home.social

Search

1000 results for “pycon”

  1. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  2. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  3. Just presented at EduSummit

    "Your slides, but faster:
    Building an AI-powered presentation workflow"

    pamelafox.github.io/ai-powered
    Tips: Use RevealJS, ASCII mockups, audits, agent skills

  4. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  5. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  6. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  7. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  8. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  9. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  10. Our plane landing at . Taken by a pymug member (Nythienzo) on ground!

  11. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  12. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  13. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  14. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  15. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  16. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  17. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  18. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  19. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  20. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  21. @pamelafox 's prez about slides with agents at was compelling as always

  22. Starting with "Watering Hole Attacks" -- targeting places people are likely to return to.

    Shai-Hulud, LiteLLM, Trivy are all examples.

    A common loop is:

    "Malicious release" -> "Cryptocoins/ransomware/credentials" -> "Get more accounts" -> repeat

    Attacks in one ecosystem can spread, because so many companies ship multi-ecosystem packages.

    #PyConUS

  23. I just finished giving my talk at the education summit, "Vibe teaching: training in the age of AI."

    What fun!

    I've uploaded the slides: speakerdeck.com/reuven/vibe-te

  24. Malware reports are going up and to the right -- in fact we're at 4x year over year (🙃)

    The people involved (Mike and Seth) have not 4x'd in response.

    So let's talk about some of the attacks we're seeing.

    #PyConUS

  25. "AI is changing everything"

    Tools are getting much better at finding bugs and defects, so finding these vulns is cheaper, both time and resources.

    Reminder: Attackers just have to be correct once, defenders have to be right all the time.

    AI has made this asymmetry worse!

    #PyConUS

  26. I have made it to my first talk at #PyConUS

    First up: Python Security with @sethmlarson and @miketheman

    #PyConUS

  27. Good morning ! FYI: auction donations are due today and you'll need to fill out: docs.google.com/forms/d/e/1FAI

    And don't forget to come to the auctionon Sat night! Dinner will be served and tickets here: us.pycon.org/2026/events/pylad

  28. Good morning #PyConUS! FYI: #pyladies auction donations are due today and you'll need to fill out: docs.google.com/forms/d/e/1FAI

    And don't forget to come to the auctionon Sat night! Dinner will be served and tickets here: us.pycon.org/2026/events/pylad

  29. Good morning #PyConUS! FYI: #pyladies auction donations are due today and you'll need to fill out: docs.google.com/forms/d/e/1FAI

    And don't forget to come to the auctionon Sat night! Dinner will be served and tickets here: us.pycon.org/2026/events/pylad

  30. Good morning #PyConUS! FYI: #pyladies auction donations are due today and you'll need to fill out: docs.google.com/forms/d/e/1FAI

    And don't forget to come to the auctionon Sat night! Dinner will be served and tickets here: us.pycon.org/2026/events/pylad