#492: Codeberg Puts Head in Sand

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to earbuds.

00:05 This is episode 492, recorded August 18th, 2026. I'm Michael Kennedy.

00:12 And I'm Calvin Hendryx-Parker.

00:13 This episode is brought to you by Logfire. So thank you to Logfire from Pydantic.

00:19 Check them out at pythonbytes.fm/logfire. It's about observability for your AI apps and

00:25 beyond. Tell you more about them later. Connect with us on social, links on the website.

00:29 Be part of the live show.

00:31 Check it out on the website, pythonbytes.fm.

00:33 It's live.

00:34 And we have a really cool newsletter that we send out mostly every week with all sorts of extras.

00:39 So you can sign up there as well.

00:40 Just visit the website, click the newsletter, do the thing.

00:44 We'll keep it private and not abuse it.

00:47 Speaking of abuse.

00:48 We're good people.

00:49 You're good people.

00:50 Let's make sure we keep people safe, Michael.

00:52 Exactly.

00:52 Sometimes you can have nice things on the internet.

00:55 That's true.

00:55 And well, the good thing is that with the solar eclipse in Europe last week, a new release came

01:01 out of some security updates for Python 3.12, 3.11, and 3.10. The key bit here, well, there's a lot of

01:10 key bits, which is there's lots of security updates that have happened. They're pretty important if

01:15 you're doing certain kinds of activities. So for example, if you are using tar files to, if you're

01:21 extracting tar files with any of these versions of Python, you are going to want to update ASAP

01:26 because this basically fixed a path traversal bypass of the data filter. So a symlink escape

01:33 that could bypass bits and pieces here and get people access to places they're not supposed to be.

01:39 Kind of important. Now the important bit here is that this is only a source release,

01:44 is a source release only. If you want to upgrade to these versions of Python, the 3.12.14, 3.11.16,

01:50 and 3.10.21, you are going to have to download the source tarball or patch your existing build

01:57 process to get these released into your production environments. But if you are on these versions,

02:02 you're going to want to get those things patched. I mean, it's nice that these are in security only

02:05 fixed mode. There's not a binary version. I have to use this. There is not a binary version of

02:10 these been released. These are in security fix only mode. I mean, hopefully you're getting into

02:16 Python 3.13 and 3.14 as they are the current releases. It's nice that the community supports

02:22 these versions that far back. I don't know when 3.10 was released, but it was quite a while ago.

02:27 And you've got to be able to stay on top of these. This is in your hands now. This is kind of more

02:32 of a do-it-yourself, but at least the fixes are available. So tar file is a big one. There are

02:38 four fresh CVEs that are being covered by these fixes here. One of them is for the sourceless

02:45 file loader. The other one is the cookies morsel, which there's basically a couple of fixes there

02:52 on that. And then the ftp lib ftp cp. So there's also a bunch of denial of service type fixes,

03:00 some cleanups in HTML parser, config parser, Unicode data normalize, element tree XPath bits.

03:08 There's some header injection fixes. Again, just lots of cleanups around the edges.

03:14 Michael, have you ever used the web browser module from the standard library?

03:18 I'm learning now there's a web browser module.

03:21 There is a web browser module.

03:23 It allows you to pop a web browser.

03:25 That's pretty handy.

03:25 I've used it for a couple like little demo-y type things,

03:28 but there was a allowed control character in there

03:30 that would have caused an action prefix bypass.

03:34 So if folks were sneaky and knew those things existed,

03:37 they could basically jump in and bypass some of these security controls.

03:40 The HTTP client also now caps chunked trailer lines and the 100 responses to 100 each.

03:49 So a hostile server could previously hang a client, even if you had a socket timeout in place.

03:54 So lots of memory safety stuff, lots of other little cleanups.

03:56 Again, it's a pretty sweeping set of security fixes.

03:59 And they chose to release it now because it's as good a time as any.

04:03 There's no set schedule for these specific releases on these older versions of Python.

04:08 Excuse me.

04:09 But it's good we've got people watching our backs and making sure we stay secure out there.

04:15 Like I say, you can go look at the release notes.

04:17 There's a ton of fixes in here.

04:19 It's a really long set of releases and fixes that went into us.

04:23 Thanks to all the Python core devs and volunteers and people submitting patches.

04:28 I'm sure some of this stuff probably came out of the new models that are able to detect these kinds of pieces.

04:34 But obviously, humans are putting the pieces into place.

04:38 So go be safe out there, Michael.

04:40 And upgrade your Pythons.

04:41 This is always something I'm worried about.

04:42 Yeah, I mean.

04:43 Upgrade your Python, please.

04:45 Here's also one of those reasons why I kind of want to stay on top.

04:48 Yeah.

04:49 Of having a fairly new version.

04:51 And I'll be like, oh, we're not going to touch it.

04:53 And hey, it's 3.8, but it works.

04:55 It's like, yeah, but when this kind of jump, this stuff comes out of the blue,

05:00 you're all of a sudden scrambling to get your app to run rather than just a point release.

05:03 Yeah.

05:04 It's hard to argue for the old stance of like, well, just because it works, it should just stay in production.

05:10 Or even if it's behind a firewall or behind some kind of level of protections, we've seen that these models can now chain together multiple vulnerabilities to get access to spaces they weren't supposed to get access to.

05:21 All that's required at this point is setting good goals for the agentic AI tools.

05:25 And they can get around a lot of things if they're given unfettered access, even not unfettered access, even if they're sandboxed in, they could still do this.

05:33 So keep up to date.

05:37 Again, this is a reason for staying on the latest released version of Python.

05:42 But the community does support back patches.

05:44 You just got to go build them yourself.

05:45 I'll have more on that later on the building.

05:48 Maybe.

05:50 So yes, but maybe.

05:52 Maybe.

05:53 What do you got?

05:53 My favorite way to install Python is uv Python.

05:58 No kidding.

05:59 Install, right?

06:00 And a quick, I just upgraded it.

06:03 You got to upgrade to get the latest.

06:04 It's just kind of odd.

06:05 It doesn't.

06:05 Oh, they've got someone's got built.

06:07 It does.

06:08 3.11.16.

06:10 And 3.12.14.

06:12 That looks like they've packaged it into Python build standalone.

06:15 That's nice.

06:16 Well, it's good to see the astral folks have got our back.

06:19 Yes, obviously.

06:20 Like that's a theme, right?

06:22 It's definitely a theme.

06:23 Well, there you go.

06:24 Go.

06:25 Well, if you're on this older version of Python, you might need to just go upgrade to uv at

06:30 this point and save yourself some headache.

06:32 Yeah.

06:33 Yeah, absolutely.

06:34 You could technically just use uv to manage your Python and still, I don't know.

06:38 Yeah, you don't need it.

06:39 You don't necessarily, yeah, you can do the rest of the way you're currently doing it.

06:42 Right.

06:43 But if you're going to jump in there, you might as well modernize and fix.

06:46 You're already in there.

06:47 You're already doing it.

06:48 You're already in there.

06:50 Okay.

06:51 Speaking of, you gave a quick shout out to give an AI agent some kind of go find bugs.

06:57 And I 100% agree.

06:59 You and I both likened to this to running a lender for the first time.

07:03 And you're like, there's a thousand errors.

07:04 Oh my God, it's so much.

07:05 Right, so stay on top of these things.

07:07 But these tools are causing some places a ripple, other places a tidal wave.

07:15 And Codeberg is one of those places that, I don't know, like, I'm not sure how to feel about Codeberg.

07:20 I, in principle, like it, but I think people want Codeberg to be more

07:26 than Codeberg wants to be, let's say that.

07:28 What the heck is Codeberg?

07:29 Codeberg isn't What is Codeberg?

07:32 It is a GitHub alternative, let's say.

07:35 Okay.

07:35 Evolved out of previous attempts to create a GitHub alternative.

07:38 It's a nonprofit community-led effort with a democratic process that provides services to free and open source projects,

07:46 such as Git hosting using 4Gio, Pages, CI/CD, and so on.

07:50 So it's already got this restriction like, hey, it's only for free and open source stuff.

07:55 It's not for just general paid software, private repos, and so on, right?

08:00 Fine.

08:01 So that's kind of its mission, and that's what it is.

08:04 But a lot of people are looking at GitHub going, I mean, just yesterday GitHub was down.

08:08 I'm like, oh, man, I guess I'll try this PR again in a half hour

08:12 because it couldn't load the PR stuff, and then I just got the unicorn,

08:16 which kind of feels like it's supposed to be amazing,

08:17 but it's a bad unicorn.

08:19 Should have like a leather jacket and be smoking or something.

08:21 I don't know.

08:22 I know, kind of the fail whale of GitHub.

08:25 Yes, exactly.

08:25 And there might be people out there that don't know the fail whale,

08:28 but oh my gosh, that Twitter went down bad in the beginning.

08:31 Yeah, so it's like the fail wheel.

08:32 Early days.

08:33 But right now, I just pulled this up into the top of the Codeberg page.

08:38 Time recording.

08:39 Yeah, the number two is interesting.

08:42 There's just like, there's stuff we don't want here.

08:44 And we don't approve of it, and it needs to get the heck out.

08:46 Even if it is free and open source, it still needs to get the heck out, okay?

08:51 So I feel like this was just, there's stuff we don't like, let's get it out.

08:55 And the number two you pointed out and laughed at is like cryptocurrency projects are no longer allowed.

08:59 And like, you know, I'm fine with that.

09:00 Like, whatever.

09:01 Okay, okay.

09:03 If that's your mission to just not have that kind of stuff,

09:05 I'm here for it.

09:06 Like cryptocurrency is weird.

09:08 I'm not 100% against it, but it's just I'm not either.

09:11 So that's why I thought it was kind of weird.

09:12 There's definitely some opinions here that had a thought process going on behind them

09:16 that we're not seeing the full story.

09:18 I guess we can go view the full change, but Yeah, but this first one is quite weird.

09:23 It says LLM generated content is being restricted.

09:26 More specifically, if you have a project that they somehow decide they believe it is majority LLM, banned.

09:34 Even if it has been here for a long time, it has gotten a lot of attention and a lot of maybe even wrote it by hand to start.

09:41 But then you do some mega refactoring that touches every file.

09:45 Banned.

09:46 So you may like that.

09:47 You may not.

09:48 It's extreme.

09:49 It seems a little extreme given that we just recently covered Linus Torvalds saying like,

09:55 look, using AI to review our stuff is a tool.

09:59 It feels a bit myopic to me.

10:01 And fine, like I said, this is their project.

10:03 They can do it, but people have thoughts.

10:06 People have a lot of thoughts.

10:07 Wait, Armin has a thought?

10:09 Could you imagine?

10:10 Armin Roniker has a thought.

10:11 And he wrote, and the reason a lot of people have thoughts is they were like,

10:15 I would just love a GitHub alternative, like for different reasons.

10:19 Some people are just like, I don't like the way GitHub works.

10:22 It's been down a lot.

10:23 Other people are like, I want a European company, not just an American company to kind of be a first-class player in this space.

10:30 Right.

10:31 And whatever, like all of those people are like, but Codeberg is now broken.

10:35 So that's out.

10:36 And that was my hope, right?

10:38 Like Obi-Wan, you're my only hope.

10:40 Oh, Obi-Wan doesn't like all of them content.

10:42 Well, I guess he's out.

10:44 Anyway, so Armin wrote an article called Codeberg Divides.

10:48 And so they changed their terms of service, as I said.

10:51 They're entirely within the rights to do this.

10:53 It's a democratic process.

10:55 But democracies don't inherently make good decisions.

10:59 That's what I'm saying, right?

11:00 So GitHub's never been democratic, and there's plenty not to like.

11:05 But as a core piece of infrastructure, it's been reliable, right?

11:09 So I don't know.

11:11 How do you even enforce this majority?

11:13 Like I said, if I have a project, let's say a web app that uses some CSS front end, and I ask AI to change the CSS front end around, even though I wrote all the code, all the back end, in the diff perspective, chances are it's going to overwhelm the back end amount of code if I have to have it rewrite every bit of HTML because it's grid versus flex box versus whatever.

11:36 This is groundwork stuff that the AIs can be directed very easily to take care of for us as humans.

11:43 Yeah, and so here's sort of the thoughts.

11:47 It's a real shame that open source and free software communities

11:49 are splitting this deeply over LLM and agents.

11:55 We all already acknowledge copyright issues, energy use,

12:00 those kinds of things.

12:01 But it's also just how software is being made, right?

12:03 And people need to, projects are going to need to figure out

12:06 how to coexist.

12:08 And yeah, if you want GitHub to face true competition,

12:12 This is not it.

12:13 Yeah, this is not going to work.

12:15 Michael, I got an idea.

12:16 Okay.

12:17 We're going to do a blockchain project to host a GitHub alternative

12:21 that is a distributed autonomous organization.

12:24 And it's going to have like smart contracts and rules.

12:27 We're going completely the other direction.

12:29 You're making my ears hurt just a little bit with that word.

12:34 So what about this?

12:35 What if we go back a little further and we can like do a sweet arc?

12:39 Like what if we do like a BitTorrent hosted, smart contract backed?

12:45 Even more, like the layers go deep.

12:47 So, you know, the decentralization aspect of BitTorrent totally makes sense here.

12:52 I think we could make this go.

12:54 No, we could totally make it go.

12:56 All right, so that was Armand's thought.

12:58 I wish this was more forward looking in a place that we could depend on

13:01 rather than a place that divides and just kicks a bunch of people up.

13:04 Now, one of the reasons I'm sure they did this is, well, these AI things use 20 times as much resources.

13:10 Yeah.

13:11 Yeah.

13:11 Okay.

13:11 So I just searched for the terms to see kind of Codeberg terms,

13:16 and I came up with this website.

13:19 The domain is amazing, but it says...

13:22 Oh, wow.

13:23 I asked literally just for the terms of service of Codeberg,

13:26 and the first thing that comes up is, I regret migrating to Codeberg.

13:30 And this is actually a really interesting and well-thought-out article.

13:34 So this person just recently left GitHub and moved all their projects over here because they're like,

13:39 ah, GitHub is kind of getting clunky, and I have just pure open source and so on.

13:45 So GitHub looked like a viable alternative, which is like this is the main spine running through this conversation.

13:50 So unfortunately, the latest update to its terms of service

13:56 seemed to mark the first step in changing one part I moved there for,

14:00 namely freedom, is now gone.

14:02 I can't work on it.

14:03 And one of the interesting things about this term, I'll move on from this section in just a second.

14:08 But from their terms, is the content that harms the reputation of CodeBerg,

14:12 which is like, we don't have a great reason for it.

14:15 And one of the criteria they use is it has to have a community behind it

14:19 in order for it to be legit.

14:21 And LLMs and AI don't make community, right?

14:24 It seems like from the blog post, it seems like many vibe coders don't realize

14:28 that they don't actually have a community around them.

14:31 And I think that that cuts at two things.

14:33 One, casting all of this stuff as vibe coders and just junk users who don't really know what they're doing.

14:40 That's already kind of a...

14:42 There's a valid practice of agentic engineering in producing software.

14:46 Yes.

14:46 And this seems to lump it all in with like, oh, it's a bunch of these idiots that don't know what they're doing and we want them off our community.

14:55 Sounds like a bunch of people who were against the stuff two years ago and have never tried it.

15:01 don't realize the effect it has.

15:03 But so just wrapping this up, this person says, look,

15:05 I have a bunch of solo developer open source projects.

15:10 And my community is people who just ask for features

15:14 or ask me to change something.

15:16 They're just people who want something from the software.

15:18 They're not really a community with rich discussions, right?

15:21 And so I agree with this person's take on,

15:24 like, it's a bunch of little tools that are my tools

15:27 and I need a good place to host them.

15:29 And I want to share them with my little community.

15:31 Yeah, like I've been publishing silly little tool for decades.

15:35 And that was from even the SourceForge days, right?

15:38 This is the essence of like open source, the cathedral and the bazaar,

15:41 like that whole bit.

15:43 Exactly.

15:44 And so one of the reasons CodeBurg is blocking LLMs is because they think there can't be a community

15:49 and therefore it's a fake project.

15:51 This guy's like, I got a bunch of projects that don't have community,

15:53 but they're important to me.

15:54 And I think that's actually the majority.

15:57 This results in censorship for me.

15:59 But the same thing is, what if you just charged for the ones or had a very high or very strong rate limit for interactions?

16:09 And if your AI does too much to burden our infrastructure, well, then, you know, maybe you cover that or you move them over to a portion of infrastructure that's even slower.

16:17 Right. I don't know.

16:19 But there's a whole lot of concrete ideas from this.

16:22 I regret moving to Kudberg.

16:24 Anyway.

16:25 It's amazing that was the first post, like first result for a valid search for their terms of service.

16:31 I know, that's a strong own goal right there.

16:35 Speaks volumes right there.

16:37 Well, the others are going to emerge.

16:38 Obviously, the fact that we still live in an open world with a fairly open internet, people can build their distributed blockchain DAO version of GitHub if they want.

16:48 Well, I'm looking forward to setting up.

16:51 We should build on Codeberg.

16:54 Oh my gosh.

16:55 Okay.

16:56 All right, sorry.

16:58 That was a bit of a detour.

17:01 A fun detour.

17:03 But let me tell you about our sponsor, actually.

17:07 You should.

17:07 I think this is important.

17:09 Yeah, because there's some really cool stuff that Logfire from Pydantic is doing.

17:15 And this is a bit of an alternative worldview, one that I definitely agree with.

17:22 But Logfire is about monitoring and observing and understanding what your AI agents and other web apps like FastAPI and Postgres and so on are up to.

17:34 So it's 2 a.m.

17:35 Your AI agent has failed.

17:38 Why?

17:38 Was it the model, a tool called the database?

17:41 Most observability tools can't tell you because they only see part of your stack, like your web stack or something.

17:46 Pydantic Logfire sees all of it.

17:48 One trace across your agents, LLMs, APIs, and database.

17:52 Down to the infrastructure, services, Kubernetes, and hosts.

17:55 It's built on open telemetry with SDKs for Python, TypeScript, and Rust.

18:00 And it works with any OTEL-compatible language.

18:03 Every prompt, token count, cost right next to your vector searches and API calls.

18:08 You query everything with Postgres-compatible SQL.

18:13 And you give that to your coding agent through the Logfire MCP.

18:18 So stop guessing, read the trace, Identic Logfire.

18:21 AI is still just engineering, as we said.

18:24 So visit pythonbytes.fm/Logfire today and sign up.

18:28 You'll get 10 million records for free every month, no credit card expired.

18:32 And this is a pretty cool thing as well.

18:35 I need to add Logfire to my app so that I get this cool feature.

18:39 How do you do it?

18:39 They have a button that'll copy some markdown text to your clipboard and you click it and it says onboard your coding agent.

18:48 So it just gives you instructions you can hand to Claude or Codex specifically what it needs to do to integrate your app with Logfire.

18:54 So I think that's super cool.

18:56 So thank you to Pydantic and Logfire for supporting the show.

19:00 Actually, I love the idea of the observability of grabbing the prompts and the costs and the token usage.

19:07 more folks are going to be heading down this route because it's been very hard to

19:11 analyze the return on investment of using these tools.

19:14 And as the costs potentially rise and subscriptions maybe shift and go away,

19:19 you're going to want to know this kind of data to make good decisions.

19:22 We're doing this right now at Six Feet Up.

19:23 Are you? Awesome.

19:24 Yeah, we're having these kinds of discussions, I should say.

19:27 And I could probably use a tool like this.

19:29 Well, I don't buy Steadafim slash Longfire.

19:32 Oh, you know, there's a code there.

19:34 That's a good one for us.

19:35 Yeah, fantastic.

19:36 All right.

19:36 Yeah, it's a super cool platform.

19:38 And like I said, right here, just onboard with your code agent, click that, and then paste it.

19:43 What's really interesting is that the instructions say things like, your user may have just clicked this and not actually read it yet.

19:50 So please work them through this.

19:53 Those are some good people.

19:56 They were doing the good work right there.

19:57 Yeah, same thing, a call in a team knows what they're doing over there.

20:00 I love it.

20:01 So does Brett.

20:02 Brett Cannon knows a few things as well.

20:03 Brett Cannon does know a few things.

20:04 Actually, this is important.

20:06 And again, I feel like the last few episodes, I've been on a bit of a security run with things.

20:12 And this is continuing it.

20:13 And he's got some great ideas.

20:14 When he was writing his nomination post for the 2026 Python Packaging Council nomination or elections,

20:23 part of his pitch why he should be there is we need a secure supply chain for the Python ecosystems around building reproducible builds.

20:33 And so right now, we don't have technically reproducible builds on PyPI, but they're not

20:40 far away.

20:41 There's like he identified three gaps in the current process to get us to a point where

20:48 we have basically the good design goal for him is zero friction.

20:52 Can producers upload something to PyPI?

20:54 They shouldn't have to do anything.

20:56 And all the work lands on the build backends and installers to track and trace and allow

21:02 you to know where your software came from that you're installing. We all are aware of the

21:09 LiteLLM exploit that happened back in March. And part of that was because of a supply chain

21:16 injections into the build process. The other one here is like he mentioned SolarWinds,

21:22 that SolarWinds attack from a few years back. Again, a supply chain injection during the build process.

21:27 So gap number one is nothing right now records the source code, where the source code distribution

21:32 came from so if you add in a json descriptor it can capture you know when you install it where

21:37 it's from what get repo is the canonical source of truth for that code and it's something that'd be

21:44 very important for you to know if you're going to go back through and do an audit of the tools

21:48 or the code and dependencies that you have into your build process interesting so you might

21:52 be able to have a another tier of trust than just it's on pypi but yeah yeah here's how it's built

21:58 Yeah, exactly. And if you combine those with the PyPI two-factor and security measures that they've

22:04 been putting in place, this gives you a little more comfort with where something came from.

22:08 Gap number two is during the build, in the build tools and during the build process,

22:14 having a software bill of materials. So referred to as an SBOM. We can do this with PEP 770

22:22 has a convention for this. Software distributions can't because there are tarball plus like some

22:27 package info stuff. So if you have a wheel, you can basically enable this already. So the first

22:32 two things, very little friction. A file that describes where your GitHub repository is. The

22:37 second one is using wheels and PEP 770 to have software build materials in there. So either don't

22:44 use SDIS or move to the SDIS V2 support for this. And then basically the mechanisms already exist

22:54 for tying this all together in the pyproject.toml.

22:58 There's a build system section.

23:00 If it has a defined entry point, so then backends can record their own environment

23:04 and you can reinstall and rerun the build.

23:06 So the goal being, again, if I build the software today

23:09 and if I build the software six months from now

23:11 or 18 months from now, I should get the exact same binary each time

23:15 and there should be no worry or at least a way to audit and trace back what happens.

23:20 So now trusted third parties can report successful reproductions back to PyPI, which can display like an independently reproduced by

23:28 some authority surfaced in the index. So installers can also prefer reproduced files.

23:33 So PyPI would have to have a couple of changes to support surfacing this data and making

23:38 decisions based on that data. This is not a nice to have. This is definitely, it's not a requirement.

23:43 This is basically like you need to have this as part of your build process or else you're not

23:48 considered a top level or a first class citizen in PyPI because it shouldn't be hard to do.

23:55 One of the things about the reproducibility that you hinched on right there at the end,

23:58 I think is cool. I look at, say, the hash or whatever of the binary that I got. And then

24:04 if I want to rebuild that myself, I should get the same hash if I follow the steps or something

24:09 like that, right? Which is super cool. Yeah. But so many things can be very variable. I mean,

24:14 the GCC compiler on your system, the minor versions of Python,

24:19 the architecture, whether it was ARM or x86.

24:23 There's a whole bunch of variables that go on in there.

24:26 It'd be nice to be able to get those from a trusted source.

24:28 And PyPI is obviously doing great work at making sure we get safe wheels

24:35 and distributions of software.

24:36 Yeah, definitely some great folks, including Seth and Mike,

24:41 over there working on this.

24:42 Well, and thanks to Seth Larson for listening to his idea and helping him check over this blog post.

24:47 So the right folks are involved all around.

24:50 That Python Packaging Council nomination, I think the voting is happening soon.

24:53 I didn't actually note down when it is, but I can't imagine why we wouldn't want Brett to be on that panel of people.

25:00 Exactly.

25:01 He's got the right ideas.

25:02 I'm all for this.

25:04 Just because to keep the world safe, we need to have these kinds of table stick ideas built into our infrastructure of Python

25:11 and the build systems.

25:13 Yeah, and Brett's been working in packaging and package adjacent stuff for a long time recently.

25:18 Yeah, so go enable these features.

25:20 You'll start participating in the ecosystem and then eventually PyPI will support it

25:25 and you'll be able to know that the software you're getting

25:28 has come from verified sources.

25:30 Maybe that's an extreme, not verified sources, but at least the build can be reproduced.

25:35 Yeah.

25:36 Verifiable.

25:38 Verifiable, not verified.

25:40 Subtle difference.

25:41 yeah okay so now moving moving on we have a extra extra extra here all about it a whole

25:51 section of extras well this is when there are so many extras that i'm like this can no longer be

25:56 extra it must be hoisted up into a top level topic all right and i don't know i've got a sidebar full

26:04 of them so let's see i got questions about one of these here for sure all right let's go well

26:08 You talked about the security fixes of like 3.11 and so on, 3.11.6 and beyond.

26:14 We also got a new...

26:15 They are.

26:16 Some of them have landed in 3.14.

26:18 Yeah.

26:18 So 3.14.7 is out.

26:21 And sometimes these are like, we've changed some minor setting or whatever.

26:26 This is a proper release of Python.

26:28 And I know it's mid-August and in a month and a half, we're going to have 3.15, which is

26:34 very exciting.

26:35 But there's a couple interesting takeaways here.

26:37 Plus, you should just install this.

26:39 So under security, it doesn't fit on my screen, the number of single sentence things fixed.

26:46 So that alone tells you maybe we should pay attention.

26:48 So like here, for example, the one you talked about, GitHub 15987, the tarball extract.

26:53 And then there's another one somewhere in here, like this is the workaround of that fix, also fixed.

27:00 But there's some denial of service-ish things like element tree find all from XML parsing

27:09 or even web page parsing has quadratic behavior if you give it certain types of inputs.

27:14 And that means you could create like a element tree find all bomb type of thing.

27:19 So there's a bunch of this complexity stuff here.

27:23 But this is also a proper release.

27:24 So I'm going to scroll at a high rate the entire time that I'm talking.

27:30 And it is way still going on.

27:32 This is all core Python internals, not even the standard library.

27:37 Ooh, okay.

27:37 And then, now maybe that was a standard library as well, but also build and then Windows and Mac.

27:41 I mean, there are pages and pages and pages of changes here.

27:45 And if you go up one, like I said, there's an interesting theme.

27:48 So if you look at free, free threaded.

27:51 Yep.

27:52 Oh, wow.

27:52 This is one of the, I mean, it is lighting up the find section.

27:56 Yeah, the little scroll bar highlight that shows where the find lands.

28:02 There are so many race conditions that are getting fixed.

28:05 This is just something Python has not really had to deal with.

28:08 And I don't know how I feel about this, Calvin.

28:10 I'm very excited about free-threaded, but there's this many fixes now.

28:13 They should have skipped the.7 and made it.15, like 3.14,.15.

28:20 I know.

28:21 It's the lead-in to 3.15 or whatever, right?

28:24 Yeah.

28:25 Yeah, but in the core built-ins, there's just tons of, like,

28:29 Fix the data race condition and free-threaded build of gc.gen count.

28:33 Fix the potential deadlock on intern from string and other functions on the free-threaded build.

28:37 And so if you're doing stuff with free-threaded, you definitely want to go through this.

28:43 I hope some folks who've been posting blog posts around free-threading go redo their benchmarks against this release to see how that has changed.

28:50 Yeah, 100%.

28:52 Okay, well, that was one of them.

28:53 That's a lot.

28:54 I know.

28:54 That was just one of the things.

28:56 Remember you gave me homework last time?

28:57 I'm like, oh, I just, I literally just added the MCP server for Python bytes.

29:04 And you said, oh, Michael, that'll hold that protocol is out of date.

29:06 You got it.

29:07 There's a new one.

29:08 I'm like, no.

29:09 Well, I upgraded it.

29:12 So Python bytes, it's MCP server, which only existed last week.

29:16 Now uses the, let me see if I get this from memory.

29:22 2026.0728 version two protocol, which is more stateless.

29:27 So it's backwards compatible with the old ones, and it now adopts the new one.

29:31 So that's pretty cool.

29:32 And also for Talk Python, they were basically a similar update there.

29:37 So how long did that take you?

29:39 I mean, were you able to just point the clankers at it

29:41 and say go?

29:42 The clankers grinded for a while to probably an hour.

29:45 Yeah, probably took an hour.

29:46 It was a pretty significant amount of turn.

29:48 But no worries, I got it done.

29:50 Nice.

29:50 You know, if I had run on Fast MCP, which is now just MCP server, I believe,

29:56 is the name of the project now, probably would have been better, even though there were breaking

30:00 changes. But this is integral. It's just a part of the Quart Flask app that are these websites.

30:08 And so it had a little more low-level stuff. But at the same time, it wasn't. I mean,

30:11 my active time was probably 15 minutes. But I had to verify and check. And so, oh, let me go over

30:17 to Claude and ask it if it still knows how to talk to it. Think of the scale you can handle now.

30:22 I mean, people can just hammer your MCP service now.

30:25 I know.

30:26 It's so stateless.

30:26 They can just ask it questions all day long.

30:28 All day long.

30:30 And in principle, I don't really mind.

30:32 I mean, I'm not inviting to not to do this amount of service because I do get that sometimes

30:38 and it's not fun.

30:39 But it is all the database backed indexed queries.

30:42 So it is like sub millisecond usually when you ask questions like this.

30:45 So it's pretty cool.

30:47 All right.

30:48 Yeah.

30:48 Remember we talked about AgentsView.

30:50 I believe you brought this up.

30:51 And I'm like, all right, so crazy that on my M5 Pro MacBook Pro, I see some portion of my work and projects reported.

31:04 And then I go to my mini and I see some other portion, the complement of my work reported.

31:10 And then I'm like, well, I finally set up Postgres Sync, which is really cool.

31:15 So if you set up this Postgres Sync thing, you just get a web page that you can host.

31:20 I'm hosting it on Tailscale, super private behind all my stuff.

31:23 Nice.

31:23 And then that gives you a unified view.

31:26 There's just a little daemon sort of thing that runs on each machine that just, you know,

31:30 normally it's running on SQLite.

31:32 It just looks at SQLite, goes, what's changed?

31:34 And it just pushes those changes and merges them on a Postgres thing that's running in Docker on my mini behind Tailscale.

31:41 I have a question for you on that because we're using agents view a little more to help with that analysis

31:47 and looking at our users and models.

31:49 The Postgres sync, could you have multiple users push into it?

31:54 Because that's exactly what I think I want to do.

31:55 The one thing to be a little careful of, and I kind of would like to just say,

31:59 could we just not put this data here at all, is it syncs the actual chat conversation, the chat log.

32:06 The sessions.

32:06 Because you're getting the full fidelity of the agent's view, but in a centralized spot.

32:10 Yeah, I mean, it is cool that you can go and do things like hit command K

32:14 and then do vector and semantic search across your work.

32:18 But at the same time, the more people send in stuff in,

32:22 it's plausible that you could write another script that just deletes that data.

32:26 Yeah.

32:26 After, right, like just goes and just zeroes it out because there's actually zero words in this,

32:32 even though the token count was recorded and so on.

32:34 I haven't tried that, but possible.

32:36 I like the fact you can do like, I guess it even mentions their team dashboard.

32:40 Yeah, exactly.

32:41 And I am a team of one for this, but I'm still working in two places and I need it

32:45 because otherwise it doesn't work.

32:46 Yeah, yep.

32:47 I've got the same.

32:48 I'm going to set that up.

32:49 All right.

32:49 Let's carry on this order.

32:50 Like I said, this is why this had to be promoted.

32:54 Brian Okken.

32:55 Hey, Brian.

32:56 Hey, Brian.

32:57 He had talked over last year on the show about working on Lean TDD, TDD Without the Waste,

33:03 and sort of redoing that.

33:05 And he has just released the Audible version.

33:08 How cool is this?

33:09 I like that.

33:10 And it's him narrating it, too.

33:12 So if you missed Brian's voice from this podcast, you can go over and listen to him read the

33:17 whole book to you.

33:18 It's pretty wild.

33:19 Like, this is audible.

33:21 And it's Brian.

33:22 Yeah, it is Brian.

33:23 And he did a really good job.

33:25 It sounds, you know, professional and great.

33:27 And I very much like it.

33:28 And I know that when he was working on this book, one of his goals was to not make it too overburdened with code samples

33:35 such that it could be an audio book that is actually worth listening to.

33:38 So link into that and check that out.

33:41 Two more things.

33:41 These have to do with Talk Python courses.

33:44 So I talked to someone recently who wanted to take a course from Talk Python.

33:50 And they said, well, this is really great.

33:53 And this is exactly what I want to take.

33:55 But it turns out our company, our organization, has some subscription to some other junkier Python training thing

34:02 that I don't want to use.

34:03 But they said if they're going to cover it, I have to use their Python thing,

34:06 not some other random internet thing that who knows what it is, right?

34:10 So I thought, well, that's not right.

34:13 Shouldn't people be able to, you know, if you're a company, get a sense of this is a good thing for your company.

34:18 So if you work for especially a large company, this falls into that category.

34:22 I have a program that I set up for you called a free Python training evaluation for teams.

34:28 So what it is, is for up to 15 people, they get complete free access to one of the, pick one, one of the Talk Python 60 courses.

34:37 And then you can go through it.

34:39 And then that team can report back like, hey, was this worth doing?

34:43 We maybe bring Talk Python as a vendor into your company.

34:47 You get a really nice dashboard of how all your students are doing,

34:52 going through the course.

34:53 And yeah, so who's redeemed the seats?

34:56 Are they finished?

34:58 Like all that kind of stuff.

35:00 You can download updates and so on.

35:02 No MCP server though.

35:04 Not for this.

35:05 Not for this.

35:05 But you could download the CSV and then go to town on it, right?

35:08 So everybody gets basically free access to the course, mobile apps, all that.

35:12 So if you work for a team, if I work for a large company and you have a team there and there's like a lot of restrictions on what training options are available, please reach out to me, Michael at talkpython.fm.

35:24 Let's set one of these up.

35:25 It costs you nothing to try it out.

35:27 Get the name brand training.

35:30 Exactly.

35:30 Not the generic lookalike.

35:33 Exactly.

35:33 Not the generic where you've got to press play every single video and navigate around.

35:37 Not good.

35:38 And related to that, I've also set up a government procurement page that gives all...

35:44 Wow, you're fancy.

35:45 That's really fancy.

35:46 It existed before, but it wasn't on a page where people knew that they could get it.

35:51 So it lists our sam.gov unique ID.

35:55 So if you work for a government entity, there's all these rules like, oh, it has to be registered with this thing.

35:59 And it has to be active.

36:00 And you have to have a 508 report on your accessibility, et cetera, et cetera.

36:04 I put all that stuff up here.

36:06 So if you work for a government and you would like a governmental agency, especially the U.S., please check it out.

36:11 This all makes it super easy.

36:13 You probably have to address this kind of stuff some of the time.

36:16 It looks like you put a lot of work into this, and it shows.

36:19 Thank you.

36:19 It's amazing.

36:20 Thank you.

36:20 Thank you.

36:20 All right.

36:21 Well, those were many extras.

36:23 Those were many, many extras.

36:24 We are done with the extras.

36:26 I've got one extra, which is a follow-up to last week's episode around the post-quantum key exchange.

36:32 And the fine folks over at Astral have made a new release of uv.

36:36 That's what it was like five days ago.

36:38 And it now supports and prefers post-quantum key exchange.

36:42 So they've already got your back.

36:45 You can opt in to TLS diagnostics, but you're going to get post-quantum key exchange out of the box

36:52 when you're using uv node.

36:53 So I thought that was pretty cool.

36:54 You know what?

36:55 Just bookend it with uv.

36:56 Well done.

36:57 Well done.

36:58 Astral.

37:00 Open AI team.

37:03 so far they're still doing again the good work i appreciate their what they're putting out there

37:09 for the community and keeping the again staying on top of us like that's really cool that

37:14 this has we went from one week being announced to next week it's in use and you're getting it

37:19 yeah that's super cool and i think i do think they're doing a great job so yeah yep so grab

37:25 the latest version of uv yeah i love it all right are you ready for a joke let's close it out do it

37:30 This joke is called beware of dog.

37:33 Oh.

37:34 We've all seen the beware.

37:36 Yeah, Mushu made his appearance last week on the show.

37:38 Yes, exactly.

37:40 Exactly.

37:40 We've all seen the signs.

37:42 Do you really, is it just a, be careful, there is a dog here?

37:45 Or is it like a dangerous, aggressive dog?

37:48 We don't know.

37:49 But this one is aggressive.

37:50 Oh, let me tell you.

37:51 So there's a big sign that says, warning, beware of dog.

37:55 He uses Kali Linux.

38:00 So you're laughing.

38:01 Tell people what Kali Linux is for those who don't know.

38:03 For those security folks who are looking to do some pen testing,

38:06 you may have installed Kali Linux in the past.

38:09 So it provides some attack tools to let you go after other people's servers,

38:13 or your own, hopefully.

38:15 Yeah, yeah.

38:15 Not others.

38:16 It basically is a distribution that bundles a whole host of things

38:20 you would separately install if you were a pen tester, hacker sort of thing.

38:24 And it comes ready to go, right?

38:26 That needs to be the new logo for Kali Linux, like a big junkyard dog with a big like spiked collar exactly love it terminal with the uh the

38:35 name and address on it there's no place like one two seven zero zero one exactly tattooed on his arm

38:44 you know i'm a sucker for dad jokes that i will laugh every time i know these are these are

38:49 pretty solid these are pretty solid so beware the dog he's his cali Linux all right well that is it

38:54 for the show, Calvin, thank you for being here with all of us.

38:58 Yeah, you bet.

38:58 And check out Pydantic Logfire at pythonpys.fm slash logfire.

39:03 Really appreciate them supporting the show.

39:05 Update your Pythons.

39:06 Yes.

39:07 uv, Python, even had an upgrade.

39:09 So for in-place point release upgrades for uv, you can just, there's a single command now

39:13 to update all of them.

39:14 So just do that.

39:15 Stay safe out there.

39:16 That's right.

39:16 Bye, y'all.

39:16 See ya.