Seth Larson

The “Open Source Maintainer Security Forum” Open Space will be in Room 202C at 3PM today 🐍🛡️

If you’re a project maintainer and want to discuss security, how to keep your project secure, or how to handle vulnerability reports: come and find us! 👋

👉 https://us.pycon.org/2026/schedule/open-spaces/#OpenSpace-43

#Python #PyCon #PyConUS #PyConUS2026 #security #oss #opensource

RE: https://fosstodon.org/@pycon/116538489589981492

This talk from @andrewnez grows more and more important as the days go on... it's a must watch!

#Python #PyPI #PyConUS #PyConUS2026 #security

#PyConUS is only a few days away! 🤩 As usual I’ll be covering the event exclusively on Mastodon (specifically the NEW “Trailblazing #Python Security” talk track on Saturday May 16th).

Time to reshare my hack for quick #Mastodon toot templates with event #hashtags:

https://sethmlarson.dev/quick-mastodon-toot-templates-for-event-hashtags

Little blog post for anyone who's interested in Epilogue Retrace and is like me: has a pre-USB-C iPhone and runs Linux instead of Windows or macOS 😢

https://sethmlarson.dev/epilogue-retrace-iphone-13-pro-ubuntu

#gaming #retrogaming #gameboy #epilogue #gb

Good morning! 🥐🍩 #FediDonutFriday

Hey #Python library maintainers! 👋 I sometimes see pull requests from well-meaning users about bumping minimum versions of dependencies to "fix security vulnerabilities". Here's a resource you can link to about why this strategy doesn't work in practice:

https://sethmlarson.dev/library-version-specifiers-not-for-vulnerabilities

#python #security #oss #opensource #vulnerability

RE: https://mastodon.social/@7ASecurity/116521920390604616

💪 “urllib3's supply chain posture was described as exceptionally strong, with advanced compliance across SLSA Source, Build, and Provenance requirements. The project maintainers were helpful, responsive, and engaged throughout the audit, ensuring that 7ASecurity had the necessary access and information at all times”

Excellent work @illiav and @quentinpradet! 👏

#security #python #opensource #oss #supplychain #slsa

I'm running a “ #Security for #OpenSource Maintainers” space at #PyConUS 2026 again this year. Bring challenges, feedback, and your experiences with the security tooling and “landscape” to share and learn from others.

Date will be announced closer to the event, hope to see you there!

https://us.pycon.org/2026/events/open-spaces/#openspace-43

#python #supplychain #pypi #oss

The only difference in holidays between the North American (NTSC) and PAL Animal Crossing: Population Growing calendars is Spring Cleaning Day and Labor Day.

Labor Day in Animal Crossing is May 1st in PAL (International Workers Day) and the 1st Monday in September in NTSC (Labor Day, US).

Spring Cleaning Day is March 15th in PAL, May 1st in NTSC.

Read more: https://sethmlarson.dev/animal-crossing-calendar#regional-differences

#retrogaming #animalcrossing #gaming #gamecube

RE: https://mastodon.social/@andrewnez/116478133377243019

Workflow security continues to be a common cause of compromises of open source projects.

If you're using GitHub Actions and don't want this to happen to your project: use Zizmor and treat the findings seriously, especially insecure triggers and user-controllable template injections.

https://docs.zizmor.sh

#github #actions #security #oss #opensource #python

pip 26.1 is an incredible release, thank you to the pip maintainers!! 💜

– Relative dependency cooldown support!
– Installing from pylock.toml
– Multiple security fixes

Read the full blog post by @ichard26

https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/

#python #pypi #pip #security #oss #opensource

I reworked my #Retroachievements play activity and progress tracker to only account for "Progression" and "Win Condition" achievements. Now I'm feeling a lot more confident about finishing “Legend of Zelda: Oracle of Seasons”. My estimated remaining play time dropped from 25 hours to 5 hours... 😅

https://github.com/sethmlarson/retroachievements-play-activity/commit/0e9a2670131b76cf2e83a37fbc735ad4ee1f592c

#retrogaming #gaming #zelda

I built a small progress calculator for #RetroAchievements using their API, and it's showing ~23h to beat LOZ Oracle of Seasons based on my progress speed. Compare that to 18h estimate from "Time to Beat"... this has been accurate to my feelings. I've been loving the @delta_emulator + Pocket Taco + RetroAchievements combination so far :)

https://github.com/sethmlarson/retroachievements-play-activity

#gaming #retrogaming #gameboy

Happy #FediDonutFriday ! 🍩🍩

:calculator: LAN Party Calculator for Mario Kart, Kirby Air Ride, and F-Zero

https://sethmlarson.dev/lan-party-calculator-for-mario-kart-kirby-air-riders-and-f-zero

#gaming #mariokart #kirbyairriders #fzero #nintendo

I just received my pre-ordered GameSir “Pocket Taco” this morning and found the setup to be non-trivial for pairing with an iPhone and configuring the controller with the @delta_emulator Here’s the exact steps to setup and start playing with this new controller:

🌮 https://sethmlarson.dev/getting-started-with-gamesir-pocket-taco-iphone-delta-emulator

#gaming #delta #emulation #retrogaming #controller #gamesir #pockettaco #iphone #ios

The popular #Python library “Requests” needs your help! @nateprewitt plans to add type hints to the API and is requesting feedback:

https://sethmlarson.dev/python-library-requests-is-adding-type-hints-and-needs-your-help

#typing #http #typehints

#GoodFirstIssue adding support for relative dependency cool-downs to pip. This would be a massive security improvement for users who can then set-and-forget a reasonable cooldown duration in their global pip config.

https://github.com/pypa/pip/issues/13674

#opensource #security #oss #python

I don't play a lot of Legend of Zelda games. Link’s Awakening surprised me how much the game respects your time and fit into my life. Now I am looking for more pocket-sized LOZ games to play next.

https://sethmlarson.dev/links-awakening

#retrogaming #nintendoswitch #legendofzelda #loz #gaming

#FediDonutFriday maple bacon Valentine's Day edition! I've got some time away from computers coming up, and I'm looking forward to the break... phew

Interesting blog post about text classification using compression, specifically the new "compression.zstd" module contributed by @emmatyping

https://maxhalford.github.io/blog/text-classification-zstd/

#compression #zstd #zstandard #classification

#FediDonutFriday coincides with a national shutdown in the USA today. See you in two weeks 🍩✌️

#ICEOUT #USPOL

#Pikmin 2 coming to Nintendo Classics, will the treasure hoard be the same...? 👀

https://github.com/sethmlarson/nintendo-classics/blob/33ce9dfc889930223bc2ead530356be5b8d83d08/nintendo-classics.csv#L383

#FediDonutFriday in federally occupied Minnesota: Maple & Bacon

Have you ever noticed that the food graphics in Super Smash Bros. and Kirby Air Riders is flat “billboarded” stock images of food? This artistic decision from director Masahiro Sakurai has persisted through 8 games over nearly 25 years.

While researching every game with this art style and all 150+ unique food images I ended up fixing wikis, reviewing a seasonal KitKat flavor, and preserving an uncatalogued image of tempura soba.

#gaming #smashbros #nintendo

https://sethmlarson.dev/food-jpegs-in-super-smash-bros-and-kirby-air-riders

I missed the first #FediDonutFriday of the year! 🍩 My next blog post will include many foods, including donuts, so here's a little preview (and peace offering for more donut Fridays in 2026)

#gaming #nintendo #smashbros #kirbyairriders

Also I was very tempted to publish my #blogroll with the original title of "Drawing with zero-width characters" by Benjamin Swerdlow... it definitely crowds out the other recent entries 🤣

https://sethmlarson.dev/blogroll

First post in 2026 and we're cutting spritesheets like cookies with #Pillow and #Python 🍪 I needed this for a future project on the blog, maybe you will get some use, too!

https://sethmlarson.dev/cutting-spritesheets-like-cookies-with-python-and-pillow

#pixelart #sprites #spritesheet #retrogaming

PEP 770 was accepted in April of this year, what has happened since then?

* Published a white paper on PEP 770 and phantom dependencies
* Auditwheel, manylinux, and cibuildwheel adoption
* Over 300 projects already ship with PEP 770 SBOM data
* Fedora and Red Hat adopted PEP 770 for Python packages

Read more: https://sethmlarson.dev/pep-770-sbom-data-from-pypi-fedora-and-redhat

#Python #SBOM #CycloneDX #SPDX #auditwheel #cibuildwheel

urllib3 used "DeprecationWarning" for 3 years to deprecate API features and it didn't work, so what do we do instead?

#python #deprecation #deprecate #api

https://sethmlarson.dev/deprecations-via-warnings-dont-work-for-python-libraries

#FediDonutFriday on a #PikminBloom Community Week walk! 🍩

Any #PikminBloom players out there? The arrival of Ice Pikmin 🧊🌱 means that collecting complete sets of decor within an event just got more difficult... 😬

I created a #Python script which simulates the number of seedlings required before and after the addition of Ice Pikmin.

Read more: https://sethmlarson.dev/ice-pikmin-and-difficulty-of-pikmin-bloom-event-decor-sets

Loving the energy from Hank this fine #Pizzamas

https://youtu.be/Vz0oQ0v0W10?si=IQe7IgpqZgdHT4Vv

I am interested in learning more about #passkeys (aka #passwordless). I've read a few older articles about how, due to the requirement of never allowing a "decrypted" key, passkeys are not portable across "providers".

So if you want to move from an iPhone to Android and you have passkeys associated with your keyring there's no way to move those passkeys to your new phone, you'd be regenerating them all for every service. Is this still the case in 2025, or has progress been made on this front?

Did you know that #gzip streams may contain filenames?

https://sethmlarson.dev/gzip-files-and-streams-may-contain-names

It's scary to be "on pace" for being able to try all the new food items at the Minnesota #StateFair... Trina and I are at 20/41 new items tried and we have two of 4 visits remaining in the year 😬

It's Minnesota #StateFair opening day, Trina and I are going (our first time to the opener) so if you're at the fair sometime tonight give me a ping! :)

I'm happy to announce that #urllib3 has a new lead maintainer: @illiav 👏 Illia has been contributing to urllib3 for over 3 years now and I'm confident will make a great lead of the project. I'll continue to maintain the project alongside my other co-maintainers @quentinpradet and @shazow

https://github.com/urllib3/urllib3/issues/3629

Thanks to the @sovtechfund and #AlphaOmega I was able to attend #UNOpenSourceWeek 2025 🇺🇳 representing the @ThePSF and focusing on how maintaining, supporting, and securing #OpenSource is a non-negotiable part of worldwide Digital Public Infrastructure (DPI). The trip was an inspiring reminder how many incredibly smart and talented people are working on this problem together.

Python 3.14 beta is now available, and there is no GPG signatures per PEP 751. Please test your verification of Python artifacts using Sigstore :)

#python #gpg #sigstore #security #oss #opensource

https://peps.python.org/pep-0761/

It's here! The 2024 annual report for #urllib3, a relatively quiet year that included work on HTTP/2 and Web Assembly (WASM). We include our plans for Python 2 deprecation, please take a look. $3,300 worth of bounty issues exist today!

https://quentin.pradet.me/blog/urllib3-in-2024.html

This model has me excited, web pages that asynchronously load #Python and #Pyodide for a seamless experience for the user while allowing developers to use Python.

https://kai.bi/post/run-python-programs-easily-in-the-browser

Hot off the presses!!! 🔥 Find me at #AllThingsOpen tomorrow and tell me how you're supporting your open source middle-stack for a #urllib3 sticker!

Cracking into some Fishwife x Fly By Jing chili crisp salmon tonight... 😋 #tinnedfish

https://eatfishwife.com/products/smoked-salmon-with-flybyjing-sichuan-chili-crisp

Lunar new year is approaching quickly, and that means it's bánh tét and dưa mắm week in our house 😋

#viet #lunarnewyear

https://en.wikipedia.org/wiki/B%C3%A1nh_t%C3%A9t

#urllib3 landed its first HTTP/2 PR, many more where that came from!

We're still fundraising to release HTTP/2 support, forward this URL to folks who have been wanting HTTP/2 support in #Python:

https://opencollective.com/urllib3/updates/urllib3-is-fundraising-for-http-2-support

I've successfully migrated from #TinyLetter to @buttondown, took a few hours but mostly painless (and I like the subscribe form embed).

📦 We released #urllib3 v2.1.0 today! This release removes many of the features that have been deprecated for removal in v2. Security fixes will continue to be available in v1.26.x thanks to @[email protected]

https://github.com/urllib3/urllib3/releases/tag/2.1.0

#urllib3 v2.0.4 is now available! This was the first release by our new maintainer Illia Volochii 🎉

– #PyPy now uses stdlib hostname verification if possible
– Union operator support for HTTPHeaderDict
– Emits http.client.connect audit events

https://github.com/urllib3/urllib3/releases/tag/2.0.4