#502: Introducing chameleon-rs

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly

00:04 to your earbuds.

00:05 This is episode 502, recorded Tuesday,

00:08 October 27th, 2026.

00:10 I'm Michael Kennedy.

00:11 And I'm Calvin Hendrix-Parker.

00:13 And this episode is brought to you by us.

00:15 If you have hard problems and you want a team you can

00:18 trust, six feet up, just get in touch with Calvin and his team. They're doing amazing work, have

00:23 been for 20 years.

00:25 And if you want to learn some Python things, check out Talk Python Training,

00:28 or you want to support the show over there at Talk Python,

00:31 you can join membership.

00:32 I have a few announcements from that as well.

00:35 Connect with us on the socials, join the newsletter.

00:38 All those things are on the website.

00:40 Now, Calvin, it's been a week.

00:43 It's been a week.

00:44 It's been a crazy week.

00:45 I was traveling last week and all this hit while I was like either in the air

00:49 or someplace exotic and strange.

00:52 And PHP wasn't the only problem.

00:54 So if you haven't heard, there was a PHP vulnerability,

00:57 a major one last week.

00:58 but that's not what I'm gonna talk about.

01:00 There were three different incidents also that affected the Python ecosystems

01:06 that you all need to be aware of, and each of them in a different layer.

01:09 So if you're not familiar with certificates and trust authorities and certificate authorities,

01:13 there was a major vulnerability there in the trust layer.

01:18 There was also a vulnerability in the release pipeline again with LightLM.

01:22 And then we had a C decoder issue that also led to an RCE with the Bratley library

01:28 from I think what defined folks at Google.

01:30 But let's dive in.

01:32 So the eMadura CA, the keys got compromised.

01:36 And so if you are using a Python older than the ones

01:40 that are listed in the release right here, so I think it's like the.2, the.10, the.18, et cetera.

01:45 So basically 3.15 through 3.11 have all been patched,

01:49 all been fixed and corrected.

01:51 uv also has been fixed and updated, but you'll notice 3.10 not in the list.

01:57 This is probably the first very large thing you need to watch out for for 3.9 and 3.10.

02:02 You're not out of luck though, 'cause as long as you upgrade pip, I believe in certify,

02:07 you'll get the latest bundles into your older versions of Python,

02:11 but you gotta go do that yourself.

02:14 The other folks have done all the patching for you

02:16 and made all the releases, so make sure you grab the latest versions of that.

02:20 So why does this matter?

02:21 When a certificate authority gets compromised like this,

02:23 anyone who has these intermediate keys can basically mint certificates for any domain

02:28 and any unpatched client who has these certificates

02:32 in their CA will accept them as valid.

02:34 That means you are now susceptible to man in the middle attacks,

02:37 basically reading and altering HTTPS traffic without a certificate warning,

02:42 pretty bad stuff.

02:43 If you consider like the world of Python and any version of Python before this,

02:49 I had those intermediates in there, is now susceptible to reading in data

02:53 from an untrusted source who will think it's trusted.

02:56 That's something everyone needs to be obviously on the hook for is making sure we all stay safe out there.

03:01 So specifically like for Python, you could be downloading a susceptible package from PyPI and get something malicious because the credentials will,

03:13 it looks real, but it's not.

03:15 It's not real under the covers.

03:17 So that one, make sure you grab that latest release.

03:20 Any existing virtual environments, you're going to need to make sure you upgrade those as well because they don't pick it up automatically.

03:26 So if you did uv and upgraded your uv and did uv reinstall the Python version,

03:31 any virtual environments created by that Python version still need to be updated.

03:34 So grab those, grab the latest and make sure you're safe.

03:37 I actually noticed this.

03:39 I didn't realize what it was for, but I noticed this because I have a script that just updates my homebrew, my NPM,

03:45 my uv installed tools.

03:47 And one of the things I've recently added, I've actually added two things,

03:50 is one, just uv Python upgrade will do a build level upgrade of all of your installed Pythons without changing

03:58 anything.

03:59 And I think without breaking your virtual environments.

04:01 Nice.

04:02 Yeah.

04:02 And there's actually another fix in here too around some tar file stuff too.

04:08 Yeah.

04:08 Reject cookies in a negative assertion.

04:10 Oh yeah.

04:10 The tar file, tar filter.

04:12 So there was more than just the CAs in this release,

04:14 two other CVEs, but none as important the CA one that's bundled in here.

04:18 The next one was on the build side.

04:21 The build side of this, which is Lite LLM again,

04:25 is in the news. They got compromised back in March.

04:27 They also have just gotten,

04:29 the build got compromised. There was a version of Lite LLM that hit PyPI.

04:34 It was up for about two hours,

04:37 roughly 49,000 downloads.

04:39 So, which is kind of sad.

04:41 Folks should make sure that they are using the back off in their pipelines to install not the absolute latest and greatest.

04:48 You may want to wait, have it back off a few days and only grab versions that have been released for,

04:53 well, at this point, if you had at least three hours in there, you had been fine and gotten the

04:58 patched version of it.

05:00 Docker images were also infected.

05:01 They basically, and I think the big

05:03 question here is why does this keep happening to LLM? I mean, it's twice this year.

05:08 The attackers are relentless.

05:09 They are looking for exposed credentials and that's how they got in this time.

05:13 They were able to find a key that didn't get revoked. There was a force push that included

05:19 trying to fix for a key that got published accidentally but they never revoked that key.

05:24 They were able to use that then to have the pipeline push keys like tokens from actual

05:31 maintainers to a third-party source where they were able to collect them and then they were able

05:35 to trigger the build pipeline, removing branch protections,

05:39 et cetera, because it had admin

05:40 privileges.

05:41 So again, make sure your build tokens have least privilege so they can't do things like

05:45 remove branch protections in your GitHub repository.

05:48 There's a lot of layers that go into this, but

05:50 obviously now the LightLLM folks have hardened the pipeline once again to protect against this.

05:55 But yeah, this was another one that the exploit was using the path hooks for Python start.

06:04 So for this to be exploited,

06:07 but it was still SSH keys, cloud browser tokens,

06:10 CI, AI tool credentials.

06:12 They're all after your credentials so they can continue propagating these attacks

06:17 into other places.

06:18 So if you happen to have downloaded it within those two hours,

06:22 that's unfortunate.

06:24 Hopefully you've already patched and are on the way.

06:26 But I think the important bit here is to learn from how they're hardening their CI pipeline.

06:31 If anyone is gonna be a good example for the best way to do it,

06:34 going to be these folks now because they are they've gone through two rounds of this and and

06:39 some pretty sophisticated versions of the attacks yikes yeah yikes is right uh the last one is even

06:45 more a bit of a yikes i have a comment really quick oh go back let's go back really quick i just want

06:51 a second uv exclude newer yes give it it's it feels a little like oh it's just security through

06:57 obscurity but we're just gonna say well we're just not going and install stuff for like oh a day and

07:03 How is that going to make any, it's a good practice.

07:05 Almost all of these major ones we've reported on are like, it was out for three hours.

07:09 It was out for two hours.

07:10 It was out for half a day.

07:12 Just let other people go first and find out.

07:15 You know what I mean?

07:16 Like you, you rarely need that much cutting edge.

07:19 Yeah.

07:20 And so just add that.

07:22 If you use an uv, it's, you almost never need it.

07:26 And the one thing that where you do maybe sometimes need it is if you're working on a

07:29 project and you're pulling in something that you're publishing a PI PI and you're like,

07:33 I want to actually just get, I want to publish it to PyPI and ship it

07:36 so I can put the fix in now and test it.

07:38 That's really frustrating because you don't want to wait a week

07:41 to test out what you're doing.

07:42 So you can just do exclude this package and just have an exclude list.

07:45 They get instant and your stuff gets, everything else gets delayed

07:49 and it's usually perfect.

07:50 Yeah, so.

07:51 Follow these good practices and you will avoid a lot of heartache.

07:54 I think is the moral of the story here for this one specifically.

07:58 It's the tools are here.

07:59 So just, you know, uv,

08:01 I believe pip added this as well.

08:02 it's like the cli is really different but it's the effect is the same yep and then the last one

08:08 major one from last week was the broccoli to shell uh so there's a bug in the broccoli decoder

08:14 that lets crafted compressed data right past the end of a buffer which gets you a fun rce so

08:21 if you want a remote shell in a box if you find one of these ones that's been installed with an

08:26 old version of the brockley c decoder you will be on your way um so if you upgrade to the latest

08:31 version of Brotley and Brotley CFFI, you'll be fine.

08:34 Everything's been patched, but you may not

08:36 know you have this.

08:38 A lot of web stacks, for example, may be bringing this in because they're

08:42 using this to get a greater performance out of compression,

08:45 for example.

08:46 This is one of the main, one of the use cases for this specific library in there.

08:52 So you may have gotten a transitive dependency brought in that brought this in.

08:57 One nice thing is that if you just uninstall the Bratley package and I believe liburl3,

09:03 other things will just fall back on like HTTPX will fall back automatically to like gzip

09:08 and deflate for compression.

09:10 So you can fix it quickly if you can't upgrade.

09:13 I don't know any reason why you wouldn't be able to upgrade

09:15 but there are a couple ways to mitigate this which basically involve taking care of

09:20 getting Bratley out of the loop and then taking care of getting this out of your system.

09:26 Again, staying on top of it,

09:28 How long was this one even like out for?

09:31 I don't even remember if it noticed in there.

09:33 Yeah, so the Bratley decoder from 1.0.3 through 1.2

09:37 had this in there.

09:39 And so by default, you don't get a Python

09:41 that's been compiled with the Bratley C decoder,

09:44 but you may be bringing in dependencies that do.

09:46 So just to be aware, if you may want to,

09:48 you run like uv or pip looking for this specific dependency

09:51 in your projects and make sure, again,

09:54 you update those dependencies.

09:56 The show notes have links to all these various things.

09:58 I just thought I'd kind of give a security roundup

10:01 in my one segment for all the Python folks out there to stay safe.

10:05 Calvin, I thought broccoli was good for you.

10:07 Broccoli is normally good for you.

10:09 It's a bad broccoli.

10:11 It's a bad broccoli.

10:12 All right, I am so excited about this project that I'm going to introduce.

10:16 This is my project, something I've been working on all of last week.

10:19 And I think it's going to be really interesting.

10:21 And I'm going to show you some numbers.

10:23 Why?

10:23 Okay.

10:24 So I'm sure you're familiar with the Chameleon template language,

10:27 yes?

10:27 Oh, yeah.

10:28 I'm a long time like Zoplon pyramid.

10:31 I'm a big fan.

10:32 I'm a big fan of it.

10:33 I like it over Jinja.

10:34 I like it over Django templates.

10:36 We don't need to go into why, but let's just say it's a really minimal,

10:40 nice, clean.

10:41 Well, the TLDR is with Chameleon, the stuff you write is still valid HTML.

10:46 With Jinja and Django, you have all this junk in there.

10:50 Plus, it allows you to write arbitrary Python in those other frameworks,

10:53 which encourages you to have bad architectural practices,

10:56 whereas Chameleon is more strict.

10:58 So now that's why I like it.

11:00 But it hasn't got a ton of love.

11:03 If you go back and look at the project, I don't have it pulled up here.

11:05 Go to pack, look at the Chameleon project to go to the, not the homepage.

11:09 Go to the repo run by a bunch of people I really like.

11:13 But if we go over here and look, you can see that like,

11:15 well, the build is failing and it's only technically built for 3.13.

11:20 it's still on to you know if you go look at the releases i think in the last i remember

11:25 summon this up but if you look at the last releases they're all like minor minor bug fix

11:30 security fix minor minor bug fix like for the last four years right it's just not a whole lot is going

11:35 on there but could we do a better job and still support that so i introduced to the world chameleon

11:42 rs like the sportier version of chameleon this is like yeah like if you had a honda accord and

11:48 And then you're like, well, what if we had the sport edition and we got a new suspension

11:52 and oh yeah, we also put a turbo on it.

11:53 You know what I'm like?

11:54 Get the RS badge on the back.

11:55 That's all you needed.

11:56 Exactly.

11:56 It's the RS edition.

11:58 So Chameleon RS, Chameleon templates modernized.

12:00 And it's not just faster.

12:01 If it were just faster, that would be interesting.

12:04 But let me ask you this.

12:05 Is Chameleon Python 315T safe?

12:09 Can I run free threaded Python on Chameleon?

12:12 I'm guessing not.

12:13 I don't know, but I would guess strongly no if it hasn't even been touched.

12:18 It probably wouldn't work very well.

12:20 Exactly.

12:20 I will bet you good odds that there will be some kind of race condition corruption issue.

12:27 So that's the modernized part, right?

12:29 Chameleon template is modernized.

12:31 I want to be able to run regular new Python and expect that my project will work and not

12:36 just race condition corrupt itself out of existence, especially on a web app that runs

12:41 for a long time, right?

12:42 So I rewrote it in Rust and I took every single unit test that Chameleon has and it passes perfectly.

12:50 I took all of the template tests where it renders them.

12:55 It's byte for byte HTML identical.

12:58 I then converted Talk Python and Python bytes to it and requested every single page on old Chameleon and Chameleon RS.

13:05 They are byte for byte HTML identical.

13:08 Not just like the same parsable structure, AST.

13:11 Like every byte comparison, they're the same.

13:14 How cool is that?

13:15 That's really cool, actually.

13:17 Great test, too.

13:18 And then I started doing a bunch of multi-threaded tests,

13:20 scaling tests, and I'm still running over on my Mac studio.

13:25 It's running for an hour over there doing some performance testing

13:29 and looking for any possible issues on the free-threaded stuff.

13:33 But not just that, more modernized.

13:34 What if, what if, check this out, in your, let's see, I'll go over here.

13:39 What if I had markdown content?

13:41 What do I do with that, Calvin?

13:42 I don't know.

13:43 I can't do anything with it in the templates.

13:45 But Markdown is so insanely common.

13:47 It's almost HTML, right?

13:49 Yeah.

13:49 Shouldn't your thing support it?

13:51 Well, now you just have Markdown colon, some kind of content.

13:54 And this happens in Rust, which is like 60 times faster than the Python ones.

14:00 So it's insanely fast.

14:02 Oh, and one of the really nice benefits of this, I don't know if you've ever,

14:06 I'm sure you've seen this, how much work you've done with these languages.

14:08 But when you first deploy your web app and you request a page and it takes like one second for that page to load.

14:14 And then after that, it's fast.

14:16 That one second, a lot of it is actually the Chameleon template compiling,

14:20 Chameleon compiling the template into its actual form.

14:24 This is 70 times faster compiling the template.

14:27 So when you deploy it, the first time you touch a page is basically as fast as if it's up and running.

14:33 Wow. And I see you've got HTMX support too.

14:37 than the perfect world combination.

14:39 You see, there's more of the modernization.

14:40 It's not totally HTMX dedicated, but I have three things that I've kind of gone around

14:45 and I've just, I like poking at trying

14:48 to make these web frameworks better.

14:49 So I created Chameleon Flask, which lets me run Chameleon on Flask in a super easy way.

14:54 You just do like a little template and you put it as a decorator on your Flask thing.

14:57 Flask will not adopt Chameleon for reasonable reasons,

15:02 but it's not a crazy good reason.

15:05 It's like the plugins in Flask expect Jinja, so we can't have any other template.

15:09 Like, well, it would be nice if we could have other templates

15:11 on Flask.

15:13 Also, if you want to do HTMX, having some kind of partial library

15:16 support is super neat.

15:18 But Chameleon is not going to add any concept of partials,

15:20 right?

15:20 So I took all of these libraries and more, and I built them in Rust,

15:25 rebuilt them, re-implemented in Rust, and put them inside of Chameleon Artist.

15:28 So it has native partial support.

15:30 It has native support for a few frameworks, such as Flask, Quart, FastAPI, Starlette,

15:36 Robyn, and Litestar and Pyramid.

15:39 Just out of the box.

15:40 All right, we need to add this to Plone now.

15:42 We'll get the Plone folks on it.

15:43 Yeah, yeah, yeah, yeah, absolutely.

15:45 Plone people wanna work with me.

15:46 I don't have enough stuff to be able to test it.

15:48 They've got a lot of employment.

15:50 So here we go, check this out.

15:52 Compatibility, like you want to switch over.

15:55 It has, like I said, tons of compatibility,

15:57 but, oh yeah, it also has an AI skill.

15:59 So if you go to the docs, it has lm.txt,

16:02 but also an installable skill.

16:04 So you can teach your agent just like, hey,

16:06 you should make this happen.

16:07 And what was the other?

16:08 Oh, yes, getting started.

16:10 So if I want to switch from regular Chameleon, this is like Chameleon, Chameleon partials,

16:16 all these different pieces.

16:18 You just import ChameleonRS.compat, compat.install.

16:22 Boom.

16:23 That's all you do in your app and everything else is now running the Rust version.

16:26 That's amazing.

16:26 I'd recommend rewriting it.

16:28 You have this live now on Talk Python?

16:30 Yeah, yeah, yeah.

16:31 Nice.

16:31 And now not only do I have it live, this is the last thing I'm going to say.

16:34 I'll chill out because I'm really excited about it.

16:35 This is such a neat thing to be doing.

16:39 So I switched it.

16:40 These numbers are off of Talk Python training, okay?

16:42 So I literally effectively wrote those two lines.

16:45 I did completely rewrite it to natively take advantage of those things

16:49 because I have plans.

16:50 But you could just do the compat thing and basically get this.

16:53 So the median page response time is 17.6 seconds.

16:58 sorry, 17.6% faster by just doing that.

17:02 And pages that are large are 19% faster.

17:06 Here's a nice graph.

17:07 Look at this graph before and after.

17:09 Huh, you can see where the change was.

17:11 Yeah, it's like the thing I'm linking to,

17:13 you can see the picture, it just drops.

17:15 And then you go, you can actually see as the pages get bigger,

17:17 it only gets to be like more useful.

17:20 And then you can see like the faster and slower.

17:22 Like in almost every way, this is just more awesome.

17:25 Even if you don't take advantage of any of the things.

17:27 Now, I want to point out, this is not, I went and I made some very specific benchmark,

17:34 like I'm going to return a JSON document that's in memory and then test how fast that goes.

17:40 Oh, look, it's 20% faster.

17:42 This is the entire application running.

17:44 This is all the data access, all the validation,

17:46 all the e-commerce junk, all the logging,

17:49 everything, like all the database calls,

17:51 all of it.

17:52 And even when you consider the entire app running, it's still 19% faster just by switching

17:56 that out.

17:57 Speed is a feature.

17:58 Speed is the feature.

17:59 All right.

17:59 Okay.

18:00 People, if you like Chameleon, check out Chameleon RS.

18:03 It's pretty awesome.

18:04 Yeah.

18:04 Well, speaking of speed is a feature, the astral folks have come up with some new fun stuff.

18:10 That's what I got up next here.

18:11 Yeah.

18:12 Let's hear it.

18:12 So it's interesting.

18:13 So they're experimenting with bringing together some of the astral tools,

18:18 which I've always loved the fact that astrals kept them kind of like a little bit of the Unix philosophy,

18:23 like one tool to do one thing and does it really well,

18:25 where you can kind of pipe them together needed to,

18:27 but now there's an ability to take them and pull them together to gain another multiplier.

18:33 So the latest release here is bringing uv and TIE together.

18:38 So this blog post from October 13th, as an experimental integration between uv and TIE

18:43 available in preview.

18:45 Now they're asking for feedback on this.

18:47 And in parallel, they're continuing towards a stable release for TIE itself.

18:50 So this is all, again,

18:52 kind of on the maybe bleeding edge, leading edge of the actual tool chain stuff.

18:57 But why does this matter to you?

18:58 Why should you even care?

19:00 And one of the things I love, and I didn't really piece this together

19:02 until I read the blog post, is with PEP 7.23,

19:05 it allows for the inline scripts, the inline dependencies at the top of the script.

19:10 So you can see here on the screen, there's an example where they've got the inline

19:14 where it says what Python it requires and what versions of what dependencies it requires.

19:17 You can have in your library, I didn't think about this,

19:21 but you can have inside your, if you've got a repository

19:24 where you're storing a bunch of different scripts,

19:25 different scripts can actually have different dependencies.

19:28 And uv handles this very, very cleanly by creating environments for each script individually.

19:33 And now it can take those various environments and use Ty as a language server

19:38 to do all the validation of your type checking inside of each script individually

19:42 without kind of running over each other or getting the wrong version of this dependency

19:46 for that one that's over there.

19:48 So it's kind of bringing together the best of both worlds here

19:50 is where you can actually enable this.

19:52 You have to turn it on and then your editor now can be aware of the various versions of the

19:57 dependencies to make sure that Ty is using the right dependency versions as it builds out the

20:03 type checking for you in the backside.

20:05 So it's all opt-in right now.

20:07 You should definitely check it out.

20:08 It's powered by the uv workspace metadata.

20:12 So again, another part I didn't really recognize

20:14 is that uv is maintaining a really rich set of metadata under the covers.

20:18 And wouldn't it be great if your type checker had access to that same set of metadata so it's bringing together

20:23 kind of more data to build a better experience for the editors the ide's well ultimately the

20:29 developer experience benefits from from doing all this so it's working on it's work on this there's

20:34 some i think there's some more stuff coming soon from them you may see rough getting some

20:38 integrations as well the tools obviously stay still independent but now they can work more

20:43 closely together to superpower the developer experience which is really cool that's very cool

20:47 and it just makes sense to bring you know ty i can see rough coming as well as just a sub command

20:53 like uv format you know what i mean like why do i need three different commands well and you

20:59 accomplish what the tool suite does right this is this is compatible with uv check so the uv check

21:04 command and uv pre-commit hooks will also grab the right versions of things and do the right type

21:09 checking of the bits uh all on the fly for you automatically so it gives you even more reason to

21:15 use the PEP 723 especially for writing lots of little utility scripts are kind of one-off commands

21:19 that are meant for consumption by other folks this makes it really easy to to develop those and use

21:25 type checking uh just seamlessly yeah which is super cool it is super cool uh two things also

21:30 astral being part of open ai looks like there's still i know people were concerned but it looks

21:35 like still innovating still innovating still coming on strong and this was independently sent

21:39 to us by sky casco so thank you for that thanks i think you indic you i think you found it separately

21:46 but still very very cool they sent that in yeah now my first my first one was kind of intense

21:50 because i was so excited about it let's do something light i am very excited i am not

21:54 i will be back i will be back with more to the story but i want to talk about streamlit light

22:00 so you know what streamlit is yeah you've seen streamlit yeah so streamlit i had adrian on way

22:06 back before Streamlit was acquired by, I'm sorry, who acquired Streamlit?

22:10 Snowflake.

22:12 And the idea is you write basically procedural code and your procedural code is understood by

22:20 Streamlit and then turned into an interactive dashboard with controls that then change the

22:25 parameters to your procedural functions you write.

22:27 It's like if you don't really want to be or are not a visual front-end designer, but you want data science like it has a cool front-end with lots

22:34 interactivity. I really, really think it's cool.

22:36 Well, like Jupyter, it requires a server.

22:39 So this STLite by witphx, I don't know,

22:43 is basically streamlit in the browser, which is pretty sweet.

22:49 So similar to what you might get with JupyterLite.

22:53 And it's really interesting because it's not just, oh,

22:55 look, you can run it. It's obviously based on Pyodide, which is solid.

22:59 I just did a Talk Python episode recorded,

23:02 not yet published with the Cloudflare team about Python Cloudflare

23:06 edge workers.

23:07 And a couple of the folks who are building that and who built that are Pyodide core

23:11 developers.

23:12 So Pyodide is going strong, which is really cool.

23:14 So what I can do is I can come up and just create a Streamlit app that you can share.

23:19 But look at this, Calvin, a desktop app.

23:22 Nice.

23:22 So the desktop app basically creates an Electron.js version.

23:27 Oh, that's cool.

23:27 then host your WASM streamlet app in PyDyde running locally with, I believe,

23:33 local data access, which is why it would be interesting.

23:35 Yeah.

23:36 Yeah.

23:36 I wonder what the speed's like.

23:37 I don't know if you've demoed any of this.

23:39 Yeah.

23:39 I don't know, actually.

23:41 Yeah.

23:41 I don't know.

23:42 WebAssembly is pretty quick these days, but who knows?

23:44 It integrates with React, which is cool.

23:46 You can drop it into your own page.

23:48 And so you just have to do things like add a style sheet and then just include the JavaScript

23:54 module, which then pulls in the WASM, and then you just have a streamlet-app inline your Python,

24:00 and you're good to go.

24:01 Anyway, I think this is really cool.

24:03 I'm a fan of these in the browser things.

24:05 So often it's like, well, how do I share this thing I built with somebody? It's like,

24:08 what if I could put it on a static file server?

24:12 Netlify or something like that.

24:13 Yeah, I like the offline desktop executable mode as well.

24:17 You can build an app, you can just So app bundle you can hand someone or an exe that someone can just run without any other dependencies.

24:24 Yep.

24:25 Yep.

24:25 It's pretty straightforward.

24:26 It just gives you all the little bits that you need and off it goes.

24:29 I would like to point out one thing for people out there working on projects or if they're listening.

24:34 Here's an app out of visual, a visual thing like a data dashboard in a desktop app.

24:40 There's not one picture here.

24:41 Goodness.

24:42 Yeah.

24:43 Screenshots, people.

24:44 Screenshots.

24:44 Get us excited.

24:45 I mean, just you already got the thing.

24:47 Just screenshot it.

24:48 Anyway, that's it.

24:49 that's it for my items. How extra are you feeling?

24:51 I'm feeling like I've got a couple extras.

24:53 One of them is a shout out to another podcast.

24:56 Given the security elements I talked about at the beginning of this episode,

25:00 if you wanted to hear more, you should definitely check out the Real Python podcast.

25:03 They had Seth Larson on talking about the future of Python security.

25:07 So definitely check that out. I think security is obviously

25:11 becoming more and more and more prevalent in our day-to-day lives as developers.

25:15 So there's another good reason to go talk about it.

25:17 And then another little just announcement is that the Python

25:20 Software Foundation wikis have moved to GitHub pages,

25:24 which I think is probably a great move.

25:26 So PSF wiki, the Python wiki, and the Jthon wiki are now over on GitHub itself.

25:31 So if you click on that, you are now in a GitHub powered wiki,

25:35 which is pretty cool. They look good.

25:37 And I'm pretty psyched to see that on a subdomain of python.org where it belongs.

25:41 Yeah, yeah, for sure. I think

25:42 you saw that the links they were to psf.github.io but then it looks like they've got a redirect in

25:47 place to get the nice canonical name yeah probably that was already on the just the GitHub pages and

25:51 they're like let's get our own domains or put out just not even get the domain just set up the dns

25:56 for a subdomain yep so i'm glad they're taking care of things keeping the project running very

26:01 strong awesome awesome is that it yep that's it for me cool so i just want to i was going to just

26:06 talk about this php to shell thing one more time this could just be some schadenfreude like

26:11 not Python.

26:12 It could be, actually, this could be a good reason

26:15 to help convince your boss or decision makers that you should migrate from PHP to Python.

26:20 Also good.

26:20 But this is going to have some serious effects on all of us

26:23 because it's taking over so many systems that have our personal data,

26:28 which is not ideal.

26:30 So OpenAI, of all places, actually released a checker

26:33 for people who happen to be in the PHP land or maybe Python people,

26:37 but you're like, oh yeah, we also maintain these PHP things.

26:40 You're self-hosting something.

26:40 you can run OpenAI's PHP2 shell dash checker and figure that out.

26:46 Okay, enough of...

26:48 It's a rough week for PHP folks.

26:51 That one was brutal.

26:52 Yes.

26:53 So the next thing is I want to talk about Talk Python membership.

26:56 A bunch of people signed up.

26:57 Thank you so much.

26:58 Please consider signing up.

26:59 You can do so for as little as five bucks a month.

27:02 And it's not just free ad-free stuff.

27:04 The next meetup, the Talk Python tech talk coming up,

27:09 is going to be by me, Talk Python in production.

27:10 building your own Python infrastructure and running it.

27:13 This, if you've heard me talk about this before,

27:15 this is not going to be the same thing.

27:17 I have some crazy new things like Chameleon RS, but some other stuff as well that will surprise people.

27:23 So I'm just going to leave it there.

27:25 Come check it out.

27:26 And I also want to announce that it was going to be this Wednesday,

27:29 but it's going to be a week later.

27:31 I reschedule it because I want to coordinate a few more things

27:33 and get some of these ideas, these new ideas,

27:35 and you're making it a little more useful for people.

27:37 So talk with a membership, be part of it.

27:39 See you there.

27:40 Very cool.

27:40 I've seen all the people joining.

27:41 Yeah, thanks.

27:42 They are.

27:43 Now, I also want to give a quick shout out to who sent this in.

27:49 This comes to us from Vincent Paolo.

27:53 And we talked about ZeroVerb projects before on the show at the numeralzerover.org.

28:01 Are you familiar with this, Calvin?

28:02 No, I'm not, actually.

28:03 Oh, my gosh.

28:04 Let's go to the top real quick.

28:06 So this is like, it's just sort of calls out

28:10 this open source trend.

28:12 It's a board that outs people with zero version.

28:15 Yes, yes.

28:16 Okay, so we talked about it before, but probably a lot of people aren't familiar with it.

28:20 So the idea is like...

28:22 Oh my goodness.

28:23 Like some of the ones that are listed here, you're like, wait a minute, these should be released.

28:27 Exactly.

28:28 And the reason I think people really started going off on this, I think Mahmoud Hashemi

28:32 went off on it for a while, is for people in open source,

28:35 like yeah whatever okay it's 0.2 that's pretty you know it must be be good for a while but as a i just

28:42 told people like hey you get move off of php to python if you can that would be nice well maybe

28:47 a tech lead who is like more from i don't know the microsoft space or something where where

28:52 everything you know like you don't use a microsoft product until it's version 3.0 or later because

28:56 it's not tested yet you know what i mean you're like it's 0.2 kill it with fire get it away from

29:01 you know and so there may be some actual friction to adoption of these projects because they are zero

29:08 over okay that's not in every case because i just i just sorted the table by first released

29:14 something released in 1987 that everyone uses get text is still a zero over project unreal

29:20 so i think the thing that um 39.8 years zero the thing that vincent pointed out to me is like

29:28 There's a notable zero for projects.

29:31 Like, you know what?

29:32 These are the ones that are really well known.

29:33 Like, I love Excalibur.

29:35 It's five years old.

29:36 It's 0.18.

29:38 Stuff you may have heard of.

29:39 FastAPI, brand new.

29:41 0.162.

29:43 Eight years old.

29:44 NeoVim, that old thing's only 11 years old.

29:46 It's only 0.12.

29:48 Hugo, Ruff, for example.

29:51 Is Ruff only 0.17?

29:53 Come on, you know?

29:54 Zig, I mean, okay, Zig's kind of new.

29:56 But there are a lot of projects.

29:57 One on the list from 1978.

30:01 You know what?

30:01 It's okay to just go 1-0 at some point.

30:02 You should just 1-0.

30:04 And it's 0.9.8.

30:06 It's so close.

30:07 It's so close to 1.

30:09 Anyway, I just thought it was the notable ones.

30:12 I thought, okay, it's time to revisit the notable.

30:14 And if you have a project that's been out there for a few,

30:17 look, if your project has been out for 11 years, I don't care if it's 0.8 or it's 1.0.

30:22 You have a commitment to a stable API, whether you like it or not.

30:26 You know what I mean?

30:27 Come on, NeoVim.

30:28 Come on, NeoVim.

30:29 Just do it.

30:30 Get off the list.

30:31 It's been 11 years.

30:31 It's been 11 years.

30:32 We can do this.

30:33 The list of shame.

30:34 All right.

30:34 Also, I want to give a quick shout out to Python 3.15.2.

30:39 You called it out for security, but I'm just going to do a quick scroll and point out two

30:43 things.

30:44 Just watch how long the scroll bar goes here, Calvin.

30:46 God, goodness.

30:47 They're busy.

30:48 These are pages and pages and pages of fixes.

30:52 And then we get to 3.15.1, which I don't think anyone talked about.

30:55 This was six days ago.

30:56 and you scroll and it's pages and pages and pages and pages.

31:00 I don't know, 20, 30 pages of one sentence fixes,

31:04 one sentence fixes.

31:05 Like insane amount of it.

31:06 So if you're using 315 and you've been waiting for some stuff to get polished,

31:10 well, it's pretty polished.

31:11 And also if you're not on.2, you want to update not just because of the security stuff,

31:16 but because of all these other changes as well.

31:18 I'll go out on a limb.

31:18 It's safe.

31:19 I think you're good to go there.

31:20 Yes, I think you're probably good to go.

31:22 It's good stuff.

31:22 Unless you have some very rare wheels are not ready or something, but generally safe.

31:26 All right, it's time for a joke.

31:28 How do you feel about captchas?

31:30 No, don't like them.

31:31 I hate captchas so much.

31:33 I got banned from discord.

31:36 I tried to create a second account.

31:38 I didn't get my regular account banned.

31:39 I got my second account banned because what I wanted to do is as part of the

31:42 talk Python membership, I wanted to on another computer,

31:46 log in and watch the video channel so I could screen record it and then make it available as a recording.

31:52 And discord doesn't do that on its own.

31:54 Right?

31:54 Well, I tried to do that.

31:56 Just log in and twice in my account.

31:57 So I went to one that would pull me out of the other videos.

32:00 Like, oh, you're going to be in two places at once.

32:01 That's not going to work.

32:02 We're going to take you out.

32:03 Like, no, like this is exact.

32:04 So I tried to make a new account.

32:05 It made me do the capture 17 times.

32:09 I'm pretty sure I got it right.

32:10 At least 16, not just once, you know, you go through three stages of show,

32:14 find the bridges, find the, um,

32:16 find all the things that can walk on four legs or whatever,

32:19 and I went through all of them over and over and over.

32:21 And then I got it.

32:23 I finally got logged in and I tried to join the room.

32:25 And the next thing I got is an email from Discord saying,

32:28 you're banned for suspicious behavior, probably for trying to hack the captcha.

32:31 But it just kept coming up and up.

32:33 I'm like, I'm just please let me by.

32:35 I don't understand.

32:36 It's like 10 minutes of captcha loops.

32:38 Anyway, at that point, they should be paying you.

32:39 I know.

32:40 I know.

32:41 So the joke is captcha.

32:43 It's too real.

32:43 So this one is a slightly different captcha.

32:46 It's a captcha with a disassembled sort of really gnarly thing.

32:51 i don't even know what language this is but a bunch of code doing like some crazy stuff

32:56 and the captcha is select all the squares with bugs if there are none click skip

33:03 what do you think about this genius it's diabolical is what it is yeah just what does this print 27

33:10 three times okay you can you can access the website too real too real find all the bugs

33:17 well played well played well played well played recapture people well played well calvin well

33:23 played for been real fun episode yeah and yeah always good to be here with you thanks for

33:28 everything thank you everyone for listening and we'll talk to you next week bye