#504: Who turned the GIL back on?

00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly

00:04 to your earbuds.

00:05 This is episode 504, recorded Monday,

00:09 November 9th, 2026.

00:10 I'm Michael Kennedy.

00:11 And I'm Calvin Hendrix-Parker.

00:13 And this episode is brought to you by Longlink.

00:16 They're a really awesome platform for building business applications on top of things like FastAPI and Python.

00:23 So I'm really excited to tell you more about them later.

00:26 Connect with us, Mastodon, Bluesky,

00:28 X, LinkedIn, all the things,

00:30 all that stuff's at the top.

00:31 And we've got this great newsletter, really fun stuff that we share

00:34 with people every week, almost every week, almost every week,

00:38 and sign up for it and you'll get it as well. You'll enjoy it, I'm sure.

00:42 So with that, feeling like some things could use, I don't know,

00:46 some redesigns. What do you think?

00:47 How about a new view on life? A new view on life. Okay.

00:51 Yeah, how about a new view for PyPI?

00:54 Oh, I'm here for that, yes, let's do it.

00:55 I am too.

00:57 That's kind of critical to a lot of things we do.

00:59 So PyPI has redesigned the project pages, which is pretty nice because it now warns

01:06 when there's provenance changes.

01:08 So LiveNow, I think as of like three days ago,

01:11 at least they announced it, that they were basically doing some user research

01:14 that they talked about in July.

01:16 This was funded by OpenSSF and built by the Kabu Creative,

01:21 there is a new security tab on every project page,

01:25 which is gonna show the releases, provenance state and per file attestations.

01:30 So actually I'll scroll down and through here.

01:32 There's this new security tab.

01:33 So if you go to PyPI today and look at any project that's up there,

01:37 you'll see a new security tab.

01:40 I think you'll see a sense of some of the theme

01:44 of my updates lately have been very much supply chain

01:48 and attack vector related.

01:50 And so this is in response to a lot of that as well.

01:53 You get basically two attestation types.

01:56 There is the on the PyPI publish one, which is basically uploaded by a trusted publisher.

02:01 So there's a trusted publisher plan or program that you can sign up for.

02:06 And then there is the SLSA build provenance, which ties into a files commit,

02:11 the build platform and the instructions.

02:14 So there's two different kinds of provenance that's up there.

02:17 So you can see here, there's the PI PI trusted publisher

02:21 at the station.

02:22 You're gonna see this for any project that has done

02:24 any of the digital attestations to date.

02:26 So projects like, for example, I pulled up SQLAlchemy.

02:30 SQLAlchemy has a security tab now, well, all of them do.

02:34 And you'll see that the last 72 files in this release

02:37 have been uploaded with Providence metadata.

02:39 So all these releases here have that metadata.

02:43 So obviously the crew over there on SQLAlchemy ahead of the game and we're publishing these before they were really visible to end users.

02:50 So this solves that problem of making these attestations visible to folks in the community.

02:57 There's also the SLSA style. So you'll see this orange icons which give you the identity,

03:03 the build, the commit,

03:05 the hash, and all the pieces that basically tie this directly back into

03:10 the CI pipeline.

03:11 There's also in addition to the there's warnings now you'll see.

03:16 So there's like a no providence is not necessarily a malware flag. It just means that the file's origins couldn't be

03:22 cryptographically verified.

03:24 That's typical for older releases and things not using trusted

03:27 publishing. So don't take that as a necessarily a bad sign.

03:30 But there are four new providence warnings down here for incomplete,

03:35 inconsistent, and change or loss of providence.

03:39 And those are all described here in that release specifically.

03:42 But you'll see here now you'll get a warning at the top of that

03:46 PyPI product page for incomplete providence, for example,

03:50 with an explanation. Like, for example, two of the five files were uploaded without the providence metadata,

03:55 which could be signals that you may encounter a supply chain attack.

03:59 But I don't think it should be the end-all be-all

04:03 definitive answer. You have to obviously go do your own search on that.

04:07 These are meant to catch files that may not have come from maintainers,

04:11 such as after an account or publishing workflow

04:13 takeover.

04:14 PyPI says a change of providence can also indicate a compromised pipeline or the account

04:19 takeover or an unexpected loss of providence should be treated with skepticism until verified.

04:25 And so I think that's the state of most security folks who are in the community,

04:31 treat everything with skepticism until verified.

04:33 The warnings will sit on top of the page until it is yanked, for example,

04:37 archived or with pre-release banners, the quarantine banner

04:41 overrides all of them. So that's kind of the top one you'll see on there.

04:44 You also notice that the redesigned product detail page has some new niceties other than the providence bit.

04:51 But probably the more interesting one is the file release files and release history will now clearly state or clearly

04:57 show when there's things that are pre-release or release that has been yanked.

05:01 That's always a big question for me when I'm looking at like trying to figure out why maybe a build failed or why I

05:05 find something.

05:06 So now you can actually see that there's a yanked reason,

05:09 you know, set up blunder, breaking some bind gen code paths, for example,

05:13 in the one that's in their blog post.

05:14 But I think this is really great to highlight or bring to the, you know, the top of the stack when there's

05:21 potential problems with the dependency packages in there.

05:23 Mike, what do you think of the redesign?

05:25 I like it.

05:25 I mean, it's pretty familiar.

05:27 There's not a whole lot of change, but functionally,

05:29 I think it's a very important change, right? I think we've had trusted publishing,

05:34 but.

05:34 It just wasn't very visible.

05:36 Like you had to kind of know this, this puts it a little more into the direct line of sight for everyday users

05:42 or everyday developers who are, you know,

05:44 maybe not as critical as they should be.

05:46 Yeah.

05:47 Scroll into the partial provenance, the one with the reddish orange bar.

05:50 Yeah.

05:51 Yeah.

05:51 Here we go.

05:52 There you go.

05:53 This one.

05:54 As a person who did Python stuff on the web back in the day,

05:59 how about that pyramid debug toolbar in the screenshot?

06:01 Come on now.

06:03 That was a good catch.

06:05 Right over here at the Pyramid Debug Bar.

06:07 Yeah.

06:08 Clicking it will do nothing because it's an image, but still.

06:10 Right.

06:12 Obviously, they made the screenshots from a pre-release version of Warehouse.

06:16 Yeah, that's cool.

06:17 I don't know if this is out.

06:18 Is this out yet?

06:18 Do you know?

06:19 This is out.

06:20 This is live.

06:22 The screen I showed from SQLAlchemy was real.

06:25 I went through and had to search a couple of projects before I found one that had full

06:29 provenance or were using the digital attestations.

06:32 A lot of common projects aren't yet.

06:34 So for example, I searched for Django.

06:35 It was not, the Django project's not currently using digital adaptations,

06:39 but boy, it should.

06:41 And hopefully this highlights that for package maintainers.

06:44 So they start doing this.

06:45 Yeah, it makes a lot of sense.

06:47 And you're making me realize I should probably do it for one of my projects I'm just about to talk about.

06:50 So let's talk about it.

06:51 All right, Michael, get on it.

06:53 So I, was it last week, week before I introduced my chameleon-rs.

06:57 I think that was two weeks ago.

06:59 project, which is the chameleon, speaking of pyramid,

07:02 the chameleon template language rebuilt for free threading and faster in Rust,

07:07 all these kinds of things, right?

07:08 And that is, maybe I hinted at this. This is just, that was just the first deposit in a bigger goal that I have to make free

07:16 threading better for Python.

07:18 And I've, it's been out for two years,

07:20 two years.

07:21 How many projects support it?

07:23 Almost none. It's really, I think, honestly, it's a little bit disheartening for me.

07:27 I don't know how you feel about this, but I'm sitting here with,

07:29 you know, 18 cores on my machine.

07:31 I get like 5% use out of them on my projects.

07:34 And it's just like, I get it. It's new

07:36 last year.

07:37 You know what I mean?

07:38 Right.

07:38 But it's like, okay, we're, we're into the third release,

07:42 third yearly release of Python with free threading.

07:44 And I don't know, maybe I was either inspired or

07:48 grumpy. I don't know which way you want to perceive it, but I'm just like, that's it.

07:50 I don't know, Michael, what's your hurry?

07:52 Come on.

07:53 Can't you be a little patient?

07:54 I'm like, okay.

07:56 A lot of these projects, I'm like, oh, well, if I could like kind of poke at the edge, maybe this little thing that'll make a little better.

08:00 I'm like, you know what?

08:01 Maybe if it's not going to get moved forward, maybe I can make an alternative version that's somehow API compatible or API similar or just not at all,

08:09 but kind of moves that forward.

08:10 And so the Chameleon-RS one was the first one.

08:13 And that's like full free threading support.

08:16 I'm working on some others I'll talk about.

08:17 But one of the things I had Chris Ariza, Christopher Ariza on Talk Python.

08:22 It's not out yet, but he has recorded the episode.

08:24 It'll be out in two weeks.

08:26 Yeah.

08:26 And we talked about free threading. And one of the things, I don't know, let me know if you

08:30 know this, because I did not know this. This totally surprised me. If I get Python,

08:34 free threaded Python, it's not that the GIL is not there.

08:37 The GIL is still there.

08:39 It's just a feature flag turned off,

08:42 even in the Python T, right?

08:44 And here's where this gets kind of crazy.

08:47 If you import something that does not,

08:49 that has native extensions, I think this is not sufficient,

08:53 but native extensions, like a C extension sort of thing.

08:56 If it does not explicitly say that it is thread safe,

08:59 the gil gets turned back on for the whole process permanently.

09:02 That's it.

09:03 Like what?

09:04 I thought we had free threaded Python.

09:05 Like, no, you get the possibility of maybe,

09:09 and then eventually it could potentially turn itself back off.

09:11 I'm like, all right, that is just nuts.

09:15 So what I would like is some kind of library or some kind of indicator that this is a problem

09:20 and it is turned back on.

09:21 Because if I have something like eight threads working on something and I have eight cores

09:26 on it, that's fine.

09:27 But if it turns out that it gets turned back into a single thing with the gill,

09:32 the collapse of performance, it doesn't just fall back to single threaded.

09:35 It falls below, like possibly quite a bit below the performance you would have got if

09:40 you just used one thread, right?

09:41 Because there's just contention, all this contention and sharing and locking over still

09:45 computed in parallel, right?

09:47 All that.

09:47 So I'm introducing to the world my next release, and there will be more, like I said,

09:52 called Gilguard, the Gilguard.

09:55 And here's what the Gilguard does.

09:56 It's a simple, pure Python package

09:59 that only runs in free-threaded Python.

10:01 What it does is, is you literally import the project,

10:06 import Gilguard at the top.

10:08 Now, you probably need to do some kind of like rough or hashtag ignore this unused import.

10:15 Is this for development only?

10:18 Like you wouldn't want to release this into production?

10:20 Probably not.

10:21 Well, okay.

10:21 Let me show you the features.

10:22 Then you talk about it.

10:23 Okay.

10:23 Okay.

10:24 The way it's written here, probably not.

10:27 So what you can do is you can put import Gilguard at the top before all of your other imports.

10:31 You don't want it to get reordered because it's I sort,

10:34 you know, the sort the imports.

10:35 That's going to change what it means.

10:38 So it has to be the first because what it does is it knows it's running on free thread of Python

10:42 and that the Gil is not enabled because it's the first thing.

10:44 And then anything else that gets imported, either on this page, the next page,

10:48 lazy imported in some other module that imports another module that then turns the gil back on.

10:54 What you get is an exception with a whole ton of details.

10:57 Crash, the gil has been re-enabled.

10:58 And then this module from this file, this version,

11:02 and this is the import sequence that it took to get there.

11:04 All that kind of stuff.

11:06 That's cool, right?

11:06 That's really cool.

11:07 It's not like you just named the package.

11:10 You're like, no, it's right here.

11:11 Exactly.

11:13 Yes, exactly.

11:14 And here's the file.

11:16 And then here is the sequence of import statements that got you to this file.

11:19 Right.

11:20 Exactly.

11:20 So if you'd like to go fix it, here's the pointer.

11:23 And I mean, the fix is like you go complain to the maintainer or you do a PR.

11:27 I don't know.

11:28 You stop using it.

11:29 Yeah.

11:29 Yeah.

11:30 But there is no fix.

11:31 Like the gills coming back on.

11:33 I mean, I guess you can ignore it, but it's kind of like it's there's a way to say like,

11:37 I don't care, like YOLO mode sort of for the runtime.

11:40 But that's not the default.

11:41 You got to choose it.

11:42 Okay.

11:42 So this is what it does by default.

11:45 And if you ask about the, do I run this in production?

11:49 Probably not like this.

11:50 Maybe, but let's say probably not.

11:53 I don't know, unless you want it to crash and then just like,

11:55 I'd rather crash and then have like such a horrible performance.

11:57 But I'm going to go with no on that.

11:59 So another thing you can do on any virtual environment

12:03 is you can just run python-m-gilgard.

12:05 And instead of running your app, it will individually create a separate Python runtime

12:10 and import each module separately.

12:12 and to give you a report.

12:13 It'll say like, I imported all these modules and one of them turned the GIL on.

12:17 For example, I ran this on Talk Python training, 114 modules it imported.

12:22 When it checked the virtual environment for the runtime stuff,

12:24 113 of them were fine, but one of them, this PDF thing,

12:28 turned the GIL back on.

12:29 And guess what?

12:30 It's not running in process anymore.

12:32 I don't know what we're doing with it, but it's, I mean, just running as a,

12:35 so this is like a generated PDF.

12:37 I could easily just do that as a multi-processing or sub-process and get the answer.

12:41 and that fixes that, right?

12:42 It's not always you gotta replace it.

12:44 I kinda like that you could run this as like a pre-commit hook,

12:46 like so I can just continually get a report or after an event of like,

12:50 I added a new import into my project or new dependency,

12:54 I'd wanna know.

12:55 Yeah, or CI, how about this?

12:57 The next feature is it also has a pytest plugin.

13:01 So you could just run it, run your pytests with the GoR.

13:04 Why would you not do this?

13:05 This is gonna save a lot of head scratching from a lot of people who are like,

13:08 why is my thing not running faster?

13:10 right it went for a while and then it gets worse right and they may be blaming free threading when

13:14 it's not actually free threading's fault it's some dependency that brought in and permanently

13:19 disabled this for you comes from the fact like you what do you mean the gil can get turned back on i

13:24 ran the free threaded one like that's insane to me yeah so all right also anything else oh yeah so

13:29 if you go over to the docs um this is not the docs but i have a security tab it has no

13:35 astestations don't tell anyone but if you go over the documentation which is that'll be fixed tonight

13:41 it's um built on great docs which is a glorious glorious thing um but if you go to the user guide

13:47 audit environment scroll down till you see some stuff and then where is it here um gosh i forgot

13:54 the guy's name who sent me this message on linkedin when i talked about this but there's a way to run

13:59 it even if you're on like python 312 non free threaded version you can run this uv run command

14:07 against your requirements file.

14:09 And then it will basically sample it.

14:12 Yeah, so you're like, I don't want to touch my code or nothing,

14:14 but let me just run this command, these two commands against,

14:17 with uv against the project, right?

14:19 And then off it goes.

14:20 And because uv is so awesome, it manages the environments,

14:22 the installing a free-threaded Python to make it work, all that stuff, right?

14:25 Yep.

14:25 And I think that's something we mentioned in last week's episode

14:28 was about uv making brand new isolated environment,

14:31 multiple isolated environments, even inside of one project.

14:33 Yeah.

14:34 Yeah, that's crazy.

14:35 So anyway, there it is.

14:36 That's my new project, Gilguard, G-I-L guard.

14:40 And hopefully people, it's just one more contribution

14:43 to help people move to at least potentially supporting

14:46 free-threaded Python.

14:47 And I think this is, even though it's a simple little package,

14:50 I think it'll be pretty significant because you turn it on and it catches a lot of these errors automatically.

14:55 Yeah, I'm not sure about the import part of that in my code,

14:58 but definitely the pytest version, the running as an inline module or this isolated run of that,

15:06 Like it's just completely hands off and not going to mutate or potentially affect the

15:11 output of the run to my code.

15:12 You can also put it in warning mode for the import and it'll just give like detailed reports

15:17 with like super big warnings.

15:19 So you can choose to not have it crash your production.

15:22 If you're touching free threading, you better be using this package.

15:26 Why not?

15:27 Why not?

15:27 It's totally free.

15:29 For real.

15:29 MIT, go out there and just have at it.

15:32 All right.

15:33 I love that.

15:34 Yeah.

15:35 Awesome.

15:35 Thanks.

15:35 let me switch this around all right so i want to tell you all now about our sponsor longlink so

15:42 longlink is a cool project so if you go over to their main website first of all their most

15:48 important call to action is you know please could you just star the GitHub project and give it a

15:51 look but here's the deal so this is made by a growing startup out of switzerland and if you've

15:58 got a company that's not a pure tech company or maybe even if it is like you ask yourself how much

16:04 your company still runs on spreadsheets and unrepeatable,

16:08 unreliable things.

16:09 So for most businesses, that's a lot of the, a lot of the runtime is Excel,

16:14 right?

16:14 Approvals might live in an email thread,

16:16 tracking lives in a shared Excel file.

16:18 Off the shelf software rarely fits the way that work actually happens. So you kind of got to work around it.

16:24 And now, obviously we're in 2026, that AI has totally changed that math. So you could build custom software pretty easily for

16:32 your business.

16:32 But keeping it simple and affordable to maintain, that's now the hard part. So the

16:37 problem Longlink is trying to solve is making that easy to maintain reliable by providing a platform

16:43 for all these things to be built on to run business processes.

16:46 You write your business apps in plain Python with familiar libraries and standard development practices.

16:51 Longlink provides the platform underneath.

16:53 Authentication, permission, deployment,

16:55 storage, routing, and logging are all

16:57 handled for you. You focus on the business logic, maybe you and Claude.

17:00 You think purchase approval, vendor onboarding, work orders,

17:04 or complaint tracking.

17:05 Start with one process, then build the next.

17:08 See how it goes.

17:08 Getting started is one command, uvx long link init.

17:13 There's uv again.

17:14 The platform has a free tier, no credit card required.

17:17 The project is open source and in beta, and the team would love for you to try it

17:21 and share your feedback.

17:22 And while you're there, they'd really appreciate it at GitHub Star as well.

17:24 So check them out at pythonbytes.fm/long link.

17:28 Link is in your podcast player show notes.

17:30 So pretty neat project.

17:32 Check it out, everyone.

17:33 It is cool.

17:34 Yeah.

17:35 When you first said that, I wondered if there were the opposite of a URL shortener,

17:38 but no.

17:39 Exactly.

17:40 I want something completely obscured as a URL.

17:44 Longer the better.

17:45 Remember Bitly?

17:46 Give me the opposite of that.

17:48 Sounds like a total vibe-coded project.

17:50 Yeah, exactly.

17:51 And it's going to exist pretty soon now.

17:54 I'm sure it will.

17:56 Long week's a cool project.

17:57 Check it out.

17:58 And pip, I mean, we talk about uv, but it's not the only way.

18:02 No, that's true.

18:02 And pip has a new release, which again,

18:05 a little more on the supply chain security bandwagon.

18:11 PIP 26.3 has a couple really interesting features and some documentation update.

18:16 But most importantly, since the November 2nd release,

18:20 its security policy and the documentation got updated basically to clarify that pip has never considered installing untrusted wheels safe

18:29 but because python's import system is dynamic pip can't guarantee that installing a wheel won't

18:35 execute third-party code so this should sound familiar to folks out in the audience because a

18:40 lot of these have been relying on some startup hooks and path pth file exploits to basically get

18:48 things thrown where they probably shouldn't belong.

18:52 Another thing that the big change is there's been

18:54 a warning since 26.1 around avoiding loading code from packages being replaced. So pip now blocks

19:02 unexpected imports during wheel installation.

19:05 So it'll load what needs for installing and it'll

19:07 report the error up front.

19:08 If you're using a command line, the CLI like pip, for example,

19:11 you'll get basically blocked until pip exits.

19:14 The import won't happen and the execution won't happen.

19:17 The code that calls pip programmatically will get warnings after the return controls from the pip library.

19:24 And this has been rolled out in steps.

19:26 Like I mentioned, it first started in 26.1 with a warning at the unexpected import of blank after pip started.

19:33 26.3 now enforces this behavior change and it will turn it into an error and stop.

19:38 So there's quite a few links I put in the show notes about the issue and the pull requests and some of the comments.

19:46 Basically what tripped this up in the wild was one of the user's organizations had a

19:53 at exit handler that was reporting interpreter usage metrics over HTTP.

19:58 And that basically gave some warnings.

20:00 And there's a couple other projects that are in the Python space that have maybe stumbled

20:05 across this, like Rich in the Emoji Codes was doing this.

20:09 The Lark API project was doing this.

20:12 It was not without controversy.

20:14 There is a slight issue right now is that there's an additional overhead to running this check.

20:21 So the author and a couple of people went back and forth inside of the various pull requests.

20:27 But basically importing pip's install command, which is where they were putting the kind of list of things that we're going to possibly lazily import during the install process,

20:35 is adding about 700 milliseconds of latency to the install process.

20:39 So others were complaining because, you know, yes,

20:43 it's not pip isn't necessarily installed in every environment and it could be called.

20:46 But the authors reply.

20:48 So this is Damien Shaw said that just moves where the import cost is.

20:52 And turning this on or turning this warning into an error is now crucial,

20:56 given the stance of security and supply chain attacks that are out there.

21:00 So if there's any kind of interrupted install, PIP will now write recovery metadata and reports to allow you to understand what happened.

21:06 An interrupted uninstall may need a manual recovery.

21:09 That's an uninstall, not install.

21:11 So check that out.

21:12 Another thing in 26.3, so if you are still a pip user,

21:15 there are pylock.toml improvements for installing extras.

21:19 And then there's also some new --group for installing non-default groups of dependencies.

21:26 So a couple of little nice little dependencies.

21:28 And another thing that pip will also refuse to do

21:30 is follow a file URL redirect, which obviously can lead to hilarity

21:37 or most likely security and supply chain issues also.

21:41 So again, I linked in the show notes to the issue,

21:47 the PR and that other kind of details in there.

21:51 I know it's a small thing, but again, anything we can do to make sure folks are not susceptible

21:55 to these supply chain issues and chain problems,

21:58 I want to make sure we're all on top of.

21:59 So I'm also not a pip user anymore.

22:03 I'm a uv all the way, but I know that that's not normal.

22:06 there's probably a tremendous majority of people who are probably still out there using pip for

22:10 things yeah absolutely and you know security is good this is all very important also just beginners

22:17 you know a lot of beginners come on they're not like oh the first thing i learned is uv yes exactly

22:21 how many docs still say pip install xyz you know yeah don't install i don't know what package that

22:26 is by the way so but yes it's it's just interesting because during the pip install

22:31 lazy imported pieces of code were the problem like it's like you were i'm going to install this thing

22:36 And then like in the middle of it, as you were like raising the curtain

22:38 and getting ready to put down the next piece of like stuff,

22:41 something else would happen that you weren't expecting.

22:43 And that is where this is blocking it now.

22:46 Probably a wise thing to do.

22:47 Just tightening everything up.

22:48 I'm here for it.

22:49 Sounds good to me.

22:50 All right.

22:51 Let's talk about some developer tools.

22:52 How about all of them?

22:54 All of them.

22:54 All of them.

22:56 So guy behind this sent me and said, hey,

22:58 I want to tell you about some regex tool that I made.

23:01 I'm like, I don't know.

23:02 I mean, regex, like we talked, there's a lot of regex.

23:04 But then I kind of poke around this place called HeyUtils.com.

23:08 I've never heard of it.

23:09 Flash tools.

23:10 I hadn't either.

23:10 There are 306 tools.

23:12 So look at this.

23:13 You got some JSON and you want it in Tommel and you don't feel like making your AI do it.

23:17 Just go in here, paste that bad boy in there and boom, you got Tommel.

23:20 Or you've got...

23:21 Oh, that's cool.

23:21 So the tools are all online.

23:23 You can use them in line from here?

23:25 Exactly.

23:26 It's a JSON path tester.

23:27 There's a JSON diff over there, which probably if they're out of order, it doesn't matter,

23:32 I'm guessing.

23:33 JSON to Go, JSON to Java, to TypeScript, to Python.

23:37 What do we get?

23:39 We get data classes.

23:40 Yeah, that's pretty sweet.

23:41 Like there's a note about a Pydantic one.

23:43 Yeah, oh wait, hold on.

23:43 You might be able to get more.

23:45 Target is Pydantic or data classes.

23:47 How about that?

23:48 That's pretty solid.

23:48 Scroll, there's CSV stuff.

23:50 There's file stuff, text encoding,

23:51 regex.

23:52 There we go.

23:52 That's what I said.

23:53 UUID generators, time and math, you know.

23:57 That's pretty handy because I can't tell you the number of times I have like JSON I want to validate in my clipboard.

24:02 And I'm just like, I just want to go to a web page.

24:04 So I go search for a new tool every time I do it.

24:07 Course tester.

24:08 Exactly.

24:09 I'm like, every time, JSON validator online.

24:12 And it feels like it's purple.

24:14 I'm like, yeah, it's purple.

24:15 But I just, I don't remember, right?

24:17 Certificates.

24:17 Anyway, we're only like 75% of the way through.

24:19 So there's a lot of stuff here.

24:21 I just thought, you know what?

24:22 I was, you have no idea.

24:24 I mean, you have an idea.

24:25 But the general you out there has no idea how many tools we get sent.

24:29 It's honestly kind of overwhelming.

24:32 to open up my email in the morning.

24:33 I get so many.

24:35 Hey, Michael and Brian, we just, I really enjoyed your episode.

24:38 And I'm like, no, I did not misspeak and forget Calvin's name.

24:41 That's what the email says.

24:42 Hi, Michael and Brian.

24:43 Because they got some crap AI that was trained six months ago

24:47 that's trying to submit their stuff to every podcast they can find.

24:50 You know what I mean?

24:51 And I'm like, erase, erase, erase.

24:54 But I feel bad because every now and then I'll get a real one,

24:57 a real legitimate, somebody's taking the time to send in something.

25:00 And I'm like, oh, I almost deleted you

25:02 you were the ninth one in a row you know what i mean so anyway that's why i put emojis in my

25:08 subject lines so i always stand out exactly i'm just kidding hashtag drop a dolphin if you if you

25:14 also use right how about uh how about dropping an extra i got an extra for you i got a fun little

25:21 one here uh you've heard of all the refrigerator and freezer hacks going on in europe because people

25:29 didn't patch their OSs or left the default password on there.

25:33 So someone developed a nice little honeypot project,

25:36 which, okay, I'm not into hacking refrigerators, but it is an interesting

25:40 research project.

25:41 And they managed to build a single file Python with no dependencies other

25:46 than the standard library version of a honeypot that acts like it's one of these supermarket

25:52 refrigeration controllers from Dan Foss or Dixle.

25:55 And so it'll return login pages and all the pieces that make it look like it's actually doing the thing that the malicious

26:03 attackers would do.

26:04 And then it writes out a nice little report for you as the person running the

26:08 honeypot.

26:08 If you're a security researcher or you want to just kind of tinker with security research,

26:13 this is a fun little way to get started.

26:15 So check it out. It is called Cold Frame.

26:17 I like to play on the pun on refrigeration controllers,

26:22 but looks pretty fun.

26:24 I haven't tried it myself so maybe it maybe itself is a honeypot it's only a few days old but can you

26:30 believe they installed it oh my god yeah well i went and looked at the code like the honeypot

26:34 file itself is only 735 lines of code so it has in there again all the login screens all the the

26:42 bit that makes it look like it's real to one of the potential attackers that's kind of fun i mean

26:47 not cool that it's happening but i love the idea of honeypots and these canaries and type of things

26:51 they're really great especially if it's your hobby and you want to like see what's going on

26:55 and experience it if you can get one of them hitting your honeypot then you'll gather data

27:00 from the attackers yeah absolutely now before we move on to my extra i just we were talking before

27:04 the show but it feels like maybe worth bringing it out to the audience now as i go around and look

27:09 at these different projects that people send me and so on like you never you never know what's out

27:13 on the internet right there's all the supply chain stuff so if you're thinking about a project maybe

27:18 just take the two minutes, copy the GitHub URL,

27:21 go to your favorite AI and go, hey, I'm considering using this.

27:23 Is there anything malicious in here?

27:25 Don't do a security review.

27:26 Just tell me, is it a supply chain thing?

27:28 And just, you know, that's the new virus scanner I think we got to get to.

27:31 These repositories have hooks potentially in them that could run code on your machines.

27:36 When you clone it, and then if you change into another branch, there's a hook that can fire

27:40 that can do whatever it wants.

27:43 Isn't that nice? I get an extra little bit of execution that I

27:46 didn't expect it was convenient it was convenient as developers because we would use it for certain

27:50 things but it's also very convenient for attackers yeah absolutely all right well my only extra is

27:57 congratulations welcome to brett smith so brett smith is joining the python software foundation

28:03 as a security developer along with seth michael larson the security developer resident and mike

28:09 fiedler as the pypi safety and security engineer who i feel like we probably covered some of his

28:14 work at the beginning for your things. He was definitely involved. So this is super cool. And

28:17 this is, I think we, I gave a unsolicited shout out to Claude earlier,

28:23 but you know, Anthropic's pretty awesome in terms of their coding tools.

28:27 And this is made possible by Anthropic donating support to the PSF. So thanks Anthropic as well. I just hope that Brett's middle name is Michael,

28:36 because we've got Seth Michael Larson, Michael Fiedler. We got to keep the mics going.

28:41 There's a lot of Michaels out there.

28:43 No, congrats, Brett.

28:44 And thanks, Anthropic.

28:46 Okay, close it out with a joke.

28:48 What do you think?

28:48 I never peek.

28:49 I always wait for the joke to hit me so you get the actual reaction.

28:53 I love it.

28:53 I love it.

28:54 That's the way to do it.

28:55 I actually have two jokes for you.

28:56 Okay.

28:57 I'll give you my first joke, which is I had not planned it,

29:00 but this is a coffee mug that I got that one of my older daughters,

29:04 they're twins, so I have two older daughters,

29:07 gave to me for something.

29:08 And it says, the code doesn't work.

29:11 why?

29:12 This is a frustrated developer.

29:13 Same picture.

29:13 The code works.

29:14 Why?

29:15 That's a good one.

29:16 I haven't seen that one before.

29:18 Yeah, I literally had this conversation with Claude yesterday

29:20 and it said, oh, I changed this thing

29:22 so this would work.

29:23 I'm like, but it worked before.

29:24 Can you help me understand why?

29:26 Because I don't know.

29:27 And he goes, Michael, honestly, I can't tell you why this works.

29:30 I'm like, oh, nobody knows.

29:33 All right.

29:34 Okay, that's where the joke.

29:36 Sometimes the agents get a little lazy.

29:38 They're like, that seems hard.

29:39 I don't want to do that.

29:40 I know, exactly.

29:41 What do you care?

29:44 Creator said save tokens.

29:46 We're on a subscription plan.

29:47 Okay, you're right.

29:48 Speaking of which, so the joke is,

29:50 I've entitled it No Papa.

29:52 So Docker is the papa.

29:54 The CPU is the papa.

29:57 Docker is the kid.

29:58 CPU says, Docker, Docker.

30:00 Yes, papa.

30:01 Eating RAM?

30:02 No, papa.

30:03 Telling lies?

30:04 No, papa.

30:05 Open your mouth.

30:06 And you look in there, it's 9.06 gigs of RAM usage.

30:12 no papa it's fine well that was a fine it is yeah that's a fine episode calvin thanks so much as always enjoyed

30:22 it yep you bet bye and bye everyone see you see you next week