#464: Malicious Package? No Build For You!

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly

00:04 to your earbuds. This is episode 464, recorded January 5th, 2026. Brian, it's 2026. Amazing.

00:14 It is amazing.

00:15 I'm Michael Kennedy.

00:16 I'm Brian Okken.

00:17 We're here to bring you another year of awesome Python news, and we've got a bunch of good ones

00:23 queued up here. I've got a pretty interesting spy story to tell people, Brian. It's going to be

00:27 very fun. Cool. Yes. If you're listening and you're not subscribed to the newsletter, you

00:32 definitely should. It's super high quality. We put a lot of extra details, extra information,

00:37 not just a emailing version of the show notes. Follow us on the socials. You'll find them on

00:43 probably in the newsletter. I believe they're right there at the top, but also in the show notes.

00:47 And yeah, with that, Brian, how would you like to kick things off for the new year?

00:52 Ty, I think I'm pronouncing it Ty. I don't know how it's supposed to be.

00:56 I've asked Charlie Marsh.

00:57 No, it's ty.

00:58 TY.

00:58 It's ty.

00:59 Okay.

00:59 I believe because it's uv.

01:01 TY.

01:01 So now I'm starting to doubt myself, but when I interviewed him about ty, I asked, I'm pretty

01:07 sure it's ty.

01:08 Oh, that makes sense.

01:09 UV and TY?

01:10 TY.

01:11 TY.

01:12 Okay.

01:13 It's an extreme, it says it is an extremely fast Python type checker and LSP, which is

01:20 what a language server protocol.

01:23 I don't know what LSP stands for.

01:24 Do you?

01:25 server protocol uh yeah lsp something yep anyway um it's okay so ty's been out for a while but the

01:33 news as of december 16th is that it's um it's in beta um people have been playing with it for a

01:39 while anyway but i thought um uh so we're gonna link to the uh charlie marsh's announcement of it

01:46 but and this was going to actually to be clear this was going to be an extra um but um i was

01:52 playing with it this weekend and i'm kind of in love i really like uh ty um so really fast type

01:59 checker and language server and um and luckily this is not one where you you it's so fast that

02:05 you say did it actually run because it actually prints something out when you when you run like

02:10 tie check it'll it'll say yeah it even if every if it doesn't find anything it says like all done or

02:16 or so thank you thank you to you astral to actually letting us know that it's finished but it is super

02:23 fast so um type checking i i've used my pi before i think that's pronounced my pie and uh and pyrite

02:33 i tried that and pilance um so actually i remember pilot pailance has been a while but i have tried

02:40 pyrite and my pie because people have submitted issues with some of my projects to say hey these

02:44 these throw problems with mypy can we fix this so we've had some fixes on like a py test check

02:51 has been one project that we've made some changes however okay so installed ty this just the other

02:59 day and yes it is super fast i didn't did i'm using expecting um in they have a graph that shows uh

03:08 Oh, what are they typing?

03:12 Oh, they checked home assistant project, which is a pretty big project.

03:15 And my pie takes 45 seconds to run and ty takes two seconds.

03:23 And I didn't have anything that large.

03:26 It just ran instantly and spit out a ton of stuff.

03:30 So I tried actually went back and tried a couple other projects.

03:33 So here's another project running it.

03:37 Let's see, in the Torch project.

03:39 Oh, recompute.

03:40 I'm getting ahead of myself.

03:42 So it's really fast, but that's not the coolest part.

03:45 The coolest part is it's really fast just the first time.

03:48 And then it's even faster when you run it again, because they're doing regenerative stuff.

03:55 So when you, after, what did they write down?

03:59 It was designed from the ground up to be incremental.

04:03 to have incrementality. I don't think that's a word guys, but, to incrementally, just,

04:10 just check the things you've changed to make it faster. And the reason why is to try to get it

04:15 running within your editor as well. So, yeah, so it's pretty, pretty fun. I actually ran it.

04:22 So, like I said, I ran it on some small projects and it, it, a couple of things I'm like,

04:27 why is it bugging me about this? But I just tried to fix the suggestions and I found that

04:33 So it was making easier to read code, even though I didn't, some of the things I didn't

04:38 quite get, like here's one that tripped me up.

04:40 So if you, if you declare, if you've got a function with a input parameter and you declare

04:46 the input type, I always think of that as like the input type.

04:49 I expect the user to call this function with, but once I'm in the function, I can, I can

04:54 like change the type.

04:55 If I, it came in as a list of strings and I wanted to turn it into just a concatenated

05:00 full string.

05:01 That was actually the example I had.

05:04 And it said, yeah, that's the wrong type.

05:06 You said list of strings, but then you assigned it a string.

05:09 And I'm like, well, okay, would it be more clear if I add a new variable?

05:14 And I actually just tried to clean it up.

05:16 And I'm like, yeah, this is easier to read, actually.

05:18 It'll be better to maintain.

05:19 So I'm trying to embrace the error messages as something that might make it easier to read,

05:24 even and not become combative.

05:26 But I tried installing, there's an extension that they released also to the ty extension for VS Code.

05:33 And this does a ton of stuff.

05:36 Inlay type hints, go to definition information.

05:40 I'm pointing this out because I know people will try it out.

05:43 But you'll have to be sure to read the documentation because there's a warning in there to say it's a language server also.

05:51 So you need to either turn off the default language server

05:55 or turn off TY's language server.

05:58 Having two at the same time don't work great.

06:00 So I'm super happy with the project so far, but yeah.

06:04 That's cool.

06:04 I definitely want to give the extension a try.

06:07 I've been using PyRite as well, and it's also, sorry, PowerFly,

06:10 all the PIs, PowerFly, and it has the same deal.

06:14 You've got to go disable a bunch of stuff in the Visual Studio editors

06:18 and, you know, like Cursor and others.

06:20 And it's annoying that you got to do it.

06:22 I feel like that is a fault of Visual Studio code.

06:26 Why would it let you run two language servers for the same language?

06:29 That should be like, which one do you want to use?

06:32 Just tell me, right?

06:33 I detected that two are running.

06:35 It's kind of the nature of Visual Studio being just composed out of a bunch of disjointed things.

06:41 But once you get it set up, it's super nice.

06:42 I totally agree.

06:44 One thing I wanted to bring up that I haven't yet also is when I ran it on pytestCheck, it ran it like,

06:50 and actually I've known that the pytestCheck is kind of a fun plugin, but it has some,

06:56 like I'm hacking Python with this.

06:58 I'm like overloading a bunch of stuff and a package that's also a context manager

07:04 and stuff like that.

07:05 I do plan on like, it's noting a whole bunch of errors and I do want to fix all those

07:10 that just have a lot of other stuff going on.

07:12 And so I'm not like a really, I didn't intend for this to be an apology.

07:18 What I'm meaning is when I go to check these, TY has a whole bunch of settings.

07:23 You can turn off any check.

07:25 So that's what I think I'll do.

07:26 I'll probably like any of them that are failing, I'll probably turn them off

07:30 and then fix them one at a time and go through.

07:33 And I like that they just said, you know what?

07:35 People might want to like turn any of these off.

07:38 So we'll just give you access to all of them.

07:40 So yeah, that's very cool.

07:42 I'd like to throw out one more thing about the fast, like, well, my editor's fast enough.

07:46 I don't really care, right?

07:47 Or what's it matter if it takes 20 seconds for Pyright to run?

07:51 One of the things that you can do with these that I don't think a lot of people are doing,

07:55 but you can tell, you can set up rules and tell your agentic coding tools,

07:59 like whenever you make a change, please run ty or Pyright or whatever

08:04 against my code base and verify that you haven't made any typing mistakes.

08:08 Everything's hanging together, right?

08:10 And those tools will do that like over and over and it can just make it super slow, right?

08:15 So you're not sitting there waiting for the thing to run and run, you know,

08:19 just reanalyze, reanalyze, just tell it to use ty and it'll just be nearly instant.

08:24 Nope, it's fine.

08:25 Oh, I got to fix something, right?

08:26 So one more use case here.

08:27 Yeah, and like we said, since it's incremental, it'll be like milliseconds to rerun it.

08:32 Yeah, exactly.

08:33 Exactly, super cool.

08:35 All right, I have a scary story for you, Brian.

08:39 Okay.

08:40 So I want to talk about a pair of articles I wrote, and I think they're very, very constructive, very helpful for people to use.

08:49 So increasingly in open source, we're dealing with issues around supply chain problems, right?

08:56 This first surfaced most prominently with typosquatting, and I'm sure people have heard of that word by now, but it's like Django without the J or whatever.

09:06 And if people don't really know and they type, you know, pip install dango or whatever, it might go and find nothing and say that's there.

09:15 Or it might find something that someone put up there to look like Django, but also bring down some kind of malicious badness, right?

09:22 And that's a problem.

09:23 You can fix it by being careful.

09:25 The PyPI folks are doing a lot of work to fight that and to like preserve misspellings of common, common things.

09:32 But it's still, it's an issue, right?

09:33 I mean, it's gone so far that there are people trying to see what agent encoding and LLMs would recommend because sometimes they would make up package names and then they would go put stuff there.

09:44 So that when the next time it recommends that non-existing thing, it actually exists as a virus.

09:49 Right.

09:49 So you got to be careful.

09:50 But way more serious than that is there was some announcements that some folks had been phished who worked on some project and their PyPI credentials were hacked and their projects were replaced with lookalike projects, but that also had bad things in it, right?

10:07 And that's way worse.

10:09 So if I use some library and it uses a library, which itself uses a less known library way down the chain and that third level gets hacked and I pip install the new version of my library, I'm toast.

10:22 Right. And it's not because I misspelled something and nobody misspelled anything.

10:25 It's because somewhere along the way, somebody's computer got taken over in some way.

10:30 Off it goes. This is bad.

10:32 So I thought I was thinking about this over winter break.

10:34 I'm like, well, what can we do about it?

10:36 So I wrote two articles with concrete advice.

10:39 First one, Python supply chain made easy, right?

10:42 And what are you going to do?

10:43 I gave out some examples.

10:44 So here's the thing.

10:46 We have this tool called pip Audit, right?

10:49 Pip Audit is cool.

10:50 It audits Python environments.

10:51 It's officially part of the PyPA.

10:53 It's under their GitHub organization, even though it's Trellabits and Google

10:57 have also had influence on it.

10:59 It audits Python environments, requirement files, and dependency trees for known security vulnerabilities,

11:04 and it can even fix them.

11:05 I don't care about fixing them because it may be too late.

11:08 I just want that to not happen.

11:09 So what I was thinking is like, well, how do we use that tool?

11:13 And how do we use UV?

11:15 So one thing you can do is with pip audit is you can just say this virtual environment,

11:19 everything installed in here, how's it looking?

11:21 Is it bad or is it not bad, right?

11:23 And you can just uv tool install it.

11:25 So because it doesn't have to be installed in your local environment, not necessarily,

11:28 right?

11:29 You just have that active when you run it.

11:31 So that's pretty cool.

11:33 But what if people don't run it?

11:36 you know like this is always the problem is like I set up this thing this um this way to lint code

11:42 or format it to make sure we always do it right but then there's those people that just don't run

11:45 it right so one thing you can do this nice is I created a unit test py test test which will run

11:52 pip audit on wherever py test is running so like your application is being tested it will also run

11:58 pip audit against that so that's cool it just does a sub process figures out which version of python

12:04 on it is, and then it just runs pip on it.

12:06 For this to work, you've got to actually have it installed

12:09 as part of the virtual environment.

12:10 But that's all good, right?

12:11 So then it will just look at all the stuff you've got installed,

12:16 and your test will fail, which means your CI will fail

12:20 if some kind of vulnerable thing gets in there.

12:22 That's pretty cool.

12:22 Yeah, pretty nice.

12:23 So people can just grab this test and drop it in, and there's really not much to it.

12:27 And you run it.

12:28 It's cool.

12:29 Also, you could-- I mean, you could set it up as a git commit

12:32 hook, but it's a little bit slow.

12:34 So next thing you can do is very often something like this will happen.

12:39 A couple of days later, people are like, why is my CPU at a hundred percent?

12:42 And why is it this project I'm working on?

12:46 You know, it'll get discovered, right?

12:48 And these things get ganked pretty quickly.

12:49 That's kind of the positive side is they don't typically last.

12:52 So the other thing you can do was with uv, as you can say,

12:56 UV pip compile or uv sync --upgrade, I think is the command for the uv lock file version.

13:05 But regardless, you can always pass a exclude newer than,

13:10 just dash, dash, exclude, dash newer, some timeframe.

13:13 So I chose one week.

13:14 And what that means is, if when I say update my requirements in the pinned lock file,

13:20 it will basically pretend anything released in the last week

13:24 doesn't exist and only update them to a week ago.

13:27 That way, because the problem is, PipAudit can know that there's a bad one, but if it was released 10 minutes ago, PipAudit,

13:34 no one's going to have reported it and formalized it, right? There's this window in the really early

13:39 days of a package being updated that no one's going to catch it and get it into the ecosystem

13:44 in time, right? And so just having a little bit of time, like let other people try this project

13:49 for a week. If no one freaks out and says, oh my gosh, it's taking over the world, it's more likely

13:55 to be okay, right? Yeah, sure. I mean, look, it's not a complete defense. It's not like, well,

14:00 if it's a week or older, it's never going to be a problem. But almost all of these that are big

14:05 problems are discovered within a week or, you know, put a month, whatever you put a year, like

14:10 whatever you feel is like enough that it's very unlikely you're going to get tied up in it. Right.

14:14 We can put whatever number you want, but the point is you can put a delay. So whenever you say update

14:19 my dependencies, it says, but not the very, very, very new ones. And I've been doing that for a

14:23 and it's been fine for a while. I mean like a week and a half. But I thought, okay, well, what about,

14:28 this is all well and good if you have CI, but what about production? What if you're doing like

14:32 DevOps with Docker or stuff? Also, if you run your pip audit and it tells you that you have a virus

14:40 you've pip installed into your dev machine, too late. Once you've installed a virus, like it could

14:45 have downloaded stuff off the internet. It could put root kits, like you're done, right? That machine

14:50 probably needs formatted. It's very bad. So is there a way that we could do this before we put

14:55 it into our computer with pipaudit, right? You can, under some circumstances, give it like a

15:01 requirements file, but I think a better way is to just install stuff into a virtual environment.

15:05 So I did a follow-up thing here that says, here's how you create a Docker instance that can copy

15:13 whatever lock file you have into your temporary Docker container, install the requirements with

15:21 UV, run pip audit on it, and then give you an answer back. That way, even if it does find something,

15:26 it finds them over there, not in your computer, but in an isolated Docker environment, which should

15:32 be safe. So it talks to you that, which is pretty cool. I'll give you a little Docker file that works

15:37 nice and easy. You can do whatever you want, create an alias so that it'll run with nice

15:41 reporting, you can skip things you don't care about.

15:44 Like this PDF library on Windows, if you give it a SVG file, image file, it has a vulnerability.

15:51 I'm like, well, one, I'm not running on Windows.

15:53 I'm not giving it user input.

15:55 Like I don't care about, like I just, that's not a problem to me.

15:58 No, there's certain things you might want to just ignore.

16:00 And then finally, you can put, I'll show you how to use like super good build time caching

16:06 to actually run as part of your Docker build pip audit

16:11 so that you can't even build a container that has a vulnerability.

16:14 Like it will fail the Docker build if it has a problem, according to pip audit.

16:18 I mean, for some definition of a problem.

16:20 Yeah.

16:20 So that whole series I wrote over winter break, and I think it'll help people.

16:25 Super easy to adopt.

16:26 There's not much to it.

16:27 If you're using Docker, it's got good things for that.

16:29 If you're not, it also has things you can adopt.

16:32 I'm curious with the, yeah, On this topic of dependencies and stuff and possible vulnerabilities, I was trying to remember the name of the word, but basically if you take some other project and just copy its source into yours.

16:47 Vendoring.

16:48 Vendoring, that's it.

16:50 I'm just wondering if that's going to happen more often for production projects because you could have something automatically or have an agent or something checked to see if there's any updates in the project.

17:04 and copy them in and test them.

17:06 Yeah, I think that's going to happen a lot, especially for small libraries.

17:09 Like, oh, this one just adds color to your output.

17:11 You're like, hmm, do I really need, like how often is that going to change?

17:15 Probably never.

17:16 Yeah.

17:16 Do I need to be subjected to a supply chain story or could I just copy it in?

17:22 Or with the agent encoding things, you're like, I really just need these two functions.

17:26 Can I just ask it to write these functions?

17:28 And if they're working, like I don't need a library at all.

17:30 You know, I agree 100%.

17:32 I think so.

17:34 Okay.

17:34 I'm going to actually talk about main updates as well in a different sense, I guess.

17:41 So I want to talk about typing extensions.

17:44 And again, this comes out of a suggestion from a listener.

17:50 It was going to be just an extra, but I started using it and it's pretty cool.

17:55 So in December, we were talking about, or I was talking about at least,

18:00 deprecation warnings and the topic of how do you deal with that of deprecated items.

18:06 And one recommendation is, was the deprecated, using the deprecated decorator.

18:14 So you could say warnings import from warnings, import deprecated,

18:19 and decorate a deprecated function.

18:21 However, we were reminded that that's Python 3.13 only.

18:26 Somebody named PrioInv on Mastodon notified us and said, hey, there's the typing extensions

18:32 and they have them.

18:33 And so I was checking this out.

18:35 So the typing extensions, let's see, deprecated.

18:40 We could just say, get it from typing extensions.

18:43 And now we've got it on earlier versions of Python.

18:47 I haven't, like, I don't know if this is a, okay, I'll save my comments, a couple of

18:53 comments for the end.

18:54 But I'm pretty excited about this.

18:56 So I'm hoping that I can just use like the modern type, modern typing for different projects.

19:05 And like, why is this important?

19:06 It's important because me as a developer, I can kind of remember how to do typing in one version of Python.

19:12 But if I'm trying to remember, well, what typing decorators and all that stuff do I use for 3.12

19:20 versus 3.13 versus 3.14?

19:23 And that's hard to keep a track.

19:24 So I'm excited to start using typing extensions.

19:28 And hopefully this cures the trying to keep track of it all.

19:31 So of it.

19:32 So there's a whole bunch of stuff in here.

19:34 We've got, it's got typing primitives, protocols, decorators, functions, enums, pure aliases,

19:43 all sorts of stuff that, and it tells you when things were added and all that.

19:48 So anyway, kind of fun.

19:50 Okay.

19:51 Yeah, that's very nice.

19:52 So hopefully I can get away with just using the deprecated wrapper, even in 3.12.

19:58 So because I mean, like, come on, everybody's got like a project that uses a new, the newest

20:03 because it's my side project.

20:05 It's using the newest version.

20:06 Or I've got a library that I'm supporting that's supporting everything back to 3.12 maybe

20:13 or 3.8 or 3.9 or whatever.

20:15 And then a work project that's using 3.13, stuff like that.

20:19 Yeah, I got a message from somebody saying, what am I open source little smaller libraries?

20:25 They can't get it to work.

20:26 They can't get it to install or something.

20:28 And I'm like, hmm, can't really see what the problem is.

20:32 Oh, you're using 3.9 and it's using some feature of 3.10 and it says it needs 3.10.

20:37 They're like, why doesn't this work?

20:38 I'm like, literally, it sounds new, but that is no longer supported at all.

20:44 It's easy for these to sound like, ah, 3.9 is not that old.

20:47 But it's out of even the bug fixes and security fixes.

20:52 Yeah, so people remember to do a min version in your PyProject.toml if you're doing a library

20:59 that other people install so that it just doesn't even update to that version.

21:02 Exactly.

21:03 That's what I did.

21:04 But there was not a fallbacks older version they could use,

21:07 because it uses types that are not available, like the lowercase d dict of string string

21:14 or something like that.

21:15 Oh, yeah.

21:16 Right.

21:17 Who wants to go back to importing uppercase dict?

21:20 I don't want to do that.

21:21 Exactly.

21:21 I'm like, I will do it when he needs support.

21:23 But like, if it's literally out of support, I'm sorry.

21:25 This is not on me to like make my library work on, you know, as far back as history goes.

21:30 All right.

21:31 Let's talk about my spy story.

21:34 Okay.

21:34 So this is a real short one.

21:35 My first one was really long.

21:36 This one's really short.

21:38 New MI6 chief Blaze Metroeli outlined her vision for a technologically,

21:45 augmented intelligence gathering in her first public speech on December 15th,

21:50 warning that the UK operates in a space between peace and war.

21:53 I mean, MI6, come on, James Bond, pretty cool.

21:56 At the Tameside headquarters, she said previously the UK,

22:02 she was previously in charge of Q, which is kind of cool.

22:05 Anyway, said the headline is, We will need our MI6 spies agents to be as fluent in Python as they are in Russian.

22:15 It's kind of interesting, right?

22:16 Yeah.

22:17 Look, we live in this super technological world, and so much of this is becoming cyber more and more.

22:24 One of the main bits is, while mentioning China, Miraweli focused mainly on the threats from Russia.

22:30 She said the country is, Russia is, testing us in the gray zone with tactics that are just below the threshold of war.

22:37 Pretty much cyber attacks, critical infrastructure, drones, propaganda, all the stuff that having some kind of programming skill will super help.

22:46 So anyway, I just thought I thought this was an interesting headline and worth a little shout out.

22:51 Also, I didn't know Q was real.

22:53 I didn't either.

22:54 I was like, oh, that's so cool.

22:56 I knew MI6 was a real thing, but Q, that's awesome.

23:00 I know.

23:01 It's definitely cool.

23:02 Cool.

23:02 All right.

23:03 Anyway, everyone needs to know Python these days.

23:06 Jake Vander Plaas in 2017, as the PyCon keynote said, Python is a, gosh, basically like a quilt of all these different uses, use cases of people doing interesting things.

23:20 Well, here's one more patch in the quilt.

23:22 Yeah.

23:22 Even if you got a cooler language, we'll just incorporate it into Python.

23:25 We are the Borg.

23:26 Exactly.

23:27 There's something to that.

23:30 All right.

23:31 What are you going to lean into next here?

23:33 So we're into extras now.

23:35 So I said that I was going to take some time off for, from writing in December and I had a wonderful break with my family.

23:43 And now I'm back to writing again.

23:45 I almost, I wanted to announce that the next chapter was the next chapter is going to

23:51 be finding waste in T tester of development.

23:55 And, and I was, I don't know why I was stressed out about it,

23:59 but yesterday I just sat down and wrote, I think a first draft.

24:03 I need to clean it up a little bit, but I want to get this released today.

24:06 So hopefully by the time you listen to this, if you're not watching it live, it'll be around.

24:11 And I'll, yeah, so the next one will be there.

24:14 I've still got a goal of finishing this, at least the first draft by the end of January.

24:20 It's a tight deadline.

24:22 I don't, I only have half the chapters written so far, but I think that we can get there.

24:28 These, I think that the later chapters are possibly shorter

24:32 and I'm going to try to read it.

24:33 release it as an audiobook too so i can't make them too long or else they'll kill me okay so

24:39 that's that's going on uh one of the things keeping me uh uh updated and on track hopefully

24:45 is uh is it watches so a slight change of topic but i um i am back to sporting a non-smart watch

24:55 um i'm doing what i've got a right now i'm wearing a uh victorinox watch and uh i picked it up at an

25:03 for 40 bucks and it was a steal it was great great watch um uh but i've and then uh since i'm now

25:10 looking for watches my i picked up a couple more estate sales in the last last week too so um that's

25:17 fun something getting in the way of writing though is uh my christmas present i got from my family so

25:23 um they uh they got me a steam deck and um uh i'm having a blast with it i like i like not having a

25:31 console like just sitting on the couch and uh or sitting back in a chair and and uh and playing

25:36 video games i'm having fun with that again so um i'd loved and i'm i've been like looking through

25:41 the store and everything i'd love to have anybody uh let me know uh so um let me know on blue sky or

25:47 mastodon if there's a particular game i should check out i haven't been into the gaming scene

25:51 since the early 90s i've got some good recommendations for you i don't know for sure

25:56 that they'll run on the Steam Deck, but they do run on Windows Steam in On X-Force Now.

26:02 Small Lands, S-M-A-L-L-A-N-D-S.

26:06 Small Lands, you're like a little tiny creature running around this forest exploring it,

26:11 and ladybugs come by and they're like hip height.

26:14 It's a really cool experience.

26:16 The graphics is incredible.

26:17 The music is peaceful.

26:19 It's cool.

26:20 Give that one a go.

26:21 All right, thanks.

26:23 But anyway, reach out on Mastodon and Bluesky.

26:25 Let me know what you were playing.

26:27 Michael, do you have any extras?

26:29 I do.

26:29 I got actually two follow-ups now that you've mentioned these things.

26:31 They were not originally there, but I've been dreaming of the Steam Machine,

26:35 which is like a six-inch by six-inch cube that is kind of like a local,

26:43 you put it by your TV or something.

26:44 I'm not sure if it makes sense for me to get it, but it looks like a really neat machine.

26:49 I've been thinking about that.

26:50 Just got it now, so that's cool.

26:52 But back to watches.

26:53 I used to have a Pebble Round 2, which is a really cool little round watch that had a traditional watch look, but it was a smart watch.

27:02 This predates Apple Watch, I think.

27:05 And it was so good.

27:06 I loved it so much.

27:07 It was incredibly thin.

27:09 The e-ink display just looked like a real watch face.

27:12 And I had so many people come up to me and say, wow, that is a cool watch.

27:16 What kind of watch is that?

27:18 And these would be like older people or people that were not techie.

27:20 And they didn't realize even that it was a smart watch.

27:23 they were saying that's a cool and i'm like actually that's a smart one they're like what

27:26 is it oh my gosh incredible uh why am i saying this it's coming back they're remaking it pebble's

27:33 coming back and is open source and so if you're a fan of pebble there's a couple of pebble things

27:37 coming back so yay for watches although i'm still sticking with my apple watch because i love all

27:41 the like health analytics it gathers about me all right here's my actual extras better not follow

27:47 of impromptu follows.

27:49 So Ruben Lerner just posted a 12 video series on what's coming up in Pandas 3.

27:55 So getting ready for Pandas 3 short focused video series.

27:58 So like I said, 12 videos, come check it out if you're looking forward to what's coming up in Pandas.

28:03 And I just released as in two hours ago, a really awesome talk Python episode called

28:08 Web Frameworks in production by their creators.

28:11 So I have folks from the Django team, folks from the Litestar team,

28:15 from Flask and Cort and FastAPI, all of the people who create all of those

28:19 coming on to talk about how you should run their web framework in production.

28:23 I thought that was just super, super fun, cool conversation.

28:26 Oh, wow.

28:27 I'm looking forward to watching that.

28:28 Yeah, somebody in the audience said that I basically put the Python Avengers team together

28:34 when it comes to web frameworks.

28:35 It was really incredible.

28:36 Quite the crew there.

28:38 Okay, that's it for my extras.

28:41 How are you feeling about a joke?

28:43 Oh, a joke would be great.

28:44 This one has to have the stage set just a little bit, okay?

28:46 Okay.

28:47 So by telling another joke.

28:48 So there's this funny joke meme that went around like 15 years ago.

28:54 There's JavaScript, the definitive guide, which is like this 600-page tome of a huge book.

29:00 And then Douglas Crawford published a follow-up book called JavaScript, the good parts.

29:06 And it's like 100 pages.

29:07 I don't know how big it is, but it's much, much smaller than the definitive guide.

29:13 Like this is the slice that you should only pay attention to

29:15 and the rest is wrong, right?

29:17 Isn't this funny?

29:18 - Yeah.

29:18 - Oh yeah, I remember that.

29:19 - Yeah, yeah, it's kind of old, but here's the new joke.

29:23 Error handling.

29:25 It's this huge, huge book.

29:26 And then there's a little tiny one, error handling before AI.

29:30 It's just like how much you gotta deal with and like keep track of it.

29:33 Like what is all this stuff going on?

29:34 Why is this all here?

29:35 It's the opposite.

29:36 It's the inverse of going from a huge thing to like a focused good one.

29:40 It's like, oh, we had this focused little bit of error handling.

29:42 Now we got this.

29:43 mega thing i gotta deal with yeah there's there's joke yeah i'm looking forward to people

29:50 people are already starting to actually care about they're making their tests readable um because um

29:56 they're having to figure out what's wrong you know so me too well happy 2026 to everybody

30:05 brian good to see you nice looking forward to another year of good stuff yeah we should have

30:09 Little poppers.

30:10 Yeah.

30:10 Little, yeah.

30:11 Those things.

30:12 She's got the little confetti or whatever.

30:14 But no, we're just going to say goodbye.

30:15 Goodbye.

30:17 Bye.

30:17 Talk to you next week.

30:18 See you later.