home.social

#pyconus — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #pyconus, aggregated by home.social.

  1. So what can package maintainers do to help?

    Know who to call: [email protected] and [email protected]

    Look into Zizmor, then CodeQL, Semgrep, Fuzzer, LLM

    #PyConUS #PyCon

  2. So what can package maintainers do to help?

    Know who to call: [email protected] and [email protected]

    Look into Zizmor, then CodeQL, Semgrep, Fuzzer, LLM

    #PyConUS #PyCon

  3. So what can package maintainers do to help?

    Know who to call: [email protected] and [email protected]

    Look into Zizmor, then CodeQL, Semgrep, Fuzzer, LLM

    #PyConUS #PyCon

  4. So what can package maintainers do to help?

    Know who to call: [email protected] and [email protected]

    Look into Zizmor, then CodeQL, Semgrep, Fuzzer, LLM

    #PyConUS #PyCon

  5. So what can package maintainers do to help?

    Know who to call: [email protected] and [email protected]

    Look into Zizmor, then CodeQL, Semgrep, Fuzzer, LLM

    #PyConUS #PyCon

  6. Next Goal: Improving Python Ecosystem Vuln response capacity

    This means:
    - Threat model guide (@sethmlarson is sprinting on this!)
    - Scanning projects
    - Sec. Engineer time to respond more
    - Incident response that's more than just "when Seth and Mike are working"

    #PyConUS #PyCon

  7. Next Goal: Improving Python Ecosystem Vuln response capacity

    This means:
    - Threat model guide (@sethmlarson is sprinting on this!)
    - Scanning projects
    - Sec. Engineer time to respond more
    - Incident response that's more than just "when Seth and Mike are working"

    #PyConUS #PyCon

  8. Next Goal: Improving Python Ecosystem Vuln response capacity

    This means:
    - Threat model guide (@sethmlarson is sprinting on this!)
    - Scanning projects
    - Sec. Engineer time to respond more
    - Incident response that's more than just "when Seth and Mike are working"

    #PyConUS #PyCon

  9. Next Goal: Improving Python Ecosystem Vuln response capacity

    This means:
    - Threat model guide (@sethmlarson is sprinting on this!)
    - Scanning projects
    - Sec. Engineer time to respond more
    - Incident response that's more than just "when Seth and Mike are working"

    #PyConUS #PyCon

  10. Next Goal: Improving Python Ecosystem Vuln response capacity

    This means:
    - Threat model guide (@sethmlarson is sprinting on this!)
    - Scanning projects
    - Sec. Engineer time to respond more
    - Incident response that's more than just "when Seth and Mike are working"

    #PyConUS #PyCon

  11. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  12. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  13. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  14. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  15. How else are Watering Hole Attacks being mitigated?

    - Trusted Reporters / Auto-Quarantine
    - More Trusted Publishing providers
    - sudo mode and more scoped privileges
    - "Staged Releases"
    - "Secure Distributions" for CPython

    More Trusted Publishing Providers is desired! Warehouse is open source and PRs are welcome.

    #PyConUS #PyCon

  16. Just presented at EduSummit

    "Your slides, but faster:
    Building an AI-powered presentation workflow"

    pamelafox.github.io/ai-powered
    Tips: Use RevealJS, ASCII mockups, audits, agent skills

  17. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  18. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  19. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  20. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  21. At current pace, there will be 65 CVEs that affect the #python package ecosystem this year.

    This is easily 3x-4x previous years.

    One response to this is PEP-811: defining a Python security response team, membership and responsibilities (peps.python.org/pep-0811/)

    This makes it easier to add more members and spread the load.

    One result already in place: a formal vulnerability report response framework, uniting Github security policies and docs and the security response team.

    #PyConUS #PyCon

  22. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  23. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  24. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  25. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  26. Another new feature that's started mitigating risk: Dependency cooldowns.

    Available in pip 26.1 and uv, dependabot, renovate, cooldowns set a time period that a package release needs to be live before installing it. Most attack releases are resolved in 24 hours, so having a cooldown period really helps mitigation.

    #PyConUS #PyCon

  27. Our plane landing at . Taken by a pymug member (Nythienzo) on ground!

  28. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  29. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  30. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  31. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  32. PyPI has also done a second audit! Funded by the Sovereign Tech Agency, and performed by @trailofbits

    This was focused on the PyPI software itself, and was completed in 2023.

    #PyConUS #PyCon

  33. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  34. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  35. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  36. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  37. 40-50% of installs are not locked/pinned!

    People are running on latest and not paying attention.

    One new mitigation to some of these watering hole attacks: "Quarantine mode" and Trusted Reporters.

    #PyConUS #PyCon

  38. @pamelafox 's prez about slides with agents at was compelling as always

  39. I just finished giving my talk at the education summit, "Vibe teaching: training in the age of AI."

    What fun!

    I've uploaded the slides: speakerdeck.com/reuven/vibe-te

  40. Good morning ! FYI: auction donations are due today and you'll need to fill out: docs.google.com/forms/d/e/1FAI

    And don't forget to come to the auctionon Sat night! Dinner will be served and tickets here: us.pycon.org/2026/events/pylad

  41. One of my fondest memories of PyCon in Pittsburgh a few years ago was meeting up with a bunch of fellow pythonistas for a run through the park by the river. Now we get to do it by the ocean! Anyone interested in joining me for a run tomorrow morning? Gotta get out early enough to get breakfast afterward. I’m thinking maybe meet at the convention center entrance at 7am? 3-4 miles, relaxed pace.

  42. Registered. Not signed up for tutorials today. Going to spend time hanging in the hallways now that I found a handy outlet to charge my laptop.

  43. If someone tells you to go outside the doors to get to seaside. You may not be allowed to come back. Please avoid.

  44. EduSummit is now happening at !

    us.pycon.org/2026/events/educa

    I'll be giving a lightning talk and tutorial in the afternoon. Join us.

  45. What does PyCon US have in store today?

    Will it be as cool as these sweet shiny ones I pulled last night during the MTG draft @crazy4pi314 hosted last night?

    They'll be hosting another draft on Sunday if you're interested.

  46. What does PyCon US have in store today?

    Will it be as cool as these sweet shiny ones I pulled last night during the MTG draft @crazy4pi314 hosted last night?

    They'll be hosting another draft on Sunday if you're interested.

    #PyConUS #MTG

  47. What does PyCon US have in store today?

    Will it be as cool as these sweet shiny ones I pulled last night during the MTG draft @crazy4pi314 hosted last night?

    They'll be hosting another draft on Sunday if you're interested.

    #PyConUS #MTG

  48. What does PyCon US have in store today?

    Will it be as cool as these sweet shiny ones I pulled last night during the MTG draft @crazy4pi314 hosted last night?

    They'll be hosting another draft on Sunday if you're interested.

    #PyConUS #MTG

  49. What does PyCon US have in store today?

    Will it be as cool as these sweet shiny ones I pulled last night during the MTG draft @crazy4pi314 hosted last night?

    They'll be hosting another draft on Sunday if you're interested.

    #PyConUS #MTG