Hello and welcome to Python Bytes, where we deliver Python news and headlines directly
to your earbuds. This is episode 392, recorded July 17th, 2024. I'm Michael Kennedy.
And I'm Brian Ackin.
This episode is brought to you by Code Comments, an original podcast from Red Hat. So thank you
to Red Hat for supporting the show. We'll tell you more about them later. You can follow us on
the links for Brian, me and the show are all in the show notes. And you can also follow us on X if
you wish. I know some people have not yet made the transition. What do you wait for people? Come on.
And finally, before we jump into it, we are super excited that people are signing up for the newsletter.
Check that out. Just go to pythonbytes.fm, click on the big newsletter button in the middle,
put your email in, you'll hear about cool stuff. We'll get the show notes, but you also get announcements
that we might send out and other things, live events, who knows. So sign up, be in the know,
and we'd love to talk to you there. And we won't share. Brian.
And we were going to do a contest or something.
Oh, yes, we're going to do a contest. The numbers are growing and we reach a monumental number.
I'm pulling up my list of monk management here. We are close. We're getting quite close here.
So, yeah, we're going to do some kind of contest. Yeah, some kind of giveaways. We'll see what that is.
The 2024 PSF board election and bylaw election. The election happened and the results are in already.
So it happened pretty quick. And nobody's demanded a recount yet. So, you know, that's good.
I guess we don't do that in the PSF.
But so new board members, Tanya Allard, Quan Hay Bay and Christian Moriera Frades, I think.
But congratulations to the three new board members. Super awesome. Should be fun for you.
One of the things in this announcement was that the where was it?
Basically, it says what's next. If there's four here, it is at the bottom.
There's four seats open again next year. So it might feel early.
But if you're kind of thinking about running for the board, it might not be early to think about it now to get ready and think about what you want to propose and stuff.
So and they suggest reaching out to one or two current board members to ask them about their experience before throwing your hat in the ring.
So it actually sounds pretty interesting. So anyway, so the three new board members, congrats.
And then also all of the ESF bylaw changes passed heartily, like with a big margin.
So let's take a look at that a little bit. So they oh, let's look at what they are again.
So there were merging, contributing and managing member classes.
That's it seems like a no brainer. I'm glad they're doing that.
Simplifying the voter affirmation process by treating past voting activity as intent to continue voting.
That makes sense. Yeah, I like that one.
Because in order to vote, you have to attest that you're interested in voting for some reason now, which is funky.
Would so. Well, well, also, I mean, it makes sense for like counting it.
Like, you know, if if if we just send it to everybody and just what, give them three weeks to vote.
I mean, it's how long do you have to wait?
The I don't know. Make it's it's all right.
Now, if you voted this year, you'll automatically be able to vote next year.
That makes sense.
And then the third one of allowing for removal of fellows by a board vote in response to code of conduct violations.
That was there was a lot of controversy on the chat and stuff and in the mailing list.
However, that third third one and all of them, the third one passed like by a huge margin.
Second one, also huge margin.
First, huge margin.
So it's, you know, smaller margin for three, but basically still most people are for it.
And I was for it, too.
And I trust our board.
So I think it's a good thing.
So if you want to read more about all of these, there's a link to all the different bylaw changes.
So you can read more about them if you want to.
Yeah, cool. Very cool.
Hey, I do have a quick comment here.
OK, so these the number of people who voted are in the hundreds, like 300, 400,
something like that.
There are millions of Python developers, literally millions.
There's plenty, tens of thousands of people who just listen to this podcast who are in in the know and interested enough.
Vote, guys and girls.
Yeah. Yeah.
Be part of the community by voting.
It's a good way to every voice heard.
I also really enjoyed this year.
Like and I do this every year of actually reading about the different reading all the different board candidates and what they've done.
It's kind of a neat way just to like catch up on some people and what the what their contributions to Python are.
So catch a little zeitgeist.
Where's the whole community going in a sense?
But not as much as if you listen to Python bytes every week because then it's like the rapids of zeitgeist.
You can barely stand it.
Speaking of barely standing it.
Imagine if you were on Saturn doing doing data science.
Oh, OK.
So we obviously know about Jupyter, which is our biggest planet, clearly.
But Saturn is pretty big, too.
And it's cool.
It's got cooler rings than Jupyter.
So better for data science?
I don't know.
OK, seriously, this is Saturn.
And it's a modern Jupyter desktop application for macOS.
Cool.
Pretty cool.
So it's like super minimal.
It has a bit of a not a JupyterLab.
That's too close to the real Jupyter.
But just the Jupyter notebook style, like straightforward.
It's supposed to be real minimalist.
It's nice and clean.
It has a command palette.
So you can, you know, command K or command shift P, whatever the hot key is.
I don't know yet.
I haven't tried it.
So you just download it and you get going.
I think it might come bundled with Python and you don't have to set up virtual environments and stuff.
But you can connect it to so-called kernels or basically virtual environments that you would like there.
All right.
Yeah.
So very nice.
You just download it and get started.
It has a built-in LLM.
So you can ask it LLM things like describe the plot above and then plot it using or describe the date above and use a plot using plot using lines and scatter.
And boom, it'll go and do that sort of thing.
Pretty cool.
Yeah.
It's a very minimalist.
Like I said, if that's your vibe, then this is it.
There's a command palette you can use.
I don't know what the hot key is.
Again, it comes with black built in.
So you get automatic formatting.
Just press F apparently and boom, your whole notebook is formatted, which is really nice.
I feel like that's one of the things kind of missing from notebooks is like a real nice sort of management of code in general.
Like the autocomplete is not that great.
I know you can press some hotkeys to trigger autocomplete, but it just doesn't happen as you type like many editors.
You can also do cool things like copy.
Just go to a graph copy and just paste it straight into.
It's got a little copy button for the data tables and for the graphs and things like that.
Yeah.
So all super neat.
Check it out.
And my final thought here is download the alpha.
There's no link to GitHub.
So presumably this is not an open source thing, although perhaps it is.
I just haven't found it, but there's no link to GitHub and there's no business model expressed here.
So will this be a paid product?
Is it just not yet out on GitHub?
You know what I mean?
Like, I don't know.
So buyer beware and by buyer, I mean person who downloads for free.
Yeah.
But it looks really promising to me.
I really like the vibe here.
Oh, okay.
Okay.
Go up.
Oh, this is the rough thing.
Let's see.
They do have a blog.
You can check it out, but it has literally one entry that says integrating the rough language server,
which is, you know, like an engineering cool.
That's fun, but it doesn't tell you anything about it.
Oh, okay.
It doesn't add any information to what I was just talking about.
You know what I mean?
Yeah.
And it doesn't have the Saturn.
It has a link to an editor, one repo, but it isn't the Saturn repo.
Okay.
We'll see.
But, you know, look, if somebody makes something that you pay money for, there's a super nice
data science app and it's not out of control.
I'm not saying that's a negative thing.
I'm just saying it's not clear what its status is, you know?
Yeah.
But also, if anybody that's part of this, like Jack Hodkinson or anybody else on Saturn team,
let us know what's going on.
Shoot us an email.
Speaking of stuff we want to let people know about, I bet there's some code comments in
this Saturn code there.
What do you think?
I think probably.
Probably.
This episode is brought to you by Code Comments, an original podcast from Red Hat.
You know, when you're working on a project and you leave behind a small comment in the code,
maybe you're hoping to help others learn what isn't clear at first.
Sometimes that code comment tells a story of a challenging journey to the current state of the project.
Code Comments, the podcast, features technologists who've been through tough tech transitions and they share how their teams survived that journey.
The host, Jamie Parker, is a red hatter and an experienced engineer.
In each episode, Jamie recounts the stories of technologists from across the industry who've been on a journey implementing new technologies.
I recently listened to an episode about DevOps from the folks at Worldwide Technology.
The hardest challenge turned out to be getting buy-in on the new tech stack rather than using that tech stack directly.
It's a message that we can all relate to, and I'm sure you can take some hard-won lessons back to your own team.
Give Code Comments a lesson.
Search for Code Comments in your podcast player or just use our link, pythonbytes.fm/code dash comments.
The link is in your podcast player's show notes.
Thank you to Code Comments for supporting the show.
Back over to you.
I want to talk about something bad that happened on PyPI, but it could have been worse, but it's not.
But it could have been.
But it wasn't bad.
Anyway, what happened was, and I'm going to link to a couple blog posts.
One of them is on the PyPI.org blog from E Durbin.
Incident report leaked GitHub personal access token.
So what happened was, and E just go ahead and writes out the timeline of events.
It was something that he was working on, something called Cabotage.
And the gist of it is, he was trying to debug something and ran into some problems with timeouts for GitHub access tokens for the generic ones or the community ones or whatever.
And so he used his own personal one for a while while he was developing it.
Then he switched back.
But his personal access token got saved into a PYC file that made it to a Docker image that got published.
So this is bad because it would have given access to a whole bunch of PyPI and core stuff, including Python.
Probably not good.
So what happened, how this was found, though, was JFrog does a regular binary scan of a lot of packages that are open source projects that we rely on, including Python and stuff.
And they found this problem, and they notified the security team on PyPI.
And the token, the security team from PyPI revoked the token within 17 minutes of getting notified.
This is like amazingly, blazingly fast, I think.
And JFrog even points this out, that this is, we had a research team identified it, reported to PyPI, and it was revoked in a mere 17 minutes, which is super cool.
Anyway, so it was revoked.
It was fixed.
And then afterwards, a scan was done to find out if that access token was used for anything, and it wasn't.
So it wasn't exploited at all.
But there are some good takeaways that, and in the original blog post, it does talk a little bit more about the details about how this showed up in the Docker file.
But the takeaways are a few of them.
There's three of them.
First, set aggressive expiration dates for API tokens.
So if you are going to use an API token, only have it for as long as you need it, and have it, you know, consider the timeout.
Because if it escapes, you have to deal with that.
Also, treat PYC files as if they were source code.
So, and that's, you know, normally I don't think about that, because we don't publish PYC files.
But if they're in a Docker image, it's going to get published, right?
So the other way was, the other note was only release builds from automated systems on, like, use a CI system with a clean source only.
So some great reminders that PYC files are really something to be careful about also, and be very careful with access tokens.
Yeah, pretty scary.
Pretty scary.
The TechRadar folks, TechRadar is speaking in the right place.
I really like their writing.
They phrased it as, a GitHub token leak could have put the entire Python language at risk.
What if Python itself was malicious?
Right?
Because, I mean, it gave anyone who wanted to get a hold of that right access to the Python, CPython repo and other parts of deployment.
It's not ideal.
Yeah.
But it sounds like it was caught, so it's really good.
Could have been very bad.
Yes.
Another bullet dodged.
But both posts are interesting reads.
The JFrog one also has quite a bit of good information about, you know, how to protect from this.
And some of the actions, some of the new GitHub access tokens have a way, they're easier to scan than they used to be able.
They're easier to find because there's like a prefix that you can scan for within binaries.
So that's pretty cool.
Oh, right, right, right.
Yeah, they've changed that format.
That's good.
Yeah.
I would like to go on a bit of an extra, extra, extra.
This was not the intention.
I had some other topic and I'm like, and another extra, another extra.
All right, this is, this is out of control.
Let's, so you ready?
Extra, extra, extra here all about it.
Yeah, I'm ready.
All right, let's do it.
Number one, first extra pretty quick here is Python 3.13 beta 3 has been released.
This was a couple of days ago.
It's not like, why would you put the data at the bottom?
I don't know.
Anyway, I know it's at the top, June 27th.
So it's actually been a little bit of time, but there's no other beta and people should be checking out.
This is the third of four beta releases.
So this is basically the last, last chance to make potential changes before it's completely just down to bug fixes, right?
Okay.
Yeah.
Okay.
So the Python folks strongly encourage maintainers of third-party Python packages to test with 3.13 during the beta phase and report any found issues to the Python bug tracker ASAP.
It will be feature complete while the release is planned to be feature complete.
Entering the beta phase is possible to get modified or changed based on how serious any problems might be.
Anyway, 3.13 beta 3.
Awesome.
Mini bar ice.
I told you guys about this when there was the bartender.
I was such a fan of bartender.
Recommend it everywhere.
And then bartender went a little funky.
It's not that it was sold to someone else.
That's the problem.
It's that it was sold.
And the fact that it was sold was obscured.
That's the problem, right?
Talked about that previously.
So I switched to ice and ice was like, it kind of does the thing that bartender used to, but it's, it hides menu.
Like it doesn't seem to show everything reliably.
And anyway, it was really kind of janky, but this thing, I think got a ton of attention since all that happened.
It's got a lot of contributions.
So new release, a lot of bug fixes, primarily like a cool little dropdown that like shows all your stuff in a second.
Like if you click on it, it'll show you a little second window.
Really nice.
So I can more strongly recommend open source free ice than before.
Links in the show notes.
You got a lot of stuff up there, man.
That's why I need this thing.
It's out of control, man.
I'm telling you, it's a problem.
All right.
Last time you mentioned the article, I will pile drive you if you say AI again.
And it resonated strongly with me.
All right.
Yeah.
So the Primogen guy did a one hour Prime reacts to the I will pile drive you article and it is gold.
So check out this if you just want to like sit back and listen to it in the background.
This is a really good video.
It's worth your hour of time.
So check that out.
I listened to an interview.
I don't have the link right off the bat, but I listened to a podcast episode of somebody interviewing the guy also.
Oh, okay.
Interesting.
Yeah.
He does a good stream sort of thing.
All right.
Next up, we talked about Polyfill, I think a couple of episodes ago, right?
Polyfill.io and all that.
So Polyfill was, polyfill.io used to be run by some financial publication.
I can't remember exactly.
I don't want to misattribute them.
And then they were sold.
They were like a CDN for JavaScript stuff.
And they were sold to a Chinese company, which in itself is not necessarily bad.
But then the Chinese company started sending malicious code instead of regular JSON polyfills to its users.
But in a super select way, like, oh, are you doing an authentication at this third party identity as a service thing?
Well, maybe now you're getting the bad JavaScript or whatever, you know?
So really, really tricky stuff.
And the polyfill.io domain was not unregistered.
It was basically blocked by its register, which I think was Namecheap.
But there are four other domains that it turns out that they're also using as CDNs.
I don't know what happened to them.
Maybe they've been dealt with by now, but maybe not.
But also, what if polyfill.io just re-registers somewhere else eventually?
Is this possible?
I don't actually know.
So I posted a thing on, posted on it on Twitter saying,
hey, if you have some kind of fancy DNS, you might want to put blocks in for all these domains.
So staticfile.org, staticfile.net, bootcss.com, bootcdn.net, and polyfill.io.
Those are all blocked in my next DNS, which is awesome, which is like a pie hole.
But you get access to it anywhere, not just while you're at your house, which is better, I think.
Cool.
Yeah.
So if you care about that stuff, this is one way to say you can now surf the web.
And even if you go to a vulnerable website, it won't load these things.
So that's always good.
All right.
Nice.
Next up, we have the JetBrains Developer Ecosystem Survey 2024.
The survey is now open.
It's pretty intense.
Takes like 25 minutes.
But if you want to complete it, contribute to sort of, you know, what editor is popular,
what frameworks you're using, do you like databases, et cetera.
For this, you may win a MacBook Pro 16, an NVIDIA GeForce, some phones, and so on, and so on.
A bunch of stuff you can win, potentially.
Code the Castle in October, October 5 to 12th in Tuscany.
It still has some seats open.
So check that out at talkpython.fm/castle.
If you're interested, a week of half Python learning, half excursions in Tuscany.
So check that out as well.
And that concludes my extra, extra, extra Hear All About It.
So do you need somebody to help, like, you know, carry your equipment?
Yeah, sure.
I mean, I'm going to bring a MacBook Air, so that is pretty heavy.
Would you like to help?
Yeah, yeah.
If you want to pay for my trip, I would definitely help you out.
Yeah, yeah.
Awesome.
I appreciate that.
No, it looks like fun.
I'm excited to hear about that when you get back.
Yeah, I am too.
I'm thinking of doing a couple days of motorcycle riding.
There's, like, some off-road enduro tours you can do there.
Like, it's pretty close.
If I can link those together, then I'll need help carrying, like, all the motorcycle gear
that will, like, out way out.
Are you going to try to check your motorcycle as a...
No, you can rent motorcycles there.
Okay.
Yeah, check it.
I'll just ship it ahead.
It'll be there waiting for me.
Yeah.
Awesome.
How about your extras?
Got anything?
Yeah.
So I wanted to...
Let's see.
I'm working on a new PyTOS course.
So already on Talk Python training, there is the Getting Started with pytest course.
It is three and a half hours long.
So it's kind of the...
It's not...
It's pretty quick.
Covers a lot of the basics of pytest.
I also have the complete pytest course over on courses.pythontest.com.
This little...
I mean, the 162 lessons might freak people out.
But a lot of the lessons, it's basically the entire Python testing with pytest book.
And a lot of the videos are chopped up into, like, three minutes, four minutes.
As they should be.
Yeah.
So...
But I do notice that there's a gap.
So I'm...
The new course I'm working on is a really introduction to pytest, introduction to testing concepts.
And this is...
And I really want it to be something that somebody could really watch in half a day easy.
Or even just a little bit.
And I'm targeting...
I'm hoping to be under an hour to introduce a lot of these great concepts.
And this would be intended for people...
For the entire team.
Like, my idea would be everybody on the team, including the manager, would take this little mini course.
And then you'd have a couple experts.
A couple people that want to be the pytest experts take the complete course or something.
Or the one on Talk Python training to be more in-depth.
And so that...
I think there's a gap there for the little quick intro.
So I'm working on that.
That'll be fun.
I agree with you, by the way.
I do think there's probably a good gap there as well.
Yeah.
Also, and I'm kind of wanting that for my internal, for my own company.
Of like, I don't think I can tell people to go watch an eight-hour video.
I don't remember if it's eight hours or not.
But it's...
Well, also...
Okay.
I want to have people not freak out too much.
It's split into three parts.
And you really...
The intent of the entire book wasn't to read everything.
It's to read the first part and then use the rest of it as resources as necessary.
So same with the course.
Okay.
I've got other stuff going on too.
I have a couple...
These other couple podcasts.
Python people.
I thought it was a great idea.
But I just haven't had time.
So it hasn't been updated since May.
I'm just going to officially say it's kind of indefinitely on hold.
I don't know what's going to happen with it.
But I'm not working on it.
Okay.
And Python test.
It was test and code.
And it's still like the...
Still the little icon is still testing code.
And now it's Python test for 14 episodes.
14 out of 221.
I am going to flip-flop and probably switch back to testing code.
Because there's a series I want to do about test-driven development.
And it's really...
It's not...
It's language agnostic.
So it doesn't really make sense to have it be under the Python banner.
And I probably...
I can't...
I want to say I promise to not switch it again.
But, you know, who knows?
It's whatever.
So that's...
Those are my extras.
I'll probably get back to record.
I'm still roughing out the ideas for the series.
It'll probably come out in August or September.
Excellent.
Well, I look forward to it.
Very cool.
But that wasn't very funny, though.
No, it was not.
It was not.
Good thing about podcasts, if people subscribe to them and a year later you're like,
all right, I'm ready for more Python people, it'll just start showing up in their players again.
Yeah.
And I'll talk, you know, follow Python bytes.
We're not going to stop Python bytes anytime.
Well, there's no plan on it.
There's definitely no plan on it.
All right.
Let's get something a little bit funny.
Now, I know there's been a lot of talk about AI, although I'm frightened of being pile-drived.
I don't know if people know this wrestling term, but it's disturbing.
Anyway, I'm a little worried about it.
But this is not helping you code with AI.
This is just straight-up editor help that I also consider super important.
It's entitled, I Need My IntelliSense.
Are you a fan of Scooby-Doo, Brian?
Yeah.
Did you watch Scooby-Doo, the cartoon, growing up?
So here's, what's the woman's name with reddish hair?
Did I?
I still catch up.
I still keep up on all the Scooby-Doo's.
Awesome.
So she has glasses and she lost them, obviously, like the picture.
She's lost.
I've lost my glasses in this like scary house or whatever.
But the caption is, my IntelliSense.
I can't code without my IntelliSense.
Oh, I relate.
That's pretty funny.
Yeah.
Anyway, I thought that would resonate with some folks out there.
Would I have to actually look up what the parameters are?
That's just barbaric.
It's totally barbaric.
And it's a segment of your mind that doesn't need to be filled with those details.
You just type and let it flow.
One of the things, though, that I, all the pop-ups that happen to help you out, like,
it's great.
Except for, like, I wish there was a toggle that I could just turn everything off or on.
Because when I'm developing, I like those on.
But when I'm recording a course or something, I don't want all those popping up all the time.
So do turn them off for your courses and stuff?
No, I have them on.
I try to show people, like, look, here's your options.
This is the one you pick out of the list.
So, yeah, I leave them on.
Yeah.
Okay.
I don't want to lose my glasses.
All right.
Well, I'll try that.
Indeed.
All right.
I think there's also ways you can just set the aggressiveness of it, which I think sounds
like something you might want, like, in a serious way.
So you can set it so if you just press a dot, boom, like, the list comes up.
Or you can set it so there's some other key, like, control dot or something you've got to,
like, choose, which you wouldn't normally hit in the course of typing to trigger that kind
of stuff.
So look into that.
Yeah.
I think there's a delay, too, you can say.
Like, if I'm just going to start typing, don't pop that stuff up.
Yeah.
Indeed.
Yeah.
Anyway.
Cool.
All right.
Well, thanks for another fun show.
Thanks, everyone, for listening.
Thank you.
Bye.