Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds.
This is episode 442, recorded July 28, 2025. I'm Michael Kennedy.
And I'm Brian Okken.
You can connect with us and the show over on Mastodon or on Bluesky.
You can find the links at the top of the show notes to all the different accounts for me, Brian, and the show on those various places.
If you want to be part of the live show, as I know some of you I can see now are, then join us usually Monday, 10 a.m. Pacific time on YouTube, pythonbytes.fm/live.
That'll take you there.
And if there's a live episode going there and even like point out, hey, we're live right now and here's how you find us.
So we appreciate all the live interactions.
It makes the show better, we think.
And yeah, so support all of our work, Brian, through his three courses.
You got three courses right now?
Yeah.
pythontest.com?
Yeah, three or four, something like that.
Beautiful.
And obviously the course is over at Talk Python, got a bunch of them.
And I have more to say about that later, actually.
So some very cool things coming there.
What's our first item?
Well, I was going to talk about, which button do we push?
That one?
Okay.
I wanted to talk about open source security.
Actually, security with respect to open source projects.
And this is something that Seth Larson likes to talk about.
He's the security dude at, isn't he?
Does some security for.
Yeah, this is official title is security dude at the PSF.
Security dude.
So he's got an article, open source security work isn't special,
but it kind of is, but it's kind of not.
So the discussion is around how we,
one of the amazing things about open source work is you can,
you can have contributors from around around different places you can have community can
people helping with the community building people helping with development docs tests uh funding
all sorts of stuff people can help out uh security is one of those things and um but um but one of the
the one of the topics really is that seth brought up is that people kind of think of security as
different because it's so important. It's, it's, you don't, you want, you don't like if somebody
just randomly came in and like implemented a cool feature, you can look at the code and go,
oh yeah, and that's kind of neat. Maybe we'll take it. Maybe we won't. But if somebody wants
to modify the security settings or do something around security with your project, either of the
project, the code project code itself, or just the community around the project and maybe the website
or something. That would be a little scarier, but maybe it shouldn't be. One of the things he
brought up, which is really important, is we kind of want the core maintainers to be like the people
that only can muck with the security stuff, but they might not have the skills necessary. So
maintainers, especially for smaller projects, are almost always experts in the domain of the project,
but not necessarily security experts. And that's definitely the case for me. I could see myself
working on like the test code or some other like, you know, application, but I'm not going to be the
security expert. So I would love to have somebody help out, but there's issues around that, right?
So the article goes into discussing things like trust and different things. One of the benefits,
like let's say we had security specialists that work on lots of different open source projects.
They could, because they are understanding multiple projects, they can see how other projects are triaging vulnerabilities and learn from different projects.
So we kind of want to spread that knowledge around between projects.
And having security experts bounce around would be good.
Just like we might have people that are good at pytest jump around and help out with the test code on different projects.
We could have security experts.
But how do we trust them?
And he does talk about trust.
And one of the great things about how to trust people is to meet them, like actually go to
go to project, go to like conferences and stuff and meet people in person.
And I think that's important.
But I would say like for a project of mine, I would if somebody said they wanted to help
out with the with the security aspect of it, I would if they had a portfolio, like, you
know, if they're already a contributor to like Flask, I'd be like, oh, yeah, they do
security for Flask.
They totally can work on this.
So building, and I think that's kind of where Seth is going,
is to try to build up a community of trusted security people
within the Python open source community.
And I think that'd be really cool.
So cool article.
Yeah, it's a neat idea.
Like, why should it be special, right?
You don't restrict the looping aspects of your project to like,
these are the loop specialists.
Yeah, well, he did talk about like the scary bit of like that XZ thing
or whatever, where somebody kind of pushes into a project to help with something else.
And then they maybe are one of the fears is also is if a security person changes something,
I don't know if it's bad or good. Right. Because I'm not the security expert. So,
yeah, dealing with that. But Seth is like saying that that's not as big of a problem as
as we might think. And and part of the, you know, trusted people around it would help.
Yeah, I would say diverging slightly from Seth's article, it might be worth just asking your favorite code AI agent like, hey, don't make any changes, but please do a security review of my code and explain the issues and see if it finds anything.
Or if somebody makes a change, you could say, hey, AI, what is the security impact of this change?
It's, you know, it's not necessarily 100% perfect, but it's sort of like double input accounting sort of thing, right?
Yeah, but right.
Yeah, that'd be cool.
Also things like, for instance, if you've already hooked up Bandit to a project to do a Bandit testing for security,
like adding that to another product.
If you see another project that you work with,
it doesn't make sense.
One of the,
the one of the advice, Brian, I don't know.
If someone or something is named Bandit,
do you really want to put them in charge of security?
That sounds a little sus, honestly.
No, Bandit's a cool tool. Sorry.
The other topic that he brought up that I appreciated was,
we do talk about companies utilizing open source projects a lot.
So this is where it really makes sense.
A company is probably going to have some security experts, right?
A larger company.
Those people could look at the dependencies
and contribute to those projects
that don't live up to their security standards.
Go ahead and contribute to help make them better.
Yeah, that's a good point.
Instead of saying this thing's not secure enough for us,
and we'll do a few PRs, and then it will be.
Yeah, exactly.
Exactly.
You know what probably is up to most people's standards is uv.
Yes.
Yeah, so uv is killing it.
And a major release has been released of uv.
And so I want to give a shout out to that.
However, between the time I noticed that, there have been three more releases.
So there's actually 0.8.3 and.2 and.1 and so on.
There's a smaller change for those.
But one that's notable is you can now get Python 3.14, which I know you're going to give a little shout out to.
The release candidate, you can get that through uv, Python, or just V and V and say that, right?
But the real notable one here is the big changes from 0.8.0.
So they say, hey, since 7, v7 back in April, I'm just going to like stomp on the 0 version.
What's this version 7? No, just kidding.
0.7 back in April, they've got a bunch of changes and improvements, but they could break some workflows.
they've been kind of holding those all back and they're letting them loose in 0.8. So for example,
some, this is the one I'm most excited about the stabilization of a couple of uv Python install
features, which is also uv venv if you don't have that version of Python installed, right? Like
that's sort of implicitly happens. So one that I was asking for, and the soon as I saw that uv would
install and manage Python. I'm like, is there a way that one of these could somehow become
the Python instead of being stashed in some crazy path, right? Like, could it be in
tilde dot local slash bin, for example, right? Well, yes, now. So the new change is it will
install Python executables into a directory on the path. So you can basically manage your system Python
sort of via uv Python install. I think that's pretty cool.
Okay. Is that what that default flag does?
Yes.
Yeah. If you put, well, it used to have, so it says if you uv Python install,
now it's installs a version of Python into a directory on the path by default.
Oh, okay.
Yeah.
It does it.
Yeah.
All right.
I think it just does it, which is pretty interesting.
I'm pretty psyched about it.
It registers Python versions with the Windows registry.
I imagine that means like, you know, Python's, I'm sorry,
Windows is all about the registry.
So it probably means like other tools can discover that Python is installed and so on.
It has a little bit of safety about removing virtual environments
if you're going to recreate them and things like that.
There's a bunch of other changes here.
So this is like pretty serious release.
I guess the last one that's pretty interesting here, maybe two even.
One is that uv build is now the default backend of uv init,
which creates a project in a pyproject.toml and those kinds of things, right?
Remember it was hatchling and then we were like,
well, is it hatchling?
Like how is the build back in specified and so on?
Well, now it's uv build.
That's cool.
Yeah, it's very cool.
I've been using uv build for a long time,
but just typing uv space build instead of, you know,
run that or whatever.
Okay.
And then it also sets the uv tool bin directory on Docker images.
This is kind of a pain because if you install stuff,
a lot of times the Docker images don't have access.
So if you're not paying attention,
you'll like try to build a Docker image.
And then the next step in the build is run,
run one of the tools you've installed to make something happen.
And it'll say, can't find this tool.
You're like, where is it?
You know what I mean?
So you got to set the path and so on.
So now you can, that's a little easier.
And so on and so on.
Like, look at all these changes for just 0.7 to 0.8.
It's the second digit may as well be the major digit.
Yeah, that's why I was calling it version 7 and version 8.
I'm like, these are just major versions.
They're just not committed to majorness.
Anyway, fun stuff.
All right.
Back to you.
Okay.
I've got a bunch.
I couldn't decide.
So I'm going to do a bunch of extras.
So first up, Python 3.14, release candidate.
One is a go.
This is from Hugo.
So, yeah, I guess that's it.
I guess this was six days ago.
So we may have already covered it last year or last week.
I don't remember.
So 3.14.
I don't think we covered it.
I think this is new news.
And this is a big deal.
The release candidate means, I mean, beta is supposed to mean that it's,
Yeah.
No features, no changes.
But now it's very, very close to what we're going to see in October
or whenever it comes out.
So people could maybe start testing with it.
Yeah, so that's where the call to action comes,
is we strongly encourage maintainers of third-party Python projects
to prepare their projects for 3.14.
And so if you've got CI pipelines for testing,
now's the time to turn it on.
if your project doesn't work with 3.14,
this is now that, I mean,
actually you should have brought it up sooner,
but you can bring it up now to say,
hey, there's an issue.
And so there's a link to the Python bug tracker
and then a list of all the different features
and whatnot, build changes, incompatibilities on here.
So that's first.
So yeah, please test everything.
And okay, so that's my first item.
Second item is f-strings, WTF.
So this is brought to us by Armin Ronecker,
encouraged by Lucas Lange and Yuri.
So this is, I took this, have you taken this yet, Michael?
No, I haven't.
And by the way, fstrings.wtf is the domain name.
Yes.
Yeah.
So this must, the top level domain of WTF, gotta love it.
So it's just a little quiz thing.
The first question is awesome.
So if you print F hello world, what do you get?
It really doesn't matter what you answer.
No, what you get is a linting error.
So it's, you know, correct.
f-strings are working exactly as you'd expect anything.
But you got to go through, there's 26 questions.
And it's a little, it's tricky right off the bat.
Like I know that the ellipses object is a thing.
So what happens if I do that?
well there's no there's no curly braces so of course it's just anyway um it's a fun thing i
thought i was going to do great since i do f strings all the time and i got like half of them
right so i learned a lot in uh going through this so i highly recommend well you're going to make me
have to do it now as well yeah um so this is uh this is good plus some of the um some of the
descriptions and uh and you know no phone funny business here we just a literal string with three
dots there's there's some good commentary within the within the quiz also so i highly recommend
django turns 20 uh happy birthday django um so we're going to link to birthday 20 django project
dot com uh this there's a whole bunch of celebrations planned uh and it's uh so this
is kind of fun there's a there's a map event of like if there's a party near you kind of fun to
go for a Django person.
Where's the closest one to me?
Looks like in October 17th,
I could go down to San Francisco if I wanted to.
So at PyBay.
Nice.
So anyway, there's that.
MakeDocs redirect.
I've been using MakeDocs lately a lot
for documenting a bunch of stuff.
I like MakeDocs.
But sometimes, and I'm actually doing
some fairly big websites,
documentation websites with MakeDocs.
It works pretty good.
but sometimes I put things in the wrong place right um you and with Hugo I've been used to um
used to being able to to like move things around and have both links work like if you move it
somewhere else but have the old link still work that doesn't work right off out of the box
with make docs there's not a thing so there's a make docs redirects plug-in that allows you to
have the old name and the new name so I haven't actually tried this yet but I need it so I'm
going to try it today yeah and my my last extra that i wanted to bring up is just an article that
i enjoyed um called uh by patty carver saying i'm tired of talking about ai and um and actually
even if you're not tired of tech talking about ai i think this is a good thing to like read through
because there's some things that i think that a lot of people are feeling like should i
because i've heard a lot of there's a lot of comments in here and reactions to comments like
if you don't start now, you won't be able to find work soon. That's scary, especially if I don't
have time to work on this right now. And I know that the commentary often is, well, you don't have
time because you're not using AI to free up your time. That's a tedious discussion. But there's a,
I think there's a, there's a, some of the cool reaction here is this just doesn't make sense.
We're telling people that AI is going to help them.
Pretty soon, anybody off the street can be a coder with AI.
Well, if that's true, then why is it so important for me to learn it today?
Can't I learn it next week when I really need it?
I don't agree with everything in this article, but there's some great logic in here.
I like it.
Plus, great writing.
That's all of my extras.
Awesome.
All right.
What have I got?
So I want to talk about Toad the Wet Sprocket.
Yeah, Toad the Wet Sprocket.
By the way, one of the best bands from the 90s.
Come on, Toad the Wet Sprocket.
It was amazing.
So this one comes to us from Will McGuggan.
I see out in the audience, Will is providing the perfect transition here for us.
AI fatigue is very real.
Yes, I agree.
I agree, Will.
But he is also helping, contributing both to this.
Thank you, Will.
Yeah, thanks a lot, Will.
Yeah, this project's called Toad,
which originally was going to be called Textual Code,
but became Toad,
is an improvement on the terminal-based agentic AI
sort of programming story.
So Claude Code and Gemini and all those types of things,
they've got really pretty poor terminal experiences,
even though that's their only user interface,
which is interesting.
Like, for example, if you resize the terminal after you get an output,
it can, like, screw up the formatting and stuff, which is weird.
All sorts of things.
So he came up with this cool project that has basically taken advantage of Textual
to create a really nice terminal experience.
And so, yeah, the idea is that it's supposed to be a universal front end for AI in the terminal.
And you can even go and watch, like, a little demo that he's put together,
UV Run Toad, which is pretty fun.
And, you know, I think this is an agentic example.
He says, write a Python code to display the Mandelbrot set.
And then, boom, just off it goes.
Write it in the terminal with code formatted nicely and syntax highlighting and all that.
Then you can say, run it.
You can say, explain it.
You get the modal dialogues.
All the things you would get from Textual, right?
So Will says this is not yet a thing you can just go grab.
But down at the bottom, you can say, code isn't quite ready for public release.
It remains a tadpole for now,
incubating in a private little pond of a repository.
But you know, he's all about Voss.
So it will be out soon enough.
In the meantime, you can,
there's ways to get early access to it.
For example, sponsor him.
So cool project, Will.
I want to just give that a shout out.
Yeah, definitely.
I always pay attention if Will's doing something.
Exactly.
So I guess you probably don't have any extras
since you just talked about your extras, right?
I do.
Yeah, I don't have any extras.
You don't have an extra extras.
Let's say that.
No more extra extras.
So I'm going to be releasing a new course really soon.
So make sure you are a friend of the show.
That could be Python Bytes or Talk Python gets a little bit,
send a few more emails over there that might be talking about it.
So if you go to talkpython.fm, click on newsletter,
share your name and email, and I'll let you know.
But very soon, I have an excellent course coming out
that I think people are really going to enjoy.
All right, with that, shall we joke, make a joke?
Yes.
If one joke were good, wouldn't two be better?
sure you'd think yeah you would think that's true for for a while until at some point like okay
either i'm tired of jokes or my my cheeks are whatever stop all right so here's the first one
what are the heaviest objects in the universe and it's got this um like uh eisen um like general
relativity sort of space-time curve continuum thing so we've got the sun and it it bends space-time a
little the neutron star obviously super big much deeper than the sun the black hole is almost a
singularity but what is more singularity than black holes node modules the node underscore modules
folder from when you create a new project it's just like I tried to use two libraries in npm
install them or yarn install them and why are there 250 things in node modules pretty fun this
This is good, this is a short little one.
But even better, we have Azure's Cloud Appy.
Cloud Architect, senior platform engineer.
This is a very fun video.
And I'm not sure if I got the right link,
I have to update that potentially.
Anyway, this comes from us,
I believe this is from Programmers Are Also Human.
And it is a six minute video that is just hilarious.
- This dude is on fire, I love all those videos.
Yeah, he's the same guy that did the vibe coding YouTube jokes.
And so this is a YouTube video, obviously.
We're not going to go through it.
But if you need to laugh, watch it.
Let's read the titles of the books on this desk, though.
Go for it.
So we've got how to do cloud and what?
How to move back on-prem.
Right next to each other.
Yeah, exactly.
Right next to each other.
We also have introduction to guesstimates.
Introduction to guesstimates.
And then he has a coffee cup that says,
DevOps agile with root access.
Yeah.
But yeah, it's really good.
He's like, and it's in this Einstein type of character
that also has a bit of a Greek accent, I believe.
It's really good.
It says, they send us our cloud bills
in scientific notation because they're so big.
It's really good.
He also gets a phone call during the interview
and he answers it and he goes, what?
No, no, it's probably DNS.
Man, it's always DNS.
He goes, yeah, this guy just called.
Somehow he has root access, but I don't know who that was.
Just kidding.
Nice.
It's really good.
If you like one-liners, it's just like a stirring of them.
It's great.
Yeah, very good.
Might be not safe for work.
Not because there's anything explicit in there,
but you're not going to be able to watch it and not laugh out loud.
Exactly.
Yeah.
If you're in a serious environment, you might need to wait till lunch.
Yeah.
All right.
They don't need to wait till lunch to listen to our show.
No, we're not that funny.
Fair enough.
All right.
Thank you everyone for watching, for being here.
Talk to y'all later.
Bye, Ryan.