WEBVTT 00:00:00.080 --> 00:00:04.040 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly 00:00:04.500 --> 00:00:05.060 to your earbuds. 00:00:05.400 --> 00:00:06.980 This is episode 502, 00:00:07.240 --> 00:00:08.080 recorded Tuesday, 00:00:08.560 --> 00:00:09.940 October 27th, 00:00:10.240 --> 00:00:10.540 2026. 00:00:10.760 --> 00:00:11.500 I'm Michael Kennedy. 00:00:11.740 --> 00:00:12.760 And I'm Calvin Hendrix-Parker. 00:00:13.280 --> 00:00:15.260 And this episode is brought to you by us. 00:00:15.600 --> 00:00:18.480 If you have hard problems and you want a team you can 00:00:18.720 --> 00:00:18.880 trust, 00:00:19.140 --> 00:00:23.640 six feet up, just get in touch with Calvin and his team. They're doing amazing work, have 00:00:23.720 --> 00:00:24.540 been for 20 years. 00:00:25.320 --> 00:00:28.840 And if you want to learn some Python things, check out Talk Python Training, 00:00:28.860 --> 00:00:31.900 or you want to support the show over there at Talk Python, 00:00:31.980 --> 00:00:32.780 you can join membership. 00:00:32.960 --> 00:00:35.180 I have a few announcements from that as well. 00:00:35.480 --> 00:00:37.100 Connect with us on the socials, 00:00:37.520 --> 00:00:38.100 join the newsletter. 00:00:38.300 --> 00:00:39.860 All those things are on the website. 00:00:40.280 --> 00:00:40.680 Now, 00:00:41.280 --> 00:00:41.580 Calvin, 00:00:42.080 --> 00:00:43.080 it's been a week. 00:00:43.560 --> 00:00:44.240 It's been a week. 00:00:44.500 --> 00:00:45.640 It's been a crazy week. 00:00:45.700 --> 00:00:47.580 I was traveling last week and all this hit 00:00:47.640 --> 00:00:49.400 while I was like either in the air 00:00:49.540 --> 00:00:51.680 or someplace exotic and strange. 00:00:52.680 --> 00:00:54.280 And PHP wasn't the only problem. 00:00:54.400 --> 00:00:55.200 So if you haven't heard, 00:00:55.960 --> 00:00:57.000 there was a PHP vulnerability, 00:00:57.160 --> 00:00:58.660 a major one last week. 00:00:58.780 --> 00:00:59.980 but that's not what I'm gonna talk about. 00:01:00.820 --> 00:01:04.040 There were three different incidents also 00:01:04.280 --> 00:01:05.760 that affected the Python ecosystems 00:01:06.160 --> 00:01:07.240 that you all need to be aware of, 00:01:07.800 --> 00:01:08.700 and each of them in a different layer. 00:01:09.420 --> 00:01:11.000 So if you're not familiar with certificates 00:01:11.480 --> 00:01:13.500 and trust authorities and certificate authorities, 00:01:13.820 --> 00:01:18.060 there was a major vulnerability there in the trust layer. 00:01:18.320 --> 00:01:19.400 There was also a vulnerability 00:01:19.630 --> 00:01:22.260 in the release pipeline again with LightLM. 00:01:22.640 --> 00:01:24.800 And then we had a C decoder issue 00:01:24.910 --> 00:01:28.019 that also led to an RCE with the Bratley library 00:01:28.040 --> 00:01:30.100 from I think what defined folks at Google. 00:01:30.540 --> 00:01:31.940 But let's dive in. 00:01:32.100 --> 00:01:34.820 So the eMadura CA, 00:01:35.240 --> 00:01:36.140 the keys got compromised. 00:01:36.820 --> 00:01:40.200 And so if you are using a Python older than the ones 00:01:40.220 --> 00:01:42.220 that are listed in the release right here, 00:01:42.300 --> 00:01:45.800 so I think it's like the.2, the.10, the.18, et cetera. 00:01:45.880 --> 00:01:49.140 So basically 3.15 through 3.11 have all been patched, 00:01:49.200 --> 00:01:50.700 all been fixed and corrected. 00:01:51.480 --> 00:01:53.760 uv also has been fixed and updated, 00:01:54.680 --> 00:01:57.480 but you'll notice 3.10 not in the list. 00:01:57.840 --> 00:01:59.960 This is probably the first very large thing 00:02:00.000 --> 00:02:02.140 you need to watch out for for 3.9 and 3.10. 00:02:02.500 --> 00:02:03.400 You're not out of luck though, 00:02:03.680 --> 00:02:07.560 'cause as long as you upgrade pip, I believe in certify, 00:02:07.940 --> 00:02:09.380 you'll get the latest bundles 00:02:09.740 --> 00:02:11.240 into your older versions of Python, 00:02:11.580 --> 00:02:12.800 but you gotta go do that yourself. 00:02:14.020 --> 00:02:16.400 The other folks have done all the patching for you 00:02:16.420 --> 00:02:17.140 and made all the releases, 00:02:17.500 --> 00:02:19.740 so make sure you grab the latest versions of that. 00:02:20.000 --> 00:02:20.840 So why does this matter? 00:02:21.320 --> 00:02:23.660 When a certificate authority gets compromised like this, 00:02:23.940 --> 00:02:26.199 anyone who has these intermediate keys 00:02:26.220 --> 00:02:28.460 can basically mint certificates for any domain 00:02:28.720 --> 00:02:32.180 and any unpatched client who has these certificates 00:02:32.370 --> 00:02:34.180 in their CA will accept them as valid. 00:02:34.500 --> 00:02:35.800 That means you are now susceptible 00:02:36.020 --> 00:02:37.080 to man in the middle attacks, 00:02:37.660 --> 00:02:40.180 basically reading and altering HTTPS traffic 00:02:40.770 --> 00:02:41.780 without a certificate warning, 00:02:42.000 --> 00:02:43.180 pretty bad stuff. 00:02:43.480 --> 00:02:46.060 If you consider like the world of Python 00:02:46.500 --> 00:02:49.240 and any version of Python before this, 00:02:49.240 --> 00:02:50.740 I had those intermediates in there, 00:02:51.040 --> 00:02:52.820 is now susceptible to reading in data 00:02:53.110 --> 00:02:55.400 from an untrusted source who will think it's trusted. 00:02:56.200 --> 00:03:01.420 That's something everyone needs to be obviously on the hook for is making sure we all stay safe out there. 00:03:01.740 --> 00:03:03.640 So specifically like for Python, 00:03:04.370 --> 00:03:13.180 you could be downloading a susceptible package from PyPI and get something malicious because the credentials will, 00:03:13.340 --> 00:03:15.380 it looks real, but it's not. 00:03:15.620 --> 00:03:16.980 It's not real under the covers. 00:03:17.290 --> 00:03:20.100 So that one, make sure you grab that latest release. 00:03:20.660 --> 00:03:25.760 Any existing virtual environments, you're going to need to make sure you upgrade those as well because they don't pick it up automatically. 00:03:26.120 --> 00:03:30.840 So if you did uv and upgraded your uv and did uv reinstall the Python version, 00:03:31.100 --> 00:03:34.140 any virtual environments created by that Python version still need to be updated. 00:03:34.280 --> 00:03:36.980 So grab those, grab the latest and make sure you're safe. 00:03:37.560 --> 00:03:39.540 I actually noticed this. 00:03:39.560 --> 00:03:45.200 I didn't realize what it was for, but I noticed this because I have a script that just updates my homebrew, my NPM, 00:03:45.520 --> 00:03:47.020 my uv installed tools. 00:03:47.220 --> 00:03:48.960 And one of the things I've recently added, 00:03:49.140 --> 00:03:50.360 I've actually added two things, 00:03:50.940 --> 00:03:51.840 is one, 00:03:52.360 --> 00:03:52.440 just 00:03:52.760 --> 00:03:58.640 uv Python upgrade will do a build level upgrade of all of your installed Pythons without changing 00:03:58.820 --> 00:03:58.960 anything. 00:03:59.340 --> 00:04:01.300 And I think without breaking your virtual environments. 00:04:01.780 --> 00:04:01.960 Nice. 00:04:02.240 --> 00:04:02.360 Yeah. 00:04:02.500 --> 00:04:07.100 And there's actually another fix in here too around some tar file stuff too. 00:04:08.160 --> 00:04:08.240 Yeah. 00:04:08.320 --> 00:04:09.820 Reject cookies in a negative assertion. 00:04:10.460 --> 00:04:10.640 Oh yeah. 00:04:10.740 --> 00:04:11.320 The tar file, 00:04:11.600 --> 00:04:11.980 tar filter. 00:04:12.080 --> 00:04:14.120 So there was more than just the CAs in this release, 00:04:14.520 --> 00:04:17.079 two other CVEs, but none as important 00:04:17.100 --> 00:04:18.739 the CA one that's bundled in here. 00:04:18.950 --> 00:04:21.340 The next one was on the build side. 00:04:21.530 --> 00:04:23.380 The build side of this, 00:04:23.670 --> 00:04:24.800 which is Lite LLM again, 00:04:25.220 --> 00:04:27.600 is in the news. They got compromised back in March. 00:04:27.840 --> 00:04:28.960 They also have just 00:04:29.120 --> 00:04:29.220 gotten, 00:04:29.830 --> 00:04:34.260 the build got compromised. There was a version of Lite LLM that hit PyPI. 00:04:34.730 --> 00:04:35.680 It was up for 00:04:35.920 --> 00:04:36.660 about two hours, 00:04:37.440 --> 00:04:38.580 roughly 49,000 downloads. 00:04:39.390 --> 00:04:39.520 So, 00:04:40.080 --> 00:04:40.800 which is kind of sad. 00:04:41.220 --> 00:04:42.280 Folks should make sure that 00:04:42.300 --> 00:04:48.620 they are using the back off in their pipelines to install not the absolute latest and greatest. 00:04:48.830 --> 00:04:48.940 You 00:04:48.940 --> 00:04:49.640 may want to wait, 00:04:49.830 --> 00:04:53.560 have it back off a few days and only grab versions that have been released for, 00:04:53.880 --> 00:04:58.760 well, at this point, if you had at least three hours in there, you had been fine and gotten the 00:04:58.880 --> 00:04:59.660 patched version of it. 00:05:00.260 --> 00:05:01.480 Docker images were also infected. 00:05:01.650 --> 00:05:02.280 They basically, 00:05:02.780 --> 00:05:03.660 and I think the big 00:05:03.820 --> 00:05:07.440 question here is why does this keep happening to LLM? I mean, it's twice this year. 00:05:08.050 --> 00:05:08.539 The attackers 00:05:08.560 --> 00:05:09.000 are relentless. 00:05:09.680 --> 00:05:12.860 They are looking for exposed credentials and that's how they got in this time. 00:05:13.340 --> 00:05:18.640 They were able to find a key that didn't get revoked. There was a force push that included 00:05:19.300 --> 00:05:23.980 trying to fix for a key that got published accidentally but they never revoked that key. 00:05:24.360 --> 00:05:30.700 They were able to use that then to have the pipeline push keys like tokens from actual 00:05:31.320 --> 00:05:35.580 maintainers to a third-party source where they were able to collect them and then they were able 00:05:35.580 --> 00:05:36.800 to trigger the build pipeline, 00:05:37.060 --> 00:05:38.820 removing branch protections, 00:05:39.060 --> 00:05:39.420 et cetera, 00:05:39.580 --> 00:05:40.360 because it had admin 00:05:40.640 --> 00:05:40.800 privileges. 00:05:41.140 --> 00:05:45.240 So again, make sure your build tokens have least privilege so they can't do things like 00:05:45.360 --> 00:05:47.680 remove branch protections in your GitHub repository. 00:05:48.020 --> 00:05:50.180 There's a lot of layers that go into this, 00:05:50.400 --> 00:05:50.480 but 00:05:50.760 --> 00:05:55.520 obviously now the LightLLM folks have hardened the pipeline once again to protect against this. 00:05:55.840 --> 00:06:03.140 But yeah, this was another one that the exploit was using the path hooks for Python start. 00:06:04.980 --> 00:06:05.540 So 00:06:05.560 --> 00:06:07.100 for this to be exploited, 00:06:07.540 --> 00:06:08.800 but it was still SSH keys, 00:06:09.320 --> 00:06:10.280 cloud browser tokens, 00:06:10.880 --> 00:06:11.020 CI, 00:06:11.300 --> 00:06:12.320 AI tool credentials. 00:06:12.860 --> 00:06:13.740 They're all after your credentials 00:06:13.920 --> 00:06:17.520 so they can continue propagating these attacks 00:06:17.900 --> 00:06:18.660 into other places. 00:06:18.960 --> 00:06:20.980 So if you happen to have downloaded it 00:06:21.040 --> 00:06:21.740 within those two hours, 00:06:22.840 --> 00:06:23.640 that's unfortunate. 00:06:24.040 --> 00:06:25.940 Hopefully you've already patched and are on the way. 00:06:26.380 --> 00:06:28.240 But I think the important bit here is to learn 00:06:28.480 --> 00:06:30.620 from how they're hardening their CI pipeline. 00:06:31.400 --> 00:06:33.620 If anyone is gonna be a good example 00:06:33.800 --> 00:06:34.520 for the best way to do it, 00:06:34.660 --> 00:06:39.200 going to be these folks now because they are they've gone through two rounds of this and and 00:06:39.230 --> 00:06:45.580 some pretty sophisticated versions of the attacks yikes yeah yikes is right uh the last one is even 00:06:45.800 --> 00:06:51.100 more a bit of a yikes i have a comment really quick oh go back let's go back really quick i just want 00:06:51.100 --> 00:06:57.760 a second uv exclude newer yes give it it's it feels a little like oh it's just security through 00:06:57.980 --> 00:07:03.439 obscurity but we're just gonna say well we're just not going and install stuff for like oh a day and 00:07:03.460 --> 00:07:05.320 How is that going to make any, it's a good practice. 00:07:05.480 --> 00:07:09.480 Almost all of these major ones we've reported on are like, it was out for three hours. 00:07:09.600 --> 00:07:10.620 It was out for two hours. 00:07:10.760 --> 00:07:11.980 It was out for half a day. 00:07:12.460 --> 00:07:15.400 Just let other people go first and find out. 00:07:15.400 --> 00:07:16.000 You know what I mean? 00:07:16.100 --> 00:07:16.480 Like you, 00:07:17.000 --> 00:07:19.740 you rarely need that much cutting edge. 00:07:19.860 --> 00:07:19.940 Yeah. 00:07:20.080 --> 00:07:21.840 And so just add that. 00:07:22.120 --> 00:07:22.800 If you use an uv, 00:07:23.240 --> 00:07:25.680 it's, you almost never need it. 00:07:26.260 --> 00:07:29.260 And the one thing that where you do maybe sometimes need it is if you're working on a 00:07:29.380 --> 00:07:33.200 project and you're pulling in something that you're publishing a PI PI and you're like, 00:07:33.260 --> 00:07:34.620 I want to actually just get, 00:07:34.820 --> 00:07:36.540 I want to publish it to PyPI and ship it 00:07:36.700 --> 00:07:38.540 so I can put the fix in now and test it. 00:07:38.820 --> 00:07:39.660 That's really frustrating 00:07:39.680 --> 00:07:40.980 because you don't want to wait a week 00:07:41.100 --> 00:07:42.060 to test out what you're doing. 00:07:42.340 --> 00:07:43.880 So you can just do exclude this package 00:07:44.380 --> 00:07:45.460 and just have an exclude list. 00:07:45.720 --> 00:07:47.540 They get instant and your stuff gets, 00:07:48.140 --> 00:07:49.160 everything else gets delayed 00:07:49.340 --> 00:07:50.380 and it's usually perfect. 00:07:50.480 --> 00:07:50.800 Yeah, so. 00:07:51.020 --> 00:07:52.040 Follow these good practices 00:07:52.500 --> 00:07:54.280 and you will avoid a lot of heartache. 00:07:54.520 --> 00:07:56.400 I think is the moral of the story here 00:07:56.420 --> 00:07:57.780 for this one specifically. 00:07:58.600 --> 00:07:59.620 It's the tools are here. 00:07:59.680 --> 00:08:00.040 So just, 00:08:00.440 --> 00:08:00.540 you know, 00:08:00.900 --> 00:08:01.100 uv, 00:08:01.160 --> 00:08:02.660 I believe pip added this as well. 00:08:02.820 --> 00:08:08.240 it's like the cli is really different but it's the effect is the same yep and then the last one 00:08:08.480 --> 00:08:14.580 major one from last week was the broccoli to shell uh so there's a bug in the broccoli decoder 00:08:14.860 --> 00:08:20.640 that lets crafted compressed data right past the end of a buffer which gets you a fun rce so 00:08:21.640 --> 00:08:26.460 if you want a remote shell in a box if you find one of these ones that's been installed with an 00:08:26.460 --> 00:08:31.759 old version of the brockley c decoder you will be on your way um so if you upgrade to the latest 00:08:31.780 --> 00:08:34.380 version of Brotley and Brotley CFFI, you'll be fine. 00:08:34.560 --> 00:08:35.360 Everything's been patched, 00:08:36.010 --> 00:08:36.680 but you may not 00:08:36.780 --> 00:08:37.520 know you have this. 00:08:38.110 --> 00:08:39.880 A lot of web stacks, for example, 00:08:40.120 --> 00:08:41.820 may be bringing this in because they're 00:08:42.240 --> 00:08:45.620 using this to get a greater performance out of compression, 00:08:45.930 --> 00:08:46.380 for example. 00:08:46.960 --> 00:08:47.800 This is one of the main, 00:08:48.100 --> 00:08:51.400 one of the use cases for this specific library in there. 00:08:52.270 --> 00:08:54.100 So you may have gotten a transitive 00:08:54.600 --> 00:08:57.020 dependency brought in that brought this in. 00:08:57.190 --> 00:08:59.079 One nice thing is that if you just uninstall 00:08:59.100 --> 00:09:02.700 the Bratley package and I believe liburl3, 00:09:03.180 --> 00:09:05.700 other things will just fall back on like HTTPX 00:09:05.740 --> 00:09:07.720 will fall back automatically to like gzip 00:09:08.120 --> 00:09:10.020 and deflate for compression. 00:09:10.500 --> 00:09:12.860 So you can fix it quickly if you can't upgrade. 00:09:13.500 --> 00:09:15.280 I don't know any reason why you wouldn't be able to upgrade 00:09:15.480 --> 00:09:17.700 but there are a couple ways to mitigate this 00:09:18.140 --> 00:09:20.140 which basically involve taking care of 00:09:20.460 --> 00:09:21.420 getting Bratley out of the loop 00:09:21.580 --> 00:09:25.400 and then taking care of getting this out of your system. 00:09:26.440 --> 00:09:26.700 Again, 00:09:27.100 --> 00:09:27.880 staying on top of it, 00:09:28.400 --> 00:09:30.900 How long was this one even like out for? 00:09:31.300 --> 00:09:33.220 I don't even remember if it noticed in there. 00:09:33.440 --> 00:09:36.840 Yeah, so the Bratley decoder from 1.0.3 through 1.2 00:09:37.340 --> 00:09:38.920 had this in there. 00:09:39.260 --> 00:09:40.320 And so by default, 00:09:40.660 --> 00:09:41.400 you don't get a Python 00:09:41.560 --> 00:09:43.880 that's been compiled with the Bratley C decoder, 00:09:44.140 --> 00:09:45.940 but you may be bringing in dependencies that do. 00:09:46.180 --> 00:09:47.180 So just to be aware, 00:09:47.400 --> 00:09:48.340 if you may want to, 00:09:48.460 --> 00:09:51.380 you run like uv or pip looking for this specific dependency 00:09:51.720 --> 00:09:53.500 in your projects and make sure, 00:09:53.680 --> 00:09:53.800 again, 00:09:54.080 --> 00:09:55.460 you update those dependencies. 00:09:56.220 --> 00:09:58.620 The show notes have links to all these various things. 00:09:58.870 --> 00:10:01.200 I just thought I'd kind of give a security roundup 00:10:01.470 --> 00:10:04.700 in my one segment for all the Python folks 00:10:04.790 --> 00:10:05.560 out there to stay safe. 00:10:05.820 --> 00:10:07.120 Calvin, I thought broccoli was good for you. 00:10:07.600 --> 00:10:09.120 Broccoli is normally good for you. 00:10:09.760 --> 00:10:10.720 It's a bad broccoli. 00:10:11.040 --> 00:10:11.800 It's a bad broccoli. 00:10:12.940 --> 00:10:14.980 All right, I am so excited about this project 00:10:15.140 --> 00:10:15.940 that I'm going to introduce. 00:10:16.220 --> 00:10:17.340 This is my project, 00:10:17.520 --> 00:10:19.220 something I've been working on all of last week. 00:10:19.430 --> 00:10:21.680 And I think it's going to be really interesting. 00:10:21.790 --> 00:10:22.940 And I'm going to show you some numbers. 00:10:23.640 --> 00:10:23.760 Why? 00:10:23.920 --> 00:10:24.040 Okay. 00:10:24.540 --> 00:10:27.240 So I'm sure you're familiar with the Chameleon template language, 00:10:27.440 --> 00:10:27.560 yes? 00:10:27.820 --> 00:10:28.200 Oh, yeah. 00:10:28.460 --> 00:10:31.000 I'm a long time like Zoplon pyramid. 00:10:31.820 --> 00:10:32.700 I'm a big fan. 00:10:32.840 --> 00:10:33.560 I'm a big fan of it. 00:10:33.700 --> 00:10:34.660 I like it over Jinja. 00:10:34.680 --> 00:10:35.760 I like it over Django templates. 00:10:36.200 --> 00:10:40.000 We don't need to go into why, but let's just say it's a really minimal, 00:10:40.440 --> 00:10:40.780 nice, 00:10:41.180 --> 00:10:41.300 clean. 00:10:41.780 --> 00:10:41.840 Well, 00:10:42.380 --> 00:10:46.300 the TLDR is with Chameleon, the stuff you write is still valid HTML. 00:10:46.820 --> 00:10:48.260 With Jinja and Django, 00:10:48.460 --> 00:10:49.800 you have all this junk in there. 00:10:50.080 --> 00:10:53.100 Plus, it allows you to write arbitrary Python in those other frameworks, 00:10:53.360 --> 00:10:56.400 which encourages you to have bad architectural practices, 00:10:56.680 --> 00:10:57.760 whereas Chameleon is more strict. 00:10:58.100 --> 00:10:59.680 So now that's why I like it. 00:11:00.100 --> 00:11:02.700 But it hasn't got a ton of love. 00:11:03.260 --> 00:11:04.560 If you go back and look at the project, 00:11:04.960 --> 00:11:05.880 I don't have it pulled up here. 00:11:05.940 --> 00:11:09.100 Go to pack, look at the Chameleon project to go to the, not the homepage. 00:11:09.620 --> 00:11:12.360 Go to the repo run by a bunch of people I really like. 00:11:13.360 --> 00:11:14.360 But if we go over here and look, 00:11:14.620 --> 00:11:15.620 you can see that like, 00:11:15.800 --> 00:11:19.520 well, the build is failing and it's only technically built for 3.13. 00:11:20.200 --> 00:11:25.340 it's still on to you know if you go look at the releases i think in the last i remember 00:11:25.880 --> 00:11:30.420 summon this up but if you look at the last releases they're all like minor minor bug fix 00:11:30.820 --> 00:11:35.280 security fix minor minor bug fix like for the last four years right it's just not a whole lot is going 00:11:35.420 --> 00:11:40.800 on there but could we do a better job and still support that so i introduced to the world chameleon 00:11:42.420 --> 00:11:48.179 rs like the sportier version of chameleon this is like yeah like if you had a honda accord and 00:11:48.200 --> 00:11:51.940 And then you're like, well, what if we had the sport edition and we got a new suspension 00:11:52.260 --> 00:11:53.860 and oh yeah, we also put a turbo on it. 00:11:53.940 --> 00:11:54.460 You know what I'm like? 00:11:54.460 --> 00:11:55.180 Get the RS badge on the back. 00:11:55.340 --> 00:11:55.760 That's all you needed. 00:11:56.080 --> 00:11:56.320 Exactly. 00:11:56.800 --> 00:11:57.620 It's the RS edition. 00:11:58.080 --> 00:11:58.920 So Chameleon RS, 00:11:59.280 --> 00:12:00.460 Chameleon templates modernized. 00:12:00.540 --> 00:12:01.580 And it's not just faster. 00:12:01.840 --> 00:12:02.700 If it were just faster, 00:12:03.020 --> 00:12:03.640 that would be interesting. 00:12:04.020 --> 00:12:05.160 But let me ask you this. 00:12:05.580 --> 00:12:09.660 Is Chameleon Python 315T safe? 00:12:09.940 --> 00:12:11.980 Can I run free threaded Python on Chameleon? 00:12:12.399 --> 00:12:13.360 I'm guessing not. 00:12:13.920 --> 00:12:18.080 I don't know, but I would guess strongly no if it hasn't even been touched. 00:12:18.160 --> 00:12:19.440 It probably wouldn't work very well. 00:12:20.050 --> 00:12:20.180 Exactly. 00:12:20.510 --> 00:12:26.900 I will bet you good odds that there will be some kind of race condition corruption issue. 00:12:27.480 --> 00:12:29.340 So that's the modernized part, right? 00:12:29.780 --> 00:12:30.480 Chameleon template is modernized. 00:12:31.060 --> 00:12:36.120 I want to be able to run regular new Python and expect that my project will work and not 00:12:36.240 --> 00:12:39.720 just race condition corrupt itself out of existence, 00:12:40.300 --> 00:12:41.260 especially on a web app that runs 00:12:41.340 --> 00:12:41.720 for a long time, 00:12:41.880 --> 00:12:41.960 right? 00:12:42.220 --> 00:12:50.460 So I rewrote it in Rust and I took every single unit test that Chameleon has and it passes perfectly. 00:12:50.910 --> 00:12:54.900 I took all of the template tests where it renders them. 00:12:55.300 --> 00:12:57.580 It's byte for byte HTML identical. 00:12:58.060 --> 00:13:05.380 I then converted Talk Python and Python bytes to it and requested every single page on old Chameleon and Chameleon RS. 00:13:05.860 --> 00:13:08.620 They are byte for byte HTML identical. 00:13:08.980 --> 00:13:10.700 Not just like the same parsable structure, 00:13:11.140 --> 00:13:11.380 AST. 00:13:11.920 --> 00:13:13.880 Like every byte comparison, 00:13:14.060 --> 00:13:14.680 they're the same. 00:13:14.890 --> 00:13:15.460 How cool is that? 00:13:15.760 --> 00:13:17.060 That's really cool, actually. 00:13:17.550 --> 00:13:18.180 Great test, too. 00:13:18.540 --> 00:13:20.800 And then I started doing a bunch of multi-threaded tests, 00:13:20.980 --> 00:13:21.720 scaling tests, 00:13:22.100 --> 00:13:25.100 and I'm still running over on my Mac studio. 00:13:25.760 --> 00:13:29.060 It's running for an hour over there doing some performance testing 00:13:29.230 --> 00:13:32.760 and looking for any possible issues on the free-threaded stuff. 00:13:33.140 --> 00:13:34.560 But not just that, more modernized. 00:13:34.840 --> 00:13:35.100 What if, 00:13:35.260 --> 00:13:38.280 what if, check this out, in your, let's see, I'll go over here. 00:13:39.620 --> 00:13:41.060 What if I had markdown content? 00:13:41.320 --> 00:13:42.560 What do I do with that, Calvin? 00:13:42.980 --> 00:13:43.560 I don't know. 00:13:43.590 --> 00:13:44.980 I can't do anything with it in the templates. 00:13:45.390 --> 00:13:47.300 But Markdown is so insanely common. 00:13:47.460 --> 00:13:48.380 It's almost HTML, 00:13:48.680 --> 00:13:48.780 right? 00:13:49.040 --> 00:13:49.160 Yeah. 00:13:49.400 --> 00:13:51.180 Shouldn't your thing support it? 00:13:51.480 --> 00:13:53.080 Well, now you just have Markdown colon, 00:13:53.250 --> 00:13:53.940 some kind of content. 00:13:54.220 --> 00:13:55.420 And this happens in Rust, 00:13:55.710 --> 00:14:00.160 which is like 60 times faster than the Python ones. 00:14:00.520 --> 00:14:02.060 So it's insanely fast. 00:14:02.430 --> 00:14:02.540 Oh, 00:14:02.760 --> 00:14:05.660 and one of the really nice benefits of this, I don't know if you've ever, 00:14:06.020 --> 00:14:06.680 I'm sure 00:14:06.800 --> 00:14:08.600 you've seen this, how much work you've done with these languages. 00:14:08.960 --> 00:14:14.300 But when you first deploy your web app and you request a page and it takes like one second for that page to load. 00:14:14.550 --> 00:14:15.820 And then after that, it's fast. 00:14:16.160 --> 00:14:16.680 That one second, 00:14:16.840 --> 00:14:19.880 a lot of it is actually the Chameleon template compiling, 00:14:20.140 --> 00:14:23.960 Chameleon compiling the template into its actual form. 00:14:24.340 --> 00:14:26.940 This is 70 times faster compiling the template. 00:14:27.300 --> 00:14:33.220 So when you deploy it, the first time you touch a page is basically as fast as if it's up and running. 00:14:33.360 --> 00:14:36.700 Wow. And I see you've got HTMX support too. 00:14:37.160 --> 00:14:39.280 than the perfect world combination. 00:14:39.580 --> 00:14:40.880 You see, there's more of the modernization. 00:14:40.960 --> 00:14:43.140 It's not totally HTMX dedicated, 00:14:43.220 --> 00:14:45.940 but I have three things that I've kind of gone around 00:14:45.940 --> 00:14:46.440 and I've just, 00:14:46.600 --> 00:14:48.280 I like poking at trying 00:14:48.280 --> 00:14:49.420 to make these web frameworks better. 00:14:49.420 --> 00:14:50.980 So I created Chameleon Flask, 00:14:51.020 --> 00:14:54.220 which lets me run Chameleon on Flask in a super easy way. 00:14:54.220 --> 00:14:55.520 You just do like a little template 00:14:55.560 --> 00:14:57.540 and you put it as a decorator on your Flask thing. 00:14:57.860 --> 00:15:02.240 Flask will not adopt Chameleon for reasonable reasons, 00:15:02.420 --> 00:15:04.900 but it's not a crazy good reason. 00:15:05.020 --> 00:15:08.220 It's like the plugins in Flask expect Jinja, 00:15:08.560 --> 00:15:09.640 so we can't have any other template. 00:15:09.740 --> 00:15:10.160 Like, well, 00:15:10.380 --> 00:15:11.560 it would be nice if we could have other templates 00:15:11.740 --> 00:15:12.140 on Flask. 00:15:13.059 --> 00:15:16.460 Also, if you want to do HTMX, having some kind of partial library 00:15:16.660 --> 00:15:17.660 support is super neat. 00:15:18.120 --> 00:15:20.360 But Chameleon is not going to add any concept of partials, 00:15:20.520 --> 00:15:20.580 right? 00:15:20.580 --> 00:15:22.600 So I took all of these libraries and more, 00:15:23.000 --> 00:15:24.880 and I built them in Rust, 00:15:25.080 --> 00:15:26.000 rebuilt them, 00:15:26.120 --> 00:15:28.240