#490: It’s a vibe coding party

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly

00:04 to your earbuds. This is episode 490, recorded July 28th. I'm Michael Kennedy.

00:11 And I'm Calvin Hendryx-Parker.

00:13 This episode is brought to you by XWeather. XWeather combines enterprise-grade weather

00:18 intelligence with agent-ready APIs, natural language capabilities, and an MCP server so

00:23 your agents can adapt workflows, automate responses, and make better decisions based

00:28 on real-world conditions.

00:29 I'll tell you more about them later in the show.

00:31 Get started for free at pythonbytes.fm/xweather.

00:35 If you want to follow us on social, then feel free to do so.

00:39 We got a link.

00:40 I have a little bit more to say about that at the end of the show.

00:44 Got links in the show notes and sign up for the newsletter, all those things.

00:48 Before we get into the first topic, Calvin, I'd like to just rep a little bit of the KTM.

00:56 See, I got my KTM shirt on.

00:58 Team Orange.

00:59 Team Orange.

00:59 And I know you're a fan of motorcycles as well.

01:01 I am.

01:02 This week, this weekend, we had Pro AMA Motocross at Washougal.

01:07 Oh, fun.

01:07 And I was there all day with some of my friends, and it was quite the epic event.

01:12 So if you're around, they travel all over the US.

01:15 If you're around one of them, go to them.

01:17 They're really an interesting experience.

01:19 Even if you're not super into motorcycles, just being in that atmosphere is really wild.

01:23 So it's cool.

01:25 Yeah.

01:25 I'm hoping they bring World Superbike someday back to Indianapolis.

01:28 yes that would be awesome because i'm team ducati yeah well don't let uh daytona and their their

01:34 bike week have all the fun you know yeah exactly exactly well you know what is fun i know it's fun

01:39 Django's fun Django is a lot of fun yeah and in thinking about some of the core features of Django

01:46 julia evans brings us great posts from last week about some of the things that she's been enjoying

01:51 about Django, but from a 2010 style website perspective. I thought this was a great post

01:58 because it reinforces some of the joy of Django and some of the cool bits and pieces that maybe

02:05 people have not forgotten about or just aren't using or haven't chosen Django because they

02:10 thought maybe it was just too complicated or too big for their project and they went Flask or Fast

02:16 API instead. But this is a good one that kind of goes over what it's like, you know, again,

02:22 the retro feel or nostalgia for a 2010 website was very backend. And with server side rendered pages,

02:31 this is kind of giving you that feel for that. But then it gets into things like query builders,

02:36 defining custom query sets, making them chainable, which if you take a look, this is very readable.

02:42 Like if you were to read this code as English, you read like, you know, events for tab with festivals is free and is outdoors.

02:51 That just almost makes sense to the human brain.

02:54 But then it translates into the Django ORM really, really cleanly because you can set up your own custom query sets and have their own custom methods on it.

03:03 So you can build a site that's a joy to maintain and to query behind the scenes.

03:09 Another thing that she highlights in the post is actually template filters and template filters are awesome.

03:14 I think a lot of people will neglect to take this into account when they are building web pages is if you can use these quick little filters that you can apply inside your template.

03:25 And it gives you a ton of like the batteries included experience that you've come to love about Python.

03:30 You get that in Django.

03:32 And I think if you go and look at the reference for the template filters, you'll see there's just tons of cool little things that save you a ton of time.

03:39 And you don't have to reinvent these wheels.

03:41 They're all ready for you to go.

03:42 And then there's also, for example, the JSON script, which takes a Python dictionary and automatically converts it to JSON and inserts into the HTML script tag in a safe way.

03:50 So it also helps you with things like cross-site scripting and template injection and all those kind of security problems that normally you'd have to consider can go mostly to the wayside because Django just takes care of it for you when you use some of those built-ins.

04:06 Other kind of things that we mentioned here, I believe, is like migrations.

04:11 So if you are building websites, don't forget, if you change your database, you've got to migrate the code.

04:16 And if you change the code, you got to migrate your database to match for those various models.

04:21 Again, something that a lot of Django nuts don't think too much about because it just happens out

04:25 of the box. But this is a good one that just kind of reinforces that. Another nicety that some folks

04:32 like is skipping inheritance for class-based views. You can prefer function-based views for sharing

04:38 code and then using Django's own mixins and interfaces to simplify that building of static

04:44 sites. What's also nice, if you basically combine this with something like HTMX, you now get a

04:49 superpower, which is you don't have to build your site twice. I think I mentioned this last week

04:53 on the show, is that you build once and you've got a beautiful feel of a single page web app

04:58 or a reactive style design, but without having to build your models twice. There's also some

05:05 performance surprises. I think if you check out the latest version of Django, you'll notice that

05:09 there's been some considerable performance improvements.

05:12 If you're considering, say, FastAPI over Django with Ninja, you should, and that's not mentioned in this article necessarily,

05:18 but I would mention that you could check that out and get fairly similar performance in certain use cases

05:24 without having to go the FastAPI route and still getting all the batteries included of Django itself.

05:29 So that was the kind of wrap up of the post.

05:32 I'm going to mention it because I think sometimes people just need to be,

05:34 have their memory jogged for some of the nice bits that are still baked into the default experience of Django.

05:41 Yeah, that's super cool.

05:42 You think admin backend.

05:44 Oh, yeah.

05:45 You know.

05:46 But it's way more.

05:47 It's so much more.

05:48 Yeah, exactly.

05:48 That's my point.

05:48 There's a lot of these sort of like one bit lower, but still really helpful things.

05:53 I feel like Julia needs to put a blog roll on this.

05:56 I mean, come on.

05:56 It's got no credibility with me until there's a blog roll.

06:01 And if you don't know what a blog roll is, probably good, but it's certainly in the vibe.

06:05 For going old school.

06:06 It's just funny that word nostalgia for 2010s.

06:10 Exactly.

06:11 Can you believe how it was back then?

06:14 That doesn't sound old to me, unfortunately.

06:16 I know.

06:17 So, yeah, yeah.

06:19 I got a little bit of real-time follow-up.

06:20 I just, the latest Talk Python episode that just came out yesterday.

06:24 Oh, yeah.

06:24 Yes?

06:25 Yeah, yeah.

06:25 Was with Carlton Gibson.

06:27 And it's a really fun episode about updates on Django's async story and rewriting all the documentation and positioning of async for Django,

06:37 plus talking some Django 6, 6.1 things.

06:40 So if you liked Calvin's bit, there's a whole hour of it right there.

06:43 That was really fun.

06:44 I have a little more on Django in the extras too.

06:46 Awesome. Awesome.

06:47 Well, okay.

06:48 Well, you know, it's all fun when there's a vibe coding party until you got to clean up the mess.

06:54 So this got sent in.

06:57 It got sent in to us by Sam Lerner saying, hey, there's this really interesting article on the Financial Times.

07:04 So thank you, Sam, for sending that in.

07:07 And it's paywalled.

07:08 So I'm going to give you the rundown.

07:10 But it's not so much that you need to read it, which is what's interesting.

07:14 It's that it is here at all.

07:16 So Financial Times is for business people.

07:19 Yeah, I was curious where this was going, Michael.

07:22 Exactly.

07:22 Why is this here?

07:23 So what is this story about?

07:26 Who cleans up after the Vibe Coding Party is the title of the article.

07:30 And the byline is hidden behind a paywall even, which is interesting.

07:34 I was writing this article.

07:35 I'd be like, could you just put my byline under it?

07:37 Anyway.

07:38 So it goes through.

07:39 I'm not speaking to journalists in these days anyway.

07:41 I know.

07:41 You're like, I've already got it hard enough.

07:44 Are you serious?

07:46 So let me give you a little bit of the rundown for this one.

07:50 Because there's one, because you don't have access to it.

07:51 But I think the reason Sam sent this in and the reason I think it's interesting as well

07:57 is actually, no, sorry.

07:58 The piece is by Sam Lerner and Dylan McConnell sent it in.

08:02 I wrote those down, but I had crisscrossed them in my mind.

08:05 So thanks for sending that in, Dylan.

08:06 So the reason I think this is interesting is it tells the story, but to a much broader audience who is not able to discern the details that I'm about to give you.

08:17 Okay.

08:17 So it starts out by going through this, the experience that Daniel Stenberg,

08:22 the creator, maintainer of Curl went through as the primary positioning of this article.

08:27 says, hey, look, Daniel, it talks about, oh my God, there's such an interesting term.

08:33 The invisible load, the load bearing people of the internet is what it's referred to all

08:38 the time.

08:38 Are you familiar with this term?

08:40 Yeah.

08:40 Yeah.

08:40 So the load bearing people of the internet are the folks like who are not Daniel, but

08:45 the anonymous folks who even just might do a PR and like, nobody knows who they are, but

08:49 they are like keeping open source.

08:51 And by way of that, like a lot of these companies run it.

08:54 So Daniel has been famous, notable, I guess, for mentioning a couple of things about Curl, right?

08:59 So Curl's, I guess, popular.

09:01 It's been installed about 20 billion times.

09:04 Yeah, it's been installed by 20 billion times and it has 33,000 plus contributors.

09:10 So notable because they killed the bug bounty program for Curl because there was an explosion of AI slop, right?

09:17 So it's like step one of this article is like, look, this really important thing that is the load-bearing piece of the internet, supported by the load-bearing people of the internet, had to actually shut down their security story because of AI slop.

09:32 Then Guido was also making an appearance, talking about Python, and said a lot of projects are holding emergency meetings over AI contributions.

09:42 Should we accept LLM patches or should we not?

09:46 And I think that's fair.

09:48 There's Vibe Coding Kills Open Source, which is a paper from Miklos Korn

09:53 about how packages frequently recommended by coding saw a huge jump, but it actually breaks some of the supporting pieces.

10:02 I think Tailscale is probably the biggest one here.

10:06 Tailscale saw a 6x jump in actual usage.

10:10 At the same time, it saw a 60% drop in its traffic to its site, and thus it's paid offerings and so on.

10:17 Stack Overflow.

10:18 I think Stack Overflow is actually the most extreme example of stuff getting kind of wrecked.

10:24 Like, are you familiar with the numbers?

10:26 So the peak Stack Overflow is getting 1,000 questions a month.

10:30 On the month that Stack Overflow opened, it got 1,500 questions, and it got 1,500 the month that this article was written as well,

10:37 which is insane.

10:39 And it's a super, super hard arc there.

10:40 But, you know, Stack Overflow was kind of a main place, and I don't know.

10:44 It was super valuable, though.

10:45 I'm sort of a little bit sad about Stack Overflow.

10:47 How about you?

10:47 Maybe a victim of its own success.

10:50 The fact that it attracted a lot of that negative energy.

10:54 So I don't know.

10:55 I don't know if it would have saved it, if it would have handled that moderation better or not.

10:58 It's hard to say.

11:00 Yeah.

11:00 We can armchair quarterback that one all day long.

11:02 Yeah, we can.

11:03 It's like, it is a bit of a victim of its own success.

11:06 Yeah.

11:06 And then the thing that closed out with content creators, like, hey, that's gotten closer to home.

11:11 Like Josh Kamau's new web dev course launched on Udemy of all places and got one third of the enrollment that it did previously, which that tracks.

11:24 I think it's a pretty tough time.

11:26 Yeah.

11:26 You'd be selling deep, deep knowledge to people who just want a surface level knowledge, you know, and are in a hurry because the button you can press or just do it, Claude, is a thing you can say.

11:36 Yep.

11:36 We're seeing that in our community, too.

11:38 I mean, the real Python folks and like the Matt Harrison's of the world, like you and you.

11:43 Yeah.

11:43 Yeah.

11:44 It's true.

11:45 It's true.

11:45 I mean, courses are still selling, but they're not as gangbusters.

11:49 I think there's a lot in that though.

11:50 It used to be a lot easier to communicate directly with people and like all the social

11:54 stuff is all scramble and there's just, there's a lot of factors in it, but AI is not a supporting

11:59 factor, let's say.

12:00 But the reason I brought this up.

12:02 Okay.

12:02 So that tells the story and then I'll close it out with this.

12:06 What's really interesting about this is what was omitted from this.

12:10 So the key, the cornerstone of this article is curl.

12:14 They had to shut down their bug bounty because vibe coding is killing open source.

12:18 Yeah.

12:19 Well, that's true.

12:21 There was this article that said the end of the curl bug bounty.

12:23 But in April, Daniel also wrote high quality chaos.

12:27 No more AI slop.

12:29 What?

12:29 Go on.

12:31 Pray do tell, my friend.

12:33 So they shut down the bug bounty program, and now they just accept unpaid security work, as a lot of projects do, right?

12:44 Or they probably are on the receiving end, even if they don't want to accept it, but they get a bunch of it.

12:49 And by shutting it down, they've removed an incentive to just generate junk and hope it gets accepted, right?

12:55 Like there was a monetary value if your prior AI slot got accepted.

13:00 Now it's just you have to do it because you care.

13:02 Well, guess what?

13:02 It says, I haven't read this article enough.

13:05 I'll recently know exactly, but it says, I complained and complained about the high-frequency junk submissions

13:10 to the Crow bug bounty program that grew really intense.

13:13 And it said, look, somewhere in here, it says, basically, yeah, here, now the quality is higher, the rate of confirmed vulnerabilities is back,

13:21 and even surpassing the number of CVEs and issues are surpassing pre-AI level.

13:27 Confirmed, right?

13:29 So that's really like the percentage of them, which are actual problems is higher than they

13:34 used to be.

13:35 So that's beyond human level.

13:37 That's a good thing, right?

13:38 So is he saying that the finding of security vulnerabilities, using AI as an augmented tool

13:44 to detect where there's vulnerabilities is what he's talking about here?

13:47 Yes, I believe so.

13:48 Yeah.

13:48 Yeah.

13:49 And so that's still a problem.

13:50 They're getting tons of them.

13:52 But it's like, we kind of hinted at this last time, like the first time you run a linter

13:57 on a program, you're like, what?

13:59 There's a thousand errors?

14:00 It's not even that big of a program.

14:03 But it's not going to be, if you took out a hundred of them a week, there's not going

14:06 to be a thousand the next week and the thousand, it's going to go down, right?

14:10 There's only so many that could possibly be there, right?

14:13 And so it is a rough time, but I think it's really, so that brings me back to the article.

14:18 So I think it's just really interesting that they chose to tell the story of, look how bad

14:23 this stuff is using curl as the cornerstone when two months after the original thing came out it's

14:30 it actually no that's this is not even the problem that you think it is it's a it is a problem but

14:35 not in the way that you think it is and this article was written in june or july the ai swap

14:39 is gone articles from april it's like here's the story you wanted to tell without those pesky details

14:45 of it's a different problem anyway i thought that was just a super interesting arc and you know

14:49 Thank you, Dylan, for sending it in.

14:51 And that's that.

14:52 There always will be bugs in software, but we're going through probably a great time of discovery,

14:58 finding bad bugs that have been present for sometimes decades.

15:02 So everyone's going to win in the fact that we use these as augmented capabilities for developers to detect,

15:08 sometimes very hard to detect bugs inside the code.

15:10 I mean, that's how Fable broke out of the sandbox or Mythos broke out of the sandbox and attacked.

15:16 Hugging Face was chaining multiple zero days that didn't exist.

15:19 to make this all happen.

15:20 Well, you know what?

15:21 Those have been closed this week because they were deemed important enough.

15:25 And now we all benefit from that.

15:27 We do.

15:27 I think it's just not black and white.

15:30 You know, it's a weird time.

15:32 Yeah.

15:33 It's a weird time for sure.

15:36 This episode is brought to you by Xweather.

15:38 You're using agents that can write code, summarize documents, and automate workflows,

15:43 but they're missing one thing, awareness of the world around them.

15:46 That's where today's sponsor, Xweather, comes in.

15:49 Xweather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server built for tools like CLAUDE, Codex, Copilot, and modern IDEs.

16:01 So your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions.

16:08 Backed by Vaisala, whose instruments fly on NASA missions to Mars, XWeather delivers trusted data and unique insights that go beyond conditions to actual impact,

16:18 from real-time lightning strikes to road surface forecasts.

16:22 Start with 15,000 free API calls each month and pay only for what you use as you grow.

16:27 XWeather is your full weather stack for developers by developers.

16:31 Start building for free today at pythonbytes.fm/xweather.

16:35 The link is in your podcast player's show notes and on the episode page.

16:39 Thanks so much to Xweather for supporting Python Bytes.

16:42 Well, Michael, would you love to understand your use of agents and LLMs a little deeper?

16:49 I will go as far as saying I have begun to understand it because of this.

16:55 It is amazing to tell people about it.

16:58 And it's thanks to you that I know about it.

16:59 So go ahead.

16:59 Yeah.

17:00 This got mentioned to us last week in one of my meetings I was in.

17:04 And I was like, that is really cool.

17:06 So AgentsView is a Python app that can basically look through all your coding agent history and sessions across a couple different providers.

17:14 So it works with OpenAI, Anthropic, and a couple others along the way.

17:19 And give you, you can see here in the screenshot, a GitHub-like tracker of your activity.

17:26 You can talk about top sessions.

17:29 And this came up because we were talking about AI cost.

17:31 And so if we're thinking about how much it costs to use the AI tooling right now, it's a lot of subscription based subsidization of these tools.

17:41 But the time may come where you're paying per token and being able to visualize and analyze your usage may actually help you change your usage because you can't change what you don't measure.

17:50 So once you start measuring things, you can actually make behavior changes to potentially actually make your AI workflow even more optimal.

17:59 So it's kind of cool.

18:00 It auto discovers those sessions on your session files on your machine.

18:04 No configuration needed.

18:05 Everything gets stored locally in a SQLite database.

18:08 There's no cloud accounts.

18:10 It does have an option to mirror into DuckDB or Postgres if you want to do more fancy things

18:15 with your session data.

18:17 It has this usage drop-in, which basically gets all the data, runs the reports, throws

18:23 it up here.

18:24 It works in a terminal as well.

18:25 So this is just a web view of it, but you can actually see that, you know, actually here's a list of all the various coding agents that it's currently supporting.

18:33 So if you're on AIDR or PI or you name it, there's a whole bunch in there.

18:37 There's so many there that I literally.

18:39 I'm like, what is this one?

18:41 Yeah, there's some things I don't even know, which is kind of cool.

18:43 But you can use, I used uvx.

18:46 So uvx agents view and you're on your way.

18:49 It will literally download and install in a matter of seconds.

18:52 You can have it give you preset reports out to the terminal, or you can say serve.

18:56 And if you do the serve option, you can get a view like this.

19:00 So this is mine.

19:01 You can see here, I've gotten more and more intense on my AI agent usage.

19:08 Now, this is just the coding agents, the local ones that I'm using.

19:10 It does offer an interesting feature.

19:13 I didn't show this off, but if you are looking at this, there's an MCP server.

19:18 Have you ever wanted to query across all of your coding agent sessions?

19:22 Say you're working on 10 projects and you want to ask a question like, have I ever solved this error before? Here is your answer.

19:29 This is actually a more interesting use case than the token spend calculation

19:33 is an aggregate view across many of your sessions.

19:36 So you can actually leverage the knowledge you use to solve a problem in one place.

19:41 You can now bring it in and solve it in another without having to reprompt or reinvent the wheel.

19:46 You can also bring in your chat history.

19:48 So if we go back over here to the chat import, you can import your Claude and your ChatGPT chat sessions.

19:55 And so those may overlap or intertwine with the work you're doing on your agent.

19:59 So now you can correlate and have those chat sessions alongside it.

20:03 This is something I've wanted for ages is a multi-chat meta search because that's now kind of my brain

20:09 is the history log on like perplexity and Claude and ChatGPT.

20:13 And where did I discuss that last?

20:15 Oh, it was over on ChatGPT.

20:16 Yeah, that's super cool.

20:17 Now I can pull that in.

20:18 I don't think it supports perplexity just yet, which is kind of a need in my mind, because

20:23 the perplexity sessions, as I found out, will expire.

20:26 If you go back to some of that history far enough, you will find that it won't have your

20:31 history actually there.

20:32 It'll list it in the history.

20:33 And but it's not so it's not the external brain that I thought it was.

20:39 So a tool like this, actually, if you set up some tooling to import those chat histories

20:43 in here might actually be a better solution because now you can search across multiple

20:47 providers and keep all your own history local instead of relying on the cloud providers. So I

20:52 really like that. It has the full text. You can optionally do semantic search. So again, if I come

20:57 back in here to the pieces, I believe semantic search. Yeah, here we go. Semantic search. You

21:02 basically can use a local like Olama or Olama CPP hosted embeddings models or OpenAI compatible

21:09 endpoints and have a vector based search against all this too. So again, this is not out of the box

21:15 on, but if you turn it on, you now kind of get super powered document semantic level search

21:22 against those. So super fun, cool project. I think I'm going to double down a little more on this.

21:26 There's some other projects in the community that are doing things like this, but this is one that

21:29 was Python. So I thought it'd be very relevant to our audience. And I think it's actually a great

21:34 way to kind of externalize your search history and how you're using the coding agents and how

21:39 you're solving problems. I think this is super neat. I'm glad you covered it. I'll tell you what,

21:44 a couple things one why search so bad in the ai things it's like searching searching and then it'll

21:52 pull up stuff you put two like you can't because they're not spending the tokens on embeddings this

21:55 this allows you to spend your own tokens to get the embeddings that are missing from that that

21:59 equation right there michael interesting but even just like a Pagefind level sort of indexing

22:06 by the apps it's it's so bad so having a really nice search here and two i like to point out if

22:12 you do try this out in the top it says um agents view then you can pick by project it identifies

22:18 which projects that you're working on so you can drill down into just the python bytes website for

22:24 example whatever work i've done there i want to see the spend and the usage over time yeah the

22:28 history yep but it also has a drop down that initially says sessions and that's pretty

22:33 interesting that's the one you showed me but if you pick like usage you get some really interesting

22:38 things. For example, I have been setting up Hermes. I spoke about Hermes. It tells me how much I spent

22:44 last month. I spent 13.2 million output tokens and 4.4 million input tokens. That's on average,

22:51 $300. No, that's peak at $300 a day on average, 71. On setting up Hermes, I spent $577. I spent

22:59 507 on DocPython training doing some mega projects. I did this project that ran for five hours without

23:06 interruption. Wow. Which is crazy, but it came out really good. I spent 169 on Python bytes,

23:13 and I'll tell you what that is later. But that kind of stuff, there's just a whole bunch of

23:17 those different kinds of reports and trends and other things. And you can turn on this embedding

23:22 stuff that you talked about. So you can like AI search of your own content. Yeah, I came for the

23:26 token cost, but I stayed for all the search and semanticness of it. Exactly. Exactly. All right.

23:32 I have another story to tell, and this one comes to us from AJ.

23:37 So let me get down to it.

23:40 Careful with the phishing, y'all.

23:41 So I thought I would retell his story because this is also pretty interesting

23:48 and give you all a little bit of a tip as well.

23:51 So AJ says, hey, I'm passing this along because it was a pretty sneaky bit of targeted phishing.

23:58 and sidebar, I think that the, all this AI stuff has absolutely exploded the amount of scammy,

24:06 crummy email out there. I get, I mean, I'll tell you, there's like four people a day that want to

24:11 buy Talk Python and they just, or they're going to help me raise a hundred million dollars. I'm like,

24:15 just get away from me. You wouldn't believe how many times Gabrielle wants gift cards from me.

24:20 And it's an urgent, she's in an urgent meeting and she needs it now. Can't wait an hour. That

24:27 talk to me in person we gotta get going so anyway i think this is part of that obviously so it says

24:33 a targeted bit of sneaky phishing to do with GitHub and happened to play off an old interaction i had

24:38 with bandits repo so bandit is a ironically a security vulnerability scanning tool for python

24:45 and he had done some kind of pr or something like that and this person probably this ai found that

24:52 interaction and said, hey, we're going to like talk about that and leverage it and make it feel like

24:58 a real person who's really talking to you, right? So it says traditionally relative newbies like me

25:03 haven't been historically worth the effort, but you know what? When everything's automatic,

25:07 now it is. So I put the actual email in here and the subject is your bandit issue 3150.

25:15 Next token false positive just fixed that exact case, right? It's okay.

25:19 great yeah hey so and hey aj i saw your bandit issue such and such and da da da i built a

25:26 deterministic gate and it goes on and on about it or so you know could you just check out here's the

25:31 here's the code that fixes it and you want to put that up on the screen michael oh have i oh i'm i do

25:39 yes you know what hold on it's it's not worth it the trouble to get over it's like kind of locked

25:44 away so sorry but it's basically it just says here's a link to yeah to the code right and i put

25:50 this is in the show notes curious whether this clears your problem or if it trips you up let me

25:54 know and it's that seems totally reasonable right but there's a few issues how long the code was

26:01 at backtrace don't go there blacktrace don't click on these links some rando alphanumeric thing how

26:09 How long has backtrace.co been around?

26:13 Not very long.

26:14 Not very long at all.

26:16 So I actually threw this into Claude.

26:18 I said, Claude, I use Spark email, which is kind of a crappy email, but it's the least crappy.

26:24 So you know what I mean?

26:26 Client.

26:27 But it has a really cool feature that for any email you get or any email thread, you can say copy as markdown,

26:33 which is so perfect for just dropping.

26:36 Yeah, because you can just paste that into any AI thing.

26:38 go tell me about this or process this or whatever, you know?

26:42 And you could do like the whole thread or just the top level as a checkbox.

26:45 It's pretty sweet.

26:45 So I did that and I gave it a clod.

26:47 And it says, this message name drops enough real detail to feel legit, but the structure is pure phishing.

26:53 And there's a couple of reasons.

26:55 So first of all, if you didn't look, it's actually a Gmail address being sent from.

27:00 Companies generally don't reach out from their Gmail, you know?

27:03 As gmail.com.

27:05 It's very sus.

27:05 Very sus.

27:06 That's very sus.

27:07 Over-specific targeting.

27:08 It mirrors AJ's exact public activity, so it's just enough plausibility.

27:13 The entire payload is two links.

27:15 It stripped the technical flattery, and it's just the paste is here, plus the results are here.

27:21 30 seconds, low friction.

27:22 A brand-new domain, blacktrace.co, has no track record of existing, so that's also a sus.

27:29 Precise jargon that's vague, disalarmingly close.

27:32 Like, if this trip's on something of yours, that'd be most useful reply, right?

27:36 like, hey, just check it out for me.

27:37 It's a very legitimate looking email, especially given the cleanness of the domain name

27:42 and the links are very clean and not messy.

27:45 A lot of times these seem pretty obvious, but this one's really, really clean.

27:50 Yeah, so just be careful out there, folks.

27:53 AJ was safe, but ugh.

27:54 One we've been seeing, and we've not seen actively, but some people in the community have been seeing,

27:59 is bogus people applying for jobs attempting to get you to click on their GitHub repositories

28:05 to clone a repository.

28:07 And it has obviously the hooks in it to do things on, you know, when things happen.

28:13 So be careful if you're an employer and people are asking you to really download their work

28:17 and check it out.

28:19 And reverse.

28:20 I've heard really bad stuff from people who got lured into applying for a fake job

28:25 and all the job was about is like, just do this take-home test coding example.

28:30 And here's the GitHub to get started.

28:32 Yep.

28:33 Just pay with all your Bitcoin and all your credentials.

28:36 It'll be fine.

28:36 And they're preying on people who are looking for a job, maybe in a situation, any opportunity

28:41 they're going to jump at.

28:43 So just be careful.

28:44 It's a good warning, Michael.

28:45 So shady.

28:46 Thanks.

28:47 Thanks, AJ.

28:47 All right.

28:48 Very good.

28:49 Extra?

28:50 Yep.

28:50 Feeling extra?

28:50 I do.

28:51 So related to the Django post from earlier, DjangoCon US is coming right up.

28:56 It's August 24th through the 28th in Chicago.

28:59 I assume there are still tickets available because the registration is still up.

29:02 but I think the hotel block closes the end of this week.

29:06 So if you want to stay in the conference hotel at the discounted rate, which is a considerable discount

29:11 for a downtown Chicago hotel, come check it out.

29:14 It is a great conference.

29:15 Tons of great content, great community.

29:18 Actually last weekend I was at the Pi Ohio community and people were already talking and excited

29:21 about going to DjangoCon as well.

29:23 So the conferences like this are where you make great friends and you get to experience that community

29:30 that everyone stayed for.

29:31 Yeah, and good connections too, right?

29:33 Yeah, yeah.

29:34 Next time you run across somebody, you're like, oh, actually met that person.

29:38 And yeah, it's good.

29:39 Yeah, actually the other one I wanted to mention here is Ruff has made a new release.

29:44 And it may not seem like an exciting release since it's 0.16.0, but watch out.

29:48 I'm still riding the zero for her.

29:50 Still on the zero.

29:52 The default rules went from 59 enabled to 413 rules enabled.

29:59 So when you run this, you will see a lot of things, but it's all in the attempt to get us into a better spot.

30:07 So much like the vibe coded security, vulnerability, searching and finding,

30:13 this is going to help with keeping things clean and in order and readable and best practices

30:19 and making sure you aren't doing something that's kind of on the edge case of even,

30:22 this can be considered almost like a security, pre-security tool.

30:25 So check that out, but be careful because it's going to give you, it's going to yell at you a lot.

30:29 It is absolutely going to.

30:31 Yes.

30:31 Yeah.

30:32 Eva out there says, I wonder what will make them break 1.0.

30:35 Yes.

30:36 That's a good question.

30:37 I don't know, but yeah.

30:41 I have been running, one of the core rules of all my agents and just before is I just,

30:45 I've been running Ruff format and ruff check on everything before I committed.

30:50 Every tool.

30:51 100%.

30:51 Yep.

30:52 Yep.

30:52 Yep.

30:52 And it's, once you get it, it's a pain at first, but once you spend a few hours, it's,

30:58 it's dialed in and it's, it's good.

30:59 The other one that I've been doing, keeping it in the astral OpenAI family, is ty.

31:06 So the biggest project, like the thing that ran for five hours was so much of Talk Python

31:12 training is built from, it's a 10-year project with 190,000 lines of Python, right?

31:17 It's a big project.

31:18 So at least for Michael, that's a big project.

31:20 So it was built under the PyCharm type checker, and I hadn't been running ty on.

31:26 I'd just been doing whatever the editor says.

31:27 And I'm like, well, let me run ty on.

31:29 It's like, oh my, 800 errors.

31:32 And you open it any other editor besides PyCharm and it's just full of red marks.

31:36 It's like, oh man, I cannot deal.

31:40 I can't even look at the editor and tell if there's something wrong because it's so full of red marks because they apply different rules and different checks.

31:46 So I spent a long time with Fable just planning out of like, how are we going to resolve this?

31:52 Because it's not just change the types.

31:54 it's like, well, you have an optional thing coming in and you didn't check if it's none before you operated on it.

32:00 So that's a attribute error, right?

32:02 So what do you do when it is none?

32:04 You've got to rewrite the code and have a different response.

32:06 So it's pretty complicated, right?

32:07 So I spent probably a couple of hours building out a plan to solve this.

32:13 Then I just said, Opus, have at it.

32:16 Five hours later, it ran out of credits.

32:19 I had to come back in the middle of the day and go, keep going, you have more credits now.

32:24 And then after dinner, it was done.

32:26 I'm like, oh my God, but zero, zero errors.

32:28 I mean, it's really nice.

32:29 Now I look at the page and if there's a squiggly, it means something, you know?

32:33 Yeah.

32:33 Well, and one of the things that Ruff did in that new release is that when it encounters

32:37 those errors or the rule breaking moments, it gives a in context description that is very

32:45 AI LLM friendly.

32:47 So these tools are designed to go back and forth with the LLMs in a very, very friendly

32:51 way to be very productive as opposed to them having to do a lot of reasoning and token burn

32:57 just to think about what's wrong it's it's trying to eliminate some of that token usage by giving

33:02 the right pointers to the right tooling that's a super point a good point because otherwise it has

33:06 to try to infer what the what's going on x means yeah it's got to trace it back through the whole

33:11 program yeah i mean basically this is the compiler of yeah in a sense right this is like the compile

33:17 the build failed equivalent.

33:20 Yep.

33:20 And that's super cool.

33:21 One more real-time follow-up piece while we're here.

33:23 Brian Weber says, wow, I had a similar experience about the phishing.

33:26 I just realized someone sent me an email about an app they did replicating a repo I had,

33:31 and now the site is gone.

33:32 Hmm.

33:34 Hmm.

33:35 So I got, yeah, not great.

33:37 I got one more thing to say.

33:38 Here's like, not mega, but I redesigned the whole homepage and some other experiences on Python Pyce

33:47 the i like it and yeah it's got some really neat things here for people but most notably it has

33:53 like a little um technology parade so you want to learn about htmx or hnckai or fast api or django

33:59 click on that and that'll take you over to talk python training with just the course that we have

34:03 there so that's pretty fun and it has a find us on social with all of our links yeah really good

34:09 there as well as somewhere it has a subscribe dedicated subscribe page so if you want to get

34:16 in CastBox or Overcast or Radio Public or whatever. It's even YouTube and Spotify. So a couple extra

34:22 nice things there. That's really cool. You need to add in a music assistant. Yes. Music assistant.

34:27 Okay. Will do. For those home assistant geeks out there. Music. Okay. Not only, not only do I think

34:35 I agree with you, that should be good. I'm now very interested and I'm, I'm, I'm here for it.

34:39 Let's do it. Yeah. There's been a lot of it. Well, maybe next week I'll do some, some home assistant

34:44 news because I feel like we have a lack of home assistant news here. We absolutely do. We absolutely

34:49 do have a lack of it. So for our joke, let's close it out here. All right. And I want to put you in

34:54 the right mood, the right state of mind here. So think about the Bobs in office space.

35:01 What would you say you do here, Michael? What exactly would you say we do here? Well,

35:07 remember when they're interviewing the project manager, Bob? So there's three Bobs. He goes,

35:11 what exactly would you say you do here, Bob?

35:15 I take the requirements from the people to the programmers.

35:18 I'm good with people.

35:20 I'm a people person.

35:21 I'm a people person.

35:22 That is really one of the best movies of all time.

35:25 It is.

35:26 If you haven't seen, not the series, the show, Office Space.

35:29 Yeah.

35:30 The movie.

35:30 The movie.

35:31 Yes, the movie.

35:32 Okay, so here's the tweet or the X post or whatever you call it.

35:36 It says, to replace programmers with AI, clients will need to accurately describe what they want. We're safe. Very true.

35:44 That probably hits closer home for you than, so one point. Yeah. I'm not worried.

35:49 All this stuff is actually just making people do the thing we should have been

35:52 doing in the beginning.

35:54 There's so much more planning.

35:56 There's so much more planning in documenting and writing down and history.

36:01 It's going to be a wonderfully well-documented world now.

36:03 Exactly. That way when Skynet takes over, it'll know that we were on its side so it won't put us into the worst prison.

36:10 no no i'm just kidding sky net a little more optimistic michael come on no i i really don't

36:15 think that oh oh i have i had a second joke from from the really quick before we run this out okay

36:20 so um for this i mean this could have been the joke it's probably should have been the joke check

36:25 this out check this out so this is no joke inside the financial times article there was a little

36:32 call out like recommended you might also like vibe coding is the new dyi who wrote it who wrote it

36:39 oh my god sarah o'connor wrote it sarah o'connor oh my god and she was the woman who was

36:47 the star of the terminator series now i know it's sarah connor but she's trying to hide from

36:52 the ai's going by this byline like isn't that hilarious oh my gosh getting it

36:59 that's an unfortunate name for that article or the author yeah it's yeah it's kind of amazing

37:06 yep well done all right well thank you calvin always great to be here with us

37:10 as always and thanks everyone for listening thanks michael talk to you next week yep bye