Brian Okken: Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds.
Brian Okken: This is episode 465, recorded January 12, 2026, and I'm Brian Okken.
Brian Okken: And I am Michael Kennedy.
Brian Okken: And this episode is sponsored by us and you.
Brian Okken: So thanks to everybody that does support us through Patreon supporters
Brian Okken: and also through grabbing the pytest course
Brian Okken: or the Lean TDD book
Brian Okken: or so many of the massively cool courses
Brian Okken: at Talk Python Training
Brian Okken: and also Michael's fun book on deployment
Brian Okken: and stuff like that.
Brian Okken: So if you'd like to,
Brian Okken: we're recording this for the podcast,
Brian Okken: but also broadcasting it live.
Brian Okken: If you'd like to join the live,
Brian Okken: you can join us at YouTube,
Brian Okken: but you can just go to pythonbytes.fm/live
Brian Okken: and there's a link on how to get that
Brian Okken: and what the timing is and all that.
Brian Okken: Also, you don't need to take notes.
Brian Okken: You can just sign up for our newsletters.
Brian Okken: So go to pythonbytes.fm, grab the newsletter
Brian Okken: and we don't do very many spammy things.
Brian Okken: We just let you know what we talked about
Brian Okken: and with all the links and a little bit of extra information.
Brian Okken: Yeah, and we love growing that list.
Brian Okken: It grows by a little bit every week
Brian Okken: and it's so fun to see.
Brian Okken: And with that, Michael, what do you got for us first?
Brian Okken: Let's talk about PortKiller.
Michael Kennedy: So PortKiller is an interesting Mac app.
Michael Kennedy: And if you're not a Mac, I apologize.
Michael Kennedy: I know it's a Windows as well.
Michael Kennedy: It's a Windows as well.
Michael Kennedy: So if you're a Mac or Windows, which is a good chunk of us, here is a cool application.
Michael Kennedy: So let me just lay out the problem for you, Brian.
Michael Kennedy: Either you've got 20 terminal tabs open or in one of your four IDE windows,
Michael Kennedy: You've got your API running or you've got your web app running or something like that.
Michael Kennedy: And you go try to run it again, not knowing that fact.
Michael Kennedy: And it says, sorry, that port is already in use.
Michael Kennedy: You're like, oh man, where is it now?
Michael Kennedy: And that's on you to know where you ran it.
Michael Kennedy: You know, I mean, there's a button to say run in your IDE versus running the terminal.
Michael Kennedy: And so maybe just press the button.
Michael Kennedy: You forgot, oh yeah, that thing was like one of the running things.
Michael Kennedy: But since 2025, there's another reason this is a pain is some of these agentic AI things.
Michael Kennedy: They're like, oh, let me start the server for you so I can test it.
Michael Kennedy: And it'll like temporarily fire up the web server and make a request and like lose track of it and not kill it.
Michael Kennedy: And it's not in your terminal.
Michael Kennedy: It's not in your ID.
Michael Kennedy: It's just there somewhere in the background, hidden.
Michael Kennedy: You can't get to it to shut it down.
Michael Kennedy: You go to a task manager activity monitor and you say Python is like four things like, hmm.
Michael Kennedy: Well, three of those are supposed to be running.
Michael Kennedy: Which one do I kill, you know?
Michael Kennedy: So it's just a real hassle.
Michael Kennedy: And so this port killer solves that problem, not just for Python, but for applications
Michael Kennedy: in general, right?
Michael Kennedy: So it's a powerful cross-platform port management tool for developers.
Michael Kennedy: It monitors ports, manages Kubernetes port forwarding, and even does integrated Cloud
Michael Kennedy: Flare tunnels.
Michael Kennedy: So it's really, really slick, actually.
Michael Kennedy: So what you do is it's got a little notification section menu bar thing that drops down and you can have multiple CloudFlare tunnels, which we've talked about in Grok and I've talked about Rathole, like CloudFlare tunnels or a thing like that.
Michael Kennedy: Like put this on the internet so other people can get to it.
Michael Kennedy: So maybe I can help debug or show off something, right?
Michael Kennedy: Like if you're trying to debug a webhook, the only way to do that is online, right?
Michael Kennedy: Because some other server is trying to get to your dev machine.
Michael Kennedy: So these tunnels are super helpful.
Michael Kennedy: We talked about that.
Michael Kennedy: So that will actually manage these things.
Michael Kennedy: Like, for example, you can go to say your Flask app and I'm pretty sure you can, I don't see the UI exactly, but I think you can go to it and say, oh, expose this Flask application as a cloud flare tunnel.
Michael Kennedy: Boom.
Michael Kennedy: It's off to the races.
Michael Kennedy: That's pretty cool.
Michael Kennedy: Yeah.
Michael Kennedy: But it also shows you all the local ports that are open and you can go kill them.
Michael Kennedy: So what you can do is you can actually go to either search for a process or a port.
Michael Kennedy: You're like, it says that port, you know, 5,000 or 8,000.
Michael Kennedy: Let's go with 8,000.
Michael Kennedy: It's a little safer.
Michael Kennedy: 8,000 is taken.
Michael Kennedy: You can't run your app.
Michael Kennedy: Why?
Michael Kennedy: Just go in there and type 8,000, find the thing and press kill.
Michael Kennedy: Cause you're like stupid clod code left that thing running and I can't find it to kill it.
Michael Kennedy: So I'll do it here.
Michael Kennedy: You know what I mean?
Michael Kennedy: Or you can just see what ports are open, what's running, all sorts of stuff.
Michael Kennedy: And I think it's super neat.
Michael Kennedy: You install it on macOS via homebrew, or you can just download a DMG.
Michael Kennedy: So that's pretty cool.
Michael Kennedy: And yeah, I mean, that's pretty much what I got to say about it, but it is nice.
Brian Okken: That's cool.
Brian Okken: Yeah.
Brian Okken: I don't like this is this obviously I'm not even sure why I'm commenting on this,
Brian Okken: but I most have like one or two ports open when I'm working on a web app
Brian Okken: because I'm not heavy duty web developer, but yeah, it looks neat.
Michael Kennedy: Well, the thing is you might not have very many,
Michael Kennedy: but you can only have one app on that one.
Michael Kennedy: And if it gets lost, especially if the little AI thing goes off
Brian Okken: and then leaves it just dangling you're like oh man yeah you got a rogue agent you got to hunt down
Michael Kennedy: yeah exactly so it's even if you're just doing one it's like it's still valuable yeah yeah it's
Brian Okken: pretty cool neat uh well what am i talking about um fine question i'm going to talk about uh making
Brian Okken: things faster and profiling so henry schreiner sent this to us and um we're he's a fan of the
Brian Okken: friend of the show and we're fans of henry shiner's work so he's a core developer um the article is
Brian Okken: how we made python's packaging library three times faster and this is cool because um packaging is
Brian Okken: is one of the um is one of the heaviest hit uh packages on pypi even though a lot of people
Brian Okken: might not uh pip install it themselves it's used by a lot of other stuff um and um i uh let's see
Brian Okken: I often am doing it when I'll reach for packaging
Brian Okken: if I'm trying to compare versions.
Brian Okken: At runtime, I'll say if I'm testing with something at 3.15
Brian Okken: versus a different one or something like that,
Brian Okken: I'll often use packaging for grabbing versions.
Brian Okken: Anyway, there's a bunch of fun stuff in the packaging package.
Brian Okken: So how did they make it three times faster?
Brian Okken: The article talks about graphing and plotting
Brian Okken: and how he's figuring this out for a while.
Brian Okken: And I'm going to scroll past all of that and talk about the actual updates.
Brian Okken: One of the things I love about this is we often hear about premature optimization is bad.
Brian Okken: But there are times where you see stuff that's taking a while and you're like, I really wish this was faster.
Brian Okken: And so there is a time for optimization.
Brian Okken: And often it goes along something like this.
Brian Okken: You put some profiling together, you try to measure the different parts of it, and then measure it and try to reproduce those, make sure they're consistent times so that they're not random.
Brian Okken: But then you just do like 10% at a time.
Brian Okken: So this is an interesting one of like 10% speed up of just stripping zeros out of stuff.
Brian Okken: They had a reversed list,
Brian Okken: iter tools drop while away to reverse it,
Brian Okken: to strip the zeros.
Brian Okken: And they just made it a little different
Brian Okken: and more actually more readable and less elegant,
Brian Okken: but it's nice.
Brian Okken: So instead of one line,
Brian Okken: there's five lines of code with a for loop,
Brian Okken: but it sped up the whole thing by 10%.
Brian Okken: And that's awesome.
Brian Okken: And then, okay, so that's a little thing, 10% speed up.
Brian Okken: And then a faster regex, 10% to 17% faster on 3.11 and above only.
Brian Okken: And that's another thing is sometimes newer versions of Python have more tools at your disposal.
Brian Okken: So you might have to have two implementations, but why not make it faster for the newest?
Brian Okken: So that's pretty cool.
Brian Okken: Removing, I don't actually get this.
Brian Okken: Removing single disk.
Brian Okken: Oh, yeah.
Brian Okken: Removing single dispatch, 7% faster.
Brian Okken: Remove duplicate version creation, 37% faster.
Brian Okken: Awesome.
Brian Okken: Removing named tuples, 20% faster.
Brian Okken: Just all these different little tiny speedups,
Brian Okken: and they're like 10% to 20%.
Brian Okken: And in the end, it's a lot faster.
Brian Okken: So I really like write-ups on people just taking a little bit befores and afters.
Brian Okken: And that doesn't mean to say if you've got something that looks like the before code that you should speed it up.
Brian Okken: You should measure and make sure that it's readable.
Brian Okken: I mean, I think the first goal is readability.
Brian Okken: Next, measure to see if it's too slow or something.
Brian Okken: Yeah.
Michael Kennedy: Write it in the form of readable, understandable, and then figure out how to make it fast.
Michael Kennedy: Yeah.
Michael Kennedy: If needed.
Brian Okken: Yeah, but there are tools available if you are ready to try to make things faster.
Michael Kennedy: Indeed.
Michael Kennedy: All right.
Michael Kennedy: I have a, I don't know how to phrase this.
Michael Kennedy: I think it's not good.
Michael Kennedy: Let's call this a not good story, but it's quite the story.
Michael Kennedy: So this is AI's impact on dev companies, open source.
Michael Kennedy: We start with a quote from Simon Wilson's sort of link blog, which itself is a quote.
Michael Kennedy: Okay.
Michael Kennedy: So Adam Watham is the CEO of Tailwind Labs, which is the maker of Tailwind CSS.
Michael Kennedy: And the story about what's happening right now with Tailwind CSS is bonkers.
Michael Kennedy: Like you would have never predicted it.
Michael Kennedy: But once you hear the story of like, ah, yes.
Michael Kennedy: Okay.
Michael Kennedy: So from Adam, he actually did this 30 minute morning walk where he like sort of walks and
Michael Kennedy: talks and it's kind of like a journal, but public or something like that, I guess.
Michael Kennedy: And he says, we had six months left.
Michael Kennedy: He says, I just laid off some of the most talented people I've ever worked with.
Michael Kennedy: and it blink and sucks.
Michael Kennedy: The direct written version is,
Michael Kennedy: this all actually came from this thing called LLMs.txt,
Michael Kennedy: which actually is pretty interesting.
Michael Kennedy: Like robots.txt, but for LLMs,
Michael Kennedy: I'm thinking about putting this on Python bytes and stuff
Michael Kennedy: to like help LLMs be more efficient
Michael Kennedy: working with what we produce.
Michael Kennedy: So if somebody wants to ask a question like,
Michael Kennedy: hey, what did Python bytes say about this?
Michael Kennedy: Like what did Michael and Brian cover here
Michael Kennedy: and what was their advice, right?
Michael Kennedy: If we put that as a, hey, LLM,
Michael Kennedy: you could technically scan the entire system
Michael Kennedy: and try and understand that,
Michael Kennedy: or you could use our search for these keywords
Michael Kennedy: and then here's how you access the transcript
Michael Kennedy: and then parse just, you know what I mean?
Michael Kennedy: You could give like a little advice.
Michael Kennedy: So someone had proposed as a PR to put that onto Tailwind
Michael Kennedy: and said, "Could you please put that
Michael Kennedy: onto the Tailwind documentation
Michael Kennedy: so that we'll be more efficient talking to Tailwind
Michael Kennedy: or asking questions of Tailwind from our AI agents?"
Michael Kennedy: And people lost it, people lost it.
Michael Kennedy: It wasn't good.
Michael Kennedy: And Adam said something to the effect of,
Michael Kennedy: like, this actually is a pretty decent request,
Michael Kennedy: but the reality is that 75% of the people
Michael Kennedy: in our engineering team lost their jobs yesterday
Michael Kennedy: because the brutal impact of AI.
Michael Kennedy: And if I add this feature, it's going to make it worse.
Michael Kennedy: All right, so here's the insane aspect.
Michael Kennedy: If you look at traffic to the,
Michael Kennedy: if you look at downloads, sorry, on NPM,
Michael Kennedy: I guess that's traffic of a form.
Michael Kennedy: If you look at the downloads of Tailwind,
Michael Kennedy: They're up six times year over year.
Michael Kennedy: Wow.
Michael Kennedy: Six times more usage.
Michael Kennedy: Don't you think that would make the product more viable?
Michael Kennedy: No.
Michael Kennedy: Because if you go to the Tailwinds documentation, it's all free, Tailwinds open source, but there's a thing that says get Tailwind Plus.
Michael Kennedy: You see that in the docs.
Michael Kennedy: However, even though there's a 6x increase in usage, there's a 40% drop in traffic to the documentation and revenue is down five times or down 80%.
Michael Kennedy: Why? Because instead of going to the docs to get help, you just say, hey, AI, install Tailwind and do this.
Michael Kennedy: Or you don't even say that. You say, make it pretty. And like Tailwind is the default styling mode of AI.
Michael Kennedy: That's pretty sad, huh?
Brian Okken: Yeah, it definitely is. I don't. Yeah, it sucks. I don't know what the solution is.
Michael Kennedy: I don't either. Avoiding LLMs.txt is probably not the answer, but it's also not a solution for sure.
Michael Kennedy: I mean, it might need a different business model. You know what I mean?
Brian Okken: Yeah. I mean, we've both seen this as well. I was faced with higher server costs on my blog. And then I put in, we talked about this earlier, I put in monitoring to see who it was, and it was mostly robots. And then I cut robots out, and we got zero traffic.
Michael Kennedy: So I'm like, not zero.
Michael Kennedy: That's not the answer either, though, is it?
Michael Kennedy: It's like saying, I do not want to appear in Google because I hate the traffic.
Michael Kennedy: I mean, I know it's not exactly the same, so don't email it.
Brian Okken: But with Google, they said, if you don't let our robots in to scrape your site for our LLMs,
Brian Okken: then we're not going to scrape your site for search traffic either.
Brian Okken: I think that's the thing.
Brian Okken: And that's lame.
Brian Okken: I think that you should be able to say, no, I don't want somebody to scrape my site for AI.
Brian Okken: but please do keep looking at it for search.
Michael Kennedy: We just like, just take a moment
Michael Kennedy: and just say that there are really good alternatives
Michael Kennedy: to Google, like Startpage, like Kaggy.
Brian Okken: Yeah, but a lot of them are all built off
Michael Kennedy: of the same data that Google's selling.
Michael Kennedy: And Startpage is built off the stuff.
Michael Kennedy: So it is in a sense, really, really the same.
Michael Kennedy: Yeah, that's a good point.
Michael Kennedy: Okay, I'm not even done with the story, Brian.
Michael Kennedy: Okay, let's hear the rest of the drama.
Michael Kennedy: Okay, so that's half the story.
Michael Kennedy: There's a really good video by this guy.
Michael Kennedy: I just came across Maximilian Schwarzmuller.
Michael Kennedy: He does a bunch of great developer videos.
Michael Kennedy: It's more of like a-
Michael Kennedy: - And an awesome name.
Michael Kennedy: - I know it is an awesome name.
Michael Kennedy: He's more like a JavaScripty guy,
Michael Kennedy: but he does a lot of just like thought pieces
Michael Kennedy: on programming in general, and he's good.
Michael Kennedy: So he did a 11 minute, 55 second video on this tailwind
Michael Kennedy: is in deep trouble, talks about it,
Michael Kennedy: actually shows a lot of graphs and data.
Michael Kennedy: So it's pretty interesting.
Michael Kennedy: Then the other is a video from the Primogen.
Michael Kennedy: And this is the other side of,
Michael Kennedy: this is another company in the same theme
Michael Kennedy: and Stack Overflow is cooked.
Michael Kennedy: It is insane.
Michael Kennedy: Let me see if I can find a spot here.
Michael Kennedy: Let me see if I can find a spot here with this graph.
Michael Kennedy: So there's an insane graph if you watch that video,
Michael Kennedy: but I can just tell you the words.
Michael Kennedy: I'll tell it to you more, Brian.
Michael Kennedy: So in, I don't have my show notes up,
Michael Kennedy: so I'm about to do this from memory,
Michael Kennedy: but I believe in the first month of Stack Overflow's life,
Michael Kennedy: there was 3,800 questions asked.
Brian Okken: Yeah, in 2009.
Brian Okken: I've got the notes up.
Michael Kennedy: Yeah, okay.
Michael Kennedy: Almost nothing.
Michael Kennedy: I mean, it's just getting going.
Michael Kennedy: It's like a forum.
Michael Kennedy: Like, no, of course, there's going to be almost no questions.
Michael Kennedy: It goes up and it stays 200,000 new questions asked per month almost through the pandemic.
Michael Kennedy: And it starts going down.
Michael Kennedy: And this is not purely from AI.
Michael Kennedy: It's going down like pretty precipitously for two years before ChatGPT comes out.
Michael Kennedy: When it does in like mid-2022, it drops even harder.
Michael Kennedy: So here's an insane stat.
Michael Kennedy: In 2016, there were 200,000 new questions asked at Stack Overflow.
Michael Kennedy: In 2026, well, technically last month in December 2025, there were 3,740-something questions asked.
Michael Kennedy: The same as the first month they opened.
Michael Kennedy: 200,000 to three or whatever.
Michael Kennedy: 3,000.
Brian Okken: It's insane.
Michael Kennedy: That is insane.
Michael Kennedy: So actually, I think the primary guide's got a premium to prepare your goodbyes.
Michael Kennedy: It's pretty much it.
Michael Kennedy: Now, it does seem to still be going strong, like selling this data, this pure data in a sense, to AI companies.
Michael Kennedy: But for how long is that going to last?
Michael Kennedy: That's like, we don't have any cows left and we can't get milk.
Michael Kennedy: But we got a lot of cheese that's really good in the freezer.
Michael Kennedy: So we can sell that for a while until it's gone.
Brian Okken: Without new questions, there's not new information there.
Brian Okken: And who's answering, even if there are new questions, who's answering them?
Michael Kennedy: Yeah, I bet you half of those 3,000 or 4,000 are like AI generated.
Michael Kennedy: Honestly, I can't believe this.
Michael Kennedy: I knew that they were going down, but 200,000 to a couple thousand is an insane level.
Brian Okken: Yeah, and they were actually one of the better ones as far as ads and sponsors and stuff.
Brian Okken: I mean, Stack Overflow, we make fun of it and stuff, but it's a part of software,
Brian Okken: and it wasn't really that spammy.
Brian Okken: It just was, it didn't have a bunch of pop-ups and stuff.
Brian Okken: So I actually kind of liked Stack Overflow.
Michael Kennedy: I know.
Michael Kennedy: I mean, I don't know.
Michael Kennedy: I don't know exactly how to feel,
Michael Kennedy: but it even went so far as we had the Stack Overflow keyboard
Michael Kennedy: that only had three keys.
Michael Kennedy: Yeah.
Michael Kennedy: Right?
Michael Kennedy: It had the, instead of the controller command,
Michael Kennedy: it had the Stack Overflow logo and then a C and a V.
Michael Kennedy: It's a beautiful joke.
Michael Kennedy: Just, you know, that's how important that used to be.
Brian Okken: Yeah, you take an error message
Brian Okken: and just throw it into Google search and you get a Stack Overflow question answering it.
Brian Okken: That's how you figure stuff out.
Brian Okken: Exactly.
Michael Kennedy: There was a period where we read books and then we copied and pasted from Stack Overflow.
Michael Kennedy: And now I guess we copy and we just take it from AI.
Michael Kennedy: But I think this is noteworthy in a big way in the developer world, right?
Michael Kennedy: This is big.
Brian Okken: Yeah.
Brian Okken: And I mean, I know that the people behind Stack Overflow, there's a lot of money there.
Brian Okken: And I think that the top of the chain, they're probably fine.
Brian Okken: But everybody that got laid off, that's lame.
Brian Okken: But Tailwind has always been a lightweight business model,
Brian Okken: even though they're doing some amazing things.
Brian Okken: And like you said, it's being used by almost everyone.
Brian Okken: So it's crazy.
Brian Okken: Yeah.
Michael Kennedy: Kiva out in the audience points out,
Michael Kennedy: it's insane how symmetric this graph is.
Michael Kennedy: I agree.
Michael Kennedy: It is insane.
Michael Kennedy: It's like almost a perfect trapezoid.
Michael Kennedy: Not quite, but almost.
Michael Kennedy: Yeah.
Michael Kennedy: While I'm pulling up stuff from the comment,
Michael Kennedy: Henry points out that he's just a PyPA member
Michael Kennedy: and builds many, many Python things,
Michael Kennedy: but not quite a core development.
Michael Kennedy: Oh, okay.
Michael Kennedy: Keep the record a little bit.
Brian Okken: Okay.
Brian Okken: Well, Henry Schreiner is a core asset in my learning journey.
Brian Okken: I guess I'll put it that way.
Brian Okken: Over to you.
Brian Okken: Okay.
Brian Okken: I wanted to talk about Henry Schreiner's art.
Brian Okken: No.
Brian Okken: Similar.
Brian Okken: So we talked about Henry Schreiner's article on Python packaging and making it faster.
Brian Okken: And it reminded me of something that I wanted to talk about for a while and I just forgot about.
Brian Okken: So thanks, Henry, for the reminder.
Brian Okken: And it was because I was and it's around profiling.
Brian Okken: So I was looking through not the packaging library.
Brian Okken: I was looking through FastAPI once looking at their I kind of do this.
Brian Okken: I kind of troll sometimes.
Brian Okken: go through GitHub workflows of different packages to see what sort of tricks they're using in their
Michael Kennedy: workflows. And I remember... It's like the view source of the modern day.
Brian Okken: Yeah, workflows. And it's one of the wonderful things about open source packages is you can do
Brian Okken: this. So FastAPI, plus the folks at FastAPI are really great about trying to stay cutting edge
Brian Okken: and helping other people. So looking through here, I saw COD speed benchmarks. And I'm like,
Brian Okken: what is this so um that's my topic right now is the cod speed tool um and um it's probably maybe
Brian Okken: it's code speed but it's spelled cod so i'm going to pronounce it cod speed um it could be measured
Michael Kennedy: in like how fast does a cod swim in the ocean and this is like a is it is it a laden cod or a uh
Brian Okken: a heavily laden cut bite your knee caps off get back here
Brian Okken: So I'll talk about the actual tool, but as we're looking through FastAPI, there's also in the merge requests for new features, there's a performance report that is linked and you can go and take a look at it.
Brian Okken: If you click on that, you go and see, like, you can go and poke around at that particular
Brian Okken: merge request.
Brian Okken: I'm looking at the overview.
Brian Okken: His FastAPI on codspeed.io has this graph of basically making is not very noisy of like
Brian Okken: the different times they've measured things and how the metrics, the performance metrics
Brian Okken: have gone up and down.
Brian Okken: And it's really kind of cool.
Brian Okken: So I was like, can I use this?
Brian Okken: Yes.
Brian Okken: So I'm going to try this out.
Brian Okken: I haven't tried it yet.
Brian Okken: but at codspeed.io.
Brian Okken: And there's a nice rabbit logo, which is nice.
Brian Okken: Anyway, it integrates into dev and CI workflows
Brian Okken: to measure performance, detect regressions.
Brian Okken: And if it was just a paid tool,
Brian Okken: I wouldn't probably be covering it.
Brian Okken: But it's one of those awesome tools
Brian Okken: that's actually not that expensive per month
Brian Okken: if you're actually paying for it for your project,
Brian Okken: for a commercial product.
Brian Okken: But it's free for open source projects.
Brian Okken: So I love those sorts of things.
Brian Okken: They're given back to the community with free tools.
Brian Okken: It's great.
Brian Okken: So what I wanted to talk about is, if we go back to the homepage, it's pretty cool.
Brian Okken: One of the things it talks about is catching performance and not noisy metrics.
Brian Okken: So I'm not sure how they're doing this, but they're saying that the traditional metrics
Brian Okken: kind of jump around a lot,
Brian Okken: but that cod speed has got a small variance.
Michael Kennedy: It's possible that they run this on dedicated hardware.
Michael Kennedy: So you're not subjected to other things on the VPC.
Michael Kennedy: Other noise.
Michael Kennedy: Yeah.
Brian Okken: So they're doing flame graphs to pinpoint problems
Brian Okken: and speed ups and slow downs.
Brian Okken: But one of the things I was really impressed with
Brian Okken: is right there on the front page,
Brian Okken: they tell you that you can design performance tests,
Brian Okken: integrate with your CI workflow and get reports.
Brian Okken: And there's like a Python button you can click on.
Brian Okken: And it's like, oh, you just take a, do a pytest.
Brian Okken: You just mark whatever test with pytest mark benchmark.
Brian Okken: And those are the ones that are used in your benchmarks.
Brian Okken: It's easy.
Brian Okken: You're already using them for testing your code.
Brian Okken: So you can just grab some of your,
Brian Okken: maybe some of your high level tests that test the whole system
Brian Okken: and try to hit and hit, you know,
Brian Okken: grab a handful of them that hit most of your system.
Brian Okken: Might be good.
Brian Okken: You can throw them on all of them.
Brian Okken: Maybe, I don't know.
Brian Okken: And then what do you do in CI?
Brian Okken: So once you try to integrate it in CI,
Brian Okken: there's tabs for GitLab and GitHub.
Brian Okken: But for GitHub Actions,
Brian Okken: they have their own action that you can use.
Brian Okken: And you just say, use that,
Brian Okken: and then run whatever your code is.
Brian Okken: So I went back to, what, FastAPI's workflow
Brian Okken: to see what that was.
Brian Okken: And their metrics, when they're running,
Brian Okken: they're just running pytest.
Brian Okken: It looks like they give it a cod speed flag.
Brian Okken: I don't know what that does, but maybe it does some cod speed stuff.
Brian Okken: So just fun.
Brian Okken: I thought it'd be good to give a shout out to these folks.
Brian Okken: And I'll try it out on one of my projects and maybe report back how it's going.
Brian Okken: But you can look directly how FastAPI is using it.
Brian Okken: It's pretty cool.
Michael Kennedy: Yeah, two quick real-time follow-ups.
Michael Kennedy: I'm going to be interviewing Sebastian Ramirez and his team about FastAPI cloud tomorrow on Talk Python.
Michael Kennedy: Nice.
Michael Kennedy: So maybe if I can keep it in my mind,
Michael Kennedy: I'll ask them about this as well.
Michael Kennedy: It's pretty interesting.
Michael Kennedy: Yeah.
Michael Kennedy: But if people want to watch that live,
Michael Kennedy: that's tomorrow morning.
Michael Kennedy: And then Henry points out that Astral uses COD Speed.
Michael Kennedy: And that was mentioned when people are asking about
Michael Kennedy: proper benchmarking for packaging.
Brian Okken: That might have been where I saw it.
Brian Okken: All right.
Brian Okken: Well, those are our topics.
Brian Okken: Do you have any extras for us?
Michael Kennedy: Let's see what I have.
Michael Kennedy: I indeed do have some extras.
Michael Kennedy: So remember how I talked about DevOps, Python, supply chain security made easy,
Michael Kennedy: and Python supply chain security made easy and all that.
Michael Kennedy: And I gave some examples using pip audit, how to set up cached build time checks
Michael Kennedy: so that your Docker images won't build if there's a CVE detected.
Michael Kennedy: Oh, yeah.
Michael Kennedy: Well, boy, oh, boy.
Michael Kennedy: Are there more CVEs in the PyPI space that I realized?
Michael Kennedy: Because just middle of last week, I couldn't ship Python bytes
Michael Kennedy: because there's a vulnerability in here.
Michael Kennedy: We're not going to let it out.
Michael Kennedy: So here's the cool thing.
Michael Kennedy: It absolutely caught it.
Michael Kennedy: It wouldn't let me release a new one,
Michael Kennedy: but it is a hassle.
Michael Kennedy: And I've also run into a little bit of a bigger hassle,
Michael Kennedy: not a bigger, an unforeseen hassle.
Michael Kennedy: I said, okay, well, what we're going to do
Michael Kennedy: is we're going to delay updating to the new thing
Michael Kennedy: by one week to make sure that that stuff gets fixed.
Michael Kennedy: Well, turns out when they find a problem,
Michael Kennedy: they fix it and they release it that day.
Michael Kennedy: But if I apply that technique,
Michael Kennedy: it doesn't get rolled into my stuff for a week.
Michael Kennedy: So got to be a little bit careful to just sort of pin some stuff for a little bit or not.
Michael Kennedy: Just don't update the dependencies until you get that.
Michael Kennedy: Or if it's not, you know, whatever you're going to do about it, right?
Michael Kennedy: But yeah, it works because I couldn't release the website
Michael Kennedy: till I like manually put different versions in to make it skip those issues.
Michael Kennedy: That's good. It's a good thing.
Michael Kennedy: All right, on to the next one.
Michael Kennedy: You probably have heard, Brian, that you should,
Michael Kennedy: anytime you're doing security, you need to have a decent password.
Michael Kennedy: You know this as a user, but if you build anything that has user auth,
Michael Kennedy: well you want to have some level complexity i feel like there's so many web builders out there that
Michael Kennedy: just suck so bad you're like how do they let you behind a keyboard for example one of my banks this
Michael Kennedy: is a international bank limits my password length not minimum maximum to like 12 characters that's
Michael Kennedy: insane that is just the stupidest i'm like are you putting that straight in the database because
Michael Kennedy: if you're putting that like if that's because that's a database constraint you better not be
Michael Kennedy: putting my password straight in the database.
Michael Kennedy: You know what I mean?
Michael Kennedy: Really bad.
Michael Kennedy: But in the extreme end--
Brian Okken: Does the length affect what the hash length looks like?
Michael Kennedy: No, the hash is the same length from one character
Michael Kennedy: and a million characters.
Michael Kennedy: That's why I'm sus of it.
Michael Kennedy: But there are actually some nuanced aspects.
Michael Kennedy: So if you're using MD5 to hash your passwords, no.
Michael Kennedy: Don't do it.
Michael Kennedy: Please don't do it.
Michael Kennedy: But there's some really nice things you can do.
Michael Kennedy: you can use more modern ones.
Michael Kennedy: And especially something that you can do
Michael Kennedy: that's really powerful is to use
Michael Kennedy: what are called memory hard problems.
Michael Kennedy: So cracking passwords is an embarrassingly parallel problem
Michael Kennedy: in that like I've got a hash
Michael Kennedy: and I'm gonna try a bunch of different stuff against it.
Michael Kennedy: And if I got a GPU,
Michael Kennedy: maybe I run like 4,000 variations in parallel.
Michael Kennedy: And if any of those match, then we call it good,
Michael Kennedy: you know, and use all the cores.
Michael Kennedy: That's because GPUs scale compute super well,
Michael Kennedy: but you know what they don't scale well?
Michael Kennedy: Memory.
Michael Kennedy: So one of the new-ish algorithms is called Argon2.
Michael Kennedy: Really highly recommended because it is not subject to this brute force attack.
Michael Kennedy: Because instead of using a lot of compute, it used a lot of memory.
Michael Kennedy: So you can't parallelize that as easy, right?
Michael Kennedy: You're like, well, each hash takes, I don't know, 15 megs to do an attempt.
Michael Kennedy: So, you know, how many of those can you parallelize before you run out of memory sort of thing, right?
Michael Kennedy: Well, it turns out that this has become a point of a problem.
Michael Kennedy: So hackers have started using, as a distributed denial of service type of thing, very long passwords.
Michael Kennedy: So like one megabytes worth of text of password.
Michael Kennedy: Because the Argon2 and the memory hard ones, the bigger the password is, the bigger the text is, the more memory they use.
Michael Kennedy: So if you just jam like an insane amount of text, all of a sudden it becomes not just memory hard for hackers, but even for your server.
Michael Kennedy: It's like, okay, this is off the charts, right?
Michael Kennedy: So I just want to put this out there on people's radar.
Michael Kennedy: Like Prudus out there says,
Michael Kennedy: my bank also restricts password length.
Michael Kennedy: Boo banks, they suck.
Michael Kennedy: But maybe they shouldn't allow a million characters,
Michael Kennedy: like limited to 100 or 50.
Michael Kennedy: Something way bigger than you're going to do,
Michael Kennedy: but like not unbounded, right?
Michael Kennedy: Don't just say less than.
Michael Kennedy: It's a super easy check,
Michael Kennedy: but this is definitely something to keep your radar on.
Brian Okken: Character restrictions are terrible also.
Brian Okken: The ones that say like,
Brian Okken: you can't use some special characters.
Brian Okken: Like, why would you not be able to use special characters?
Brian Okken: Exactly.
Michael Kennedy: I honestly think like a good chunk of this,
Michael Kennedy: and maybe this is the bank thing as well,
Michael Kennedy: is like it's a tech support thing.
Michael Kennedy: Somebody who is like 78, doesn't really know what they're doing,
Michael Kennedy: can't type in their password.
Michael Kennedy: They're like, I called tech support,
Michael Kennedy: and they're going to help me type it in or something.
Michael Kennedy: I don't even know.
Michael Kennedy: But I feel like it's, you know, restrict the characters use
Michael Kennedy: so they're more legible.
Michael Kennedy: I don't know.
Michael Kennedy: But why would you allow an L and a 1?
Michael Kennedy: I don't know.
Michael Kennedy: It's all messed up.
Michael Kennedy: or an o and a zero like can't use zeros you only can use those or vice versa well the ones that
Brian Okken: like require you to use a number also it just seems weird it's like these particular like 10
Brian Okken: characters are special and we need one of those 10 to be in of of all the possible characters these
Brian Okken: 10. that's a really good point makes me so frustrated i i have uh one password generate
Michael Kennedy: these like ones that are easier to type if you got to type them on your phone or something but they're
Michael Kennedy: like 30 characters and capital words, lowercase words, dashes, and it says, you don't have
Michael Kennedy: a number or a special character.
Michael Kennedy: I'm like, do you really think it's going to make a difference if there's an exclamation
Michael Kennedy: mark on this 30 character random?
Michael Kennedy: Like, no.
Michael Kennedy: Anyway, I am here with you.
Michael Kennedy: All right.
Michael Kennedy: Last extra, I sold my computer and bought a new one at this place called Swappa.
Michael Kennedy: So I kind of want to talk about Swappa really quick, because I just think this is a good
Michael Kennedy: Good alternative to buying computers from Apple directly.
Michael Kennedy: It's kind of like eBay, but specifically for computers.
Michael Kennedy: So you don't buy it from the company.
Michael Kennedy: They facilitate you buying it from another person, which I think is kind of interesting.
Michael Kennedy: Okay.
Michael Kennedy: So I had this Mac mini super minimum version that I had bought with some trade-ins that
Michael Kennedy: effectively I paid like 360 bucks.
Michael Kennedy: I sold it for $600 on here and then turned around and bought a maxed out Mac Mini Pro version,
Michael Kennedy: which has got like 14 cores and lots more memory, like a lot of upgrades for like $1,700 instead of $3,000.
Michael Kennedy: And you apply the $600 and it gets like, hey, that's almost nothing in price.
Michael Kennedy: So someone was saying like, oh, hey, I don't have an Apple Silicon thing and I need to do builds for it.
Michael Kennedy: And what a hassle that is.
Michael Kennedy: So like even the most brand new Mac minis are for sale for like four or 500 bucks.
Michael Kennedy: But if you look and you just want, I just need an Apple Silicon thing.
Michael Kennedy: You go to the 2020 ones and it's like 280 bucks for a new, not new, but mint ish computer,
Michael Kennedy: right?
Michael Kennedy: Like a decent M1 if you need to grab.
Michael Kennedy: Anyway, I thought that just throw that out there because I had a nice experience both
Michael Kennedy: buying and selling my computers there.
Michael Kennedy: And now I got like a really maxed out one, which I used to make my unit test go twice
Michael Kennedy: as fast.
Brian Okken: Nice.
Brian Okken: That was fun.
Brian Okken: Yeah.
Brian Okken: nice uh segue there uh so uh as an extra i've got um actually so the you all know i've been
Brian Okken: working on a new book so uh lean tdd and um i'm kind of excited about this update because
Brian Okken: i was working on just the next chapter and then it was getting big and i was writing a lot so i
Brian Okken: decided to break it up so um i split the split the book into three parts there's foundations
Brian Okken: that's talking about lean and TDD.
Brian Okken: And I think I want to expand the TDD.
Brian Okken: I've got some questions on test-driven development
Brian Okken: from people that were new to it.
Brian Okken: I just sort of assumed everybody knew about TDD.
Brian Okken: So I'll probably expand that later.
Brian Okken: But so I've got foundations.
Brian Okken: And then what I released today, this morning,
Brian Okken: was, what is it, one, two, three, four, five, six, seven, eight,
Brian Okken: nine new chapters on part two, which is lean TDD practices.
Brian Okken: and so instead of dumping this all in one big chapter i put it i split it all up and some of
Brian Okken: these are to be fair i mean in pdf form some of these are a couple pages so there'll be like
Brian Okken: three or four pages in your e-pub but they're uh i i don't want to keep it's it's a lean book as
Brian Okken: well so it's i think that the total right now i'm up to like 70 pages um after this i do want to try
Brian Okken: to wrap this up by the end of this month still. So I got a couple of weeks left. I've got the last
Brian Okken: part is considerations. I want to cover the role of test engineers, if you have them on your team,
Brian Okken: and also talk about test coverage and monitoring. But so that's only a few topics I got left,
Brian Okken: and that'll wrap up the first draft. So excited about, I've been really excited about the flow and
Brian Okken: getting this in here it is funny though um things that you think you just know in your head when you
Brian Okken: try to write it down in a sequential form it's like wait i how should i phrase this i i thought
Brian Okken: i could just talk about this easy but trying to get it out of your head is um yeah sometimes tricky
Brian Okken: so that's my thing um also appreciate so i i had set up uh github um uh repo that doesn't
Brian Okken: have the book, but it has just a place for stuff. It's Lean TDD book under Aachen for feedback.
Brian Okken: And not very many people were using it, but just recently, I want to shout out to Timothy Malahy.
Brian Okken: He gave me a bunch of stuff, like look through a bunch of typos. I really appreciate that.
Brian Okken: And then some other ideas about maybe expanding on some sections. So I like the feedback.
Brian Okken: Awesome. Congrats on the progress too.
Brian Okken: Ah, thanks. Yeah, that's my extra. How about something funny?
Michael Kennedy: Yeah, let's do something funny over here. So this one is about how amazing agentic coding is,
Michael Kennedy: even if you don't even know anything about programming. You don't know anything about
Michael Kennedy: the web, Brian. You can do it. Here's a quote. I believe this is on Reddit.
Michael Kennedy: Claude Code is blanking insane. I know literally nothing, all caps, about coding. Zero, all caps.
Michael Kennedy: and I built a fully functioning web app in minutes.
Michael Kennedy: Check it out at localhost.3000.
Michael Kennedy: Yeah.
Michael Kennedy: Nope.
Michael Kennedy: We're not going to be checking it out at 3000
Michael Kennedy: because you know nothing.
Michael Kennedy: That's funny.
Michael Kennedy: I think that captures the end of 2025 vibes
Michael Kennedy: is just like, it's amazing and terrible.
Michael Kennedy: Yeah.
Michael Kennedy: Well, I mean, when do we get AIs that can deploy for you?
Brian Okken: Well, are we there yet?
Brian Okken: I don't think we're that far away.
Michael Kennedy: I just had Claude Code helping me set up a special web socket,
Michael Kennedy: HTTP to web socket to secure web socket conversion on Nginx,
Michael Kennedy: and it was like, here, boom, perfect.
Michael Kennedy: But you got to know to ask, right?
Michael Kennedy: That's the thing.
Michael Kennedy: Yeah.
Michael Kennedy: But these are weird times.
Michael Kennedy: They're very weird times.
Michael Kennedy: They're weird times.
Brian Okken: But we're still hanging in there.
Brian Okken: And if you're hanging in there too and hanging in with us,
Brian Okken: I really appreciate everybody listening to the episode,
Brian Okken: listening to Python Bytes,
Brian Okken: and supporting us through all of the different means.
Brian Okken: And yeah, we're going to do this as long as we can.
Brian Okken: So thanks, Michael.
Brian Okken: Yeah.
Brian Okken: Thank you, Brian.
Brian Okken: See you later.
Brian Okken: Bye, everyone.
Brian Okken: Bye.