaging
@mgorny@social.treehouse.systemsYes, please reinvent more wheels by rewriting #Python logic in #RustLang. What could possibly go wrong?!
https://github.com/awolverp/cachebox/issues/51
@mgorny@social.treehouse.systemsHow to get a package removed from #Gentoo?
1. Add a new #NIH dependency.
2. The dependency turns out to use coherent.build. Nightmare! Oh, wait, apparently coherent.build generates source distributions that use flit.core (understandable; coherent.build is unusable).
3. The dependency depends on chardet (the project famous for GPL copywashing). Okay, technically it works with the older version, and the dependency is optional with poor person's fallback, so I guess it would be fine.
4. But hey, this package is not used by anything, and the last package using it in Gentoo was removed in 2020, after not being touched for 4 years already. Also, that package is not maintained upstream since 2017, so I guess there's negligible risk of it ever coming back.
#Python
@mgorny@social.treehouse.systemsThe state of #security these days: #Python #virtualenv package now includes SHA256 sums of their bundled wheels, declaring that it protects against "supply-chain compromise". Because obviously there are so many attack vectors that permit you to alter a .whl file but not the .py file in the same directory.
No, I'm not saying verifying checksum makes no sense, because indeed it can save some pain if fs is damaged somehow. However, calling this a "security" feature is a misnomer at best, and openly giving people false sense of security at worst.
@mgorny@social.treehouse.systems#Python #cryptography library (yes, the one that criticizes everything and everyone) is now vibecoded. Our future is truly bright!
Noticed because apparently "Claude" wrote a test that OOM-ed my system. But hey, #RustLang protects against memory errors, so it's fine to vibecode your security critical components.
#security #AI #LLM #NoAI #NoLLM
@mgorny@social.treehouse.systemsOne of my strong suites in all the packaging work is the knowledge in my head.
"Why don't you write it down for others to benefit from, then?", you'd ask.
The thing is, this knowledge is basically "hot cache". I'm bumping hundreds of #Python packages in #Gentoo, so I remember stuff. And because of that, I can quickly notice some things or answer some questions.
If that were written down, the effort needed to find it would diminish all the gain. I mean, technically *it is* already written down, and the whole point is that I have it "cached".
@mgorny@social.treehouse.systemsAlways grateful for the new levels of stability and reliability that #RustLang rewrites of #Python stuff bring.
> a = Tibs.from_i(-1, 128)
^^^^^^^^^^^^^^^^^^^^
E pyo3_runtime.PanicException: attempt to negate with overflow
https://github.com/scott-griffiths/tibs/issues/1
