Hello and welcome to Python Bytes where we deliver Python news and headlines directly to your earbuds.
This is episode 335. Is that right? Yeah. Recorded May 9, 2023 and I'm Brian Okken.
I'm Michael Kennedy.
And we've got a sponsor, Influx TV. Thanks, Influx. We'll hear more about them later.
If you'd like to connect with us and talk to us in sort of real time or async,
we've got all of us are on Mastodon. All of us, all two of us.
But at M. Kennedy, at Fostadon, at Brian Okken, and at Python Bytes, we're all on Fostadon.
So you raise a philosophical issue. The United States, the laws may have gone too far to be business friendly in some ways.
And businesses have the same rights as a person. Does a podcast? I don't know.
You said all three of us are on. Oh, yeah.
Does the podcast have pronouns? What rights does our podcast have? I'm very curious now.
But maybe we've got to think about that later.
My podcast identifies as a podcast.
It identifies as MP3.
Well, so let's kick off the wonderful show with a cool topic.
Yes. Talking about trust.
So Brian, one of the ways in which you automatically publish or even within your system publish things to PyPI is you take your one and only permanent API key and you put it in that in whatever location that is.
So some people will go and publish from GitHub through GitHub actions.
And in the action, it says, here's where your username goes.
Here's where your API key goes.
And it may be a little known fact that people, I'm not sure if you're aware of this, but if you're on the command line and you do get actions like get pull and it says, oh, enter your username.
Boom. Enter your username.
Enter your password.
You can enter that API key and that will allow you to do like full CLI access, presumably, depending on.
Actually, that's the GitHub one.
So I'm crisscrossing these.
But nonetheless, putting your PyPI API key into GitHub actions and other CI, CD places and scripts, not ideal.
Right.
Yeah.
So last month, a couple of weeks ago, Dustin Ingram, one of the folks at PyPI said, we're introducing trusted publishers.
So starting today, PyPI package maintainers can adopt a new, more secure publishing method that does not require long lived passwords or API tokens to be shared with external systems, such as GitHub actions and others.
Okay.
So what you can do instead is you can create like an open ID OAuth type of connection between PyPI for your account and GitHub.
Yeah.
And when you do that, then when that, that action runs, instead of saying, what is the API key?
It says, let me through open ID connect exchange, say, we trust each other for this user.
Give me a 30 second valid token that I can use, or I'm making up 30 seconds, but give me a token that I can use a short lived token that just for this publish or just for this interaction is authenticated.
And then we'll immediately expire.
Oh, yeah.
Cool.
Yeah.
That's pretty cool.
Right?
Um, yeah.
So basically you just connect those and you're good to go.
The, these API tokens, because they're regenerated and short lived never need to be, or should be stored.
They are not shared.
They rotate automatically because they are invalid.
They invalidate themselves.
And, this is not quite as obvious, but if somebody says this user logged in and published this version of a package to PyPI and there's one API key, well, I don't know.
Was that really the user?
Where were they?
Were they on vacation when they were that IP address or is that a hacker?
Was that a CI system?
We don't know.
But because this actually understands what system is requesting the token.
They say that it provides a verifiable link between a published package and its source, which I think is pretty cool.
Think?
Although what if somebody hacks into my GitHub actions?
Yeah.
Well, it only goes one level out in the ring of trust.
Right.
Okay.
So yeah, that, I mean, that is possible for sure.
Uh, speaking of what, if somebody, hacks into my GitHub actions, you can see in the doc that the blog posts that they publish.
It shows this is the part that you add permissions ID, right?
ID token is right.
And that's it versus here is your, username and password.
Right.
So that's cool.
It says additional security hardening is available.
You can further increase the security of your release workflow by configuring trusted publishers only to release from a specific GitHub action environment.
I don't do anything with that, to that degree with the GitHub actions, but basically with GitHub action environments, you can, set rules and workflows around that environment, such as requiring manual approval for each run.
By a set of trusted people who are repository maintainers.
Right.
So even if it gets hacked, you know, it's not enough that the organization, the GitHub organization has a workflow that will push it.
You might be able to, you might want to set it up so that it says in order to push, high test check out of this environment automatically, when we're going to production, right?
Shipping a build, it's got a, you've got to go push a button as Brian Okken on GitHub.
Okay.
Interesting.
Okay.
That is, optional, but strongly recommended.
And finally, right now, from my understanding, it says just works with GitHub actions.
However, it, this infrastructure to make this possible is now in place.
So it can be integrated with many more things.
So introducing trusted publishers.
If you maintain important packages, this might be worth looking at.
That's pretty cool.
Thanks.
Indeed.
Yeah.
Over to you.
Well, this, this, this topic is on fire.
Um, it is on fire.
So, modular released a, a state, you know, a video and a statement.
I think it was on the second of the month.
Uh, so it's been almost a week, but you know, time moves fast in the software world.
So, Mojo modular announced Mojo.
Mojo is a new programming language for all AI developers.
And although I'm not an AI developer, we are all AI developers.
I think, either you're in the machine or you are, controlling it.
Take your pick.
Yes, exactly.
Um, so anyway, so what is Mojo?
So there, and also I want to thank everybody that suggested this.
We got like a whole bunch of people suggested this set.
Have you seen this?
And don't feel bad if you, if you see a new, new topic and you think, yeah, somebody's
probably already told, told you guys tell us anyway, we like it.
And anyway, so Mojo, a new programming language.
Well, what is it?
So it is kind of like Python ish.
It looks like Python.
So it actually, supposedly one of the goals is it's going to be a super set of things.
So it's not there yet, but it has, it's, they want to do, kind of like Python, but extra
stuff that's C++ ish, like structs and, and, and, and strict types and everything.
Is this like your programming world has crashed together?
And it's now trying to become one.
I hope so.
The tectonic plates of Brian Okken's programming experience.
I'm pretty excited about it.
Actually not, not for AI stuff, but for hardware things.
I think that this, this would be kind of fun.
So, well, so what's the big deal?
It's, compiled and fast, in, in the order of like thousands of times faster,
uh, in some cases, supposedly.
So, but so what, one of the things we're going to link to the Mojo, webpage where,
how you can get started.
It's hard to get started right now, but we'll get to that.
Um, so there's a, there's also a fast AI, like announcement blog post, but also
a video with Jeremy Howard.
Um, it's a really fascinating read.
And why is this kind of, where's this coming from?
Are you, if you're not familiar with modular, which I wasn't really, these are the same
people that kind of brought us LLVM.
Um, so yeah, Chris Lattner and crew.
Yeah.
So there's, there's, there's a lot of excitement around it.
Um, and, it's not an LLVM.
It is.
So I had to look this up.
LLVMs are what low level virtual machine is what it started out with, but we kind of know
it is almost all languages are built on top of it right now.
So Mojo is not that it's multi-level intermediate representation.
It's a M I L M L I R instead.
So, do I care?
Probably not, but, it's a, so anyway, there's a announcement.
It probably doesn't mean it has a lot of targets that it can compile for, right?
Giving you that intermediate flexibility.
Yeah.
Um, and it's in, it doesn't have some of the, there are some limitations with the LLVM that
it doesn't have because it's a little different.
Um, so I don't completely know it, but there's, it's kind of a fun video.
Um, I've been playing with it just a little bit.
So if you, right now, what's the stage of it?
You can't get it for your local machine.
So you, you have to site, you have to like, if you want to go to the normal page,
you say, get started.
And it has you sign up on a list waiting list.
And luckily I got in.
Yay.
Um, so I got to play with it and, the, a little bit.
So when you, when you drop into it and play with it, you get a Jupyter notebook thing.
Um, and the Jupyter notebooks are already filled out with like a hello world and, or hello mojo.
And you get to walk through it and you get to see some of the different stuff.
So it's got definitions or defs, but you have these let statements.
So you can, that's different.
Um, we don't have to do let's and, and vars in, declarations in Python.
So it's, you can do normal Python.
Kind of the neat thing about having it be kind of like Python is you're kind of used to it already.
You don't have to learn something new, but also it's compatible with external libraries.
So you can, hook in things that are already built in pure Python that can be hooked into.
That's the part where I'm curious about.
Can I just forget about all this other machine language, low level stuff.
And can I just use this to compile my Python?
Don't know that yet.
Um, yeah, I don't know what the integration with other libraries is.
Like the example had, clearly indicated like NumPy integration.
Yeah.
But can I use Flask with it?
For example, right?
I don't know.
Yeah.
Don't know.
Yeah.
I don't know either.
Um, this is very exciting.
I did.
I did want to point out that we are correcting a mistake that we made at PyCon, Brian.
Uh, no, no, just last week.
Somebody out in the comment in the live stream last time and Aaron, the YouTube video and
said, I'm telling y'all folks, I'm really not believe what I'm hearing.
How can they not be talking about Mojo?
Oh, so, yeah.
But what's the, what do you think?
Well, okay.
So one, it sounds very exciting.
Two things rubbed me the wrong way quite a bit from the start that it's behind a, an sort
of mailing list paywall, not paywall, but like gated wall.
Yeah.
Right.
That, that just seems, it seems off to the wrong start.
Right.
If you want to get a lot of, attraction, I think, you know, put it out there.
Maybe, maybe you've got to sign up in order to, run the compilers on, on a Jupyter notebook
in the cloud because they're not totally tested and stable or something along those lines.
That would be totally fair.
But like, it doesn't tell you if it's open source or not.
It doesn't share a GitHub repository.
It doesn't share a way in which, it expresses what this is going to be.
Is this a thousand dollar a month subscription?
Is this open source?
Is it both?
Right.
Is it like, oh gosh, what was it called?
Codon.
I believe some people were like so excited about Codon.
It's like, it's, it's under the model of if it's, if you've got to ask what the price
is, it's, it's too expensive for you.
Oh yeah.
Which like, okay, I'm not going to get super excited about investing in that, even
if it is neat and powerful.
So that, that said, everyone seems to be super excited about it.
I love the way the language looks for like a more compiled way.
I think there's a lot of possible Python integrations.
Like we already talked about, Hey, could I run Flask?
Is it so close that we could just make our stuff go faster when we need it?
If we're willing to say, decorate our, our variable declarations with a let or a var, right?
I might be willing to do that if my code could run a thousand times faster.
Yeah.
There's some, I don't know.
It's like, it's not clear to me how much sort of community there is versus product, which
I don't, I'm not saying you shouldn't have one or the other.
They're both fair, but it doesn't say in that.
And it's behind a, like a sign of wall, which makes me wonder, right?
It just makes me feel less excited about it, which is why I didn't cover it last week.
I'm like, eh, maybe, I don't know.
We'll see.
Okay.
Also the rough edges, there's a rough edges section of like roadmap and rough edges.
And some of them are really big missing things like tuples.
Yeah.
Like tuples not supported.
Class is not supported.
Well, yeah.
Uh, that's a lot of Python that you can't use without classes.
So, yeah.
Well, and maybe this is just early and they're just showing it.
And if it's coming, that is totally good.
So I just, I don't know when I first saw it though, the, like here, like sign up for our mailing list so that you can maybe look at it.
It's like, what is this thing here?
And it doesn't express, there's no GitHub repo linked.
I don't know.
So I have a lot of hope for it, but I'm just not, I'm going to just withhold my assessment of like the impact I think it will make yet because of that.
Right.
I whistled.
It could have quite an impact if, if, if we get everybody able to play with it and it's, it's, it's just going to be, I mean, it was, there's a lot of people talking about it this week, but, it seems like there's a new trend every week.
So anyway.
Yeah.
I'm a little suspect.
Is it written in rust?
I'm not sure it is.
Just kidding.
Um, cause that's where, how can it be cool if it's not written in rust?
I know that's, that's exactly my point.
That seems where all the action is right now, which is, is cool.
But, it's also worth pointing out for people who are not putting it together that Chris Lautner is also the person behind the Swift programming language, which is a pretty interesting language that's also borrowed a lot from Python.
So it is exciting.
The other thing that is, it's sold as a make AI work fast, but like Python.
That's awesome.
And it's a, it's a cool focus, but it, it doesn't speak to, a goal of like, Hey, we could bring more and more Python until it's like a 90% case.
That's awesome.
That we could do many things with if it's really focused on, you know, running Python code on, on GPUs and just like really, really focused in on the AI stuff.
So, that's the other comment that I wanted to make about like, where's this going?
So we'll see.
But yeah, a lot of people are excited.
I mean, I would say, honestly, we have not received more listener recommendations that we cover something than this.
Yeah.
I mean, maybe the only other thing was Guido retiring from, from, BDL was the only other thing that we got like that much, that much massed on Twitter email about.
So thank you all for sending that in.
Um, these are my thoughts.
I would love to see it succeed.
Um, but I just don't know quite, where it's going or what it's going to be yet.
Yeah.
I guess my optimism comes from the, where it's coming from.
The people involved have a history of doing things that are helpful to the community.
So yeah, it absolutely has, you know, big hitters behind it.
So it's got a way better chance than just somebody publishing something cool.
Okay.
Yeah.
All right.
Yeah.
We'll see.
I mean, certainly worth, keeping track of it.
Um, so next up, I would like to talk about our sponsor.
No, right on influx DB.
So this episode of Python bytes is brought to you by influx data, the makers of influx DB.
Influx DB is a database purpose built for handling time series data at a massive scale for real,
real time analytics.
Developers can ingest store and analyze all types of time series data, metrics, events,
traces in a single platform.
So dear listener, let me ask you a question.
How would boundless cardinality and lightning fast SQL clear queries impact the way you develop
real time applications?
Influx DB processes, large time series data sets, data sets and provides low latency SQL
queries, making it a go-to choice for developers building real time applications and seeking
crucial insights for developer efficiency.
Influx DB helps you create IOT analytics and cloud applications using timestamped data rapidly
and at scale.
It's designed to ingest billions of data points in real time with unlimited cardinality.
Influx DB streamlines building once and deploying across various products and environments from
the edge on premise into the cloud.
Try it for free at pythonbytes.fm/influx DB.
That link is also, of course, in our show notes.
Thanks for sponsoring the show.
Yep.
Thank you, Influx DB.
Now let's talk about some Django.
Okay.
All right.
So in Django, I want to introduce something called Django prose.
Doesn't it just make you want to write, just sit down and put on your best Ernest Hemingway
impression and just start writing?
I don't know, maybe.
But this thing is a rich text editor that you plug in to, I believe, into the admin section,
the admin backend for Django.
Yeah?
Okay.
So wonderful rich text editing for your Django project.
Right?
So what you do is you install it.
You add it as one of your apps.
And then you have to run some migrations because it needs some database backend stuff to keep
track of what it's working on.
And then finally you set up a URL for it and then you're good to go.
And there's different ways in which you can work with it.
It can control basically the entire page because it's more or less HTML.
And so you can just say, show me the document.content.
Now, when you render that in your Django templates, this is HTML and Django templates, like many of
the templating languages are smart and say, yeah, no, if we just let people type in here,
they're going to type angle bracket, JavaScript, hackswords.com, dot, dot, dot, dot, dot, right?
So they're going to HTML and code that, which will show it up as like view source.
Right?
So you've got to do a pipe safe to say, nope, don't encode it.
Just drop the HTML straight in there, which in which case this should not be used by untrusted
individuals.
Right?
You can also have ORM models and the ORM model itself can have a rich text field type, which
is kind of interesting.
Right?
Yeah.
And then you can show that as part of your template.
And again, you've got to pipe safe that because if not, it won't work.
And then you can even have a separate table with a foreign key relationship to the content
for like large documents.
So there's a lot of stuff with not just dropping an editor into the admin section, but actually
integrating that into the Django ORM and models, which is where I think it gets, you know, worth
paying attention to over some of the other just JavaScript front ends for HTML editing.
Nice.
Yeah.
It even has a form support for rendering out editable forms and attachments, all those sorts
of things.
It also only allows a subset of tags and attributes, and it uses the bleach library, which I don't
know how familiar people are with bleach, but bleach is kind of interested.
Apparently it's deprecated.
Although you're just using it for whitelisting.
I don't know really why it would make a change, right?
Like these are the 20 tags and whatnot that are allowed and they're still going to be allowed.
But anyway, if you want to see, there's both a picture that's larger than I was hoping for.
There's a picture of basically what it looks like.
And you can imagine it's like a rich text editor or online blog thing, and it has an editing section
and a preview section, as well as a video tutorial.
So if you're doing Django and you want rich text editing that renders, that basically edits raw HTML
in a nice way, WYSIWYG, as they said back in the day, you can go and check this out and check out Django
pros.
Nice.
Hey, so have you ever heard the, you know, if you had a writing group in a penitentiary, it would be pros and cons.
Pros from cons.
I love it.
That's good.
Yeah.
We're, we're jumping ahead.
The joke comes at the end.
Okay.
Sorry.
Don't get ahead.
Okay.
So I want to talk with, speaking of rich, I want to talk about pileizer.
Actually not rich.
Rust.
So pileizer.
So this was a suggested by Owen.
Thanks, Owen.
And this is a project that is, it reminded me of rough a little bit.
So it is pileizer is a static code on the analyzer in a language server for Python written
in rust.
Just cool.
Some of the details on it.
I'm a little, I don't quite understand, but anyway, it's a rust thing that can analyze your
code.
So what is the big deal?
Why don't we have, what is, speaking of rough, what's the difference?
Well, so rough is like pilot rough is a static code analysis, but rough is just your linter.
It doesn't do type checking in language server.
So pileizer has a little bit more.
It's a little, does more, a little more linting.
It can do things like checking for out of bounds errors and things.
So it isn't a replacement for rough.
You would run both of them if you want.
And they're so fast that why not?
So, and that's one of the things because it's written in rust, it's quick.
It's very fast, but that's not the only thing.
Cause you always want, you also want like good error messages.
So that's one of the selling points apparently is a detailed analysis.
It can check a whole bunch of stuff, but it also is readable.
So it'll, it'll do, you know, tell you what's wrong.
And, and it's supposedly, it does things like underlining where, where the problem is and
what you should do instead.
Maybe.
So this kind of looks like fun actually.
So yeah, that is a really nice error message.
It has like a tree structure under the line, under the error thing.
It says expected stir, but found int.
Yeah.
Kind of reminds me of some of the new stuff in Python to, to help you.
with exactly the three 11 error message improvements.
Yeah.
Um, and especially if it's going to do this sort of stuff, language server, I'd like it integrated
with a, editor, right?
So this, this does have a VS Code extension that you can integrate that and use that instead
of the built in, whatever VS Code uses.
I can't.
High Lance.
High Lance is pretty good though.
So anyway, I'm not sure.
Uh, so how it works.
So here's the stuff that I don't quite get part is,
it uses a type checker from the ERG programming language.
Erg.
Must be a pirate.
I've never heard of Erg.
Interesting.
Um, I haven't heard of it either.
So I'm not quite sure.
Maybe it's faster that way, but it does that.
I don't know if there's limitations, but there's, it's a, project in the rather early stages.
I think it's got a lot of stuff going on for it, but I don't, I think it's neat that they
listed a to-do list and the things they haven't done yet.
So it doesn't check for finals and other things, but it does quite a bit.
I'm still pretty good.
So new tool.
Neat.
Uh, all right.
Are you ready for a joke or you got an extra?
I know extras today, but I'm ready for a joke.
Awesome.
Me too.
This one comes to us from Arthur Rio and says, this joke might be right up your alley.
Okay.
So what this is, is it says escape room.
So it's, it's an escape room.
Like, you know, the, like the kind of thing where you, you go and you got to find the clues
to get out.
And if you don't find the clues, you're going to be stuck in there.
So this, this person with a big smiling anticipation is walking into the escape room, finds a skeleton
sitting at a laptop, like a, a person who died is gone.
Right.
And starts to get really worried.
Like maybe this escape room is too serious for me.
Looks over the shoulder and realizes what they are doing is they're in Vim trying to get out
of it.
It's so meta.
I know.
It's so meta.
Yeah.
Go ahead.
You just have to hit escape.
I know.
And well, and look, look at the person who says there's always a way.
I'd completely beaten, smashed MacBook.
How did that happen?
I don't know.
But there's always a way.
Or something.
It does look like he got run over and then they opened it.
Yeah.
It's, well, it's not ideal.
But the escape room, I thought you'd appreciate that one.
Yeah.
Why is that such a big thing?
Like, I don't know.
It's one of the frustrating old joke of like, people are always going to make fun of it.
I know.
You could do the same for Emacs.
Yeah.
How do you quit Emacs?
I don't even know.
Yeah.
It's like a chord.
I forgot what it was.
Like, you know.
You have to play guitars for it?
Yeah, you do.
It's why it takes so long.
First you learn guitar, then you can save or exit.
Anyway.
So.
Awesome.
Well, I guess that's an episode.
That would be episode 335 in the bag.
Yeah.
Thanks, everybody, for listening.
Thanks, Michael.
You bet.
Fun as always.