Tootfinder

Einige der zuletzt hier besonders häufig geteilten #News:
„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python

„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python
Die Entdecker haben die root-Lücke im Linux-Kernel „Copy Fail“ getauft. Alle größeren Distributionen seit 2017 sind betroffen.

Noch ein paar der zuletzt hier besonders häufig geteilten #News:
„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python

„Copy Fail“: Linux-root in allen großen Distributionen mit 732 Byte Python
Die Entdecker haben die root-Lücke im Linux-Kernel „Copy Fail“ getauft. Alle größeren Distributionen seit 2017 sind betroffen.

Now elementary-data has also been hit: for just under half a day, a malicious version 0.23.3 was available on PyPI, which had stolen credentials such as SSH keys, AWS login details, API tokens and wallet files. The attack was carried out via a script injection vulnerability in one of the GitHub Actions workflows. Cooldown helps protect against such attacks, as we have described here:

Apps
App projects are suitable for web servers, scripts and CLI. We can also create them with uv init --package: myapp/pyproject.toml, The pyproject.toml file contains a scripts entry point myapp:main: ...

A user at a client contacted me over what transpired to be them trying to install a python library on a machine (that didn’t have python installed) to run an AI tool at the direction of ChatGPT.
After *I* get it installed:
User: “Ok, how does it work?”
Me: 🤷🏻‍♀️ (╯°□°）╯︵ ┻━┻ “never seen it before”

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

Here’s my part in the great nogil/free-threading endeavor: build-and-inspect-python-package now will optionally add 3.14t and 3.15t to the generated matrix if a package indicates to support 3.14 or 3.15!
https://github.com/hynek/build-and-inspect-python-package…

Release v2.16.0 · hynek/build-and-inspect-python-package
Added New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after e...

surely a project that starts with converting a python script from 2 to 3 cannot go wrong #academicChatter

my python boot is too tight

I think we should EOL #Python versions more often. This triggers not-very-active projects to finally make a release, including another batch of releases today (apparently 6 months mark). Unlike, I don't know, bug fixes.
#Gentoo

(I suspect the crowd on the fediverse will skew towards “yeah duh” on what I’m about to say - But I think there’s still value in saying it out loud)
As a Very Serious Enterprise Software Consultant I’m quite used to the lead time for running software to be Quite Long, for various Reasons.
So tonight for a change, I fired up my computer, opened up a new file with nano (Sorry vi vs. emarcs warriors) and just like… typed some python?

#ZenOfAICoding: 16 theses on the future of #softwaredevelopment in the #AI era — a homage to the Zen of

Slightly technical coding question, #Matlab to #Python:
What's the simplest way to read a Matlab table in Python?
Or, if that's not possible, what should I convert my Matlab table to so I can read it in python? 🙏
It's quite a big table with "nested" data i.e. some of th…

load matlab tables in python using scipy.io.loadmat
Is it possible to load matlab tables in python using scipy.io.loadmat? What I'm doing: In Matlab: tab = table((1:500)') save('tab.mat', 'tab') In Python: import scipy.io mat = scipy.io.loadmat(...

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

Вопрос к гуру #Python и #SQLite: что вы передаете в функции, Cursor или Connection? Какие плюсы и минусы, или нет никакой разницы?
Если нужно коммитить, то насколько странно делать это через cur.connection.commit()?

#Cython promises to make "writing #C extensions for Python as easy as #Python itself." The reality is: learn C's mental model, express it in Python syntax, and use a separate diagnostic tool to verif…

faster-python-bench/docs/cython-minefield.md at main · cemrehancavdar/faster-python-bench
Contribute to cemrehancavdar/faster-python-bench development by creating an account on GitHub.

The document-wide in-scrollbar thumbnail / minimap has been around for a while. Most people are familiar with it from RockScroll (2008) or Sublime Text (2012) or VSCode (2015).
#coverage #python

#Steady #Klimacrew
#BahnMonitor-Projekt: 7. Zufall ist nicht gleich Zufall. 🤭
Nach der Verspätungsmeldung kommt ein Wissenshäppchen. Der

Python-Projekt mit Bahn-API: 7. JSON-Wissenshäppchen: Zufall clever gemacht
So ergänzt dein Python-Bot Mastodon-Posts mit JSON-Wissenshäppchen – zufällig ausgewählt und fair rotiert.

from my link log —
Towards scalable dataframe systems.
https://arxiv.org/abs/2001.00888
saved 2026-03-29 https://dotat.at/:/6GM7U.html

Towards Scalable Dataframe Systems
Dataframes are a popular abstraction to represent, prepare, and analyze data. Despite the remarkable success of dataframe libraries in Rand Python, dataframes face performance issues even on moderately large datasets. Moreover, there is significant ambiguity regarding dataframe semantics. In this paper we lay out a vision and roadmap for scalable dataframe systems. To demonstrate the potential in this area, we report on our experience building MODIN, a scaled-up implementation of the most widel…

Boah, ernsthaft? Kauf mir nen Zi-Stick im Handel und muss erstmal durch dieses Firmware-Prozedere (https://aeotec.freshdesk.com/support/solutions/articles/6000270951-update-zi-stick-to-thread-or-zigbee-with-python-…

Polars is a lightning fast DataFrame library/in-memory query engine with parallel execution and cache efficiency. And now you can use is with the tidyverse syntax: #rstats

More Efficient Tidyverse Code, Using Polars in the Background
Polars is a cross-language tool for manipulating very large data. However, one drawback is that the R implementation has a syntax that will look odd to many R users who are not used to Python syntax. The objective of tidypolars is to improve the ease-of-use of Polars in R by providing tidyverse syntax to polars.

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

#Python #Type Checker Comparison: Typing #Spec Conformance
https://…

Thonny, Python IDE for beginners
#IDEsofMarch #python

I do not get how Python's math.modf works...
Why do I get all the zeros or nines?
4.4 | 4.0 | 0.40000000000000036
4.5 | 4.0 | 0.5
4.6 | 4.0 | 0.5999999999999996
I can fix it with... more math, but maybe I am doing something wrong?
#python #math

My current task for our #VFXPipeline is to accomodate Windows users in a Linux pipeline. Easiest option: give every Photoshop artist a Linux workstation for Nuke. Seems to be a common thing. But out of curiosity (and to be prudent with hardware) I‘m trying to get everything working on Windows. A constant source of sadness I have to say, worse than UTF8 strings in Python 2.

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

Falls ihr das #Python "dist"-Modul oder #Ansible nutzt und bei #Gentoo plötzlich für distribution/ansible_distribution/… falsche Werte erhaltet (z.B. ClearLinux):
Gentoo quo…

Aaand we're seeing the first '#setuptools < 82' runtime dependencies in random packages because they are trying hard to workaround breakage due to pkg_resources removal.
#Python

Looks like there is another supply chain attack on open source, this time the #python based #litellm package. I had a look at the #github page and I can see over a thousand open pull requests and a core t…

I've finally gotten Termux to rsync files via crontab. Needed to set up keychain, something I used to understand in the distant past. Now I have my own quantified-self data (well, location and battery) uploading to my private cloud.
#termux termux.api, python, rsync, crontab, keychain.

OpenAI agrees to acquire Astral, which makes Python tools for developers, to integrate its team into Codex, and says Codex has 2M users, up 3x since January (Agnee Ghosh/Bloomberg)
https://www.bloomberg.com/news/articles/20

ok so newsletter is out, and i’ve finally posted my PyCon UK keynote with additional material to my homepage.
if you wanna know what took me so long: check out my latest newsletter ;)
back to sauna!
https://hynek.me/talks/python-superpower/

Python’s True Superpower
Python appears to be everywhere nowadays! How did it happen, that a language that almost died in the Python 2 to 3 process is now the lingua franca a default choice when people talk about programming? There must be some secret superpower and I think I found it!

«YubiKey Manager — Sicherheitslücke ermöglicht Ausführung untergeschobenen Codes:
Yubico warnt vor einer Suchpfad-Schwachstelle im YubiKey Manager, libfido2 und python-fido2. Updates korrigieren die Fehler.»
Eine IT-Security Meldung die wirklich sicher ist und Updates nun wirklich sofort vor dem Wochenende gemacht werden müssen.
🔐

YubiKey Manager: Sicherheitslücke ermöglicht Ausführung untergeschobenen Codes
Yubico warnt vor einer Suchpfad-Schwachstelle im YubiKey Manager, libfido2 und python-fido2. Updates korrigieren die Fehler.

User A wrote a nifty little tool in Python. On Windows. Several weeks of work.
User B wants to use it as well.
They copy it, try to run it. Doesn't work.
Call me for help.
A: "It works on my machine. B must configure his python exactly like I do!"
Me: "Can't we run it in a virtual environment (venv). Or with a docker image?"
A: "Hm, I would have to learn how to do that. Is this really necessary?"
Me:

#Steady #Klimacrew
#BahnMonitor-Projekt: 5. Automatisierte Skripte brauchen Kontrolle – besonders bei API-Aufrufen.
Jetzt bekommt das

Python-Projekt mit Bahn-API: 5. Fehlerprotokollierung und Logfile
So richtest du Logging in deinem Python-Projekt ein: UTF-8-Logfile, CSV-Struktur, automatische Dateierstellung inklusive.

finally got around to "move my archive of scanned documents out of google drive" with the help of a lovely program "ocrmypdf", which is basically a python wrapper around tesseract and various pdf tools, but it's a really well done wrapper.
the simple invocation:
`ocrmypdf input.pdf output.pdf`
does what I want. the defaults are sensible. and now I can pdfgrep when I need to find that thing from 20 years ago that I still have for questionable "I do…

Blindsight Simulator https://github.com/Satoshi88818/BlindsightSim Stand-alone python script by James Squire to simulate visual experience through cortical and retinal visual prostheses a la Cortigent Orion or Neuralink Blindsight;

If you create visualizations with #Python, what would be your 2026 choice?
I recently learnt that #seaborn which I liked hasn't had a release over a year (which is not necessarily bad, but their move to an object interface was not nearly completed and now it's stuck).
Let me know your fav…

Final preparations for the Python Users Berlin (@…) meeting tonight. I’m looking forward to meeting all the Pythonistas in Berlin and Rodrigo’s (@…) talk on itertools.tee:

Python Users Berlin (PUB): The paradox of itertools.tee, Thu, Feb 12, 2026, 7:00 PM | Meetup
📆 Agenda * 19:00 Welcome to the PUB (Python Users Berlin) – setting up * 19:15 Main talk * 20:00 Lightning talks * 20:30 Social gathering 🎙 Main talk by [Rodrigo Girão

Moje nowe odkrycie https://marimo.io/ - pythonowe notebooki jako pliky .py .

Bardzo sprytne narzędzie. To, co zrobimy w "notebooku" możemy też od razu jako skrypt uruchamiać.

#python #notebooks

Idea: statically typed language (or Python type checker?) Where types aren't declared, but can only be assigned by providing tests/examples that use that type. Examples could provide explicit type info where necessary, but code could not.
If it's not documented with an example, it's not safe to use with those types.

We go back to the 60s this week for a bit of bluesy rock as our spotlight falls on a track from Python Lee Jackson.
As always we invite you to give it a listen and see what we had to say about the track and the band behind it.
Don't forget to follow us for more from our weekly showcase, exploring great tracks from across the universe of #rock and

Python Lee Jackson - In A Broken Dream
One awesome, hand picked song from the world of rock and metal, showcased every week. Nothing more, nothing less! 🤘

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

Argument type is "list[tuple[dict[str, list[list[Unknown]]], list[str]] | tuple[dict[str, list[list[Unknown]]], list[Any]]]"
Utterly ridiculous statements made about parsed json that no-one should have to read in the morning.
#python #typing

So last week I asked people to share their blog URLs, and I got a whole bunch of them! And I’ve been trying to go through them, and some go back to 2015… So there’s a lot to do. I did find a really interesting one about GPX files and Python, but it uses Google maps, and I’m not sure I want to do that since I prefer OpenStreetMap. Nice to find interesting gems though, in the 1,500 (gulp!) blog posts I’m going through.

Remember 2013 when i wrote ruby scripts, https://github.com/rtanglao/momogs , that used the get satisfaction API to report on Mozilla Thunderbird Desktop SUMO metrics? Neither do I :-) but i'm cooking up something better in python! hooray for "free compute" and i wish ruby was as popular as p…

#orjson is another #Python package you should avoid:
> There is no open issue tracker or pull requests due to signal-to-noise ratio.
#RustLang.

My wife is currently trying to get a python script working on her computer and she's encountering the "fun" of python not having any package manager built-in

The rewrite of the Sisyphus server continues, I've got all of the GET endpoints and about 60% of all the endpoints finished overall. Some initial testing on the `/workers` and `/queue` endpoints show some worrying results from the old version and some great results from the new version. The `/workers` endpoint started throwing errors at about 800 RPS on the Python/Flask version (the old one), the rewrite is showing around 4800 RPS (Golang/Gin). The `/queue` endpoint doesn't show a…

Downloading all my old Gmail attachments using this great Python script tool
https://github.com/mjseeley/Gmail-Attachment-Downloader
Finding some great old photos, but also realising how much digital crap we collect!

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

#MyDeepGuide with some #privacy network tests on #epaper devices. He developed a test method and an interesting Python analysis/report workflow that is supposed to be published. 👍
First run:

@… thanks!
Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig — <https://www.

I have just updated this old #IDA Plugin of mine: IDA Magic Strings.
https://github.com/joxeankoret/idamagicstrings
It now supports installation using hcli (

Very smart of Pantages Theater in Hollywood advertising with the RenFair in Los Angeles. I bought tix immediately. 😁
✅ Monty Python's Spamalot - Mar 24-Apr 12, 2026 - Pantages Theater, Hollywood
https://www.broadwayinhollywood.com/events/detail/spamalot

Two versions of LiteLLM, an interface for accessing LLMs, have been removed from PyPI after a supply chain attack injected them with credential-stealing code (Thomas Claburn/The Register)
https://www.theregister.com/2026/03/24/trivy_compromise_litellm/

LiteLLM loses game of Trivy pursuit, gets compromised
: Python interface for LLMs infected with malware via polluted CI/CD pipeline

Integration in Codex: OpenAI übernimmt das Start-up Astral
OpenAI baut mit der Übernahme des Python-Tool-Entwicklers Astral das Engagement im Bereich Coding weiter aus und will seine Codex-Plattform weiterentwickeln.

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

Replaced article(s) found for nlin.PS. https://arxiv.org/list/nlin.PS/new
[1/1]:
- sangkuriang: A pseudo-spectral Python library for Korteweg-de Vries soliton simulation
Dasapta E. Irawan, Sandy H. S. Herho, Faruq Khadami, Iwan P. Anwar
https://arxiv.org/abs/2601.12029 https://mastoxiv.page/@arXiv_nlinPS_bot/115932078207209076
- Piecewise integrability of the discrete Hasimoto map for analytic prediction and design of helica...
Yiquan Wang
https://arxiv.org/abs/2602.16255 https://mastoxiv.page/@arXiv_qbioBM_bot/116096399354766559
toXiv_bot_toot

An AI agent autonomously wrote and published a personalized attack article
against an open-source software maintainer
after he rejected its code contribution.
⚠️ It might be the first documented case of an AI publicly shaming a person as retribution. 
Matplotlib, a popular Python plotting library with roughly 130 million monthly downloads, doesn’t allow AI agents to submit code.
So Scott Shambaugh, a volunteer maintainer (like a curator for a repository of comp…

An AI agent just tried to shame a software engineer after he rejected its code
When a Matplotlib volunteer declined its pull request, the bot published a personal attack.

If you have a WordPress blog and want to retrospectively update your media library with image descriptions ... consider my little python script https://repos.mxhdr.net/maxheadroom/wp-image-alt-generator
This will generate images descriptions using various LLM providers …

wp-image-alt-generator
A Python script to add image descriptions to WordPress images in the gallery and also update existing blog posts with these descriptions. Provides multiple LLM backends.

from my link log —
Writing C with indent-based syntax similar to CoffeeScript or Python, via Guile.
https://sph.mn/computer/guides/c/c-indent.html
saved 2026-02-14

> The next great […] library for #Python
Checks.
> Last commit: 4 years ago. Already broken.

Does VSCode (eg in pylance) have a feature to display a clickable link to the language standard library documentation (eg #python #vscode #askfedi

#Steady #Klimacrew
#BahnMonitor-Projekt: 3. Klappt der erste Zugriff auf die Bahn-API?
Im nächsten Schritt wurde die API-Abfrage getestet udn geprüft, ob die zurückgelieferten Datenstru…

Python-Projekt mit Bahn-API: 3. Erste Tests mit API-Abfrage
Erfahre, wie du Bahn-API-Antworten in Python einliest, analysierst und debugst – mit Tipps zur Konsolenausgabe und Codeanpassung.

#Spring creator wants #Java’s type system to tame #agenticAI

in a world of omnipresent shitty and baity talk/blog/video titles, I cannot appreciate @… 's talk enough:
"How to give your Python code to someone else”
It's perfect. 🥹
https://…

How to give your Python code to someone else
You've written some Python code. It works great on your machine. Now you want someone else to use that code. … Presented by: Russell Keith-Magee

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

It's been a while but I was reminded that Java is shit.
Python is better, but has issues, mostly because of macOS.
And macOS permissions for user-created applications are a nightmare!
But a big, big thanks goes out to tools like Platypus.
"Platypus is a developer tool that creates native Mac applications from command line scripts such as shell scripts or Python, Perl, Ruby, Tcl, JavaScript and PHP programs."

Platypus - Create Mac apps from command line scripts |
Sveinbjörn's personal website. Also some open source software stuff.

#Python is just doing great. We're not having impossible constraints, as some projects need old #setuptools for pkg_resources, and other projects are starting to require newer setuptools for some fancy new features. And ofc after promising to release pkg_resources standalone over a month ago, setuptools upstream didn't deliver.
#Gentoo

#Steady #Klimacrew
#BahnMonitor-Projekt: 2. Welche Architektur sollte der Bot haben?
Bevor es ans Coden geht, ist etwas Grübeln über eine sinnvolle Gliederung der Module ratsam. Wie sie…

Python-Projekt mit Bahn-API: 2. Architekturentwurf
Architektur eines Python-Projekts zur Analyse von ICE-Verspätungen via Bahn-API – mit ChatGPT und strukturierter Code-Aufteilung.

Finally put together type stubs for an old (last release 2017!) python library I've been depending on for years. And now wondering whether it would have been easier to just contribute types to the library directly. I thought it abandoned but then the maintainer responded up on an unrelated ticket.
(Though there's no CI infra actually working anymore. Makes testing contributions painful. Wonder whether building that first would be worthwhile & welcome...)
#python #packaging

python -c "import this"
The Zen of Python, by Tim Peters
Beautiful is better than ugly.
Explicit is better than implicit.
Simple is better than complex.
Complex is better than complicated.
Flat is better than nested.
Sparse is better than dense.
Readability counts.
Special cases aren't special enough to break the rules.
Although practicality beats purity.
Errors should never pass silently.
Unless explicitly silenced.…

And while we're releasing, here's a double-feature, mostly to avoid GitHub Actions complaining about deprecated actions:
- https://github.com/hynek/build-and-inspect-python-package/releases/tag/v2.15.0
-

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

#Astral, die Firma hinter Python-Tools wie uv und ruff, wurde an #OpenAI abgegeben
https://astral.sh/blog/openai

#Steady #Klimacrew
#BahnMonitor-Projekt: 1. Wie kommt man an Live-Daten der Deutschen Bahn?
Im November konnte ich per Zufall mit einem

Python-Projekt mit Bahn-API: 1. Zugang einrichten
Entdecke, wie du mit Visual Studio Code und ChatGPT ein Python-Projekt realisierst – inklusive Vibe Coding und Bahn-API-Zugriff.

Here's two examples of running command line stuff on iOS via Apple Shortcuts and a-Shell.
One shows the uptime of my phone, the other runs a Python script and shows the output.
#iOS #apple #python

Did you know that #PEP425 ("Compatibility Tags for Built Distributions") said:
> Why isn’t there a . in the Python version number?
>
> CPython has lasted 20 years without a 3-digit major release. This should continue for some time. Other implementations may use _ as a delimiter, since both - and . delimit the surrounding filename.
This didn't age well.
#Python

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

from my link log —
Plotnine: grammar of graphics for Python.
https://plotnine.org/
saved 2026-04-20 https://dotat.at/:/96VP8.html…

Plotnine

python_dependency: Python Dependency Network
Python's package dependency networks. Nodes in the network are Python's packages registered to PyPI and edges are dependencies among packages.
This network has 58743 nodes and 108399 edges.
Tags: Technological, Software, Unweighted
https://networks.sk…

I was using the Python csv library for a script but decided I should dig into the pandas DataFrame stuff instead.
It was more complex, and it took me awhile to figure things out, and I had to read a bunch of web pages explaining things.
But in the end, I am 100% happy I did it that way.
I did not want to ask some AI/LLM for the answers, or to write the code for me.
Because for me, the struggle and the journey is part of creating something worthwhile.

I’m shocked I haven’t sold out PyTexas yet! What’s up Austin, I even got a fresh haircut! #Python
https://pretix.eu/pytexas/2026/

PyTexas 2026
April 17 – 19, 2026

Fun case of circular logic in #Python #standards:
https://discuss.python.org/t/spaces-not-considered-a-valid-verbatim-character-for-glob-patterns/106463
1. Use "globs" in the specification.
2. Decide that "glob" may be ambiguous, so add severe restrictions on what's supported.
3. Because of the severe restrictions, people may have reinvented the wheel instead of using system `glob` module.
4. Since people may have used their custom implementations, just relaxing the spec is a problem.

from my link log —
Nornir: an automation framework in Python.
https://nornir.readthedocs.io/en/latest/
saved 2020-03-23 https://dotat.a…

Here’s stamina 26.1.0, my opinionated #Python retry package, that now supports more than 1024 retries for the cases when you need A LOT of stamina: https://github.com/hynek/stamina/releases/tag/26…

Release 26.1.0 · hynek/stamina
Highlights stamina now allows more than 1024 retries by handling overflows and warns on a footgun. Full changelog below! Special Thanks This release would not be possible without my generous sponso...

Oh, in other news, Wheel Variants (formerly PEP 817) is being split into smaller PEPs that will be easier to comprehend. The draft of the first split part, PEP 825, titled "Wheel Variants: Package Format" has been merged. We'd appreciate your feedback!
#Python #packaging

Maintainer friends of wheel-heavy #Python packages: do we already have some practical, standard way to automatically upload all the cibuildwheel output across all architectures? My current workflow is a) a pain in the ass and b) requires me to have one last PyPI upload token.

How to get a package removed from #Gentoo?
1. Add a new #NIH dependency.
2. The dependency turns out to use coherent.build. Nightmare! Oh, wait, apparently coherent.build generates source distributions that use flit.core (understandable; coherent.build is unusable).
3. The dependency depends on chardet (the project famous for GPL copywashing). Okay, technically it works with the older version, and the dependency is optional with poor person's fallback, so I guess it would be fine.
4. But hey, this package is not used by anything, and the last package using it in Gentoo was removed in 2020, after not being touched for 4 years already. Also, that package is not maintained upstream since 2017, so I guess there's negligible risk of it ever coming back.
#Python

I had a question about Olympic success and wealth, and I’m glad someone else did too. And, they brought all the Python!
https://towardsdatascience.com/the-price-of-gold-is-olympic-success-reserved-for-the-wealthy-adade0233d61/…

The Price of Gold: Is Olympic Success Reserved for the Wealthy?🥇 | Towards Data Science
Analyzing 30 years of Olympic Games medals distribution and national wealth indicators

This is such an end of an era that fresh Python programmers can’t even fathom.
PyPy used to be our hope! No major Python conference that didn’t suggest that they’re gonna fix the GIL and make time go backwards. And yeah, it’s really fast! I suspect the money-backed focus on performance in CPython combined with the compat paper cuts PyPy always came with has sealed its fate. I‘ve watched its decline over the years so I’m not surprised, but damn.

The state of #security these days: #Python #virtualenv package now includes SHA256 sums of their bundled wheels, declaring that it protects against "supply-chain compromise". Because obviously there are so many attack vectors that permit you to alter a .whl file but not the .py file in the same directory.
No, I'm not saying verifying checksum makes no sense, because indeed it can save some pain if fs is damaged somehow. However, calling this a "security" feature is a misnomer at best, and openly giving people false sense of security at worst.

I’ve been working on some Python code for a few days now… just an hour or so in the evening as time allows. I could probably use some AI Slop Generator to quickly kick out what I need, but that’s not gonna happen.
No, Nope, No Way.
I actually *want* to write the code, and understand it, and know that every choice was mine, even if I make mistakes along the way.
If I publish it I want it to be from me, not from me and the AI Slop Generator and every codebase it ever stole …

since I see a lot of gloom re Astral x OpenAI:
⁃ Even if Astral actively (malice) or passively (neglect) ruins uv, Python packaging is 1000x better today than 2 yrs ago.
⁃ Ruff is nice but only nice to have—ty is barely usable. We'll be fine if they vanish today.
⁃ Channelling Buddhism: it’s OK when things change or go away! Expecting things to last forever is an unnecessary source of suffering. But, worst case is that we get the community-maintained pkg mgr you always w…

I'm looking at Repology, and I think most of the distributions and other downstreams have rightfully boycotted #Python #chardet #copywashing. Of course, there's the possibility that some of them are simply out-of-date, though.
So far chardet-7 is distributed by #Chromebrew, #CondaForge (not on Repology), #Homebrew, #KaOS, #OpenIndiana, #openmamba, #Ravenports, #Spack and #T2 SDE. Shame on you!
https://repology.org/project/chardet/versions
https://repology.org/project/python:chardet/versions

Always grateful for the new levels of stability and reliability that #RustLang rewrites of #Python stuff bring.
> a = Tibs.from_i(-1, 128)
^^^^^^^^^^^^^^^^^^^^
E pyo3_runtime.PanicException: attempt to negate with overflow
https://github.com/scott-griffiths/tibs/issues/1