Brian Okken: Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds.
Brian Okken: This is episode 481,
Brian Okken: recorded May 25th.
Brian Okken: May 25th, 2026,
Brian Okken: not 1926.
Brian Okken: And I am Brian Okken.
Brian Okken: I'm Michael Kennedy.
Brian Okken: And this show is sponsored by us.
Brian Okken: Check out all the Talk Python training courses,
Brian Okken: the pytest course,
Brian Okken: and thanks to Patreon supporters
Brian Okken: and also we've both written books
Brian Okken: so check out books also
Brian Okken: and I'll have a little bit of news on the Lean TDD
Brian Okken: later.
Michael Kennedy: We both have something
Michael Kennedy: fresh for people that if they want to support us
Brian Okken: they can check it out. Something fresh, yeah.
Brian Okken: You can,
Brian Okken: if you've got
Brian Okken: suggestions or
Brian Okken: yeah,
Brian Okken: if you've got complaints,
Brian Okken: send
Brian Okken: to Michael,
Brian Okken: but if you have suggestions,
Brian Okken: send to either
Brian Okken: of us and the
Brian Okken: info is on the show
Brian Okken: notes,
Brian Okken: but we're on Mastodon
Brian Okken: and
Brian Okken: um and blue sky and all the all the places so um also if you're listening to this and would like to
Brian Okken: like see what we look like or watch the watch the stuff or show even show up live you can go to
Brian Okken: pythonbytes.fm live where there's a link to join the audience and during the during the recording
Brian Okken: a lot of people sometimes people drop in questions and we'll answer them on the show that's fun and
Brian Okken: And lastly,
Brian Okken: you don't have to take notes because all of these,
Brian Okken: all of the links are,
Brian Okken: the links
Brian Okken: are in the show notes, but the links and extra information are sent out in the email newsletter.
Brian Okken: So you can subscribe at pythonbytes.fm and we will send you a whole bunch of information.
Brian Okken: If you don't quite understand what we're talking about,
Brian Okken: there's some background information
Brian Okken: there too that will fill you in.
Brian Okken: With that,
Brian Okken: let's talk about something dumb.
Michael Kennedy: Dumb ways to die.
Michael Kennedy: Dumb ways for open source projects to die.
Michael Kennedy: Oh,
Michael Kennedy: and let me count the ways.
Michael Kennedy: This one is by Andrew Nesbitt.
Michael Kennedy: It's an article.
Michael Kennedy: It's a taxonomy, I suppose, is the way you would put it.
Michael Kennedy: Pretty interesting.
Michael Kennedy: I think it creates some interesting ways to talk about and think about just open source
Michael Kennedy: projects and supply chain,
Michael Kennedy: mostly not security, although a little bit security,
Michael Kennedy: but also just
Michael Kennedy: stability,
Michael Kennedy: right?
Michael Kennedy: So this taxonomy is broken into a two-level tree.
Michael Kennedy: So there's things like the maintainer left and the maintainer is still there.
Michael Kennedy: sabotage and capture,
Michael Kennedy: the release pipeline broke and so on.
Michael Kennedy: And for each one of those, there's a
Michael Kennedy: bunch of sub items that are really good.
Michael Kennedy: So for the maintainer left,
Michael Kennedy: I'll give you a couple of
Michael Kennedy: them. They're all pretty interesting.
Michael Kennedy: So I won't read the whole article,
Michael Kennedy: but I'll read off a few
Michael Kennedy: of them so you'll get the sense and you can come back and use this as a resource.
Michael Kennedy: So under the
Michael Kennedy: maintainer left, we have the ghost maintainer,
Michael Kennedy: the simple and most common case.
Michael Kennedy: The last human commit
Michael Kennedy: is some years ago.
Michael Kennedy: Issues are accumulated unanswered. The repo is not archived,
Michael Kennedy: so it doesn't show up in
Michael Kennedy: any filter that would flag it.
Michael Kennedy: Usually the maintainer just moved on and it wasn't important
Michael Kennedy: enough to formally hand it over or shut it down.
Michael Kennedy: And it goes on a bit.
Michael Kennedy: And by the way,
Michael Kennedy: Andrew references this weekend that Bernie research,
Michael Kennedy: he did,
Michael Kennedy: and basically went through
Michael Kennedy: different packaging platforms or services or whatever, like PyPI or npm and so on,
Michael Kennedy: and said
Michael Kennedy: like, well, which one of these are in an active state, a dormant state, a dead state, unknown,
Michael Kennedy: and has a percent dead.
Michael Kennedy: And PyPI actually has a very low percent dead.
Michael Kennedy: Conda is better.
Michael Kennedy: Maven is better.
Michael Kennedy: But everything else is worse, like quite a few others.
Michael Kennedy: So that's pretty interesting.
Michael Kennedy: Yeah, it goes up there at like 20%.
Michael Kennedy: I know, that's crazy,
Michael Kennedy: right?
Michael Kennedy: So it's kind of like, let's take those and then categorize.
Michael Kennedy: So we went through and did a bunch of research on these and said,
Michael Kennedy: okay,
Michael Kennedy: well, why is it dead?
Michael Kennedy: What ways can it be dead?
Michael Kennedy: So there's the, just,
Michael Kennedy: they ghosted, right?
Michael Kennedy: The maintainer just ghosted.
Michael Kennedy: It's fine.
Michael Kennedy: There could be the corporate orphan.
Michael Kennedy: A company built and open sourced it with a team to run it.
Michael Kennedy: and then pivoted or laid off the people and nobody updated it because they just,
Michael Kennedy: well,
Michael Kennedy: they're fired.
Michael Kennedy: That's an interesting one.
Michael Kennedy: There's the thesis orphan.
Michael Kennedy: I created this project as a PhD or master's thesis,
Michael Kennedy: and then I graduated and I'm done.
Michael Kennedy: I'm not messing with it anymore.
Michael Kennedy: I actually didn't enjoy it anyway.
Michael Kennedy: Funding cliff,
Michael Kennedy: similar,
Michael Kennedy: like it has a grant or an NSF grant or something like that.
Michael Kennedy: And then when the money's gone,
Michael Kennedy: stop and so on.
Michael Kennedy: Let's go on the next category.
Michael Kennedy: So this one's also really common.
Michael Kennedy: The maintainer's still there, but there's the burnout plateau,
Michael Kennedy: still active by any metric you'd run.
Michael Kennedy: Typo fixes and dependency bumps get merged with the occasional thanks on an issue,
Michael Kennedy: but anything that needs actual design work or serious debugging is open indefinitely because they're just done.
Michael Kennedy: Custody battle,
Michael Kennedy: two maintainers fighting over it.
Michael Kennedy: Toxic gatekeeping,
Michael Kennedy: you know, the person in charge of it just doesn't really want to maintain it,
Michael Kennedy: but also to all new incoming work.
Michael Kennedy: That happens a lot, I think, actually.
Michael Kennedy: Yeah, I think so.
Michael Kennedy: there's the sabotage and capture.
Michael Kennedy: Captured maintainer.
Michael Kennedy: Commit or publish access ends up with someone hostile.
Michael Kennedy: XZ is an elaborate version.
Michael Kennedy: Remember that two-year social engineering campaign
Michael Kennedy: that eventually talked that person into letting the person take over,
Michael Kennedy: but they were actually a state actor,
Michael Kennedy: we believe.
Michael Kennedy: Addison Ware.
Michael Kennedy: And then we've also covered the protest where, this is bad,
Michael Kennedy: seems to be more JavaScript,
Michael Kennedy: but there it is.
Michael Kennedy: The legitimate maintainer deliberately breaks their own package.
Michael Kennedy: Colors and Faker were sabotaged by their author in 2022.
Michael Kennedy: LeftPad was unpublished entirely.
Michael Kennedy: Remember that one was pretty bad.
Brian Okken: That was funny.
Michael Kennedy: Why is there an entire package that just LeftPad's a string?
Michael Kennedy: Like, that's all it does.
Michael Kennedy: You know, it's just too fine-grained.
Michael Kennedy: All right.
Michael Kennedy: The release pipeline broke, a bunch of stuff around that.
Michael Kennedy: Force majeure,
Michael Kennedy: like, sanctions.
Michael Kennedy: Some people's accounts have been shut down or blocked
Michael Kennedy: because they've been frozen under export controls
Michael Kennedy: or other things like that,
Michael Kennedy: or taken down because of DMCA.
Michael Kennedy: The world moved on.
Michael Kennedy: This one we know well from the Python world.
Michael Kennedy: The platform got stranded,
Michael Kennedy: like chained to an end-of-the-life runtime.
Michael Kennedy: Python 2 only,
Michael Kennedy: or requires a certain node version or whatever.
Michael Kennedy: And related to that is the transit of death.
Michael Kennedy: So the project's fine, the maintainer's present willing,
Michael Kennedy: but something two or three levels down in its own dependency tree
Michael Kennedy: can't be swapped out without a rewrite,
Michael Kennedy: like think Python 2,
Michael Kennedy: right?
Michael Kennedy: Why did a lot of stuff not upgrade to Python 3?
Michael Kennedy: because something it depended upon was Python 2 only.
Michael Kennedy: And so there's no way to get there.
Michael Kennedy: You know what I mean?
Brian Okken: Yeah.
Michael Kennedy: API rug pull.
Michael Kennedy: I've seen this like, hey,
Michael Kennedy: I depended upon,
Michael Kennedy: I wrote something that wraps,
Michael Kennedy: like let's say the Reddit's API or Twitter API.
Michael Kennedy: And then those APIs go away.
Michael Kennedy: And guess what?
Michael Kennedy: Your app or library doesn't work.
Michael Kennedy: Or it's just superseded,
Michael Kennedy: right?
Michael Kennedy: Like there's no reason to do a thing
Michael Kennedy: if it's now part of the language or something like that.
Michael Kennedy: Project split.
Michael Kennedy: Yeah,
Michael Kennedy: that's pretty much it.
Michael Kennedy: Licensing.
Michael Kennedy: So what do you think?
Michael Kennedy: That's pretty neat, right?
Brian Okken: Yeah.
Brian Okken: And one of the things that's unfortunate is because a lot of the open source,
Brian Okken: I don't know,
Brian Okken: there's a lot of projects,
Brian Okken: or there at least have been enough projects that has been painful that have had a lot of users and like something happened and it's not maintained anymore.
Brian Okken: And it's not, there isn't a really good way to transition away or to something else.
Brian Okken: And it gets messy.
Brian Okken: I mean, we had, I had a,
Brian Okken: like,
Brian Okken: even at work,
Brian Okken: we had a project that we were depending on
Brian Okken: that was by Python 2 only.
Brian Okken: And it's one of those things of, like, we could have thrown money at it and just had
Brian Okken: a corporate,
Brian Okken: you know, a corporate entity could convert it.
Brian Okken: But we waited until a university,
Brian Okken: some university students did it.
Brian Okken: But,
Brian Okken: you know, that seems dumb.
Brian Okken: Why not throw money at it?
Brian Okken: I think for a lot of, a lot of these.
Michael Kennedy: You could just pay the person,
Michael Kennedy: hey, I know it's on this old version,
Michael Kennedy: but would $5,000
Michael Kennedy: make it work on the new version too?
Michael Kennedy: A lot of times people say, heck yeah.
Michael Kennedy: Or I've wanted to do it, but I don't have the time or energy,
Michael Kennedy: right?
Brian Okken: Or get your own people to do the conversion work, take it over.
Michael Kennedy: Honestly, I'd rather see companies support the maintainers and get it upgraded.
Michael Kennedy: But if that's not an option,
Michael Kennedy: Claude could probably upgrade it too.
Brian Okken: Well, I mean, in the case where somebody just moved on,
Brian Okken: they're not interested in the project anymore,
Brian Okken: throwing money at them is probably not the right option.
Michael Kennedy: Yeah, that's true.
Michael Kennedy: It depends on the situation.
Michael Kennedy: I'll give you two examples of these in the Python space that both make me say, well,
Michael Kennedy: one's in the front end CSS space is Bulma.
Michael Kennedy: I really like Bulma.
Michael Kennedy: Super cool project.
Michael Kennedy: It sells itself as a modern CSS framework and all these things.
Michael Kennedy: But let's see, when was the last release?
Michael Kennedy: Oh yeah, about a year and a half ago.
Brian Okken: Really?
Michael Kennedy: Weird.
Michael Kennedy: Which is really sad.
Michael Kennedy: Like there was a commit for something super,
Michael Kennedy: like, so this,
Michael Kennedy: I think this is an absolute
Michael Kennedy: telltale sign of this.
Michael Kennedy: So people out there thinking about projects they want to depend upon.
Michael Kennedy: This is a mega sign for it.
Michael Kennedy: So three months ago,
Michael Kennedy: the maintainer of this fixed issue 4000.
Michael Kennedy: What is issue 4000?
Michael Kennedy: The footer has a broken logo on the website.
Michael Kennedy: Meanwhile, it's got 50,000 GitHub stars,
Michael Kennedy: 4,000 forks.
Michael Kennedy: And that's fine.
Michael Kennedy: Like this guy,
Michael Kennedy: he doesn't owe the world anything.
Michael Kennedy: If he built it, it's amazing.
Michael Kennedy: I actually use this.
Michael Kennedy: I love Bulma and I decided to keep using it even though it's basically dead in the water
Michael Kennedy: because I looked around and all the other stuff.
Michael Kennedy: It's like Tailwind, but way less complicated.
Michael Kennedy: And it's going to keep working.
Michael Kennedy: And in five years, I'll find something else.
Michael Kennedy: But right now I
Brian Okken: could see it though. So
Brian Okken: you've got 10 minutes to work. Maybe
Brian Okken: you've got a half an hour on the weekend to work on it. You
Brian Okken: open this up and you see 346 issues and 175 pull requests.
Brian Okken: I
Brian Okken: just close my laptop and go outside and mow the lawn or something.
Brian Okken: I
Brian Okken: know.
Michael Kennedy: No,
Michael Kennedy: I know.
Michael Kennedy: And so the guy doesn't owe the world anything.
Michael Kennedy: He created something cool and that's fine.
Michael Kennedy: He doesn't have to do, but there,
Michael Kennedy: here's something that bugs me.
Michael Kennedy: And I would just like to put this out there for, for people.
Michael Kennedy: And you know, I,
Michael Kennedy: if I have projects like this,
Michael Kennedy: I consider myself same and nothing.
Michael Kennedy: I have nothing of the scale.
Michael Kennedy: But for example,
Michael Kennedy: if I go to the pull request section,
Michael Kennedy: I understand what you're saying,
Michael Kennedy: Brian, like, oh God,
Michael Kennedy: there's so much work here,
Michael Kennedy: but he should put some kind of message
Michael Kennedy: that says,
Michael Kennedy: Hey, listen,
Michael Kennedy: I just can't right now.
Michael Kennedy: So please don't submit any PR.
Michael Kennedy: I don't go do work that I won't even look at.
Michael Kennedy: So if you look at the PRs, like there's one, one on February 20th, one on January 20th,
Michael Kennedy: and there's 175 PRs without even a response to them going back,
Michael Kennedy: you know,
Michael Kennedy: way,
Michael Kennedy: I don't know,
Michael Kennedy: how far do they go back?
Michael Kennedy: You got a page to it, right?
Michael Kennedy: Like 2018.
Michael Kennedy: You know what I mean? And so
Michael Kennedy: I just feel like it kind of bugs me that there's all these people out in the world go, oh, I'm going
Michael Kennedy: to help improve this project.
Michael Kennedy: I'm like, I'm going to add the view CLI. Like, no, you're not,
Michael Kennedy: because it's not going to get responded to and so on.
Michael Kennedy: And also there's 36 people sponsoring the project,
Michael Kennedy: like paying money monthly to support it.
Michael Kennedy: Like, I just feel like at some point you're like,
Michael Kennedy: just please use it, please enjoy it,
Michael Kennedy: but don't do extra work to it
Michael Kennedy: because I'm not in a space where I want to
Michael Kennedy: or able to work on this right now.
Michael Kennedy: You know, I don't know.
Michael Kennedy: What are you thinking on that?
Brian Okken: Well, I think that sometimes you're optimistic
Brian Okken: when you originally like write up a contributor guideline,
Brian Okken: but need to update it to say,
Brian Okken: Yeah,
Brian Okken: I'm not going to accept contributions,
Brian Okken: I guess.
Michael Kennedy: Yeah, exactly.
Michael Kennedy: I think one sentence on the readme, like, hey,
Michael Kennedy: look, I just can't, like a big, bold, I can't right now,
Michael Kennedy: folks.
Michael Kennedy: So please just hold your thoughts,
Michael Kennedy: you know,
Michael Kennedy: and so on.
Michael Kennedy: Because anyway,
Michael Kennedy: so the other one is disk cache, which I use and love.
Michael Kennedy: What?
Michael Kennedy: That's abandoned?
Michael Kennedy: Last commit two years ago.
Michael Kennedy: Maybe it just works, though.
Michael Kennedy: Yeah.
Michael Kennedy: But here's the thing.
Michael Kennedy: Well,
Michael Kennedy: I mean, there's 20 pull requests,
Michael Kennedy: 50 issues, no responses.
Michael Kennedy: The guy Grant, I don't know him.
Michael Kennedy: I don't know his background.
Michael Kennedy: But I noticed that he was hired by OpenAI
Michael Kennedy: almost exactly just a little bit after the last release.
Michael Kennedy: So he's just, I don't know if this was captured in the taxonomy,
Michael Kennedy: but like I've been,
Michael Kennedy: it is actually,
Michael Kennedy: I can't remember which one,
Michael Kennedy: but there's like one of them where, hey,
Michael Kennedy: if you get hired at a company that doesn't let you do open source,
Michael Kennedy: your projects kind of like de facto die,
Michael Kennedy: unless you can get someone else to do it.
Michael Kennedy: You know what I mean?
Brian Okken: Or you did open source to try to be well-known enough
Brian Okken: hired by OpenAI.
Michael Kennedy: I'm not saying there's a negative outcome.
Michael Kennedy: Probably an amazing outcome for Grant.
Michael Kennedy: So congrats to him.
Michael Kennedy: And again, he doesn't know the world or anything. I think this is a little
Michael Kennedy: bit different because it's really a wrapper on SQLite and SQLite is constantly being maintained
Michael Kennedy: and updated.
Michael Kennedy: So I feel less worried about it.
Michael Kennedy: Anyway,
Michael Kennedy: dumb ways for open source projects that I,
Michael Kennedy: there's just two examples.
Michael Kennedy: I think this is important,
Michael Kennedy: especially for newcomers to open
Michael Kennedy: source and Python.
Michael Kennedy: When you add something to your project as a requirement,
Michael Kennedy: you should know,
Brian Okken: the consequences of doing that right um i want to add one more thing there's a there are a lot of
Brian Okken: packages that really don't need that a lot that many updates um even if even if they have issues
Brian Okken: in pull requests they might be just maybe the maintainer's not that great at saying you know i
Brian Okken: don't feel like it or something um but one way to keep it like to to keep it noted that it's alive
Brian Okken: is once a year update your tests to the new python version um then it's at least a year old and you
Brian Okken: know it's being tested on the latest Python.
Brian Okken: And that's the bare minimum,
Brian Okken: I think.
Michael Kennedy: Yeah.
Michael Kennedy: Change your classifier.
Michael Kennedy: What are those things called?
Michael Kennedy: Your classifier to just say,
Michael Kennedy: take out the old Python, put in the new Python,
Michael Kennedy: something like that. You have a classifier in
Michael Kennedy: here and you're good to go.
Michael Kennedy: Yeah. But projects can be done.
Michael Kennedy: They definitely can be done.
Michael Kennedy: It's
Michael Kennedy: just,
Michael Kennedy: they don't need more changes. But I think it's all pretty interesting,
Michael Kennedy: but let's take us on
Michael Kennedy: to more packaging talk.
Brian Okken: Yeah.
Brian Okken: Okay.
Brian Okken: So the,
Brian Okken: I wanted to talk, this is a brief one, but,
Brian Okken: um,
Brian Okken: this is a Tim Hopper article on how to create a PyLock Toml file.
Brian Okken: And,
Brian Okken: um, I just kind of forgot
Brian Okken: that these were sort of rolling in at different times.
Brian Okken: And as of May,
Brian Okken: um,
Brian Okken: now of 2026,
Brian Okken: there's
Brian Okken: now three ways to create these these guys so uh he he covers um using uv pip and pdm and notes that
Brian Okken: uv is the only one that says it's in stable status uh the pip lock uh piloc tunnel generation
Brian Okken: is experimental and so is pdm experimental i didn't know pdm did it i'm not really a pdm user
Brian Okken: um but the uh yeah just uh sort of sort of running down uh how to how to create lock files with the
Brian Okken: all these tools and it's kind of just a general neat tutorial with the
Brian Okken: recommendation of why not just use uv because it works the incantations a
Brian Okken: little magic it's uv export --format by lock Tomo with an output of
Brian Okken: pilot all hmm seems you're done I wonder if there's there are I think there's a
Michael Kennedy: global config for uv I wonder if you could put it in there that'd be
Brian Okken: interesting I don't know and if you the he also has apparently a companion page
Brian Okken: of how to install and the how to install is the short version is use -r because
Brian Okken: every they all the tools treat it like a requirements file so oh not completely
Brian Okken: interesting no depths oh you know no dependencies okay anyway yeah just
Brian Okken: creating by like toml files I'm and yeah it's kind of the way we were moving so
Michael Kennedy: That's it.
Michael Kennedy: It sure is.
Michael Kennedy: Very interesting.
Michael Kennedy: Now,
Michael Kennedy: let's talk about lifeguard.
Michael Kennedy: So lifeguard,
Michael Kennedy: we've talked about... That was a good summer topic.
Michael Kennedy: Exactly.
Michael Kennedy: A lot of places, at least in the U.S.,
Michael Kennedy: public pools open on Memorial Day and all the lifeguards go back to work and you need a lifeguard
Michael Kennedy: job. And it's often a rite of passage of high school to work as a lifeguard.
Michael Kennedy: So this works for
Michael Kennedy: lazy imports.
Michael Kennedy: Remember,
Michael Kennedy: lazy imports are coming in Python,
Michael Kennedy: which is going to be really nice.
Michael Kennedy: And I was pretty interested in before, but then I did that work where,
Michael Kennedy: and I wrote it up,
Michael Kennedy: said, we talked about it here,
Michael Kennedy: cutting Python web app memory by 31%. A lot of that had to do with
Michael Kennedy: imports and changing imports and only using heavyweight libraries when they actually executed
Michael Kennedy: the code that needed them.
Michael Kennedy: But so lazy imports,
Michael Kennedy: good,
Michael Kennedy: I think.
Michael Kennedy: However,
Michael Kennedy: lazy imports also can have
Michael Kennedy: incompatibilities in other issues.
Michael Kennedy: So this lifeguard library will go through and find those issues.
Michael Kennedy: It's, I don't know if we,
Michael Kennedy: it's kind of an interesting juxtaposition.
Michael Kennedy: It has 56 GitHub
Michael Kennedy: stars. So it's kind of like brand new,
Michael Kennedy: which is fine. It's just like a linter type thing made by
Michael Kennedy: Facebook.
Michael Kennedy: So it's probably something that meta used internally and they just open sourced, you
Michael Kennedy: know, a couple months ago.
Michael Kennedy: So that's all good.
Michael Kennedy: Looks like it is a Rust based thing because it
Michael Kennedy: as a cargo folder.
Michael Kennedy: And that was two months ago when it was created.
Michael Kennedy: I don't know when it actually came out public on GitHub,
Michael Kennedy: right?
Michael Kennedy: Because you can have a private repo
Michael Kennedy: and then flip it to public at some point.
Michael Kennedy: Anyway,
Michael Kennedy: it says, what are lazy points?
Michael Kennedy: We talked about that in ports.
Michael Kennedy: But it says,
Michael Kennedy: the idea is obviously,
Michael Kennedy: especially in large code bases,
Michael Kennedy: this
Michael Kennedy: both increases startup time and lowers memory usage,
Michael Kennedy: which
Michael Kennedy: is great.
Michael Kennedy: However,
Michael Kennedy: sometimes it doesn't work
Michael Kennedy: because there's certain Python patterns that
Michael Kennedy: require these things to execute immediately.
Michael Kennedy: So module level side effects, like a module that registers a handler or
Michael Kennedy: modifies global state at import time will behave differently if its import is deferred.
Michael Kennedy: Think about something that sets sysstat at exit,
Michael Kennedy: right?
Michael Kennedy: So it wants to run some code at exit to unravel something.
Michael Kennedy: But that's only there if you call the function that causes the lazy import to load and so
Michael Kennedy: on, right?
Michael Kennedy: As opposed to the way it does now.
Michael Kennedy: The registry pattern.
Michael Kennedy: So dependency injection, I'm guessing.
Michael Kennedy: A module registers itself added to a global dict that when imported will silently fail under lazy imports.
Michael Kennedy: Sys.modules manipulations.
Michael Kennedy: Code that reads and writes Sys.modules assumes that prior imports have already executed.
Michael Kennedy: Interesting.
Michael Kennedy: And metaclasses.
Michael Kennedy: Class creation side effects may depend on.
Michael Kennedy: So you can just run this against your project and it'll tell you how safe are your lazy imports.
Michael Kennedy: And you can't be lazy.
Michael Kennedy: It's a lifeguard.
Michael Kennedy: Looks out for you.
Michael Kennedy: So you don't, I guess, drown in lazy imports.
Michael Kennedy: Yeah.
Michael Kennedy: Anyway,
Michael Kennedy: I just want to put that out there for people because this is coming in Python 3.15.
Michael Kennedy: And it's always better to go,
Michael Kennedy: hey, let's test our package or our application on this new version before it's actually released.
Michael Kennedy: Especially if you have a package other people use, right?
Brian Okken: Yeah.
Brian Okken: And I guess that I think like testing is often pretty safe to do lazy imports.
Brian Okken: So I just want to throw out,
Brian Okken: I don't have a link or anything,
Brian Okken: but a reminder to people that if you're loading something fairly large for testing purposes and you have a big suite,
Brian Okken: You can throw that into a conf test or not a conf test.
Brian Okken: We could do me in a conf test,
Brian Okken: but you can throw the import into a fixture and even an auto use fixture and
Brian Okken: it'll,
Brian Okken: it'll load at runtime instead of test collection time then.
Brian Okken: So it's a lot faster.
Michael Kennedy: That's very good.
Michael Kennedy: You're focusing on just some category test or something like that.
Michael Kennedy: You don't have to do it.
Michael Kennedy: All right,
Michael Kennedy: let's log it.
Brian Okken: Let's log it.
Brian Okken: So there's a,
Brian Okken: I ran across this article called choosing a Python library log,
Brian Okken: choosing a Python logging library in 2026.
Brian Okken: And this just kind of came up at the right time because I've got a project that I'm switching to use.
Brian Okken: My plan is to switch it to use Logaroo.
Brian Okken: Logaroo?
Brian Okken: I don't know.
Brian Okken: Logaroo.
Brian Okken: L-O-G-U-R-U.
Brian Okken: And the,
Brian Okken: but so I was looking at this just because it's interesting.
Brian Okken: So the comparison is to the straight logging module,
Brian Okken: struct log, Logaroo,
Brian Okken: logbook,
Brian Okken: and Pico logging.
Brian Okken: And it looks like they sort of gave up on some of those.
Brian Okken: But one of the interesting things about using straight logging was that doing structured output like JSON,
Brian Okken: like logging JSON information,
Brian Okken: is a little bit difficult.
Brian Okken: So their recommendation right off the bat is to use a project called Python JSON Logger,
Brian Okken: which I didn't know about,
Brian Okken: which you can use with the standard logging module.
Brian Okken: And it just makes logging easier.
Brian Okken: They even have a, the same,
Brian Okken: same people that wrote the original article have a setup guide,
Brian Okken: a practical guide to setting up the JSON logger.
Brian Okken: So that's, that's cool.
Brian Okken: And especially I was thinking like,
Brian Okken: especially for API endpoints or entry points or whatever,
Brian Okken: that's important, but there's, he's JSON all over the place.
Brian Okken: So,
Brian Okken: but so just talking about comparing them all and they didn't really give an example.
Brian Okken: They actually talked about,
Brian Okken: well, they have examples,
Brian Okken: but they didn't recommend anything.
Brian Okken: Actually, the recommendation really was use the standard logging module unless you have a reason not to because it's being supported everywhere.
Brian Okken: But I really liked the Logguru example of just how easy it looks to set up.
Brian Okken: And we've covered this before,
Brian Okken: but especially if you have a lot of people that are,
Brian Okken: you know, logging kind of looks complicated.
Brian Okken: And if you've got a small team that all understand it, that's great.
Brian Okken: But if you have a large team,
Brian Okken: it might be easier just to have an easier logging system.
Brian Okken: And that's where I'm kind of leaning.
Brian Okken: And the setting up JSON output,
Brian Okken: you can say serialized equals true.
Brian Okken: Now, I don't know.
Brian Okken: I think that means that converts every log record to a JSON output.
Brian Okken: So that might not be.
Brian Okken: It's not logging JSON stuff.
Brian Okken: It's actually the output is a JSON thing.
Brian Okken: So you can read it somewhere else,
Brian Okken: which also might be kind of cool.
Brian Okken: But I probably won't do that.
Michael Kennedy: Yeah, you could have two logs.
Michael Kennedy: You could set up a logger to a file that logs without serialize and one that logs.
Michael Kennedy: Oh, yeah.
Michael Kennedy: Right?
Michael Kennedy: So you have like a parallel,
Michael Kennedy: like a structured and an unstructured version.
Michael Kennedy: And when you just say log, it just hits all the attached destinations or whatever.
Brian Okken: But the easy setup is what I'm looking for.
Brian Okken: But there are some caveats.
Brian Okken: Like it's harder to have multiple loggers apparently,
Brian Okken: or at least multiple configurations of different loggers.
Brian Okken: I don't know if that's true or not, but that's what the article says.
Brian Okken: One of the things that I,
Brian Okken: that I didn't know about with this is that there's a logger catch
Brian Okken: and a logger exception.
Brian Okken: So there's different ways the logger catches a decorator to,
Brian Okken: uh,
Brian Okken: to log exceptions,
Brian Okken: uh,
Brian Okken: nicely or into your,
Brian Okken: into whatever log file you have set up.
Brian Okken: Um,
Brian Okken: so,
Brian Okken: or logging stream or whatever.
Brian Okken: Um,
Brian Okken: and that looks neat because usually,
Brian Okken: you know,
Brian Okken: Michael does no exceptions,
Brian Okken: but if there
Brian Okken: is an exception,
Brian Okken: uh,
Brian Okken: be able to, might be nice to look at that.
Brian Okken: Anyway,
Brian Okken: kind of a good rundown of what the logging libraries look like right now
Brian Okken: and now how to do structured output.
Brian Okken: There was a performance benchmark,
Brian Okken: which was interesting,
Brian Okken: that it compared the standard lib plus the JSON stuff with struct log and Logaroo.
Brian Okken: And Logaroo is about the same as the standard lib with JSON.
Brian Okken: And struct log is about twice as fast as in some cases.
Brian Okken: So that's interesting.
Michael Kennedy: Well,
Michael Kennedy: I use Logaroo by default these days.
Michael Kennedy: I really like it.
Michael Kennedy: But I've also used Logbook.
Michael Kennedy: I don't really use the built-in logging.
Michael Kennedy: It just seems complicated than needed to me.
Brian Okken: I've been doing the built-in logging mostly lately.
Brian Okken: And I figured,
Brian Okken: you know, once I figure out like some,
Brian Okken: and I think I'm like with a lot of people that use it,
Brian Okken: I figured out one way that works for me,
Brian Okken: and I just copy and paste and do that.
Brian Okken: All right.
Brian Okken: Well,
Brian Okken: those are our items.
Brian Okken: Do you have any extras you want to talk about?
Brian Okken: Sure do.
Michael Kennedy: I sure do.
Michael Kennedy: Hold on.
Michael Kennedy: I have two fun things.
Michael Kennedy: So first of all,
Michael Kennedy: let's do this in order.
Michael Kennedy: A while ago, I told everyone that I have German subtitles available for all 283 hours of courses
Michael Kennedy: over at Talk Python.
Michael Kennedy: Training,
Michael Kennedy: the courses we got. Well,
Michael Kennedy: now we have Spanish as well.
Michael Kennedy: So I'm very
Michael Kennedy: excited to announce if Spanish is your language and you want Spanish subtitles to accompany the
Michael Kennedy: English spoken version.
Michael Kennedy: Well,
Michael Kennedy: click on Espanol and you'll be good to go right there.
Michael Kennedy: How about that?
Michael Kennedy: That's cool.
Michael Kennedy: We took two and a half weeks of just grinding on translations to get it done,
Michael Kennedy: but there it is.
Michael Kennedy: I think it's going to be really great.
Brian Okken: So what do you, what, you have German and Spanish now? Is that?
Michael Kennedy: German and Spanish.
Michael Kennedy: Okay, nice.
Michael Kennedy: Now I'm working on Portuguese.
Michael Kennedy: Actually, I've done a lot of research and I feel like Portuguese
Michael Kennedy: will be the most beneficial for the tech folks.
Michael Kennedy: Because you got to intersect,
Michael Kennedy: you got to look at
Michael Kennedy: two things. You got to look at how confident is the group of people who speak a certain language
Michael Kennedy: in English,
Michael Kennedy: right?
Michael Kennedy: So for example,
Michael Kennedy: German,
Michael Kennedy: I did German first because I speak some German,
Michael Kennedy: so I could kind of spot check it a little bit and it made some sense to me, you know?
Michael Kennedy: But German people are pretty good at English,
Michael Kennedy: especially tech-oriented ones.
Michael Kennedy: And so I was
Michael Kennedy: looking around and it turns out that I think Portuguese people are a little less comfortable
Michael Kennedy: with English than maybe German folks or I don't know,
Michael Kennedy: French.
Michael Kennedy: So I'm like, all right,
Michael Kennedy: then
Michael Kennedy: subtitles in their native language would be more helpful than not. So anyway, that's the kind of
Michael Kennedy: thing I'm trying to balance.
Michael Kennedy: So Portuguese is next.
Michael Kennedy: Apparently there's a lot of like Python is one of
Michael Kennedy: is super popular in Brazil and other places.
Michael Kennedy: So excited for that.
Michael Kennedy: All right. So that's, that's one
Michael Kennedy: Spanish subtitles,
Michael Kennedy: not Portuguese,
Michael Kennedy: but Portuguese maybe in three or four weeks, something like that.
Michael Kennedy: And a brand new course.
Michael Kennedy: I'm super excited about this.
Michael Kennedy: Python web security is the course.
Michael Kennedy: And it comes in two components.
Michael Kennedy: The OWASP top 10.
Michael Kennedy: So it goes through every one of the OWASP top 10 categories with two to three examples,
Michael Kennedy: sometimes in Flask, sometimes in Django,
Michael Kennedy: sometimes in FastAPI,
Michael Kennedy: the bad version, the good version,
Michael Kennedy: just purely learning the security issues.
Michael Kennedy: And then we turn it into an agentic AI course and start searching for bugs in your own code
Michael Kennedy: using agentic AI.
Michael Kennedy: So we talked about how Mozilla found a bunch of bugs with Cloud,
Michael Kennedy: similar to that
Michael Kennedy: with some really custom OWASP and Python web app focused things.
Michael Kennedy: Yeah.
Michael Kennedy: So if you're publishing
Michael Kennedy: web apps or APIs on the internet, you definitely want to look at this because it basically gives
Michael Kennedy: you tooling and a blueprint on how to completely check your app for OWASP violations and beyond
Michael Kennedy: using things like Claude Code and others.
Michael Kennedy: So you can,
Michael Kennedy: instead of hiring pen testers,
Michael Kennedy: you can do a first pass with this and then maybe find just a few more things.
Michael Kennedy: If,
Michael Kennedy: if you're that kind of company that can afford $25,000 or whatever for a pen
Michael Kennedy: test,
Michael Kennedy: or,
Michael Kennedy: you know,
Michael Kennedy: you could at least do this if you were going to do nothing.
Michael Kennedy: So I think it's really helpful.
Michael Kennedy: Thanks.
Michael Kennedy: All right.
Michael Kennedy: That's it for me.
Brian Okken: Okay.
Brian Okken: I,
Brian Okken: I noticed this,
Brian Okken: there's an article that was on NPR or planet money,
Brian Okken: but I noticed it because on blue sky,
Brian Okken: shout out to where I got the information from.
Brian Okken: if my tabs work.
Brian Okken: Savannah Ostrowski.
Brian Okken: So posted this,
Brian Okken: said it was surprising.
Brian Okken: This is a disturbing article,
Brian Okken: actually.
Brian Okken: It's what happened to women in computer science.
Brian Okken: And I didn't realize this was going on so long.
Brian Okken: So basically,
Brian Okken: modern computer science is dominated by men.
Brian Okken: The percent of women in computer science was...
Brian Okken: And also in the percent compared with other fields, like other physical sciences,
Brian Okken: law school,
Brian Okken: medical school.
Brian Okken: So it's an interesting comparison.
Brian Okken: But in the mid 80s,
Brian Okken: it was at its height at like 36% or something were women.
Brian Okken: And it's just been going down since then.
Brian Okken: And,
Brian Okken: you know, it's leveled off in like around 2008 or something like that.
Brian Okken: But this isn't good.
Brian Okken: And so I think we need more women in computer science.
Brian Okken: And the analysis of this was really thought that this was because of the personal computers showing up in homes.
Brian Okken: And I guess families and teachers encouraging boys to play with computers more than they taught girls.
Brian Okken: And also a commentary from one woman that when she first went into her first computer science class,
Brian Okken: she asked a question.
Brian Okken: And the professor stopped and looked at her and said, you should know that by now.
Brian Okken: But it was like the first class.
Brian Okken: And so I actually, my wife had the same experience.
Brian Okken: She took CS101 or something like that, or a basic class in high school.
Brian Okken: And all the rest of the kids had already played with it on their Macs at home or something like that.
Brian Okken: And she was an intro.
Brian Okken: So I think we need to change this.
Brian Okken: I think hopefully it's changing because I think there's less actual personal computers in homes now than there were in the 90s.
Brian Okken: So I think maybe, hopefully it's leveled the playing field.
Brian Okken: But who knows?
Brian Okken: I'm glad that my daughter has already taken my,
Brian Okken: has taken some Python in school,
Brian Okken: but this is bad.
Brian Okken: I mean,
Brian Okken: software is not a boys or girls thing.
Brian Okken: If anything,
Brian Okken: the women started it.
Brian Okken: So we're,
Brian Okken: we're late comers to the,
Brian Okken: to the,
Brian Okken: to the game.
Brian Okken: Anyway,
Brian Okken: we need to fix this as a community.
Brian Okken: So the,
Brian Okken: the next thing,
Brian Okken: the other thing I want to share is that I am.
Michael Kennedy: A field report,
Michael Kennedy: Brian.
Michael Kennedy: So at PyCon,
Michael Kennedy: I spoke to,
Michael Kennedy: I was speaking to several women and they,
Michael Kennedy: said just talking to each other something like there is a very good representation of women at
Michael Kennedy: this conference now and 10 years ago it wasn't like that and i i feel that's great and it's so
Michael Kennedy: it's really encouraging at least in the python space but in general i agree that the graph
Brian Okken: is bad and it doesn't need to be that way i also wonder like a lot we get a lot of uh programmers
Brian Okken: from other fields though not necessarily computer science so i wonder if um maybe we need to but it
Brian Okken: It does say physical sciences.
Brian Okken: Maybe we're getting a lot of our women coders from other fields.
Brian Okken: I don't know.
Michael Kennedy: I do think so.
Michael Kennedy: You know, my daughter was learning to do like data science-y stuff in her psychology field.
Michael Kennedy: And psychology,
Michael Kennedy: I think, has more women than men in it,
Michael Kennedy: right?
Michael Kennedy: And so to the extent that like the data science side brings people in, I think there's a really
Michael Kennedy: interesting, Python is super interesting because it brings people in from all these different
Michael Kennedy: disciplines.
Michael Kennedy: And it's not just a, unlike,
Michael Kennedy: let's say, Go or See,
Michael Kennedy: right?
Michael Kennedy: That's like a straight path.
Michael Kennedy: You start in programming and you end in this location, right?
Michael Kennedy: Whereas with Python,
Michael Kennedy: it's got a much more diversity of sources,
Michael Kennedy: not necessarily people or genders,
Michael Kennedy: but like a diversity of different backgrounds that you come from to get into it.
Michael Kennedy: So I think that might have something to do with it as well, which is good.
Brian Okken: Different generational things too.
Brian Okken: I know we need to move on,
Brian Okken: but I remember when I was doing teaching at university,
Brian Okken: having some of the older students come in and not knowing i would i i was guilty of just expecting
Brian Okken: a lot of people to know a lot of the basics um know how to do word or excel or something like
Brian Okken: that and um and you don't people don't necessarily do that you can't assume anything really so yeah
Brian Okken: anyway um i am still working on the audio version of the uh the lean tdd book um and it's uh it's
Brian Okken: coming along well but during in the process of doing a lot of the audio i've made some changes
Brian Okken: to the actual book.
Brian Okken: That's why I'm holding off on the official release
Brian Okken: because I want the audio
Brian Okken: and the official release to match.
Brian Okken: But a lot of changes have come in.
Brian Okken: Just,
Brian Okken: I published this morning,
Brian Okken: one of the things is separating out TDD with teams
Brian Okken: because the team aspects are different.
Brian Okken: So I both have an emphasis
Brian Okken: on acceptance tester and development
Brian Okken: and then also how to apply those sorts of ATDD stuff
Brian Okken: to the lean concept.
Brian Okken: I also beefed up the AI chapter
Brian Okken: to talk about guardrails and security.
Brian Okken: So just a little bit.
Brian Okken: Anyway,
Brian Okken: it's coming along well.
Brian Okken: And I don't know.
Brian Okken: Who knows how long it'll take?
Brian Okken: My original plan was last January.
Brian Okken: So we'll see.
Brian Okken: Or,
Brian Okken: you know, January a few months ago.
Brian Okken: Congrats.
Brian Okken: That's awesome.
Brian Okken: Thanks.
Brian Okken: So it's still going.
Brian Okken: Thanks to everybody that's contributed
Brian Okken: and helped out.
Michael Kennedy: What skill do you need to be an author?
Michael Kennedy: Persistence.
Michael Kennedy: yes humble humbleness yes uh speaking of persistence our joke is titled stop texting me
Michael Kennedy: so it's just a um just a screenshot of a chat conversation somebody has clawed in their they've
Michael Kennedy: clawed in their iphone i think it's an i it's an iphone um on their their messages right it says
Michael Kennedy: claude build a one billion dollar b2b sass platform from scratch make no mistake then it says red
Michael Kennedy: dude for the thousandth time this is Claude from the pickleball league i am not ai
Michael Kennedy: ah that's funny and then of course there's comments there are definitely comments so
Michael Kennedy: instead it doesn't i think i said it this way but it's not spelled out dude for the thousand
Michael Kennedy: time this is Claude it's not the thousandth time so someone comments is it a legal requirement
Michael Kennedy: that someone named Claude should be able to spell correctly.
Michael Kennedy: And then,
Michael Kennedy: yeah,
Michael Kennedy: I don't know.
Michael Kennedy: It just goes on and on.
Michael Kennedy: This is funny.
Michael Kennedy: Yeah, anyway,
Michael Kennedy: comments are kind of fun too.
Michael Kennedy: But for the thousandth time,
Michael Kennedy: this is Claude from the Pickleball League.
Michael Kennedy: I am not AI building this.
Brian Okken: That's funny.
Brian Okken: I would totally build them a really crappy B2B SaaS
Brian Okken: and just charge them a billion dollars.
Brian Okken: I can give you a billion dollar company.
Brian Okken: You pay me a billion dollars,
Brian Okken: I'll give you something that earns at least a dollar.
Michael Kennedy: Just because you spend a lot of money building the company doesn't mean it's going to make a lot of money.
Exactly.
There's no guarantees there.
Yeah.
But anyway,
as always,
it's fun.
And we'll talk to you later.
Yep.
Thanks.
Bye.