Michael Kennedy: Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to earbuds.
Michael Kennedy: This is episode 492, recorded August 18th, 2026. I'm Michael Kennedy.
Michael Kennedy: And I'm Calvin Hendryx-Parker.
Michael Kennedy: This episode is brought to you by Logfire. So thank you to Logfire from Pydantic.
Michael Kennedy: Check them out at pythonbytes.fm/logfire. It's about observability for your AI apps and
Michael Kennedy: beyond. Tell you more about them later. Connect with us on social, links on the website.
Michael Kennedy: Be part of the live show.
Michael Kennedy: Check it out on the website, pythonbytes.fm.
Michael Kennedy: It's live.
Michael Kennedy: And we have a really cool newsletter that we send out mostly every week with all sorts of extras.
Michael Kennedy: So you can sign up there as well.
Michael Kennedy: Just visit the website, click the newsletter, do the thing.
Michael Kennedy: We'll keep it private and not abuse it.
Michael Kennedy: Speaking of abuse.
Calvin Hendryx-Parker: We're good people.
Calvin Hendryx-Parker: You're good people.
Calvin Hendryx-Parker: Let's make sure we keep people safe, Michael.
Michael Kennedy: Exactly.
Michael Kennedy: Sometimes you can have nice things on the internet.
Michael Kennedy: That's true.
Calvin Hendryx-Parker: And well, the good thing is that with the solar eclipse in Europe last week, a new release came
Calvin Hendryx-Parker: out of some security updates for Python 3.12, 3.11, and 3.10. The key bit here, well, there's a lot of
Calvin Hendryx-Parker: key bits, which is there's lots of security updates that have happened. They're pretty important if
Calvin Hendryx-Parker: you're doing certain kinds of activities. So for example, if you are using tar files to, if you're
Calvin Hendryx-Parker: extracting tar files with any of these versions of Python, you are going to want to update ASAP
Calvin Hendryx-Parker: because this basically fixed a path traversal bypass of the data filter. So a symlink escape
Calvin Hendryx-Parker: that could bypass bits and pieces here and get people access to places they're not supposed to be.
Calvin Hendryx-Parker: Kind of important. Now the important bit here is that this is only a source release,
Calvin Hendryx-Parker: is a source release only. If you want to upgrade to these versions of Python, the 3.12.14, 3.11.16,
Calvin Hendryx-Parker: and 3.10.21, you are going to have to download the source tarball or patch your existing build
Calvin Hendryx-Parker: process to get these released into your production environments. But if you are on these versions,
Calvin Hendryx-Parker: you're going to want to get those things patched. I mean, it's nice that these are in security only
Michael Kennedy: fixed mode. There's not a binary version. I have to use this. There is not a binary version of
Calvin Hendryx-Parker: these been released. These are in security fix only mode. I mean, hopefully you're getting into
Calvin Hendryx-Parker: Python 3.13 and 3.14 as they are the current releases. It's nice that the community supports
Calvin Hendryx-Parker: these versions that far back. I don't know when 3.10 was released, but it was quite a while ago.
Calvin Hendryx-Parker: And you've got to be able to stay on top of these. This is in your hands now. This is kind of more
Calvin Hendryx-Parker: of a do-it-yourself, but at least the fixes are available. So tar file is a big one. There are
Calvin Hendryx-Parker: four fresh CVEs that are being covered by these fixes here. One of them is for the sourceless
Calvin Hendryx-Parker: file loader. The other one is the cookies morsel, which there's basically a couple of fixes there
Calvin Hendryx-Parker: on that. And then the ftp lib ftp cp. So there's also a bunch of denial of service type fixes,
Calvin Hendryx-Parker: some cleanups in HTML parser, config parser, Unicode data normalize, element tree XPath bits.
Calvin Hendryx-Parker: There's some header injection fixes. Again, just lots of cleanups around the edges.
Calvin Hendryx-Parker: Michael, have you ever used the web browser module from the standard library?
Michael Kennedy: I'm learning now there's a web browser module.
Calvin Hendryx-Parker: There is a web browser module.
Calvin Hendryx-Parker: It allows you to pop a web browser.
Calvin Hendryx-Parker: That's pretty handy.
Calvin Hendryx-Parker: I've used it for a couple like little demo-y type things,
Calvin Hendryx-Parker: but there was a allowed control character in there
Calvin Hendryx-Parker: that would have caused an action prefix bypass.
Calvin Hendryx-Parker: So if folks were sneaky and knew those things existed,
Calvin Hendryx-Parker: they could basically jump in and bypass some of these security controls.
Calvin Hendryx-Parker: The HTTP client also now caps chunked trailer lines and the 100 responses to 100 each.
Calvin Hendryx-Parker: So a hostile server could previously hang a client, even if you had a socket timeout in place.
Calvin Hendryx-Parker: So lots of memory safety stuff, lots of other little cleanups.
Calvin Hendryx-Parker: Again, it's a pretty sweeping set of security fixes.
Calvin Hendryx-Parker: And they chose to release it now because it's as good a time as any.
Calvin Hendryx-Parker: There's no set schedule for these specific releases on these older versions of Python.
Calvin Hendryx-Parker: Excuse me.
Calvin Hendryx-Parker: But it's good we've got people watching our backs and making sure we stay secure out there.
Calvin Hendryx-Parker: Like I say, you can go look at the release notes.
Calvin Hendryx-Parker: There's a ton of fixes in here.
Calvin Hendryx-Parker: It's a really long set of releases and fixes that went into us.
Calvin Hendryx-Parker: Thanks to all the Python core devs and volunteers and people submitting patches.
Calvin Hendryx-Parker: I'm sure some of this stuff probably came out of the new models that are able to detect these kinds of pieces.
Calvin Hendryx-Parker: But obviously, humans are putting the pieces into place.
Calvin Hendryx-Parker: So go be safe out there, Michael.
Calvin Hendryx-Parker: And upgrade your Pythons.
Calvin Hendryx-Parker: This is always something I'm worried about.
Calvin Hendryx-Parker: Yeah, I mean.
Calvin Hendryx-Parker: Upgrade your Python, please.
Michael Kennedy: Here's also one of those reasons why I kind of want to stay on top.
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: Of having a fairly new version.
Michael Kennedy: And I'll be like, oh, we're not going to touch it.
Michael Kennedy: And hey, it's 3.8, but it works.
Michael Kennedy: It's like, yeah, but when this kind of jump, this stuff comes out of the blue,
Michael Kennedy: you're all of a sudden scrambling to get your app to run rather than just a point release.
Calvin Hendryx-Parker: Yeah.
Calvin Hendryx-Parker: It's hard to argue for the old stance of like, well, just because it works, it should just stay in production.
Calvin Hendryx-Parker: Or even if it's behind a firewall or behind some kind of level of protections, we've seen that these models can now chain together multiple vulnerabilities to get access to spaces they weren't supposed to get access to.
Calvin Hendryx-Parker: All that's required at this point is setting good goals for the agentic AI tools.
Calvin Hendryx-Parker: And they can get around a lot of things if they're given unfettered access, even not unfettered access, even if they're sandboxed in, they could still do this.
Calvin Hendryx-Parker: So keep up to date.
Calvin Hendryx-Parker: Again, this is a reason for staying on the latest released version of Python.
Calvin Hendryx-Parker: But the community does support back patches.
Calvin Hendryx-Parker: You just got to go build them yourself.
Michael Kennedy: I'll have more on that later on the building.
Michael Kennedy: Maybe.
Michael Kennedy: So yes, but maybe.
Calvin Hendryx-Parker: Maybe.
Michael Kennedy: What do you got?
Michael Kennedy: My favorite way to install Python is uv Python.
Michael Kennedy: No kidding.
Michael Kennedy: Install, right?
Michael Kennedy: And a quick, I just upgraded it.
Michael Kennedy: You got to upgrade to get the latest.
Michael Kennedy: It's just kind of odd.
Michael Kennedy: It doesn't.
Calvin Hendryx-Parker: Oh, they've got someone's got built.
Michael Kennedy: It does.
Michael Kennedy: 3.11.16.
Michael Kennedy: And 3.12.14.
Michael Kennedy: That looks like they've packaged it into Python build standalone.
Calvin Hendryx-Parker: That's nice.
Michael Kennedy: Well, it's good to see the astral folks have got our back.
Michael Kennedy: Yes, obviously.
Michael Kennedy: Like that's a theme, right?
Calvin Hendryx-Parker: It's definitely a theme.
Calvin Hendryx-Parker: Well, there you go.
Calvin Hendryx-Parker: Go.
Calvin Hendryx-Parker: Well, if you're on this older version of Python, you might need to just go upgrade to uv at
Calvin Hendryx-Parker: this point and save yourself some headache.
Michael Kennedy: Yeah.
Michael Kennedy: Yeah, absolutely.
Michael Kennedy: You could technically just use uv to manage your Python and still, I don't know.
Calvin Hendryx-Parker: Yeah, you don't need it.
Calvin Hendryx-Parker: You don't necessarily, yeah, you can do the rest of the way you're currently doing it.
Calvin Hendryx-Parker: Right.
Calvin Hendryx-Parker: But if you're going to jump in there, you might as well modernize and fix.
Calvin Hendryx-Parker: You're already in there.
Calvin Hendryx-Parker: You're already doing it.
Michael Kennedy: You're already in there.
Michael Kennedy: Okay.
Michael Kennedy: Speaking of, you gave a quick shout out to give an AI agent some kind of go find bugs.
Michael Kennedy: And I 100% agree.
Michael Kennedy: You and I both likened to this to running a lender for the first time.
Michael Kennedy: And you're like, there's a thousand errors.
Michael Kennedy: Oh my God, it's so much.
Michael Kennedy: Right, so stay on top of these things.
Michael Kennedy: But these tools are causing some places a ripple,
Michael Kennedy: other places a tidal wave.
Michael Kennedy: And Codeberg is one of those places that,
Michael Kennedy: I don't know, like, I'm not sure how to feel about Codeberg.
Michael Kennedy: I, in principle, like it,
Michael Kennedy: but I think people want Codeberg to be more
Michael Kennedy: than Codeberg wants to be, let's say that.
Michael Kennedy: What the heck is Codeberg?
Calvin Hendryx-Parker: Codeberg isn't
Calvin Hendryx-Parker: What is Codeberg?
Michael Kennedy: It is a GitHub alternative, let's say.
Calvin Hendryx-Parker: Okay.
Michael Kennedy: Evolved out of previous attempts to create a GitHub alternative.
Michael Kennedy: It's a nonprofit community-led effort with a democratic process that provides services to free and open source projects,
Michael Kennedy: such as Git hosting using 4Gio, Pages, CI/CD, and so on.
Michael Kennedy: So it's already got this restriction like, hey, it's only for free and open source stuff.
Michael Kennedy: It's not for just general paid software, private repos, and so on, right?
Michael Kennedy: Fine.
Michael Kennedy: So that's kind of its mission, and that's what it is.
Michael Kennedy: But a lot of people are looking at GitHub going,
Michael Kennedy: I mean, just yesterday GitHub was down.
Michael Kennedy: I'm like, oh, man, I guess I'll try this PR again in a half hour
Michael Kennedy: because it couldn't load the PR stuff,
Michael Kennedy: and then I just got the unicorn,
Michael Kennedy: which kind of feels like it's supposed to be amazing,
Michael Kennedy: but it's a bad unicorn.
Michael Kennedy: Should have like a leather jacket and be smoking or something.
Michael Kennedy: I don't know.
Calvin Hendryx-Parker: I know, kind of the fail whale of GitHub.
Michael Kennedy: Yes, exactly.
Michael Kennedy: And there might be people out there that don't know the fail whale,
Michael Kennedy: but oh my gosh, that Twitter went down bad in the beginning.
Michael Kennedy: Yeah, so it's like the fail wheel.
Michael Kennedy: Early days.
Michael Kennedy: But right now, I just pulled this up
Michael Kennedy: into the top of the Codeberg page.
Michael Kennedy: Time recording.
Calvin Hendryx-Parker: Yeah, the number two is interesting.
Michael Kennedy: There's just like, there's stuff we don't want here.
Michael Kennedy: And we don't approve of it,
Michael Kennedy: and it needs to get the heck out.
Michael Kennedy: Even if it is free and open source,
Michael Kennedy: it still needs to get the heck out, okay?
Michael Kennedy: So I feel like this was just,
Michael Kennedy: there's stuff we don't like, let's get it out.
Michael Kennedy: And the number two you pointed out and laughed at
Michael Kennedy: is like cryptocurrency projects are no longer allowed.
Michael Kennedy: And like, you know, I'm fine with that.
Michael Kennedy: Like, whatever.
Calvin Hendryx-Parker: Okay, okay.
Michael Kennedy: If that's your mission to just not have that kind of stuff,
Michael Kennedy: I'm here for it.
Michael Kennedy: Like cryptocurrency is weird.
Michael Kennedy: I'm not 100% against it, but it's just
Calvin Hendryx-Parker: I'm not either.
Calvin Hendryx-Parker: So that's why I thought it was kind of weird.
Calvin Hendryx-Parker: There's definitely some opinions here
Calvin Hendryx-Parker: that had a thought process going on behind them
Calvin Hendryx-Parker: that we're not seeing the full story.
Calvin Hendryx-Parker: I guess we can go view the full change, but
Michael Kennedy: Yeah, but this first one is quite weird.
Michael Kennedy: It says LLM generated content is being restricted.
Michael Kennedy: More specifically, if you have a project that they somehow decide they believe it is majority LLM, banned.
Michael Kennedy: Even if it has been here for a long time, it has gotten a lot of attention and a lot of maybe even wrote it by hand to start.
Michael Kennedy: But then you do some mega refactoring that touches every file.
Michael Kennedy: Banned.
Michael Kennedy: So you may like that.
Michael Kennedy: You may not.
Michael Kennedy: It's extreme.
Michael Kennedy: It seems a little extreme given that we just recently covered Linus Torvalds saying like,
Michael Kennedy: look, using AI to review our stuff is a tool.
Michael Kennedy: It feels a bit myopic to me.
Michael Kennedy: And fine, like I said, this is their project.
Michael Kennedy: They can do it, but people have thoughts.
Michael Kennedy: People have a lot of thoughts.
Michael Kennedy: Wait, Armin has a thought?
Michael Kennedy: Could you imagine?
Michael Kennedy: Armin Roniker has a thought.
Michael Kennedy: And he wrote, and the reason a lot of people have thoughts is they were like,
Michael Kennedy: I would just love a GitHub alternative, like for different reasons.
Michael Kennedy: Some people are just like, I don't like the way GitHub works.
Michael Kennedy: It's been down a lot.
Michael Kennedy: Other people are like, I want a European company,
Michael Kennedy: not just an American company to kind of be a first-class player in this space.
Michael Kennedy: Right.
Michael Kennedy: And whatever, like all of those people are like,
Michael Kennedy: but Codeberg is now broken.
Michael Kennedy: So that's out.
Michael Kennedy: And that was my hope, right?
Michael Kennedy: Like Obi-Wan, you're my only hope.
Michael Kennedy: Oh, Obi-Wan doesn't like all of them content.
Michael Kennedy: Well, I guess he's out.
Michael Kennedy: Anyway, so Armin wrote an article called Codeberg Divides.
Michael Kennedy: And so they changed their terms of service, as I said.
Michael Kennedy: They're entirely within the rights to do this.
Michael Kennedy: It's a democratic process.
Michael Kennedy: But democracies don't inherently make good decisions.
Michael Kennedy: That's what I'm saying, right?
Michael Kennedy: So GitHub's never been democratic, and there's plenty not to like.
Michael Kennedy: But as a core piece of infrastructure, it's been reliable, right?
Michael Kennedy: So I don't know.
Michael Kennedy: How do you even enforce this majority?
Michael Kennedy: Like I said, if I have a project, let's say a web app that uses some CSS front end, and I ask AI to change the CSS front end around, even though I wrote all the code, all the back end, in the diff perspective, chances are it's going to overwhelm the back end amount of code if I have to have it rewrite every bit of HTML because it's grid versus flex box versus whatever.
Calvin Hendryx-Parker: This is groundwork stuff that the AIs can be directed very easily to take care of for us as humans.
Michael Kennedy: Yeah, and so here's sort of the thoughts.
Michael Kennedy: It's a real shame that open source and free software communities
Michael Kennedy: are splitting this deeply over LLM and agents.
Michael Kennedy: We all already acknowledge copyright issues, energy use,
Michael Kennedy: those kinds of things.
Michael Kennedy: But it's also just how software is being made, right?
Michael Kennedy: And people need to, projects are going to need to figure out
Michael Kennedy: how to coexist.
Michael Kennedy: And yeah, if you want GitHub to face true competition,
Michael Kennedy: This is not it.
Calvin Hendryx-Parker: Yeah, this is not going to work.
Calvin Hendryx-Parker: Michael, I got an idea.
Calvin Hendryx-Parker: Okay.
Calvin Hendryx-Parker: We're going to do a blockchain project to host a GitHub alternative
Calvin Hendryx-Parker: that is a distributed autonomous organization.
Calvin Hendryx-Parker: And it's going to have like smart contracts and rules.
Calvin Hendryx-Parker: We're going completely the other direction.
Michael Kennedy: You're making my ears hurt just a little bit with that word.
Michael Kennedy: So what about this?
Michael Kennedy: What if we go back a little further and we can like do a sweet arc?
Michael Kennedy: Like what if we do like a BitTorrent hosted,
Michael Kennedy: smart contract backed?
Calvin Hendryx-Parker: Even more, like the layers go deep.
Calvin Hendryx-Parker: So, you know, the decentralization aspect
Calvin Hendryx-Parker: of BitTorrent totally makes sense here.
Calvin Hendryx-Parker: I think we could make this go.
Michael Kennedy: No, we could totally make it go.
Michael Kennedy: All right, so that was Armand's thought.
Michael Kennedy: I wish this was more forward looking
Michael Kennedy: in a place that we could depend on
Michael Kennedy: rather than a place that divides
Michael Kennedy: and just kicks a bunch of people up.
Michael Kennedy: Now, one of the reasons I'm sure they did this is,
Michael Kennedy: well, these AI things use 20 times as much resources.
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: Yeah.
Michael Kennedy: Okay.
Michael Kennedy: So I just searched for the terms to see kind of Codeberg terms,
Michael Kennedy: and I came up with this website.
Michael Kennedy: The domain is amazing, but it says...
Michael Kennedy: Oh, wow.
Michael Kennedy: I asked literally just for the terms of service of Codeberg,
Michael Kennedy: and the first thing that comes up is,
Michael Kennedy: I regret migrating to Codeberg.
Michael Kennedy: And this is actually a really interesting and well-thought-out article.
Michael Kennedy: So this person just recently left GitHub
Michael Kennedy: and moved all their projects over here because they're like,
Michael Kennedy: ah, GitHub is kind of getting clunky,
Michael Kennedy: and I have just pure open source and so on.
Michael Kennedy: So GitHub looked like a viable alternative,
Michael Kennedy: which is like this is the main spine running through this conversation.
Michael Kennedy: So unfortunately, the latest update to its terms of service
Michael Kennedy: seemed to mark the first step in changing one part I moved there for,
Michael Kennedy: namely freedom, is now gone.
Michael Kennedy: I can't work on it.
Michael Kennedy: And one of the interesting things about this term,
Michael Kennedy: I'll move on from this section in just a second.
Michael Kennedy: But from their terms,
Michael Kennedy: is the content that harms the reputation of CodeBerg,
Michael Kennedy: which is like, we don't have a great reason for it.
Michael Kennedy: And one of the criteria they use
Michael Kennedy: is it has to have a community behind it
Michael Kennedy: in order for it to be legit.
Michael Kennedy: And LLMs and AI don't make community, right?
Michael Kennedy: It seems like from the blog post,
Michael Kennedy: it seems like many vibe coders don't realize
Michael Kennedy: that they don't actually have a community around them.
Michael Kennedy: And I think that that cuts at two things.
Michael Kennedy: One, casting all of this stuff as vibe coders and just junk users who don't really know what they're doing.
Michael Kennedy: That's already kind of a...
Calvin Hendryx-Parker: There's a valid practice of agentic engineering in producing software.
Michael Kennedy: Yes.
Michael Kennedy: And this seems to lump it all in with like, oh, it's a bunch of these idiots that don't know what they're doing and we want them off our community.
Michael Kennedy: Sounds like a bunch of people who were against the stuff two years ago and have never tried it.
Michael Kennedy: don't realize the effect it has.
Michael Kennedy: But so just wrapping this up,
Michael Kennedy: this person says, look,
Michael Kennedy: I have a bunch of solo developer
Michael Kennedy: open source projects.
Michael Kennedy: And my community is people
Michael Kennedy: who just ask for features
Michael Kennedy: or ask me to change something.
Michael Kennedy: They're just people
Michael Kennedy: who want something from the software.
Michael Kennedy: They're not really a community
Michael Kennedy: with rich discussions, right?
Michael Kennedy: And so
Calvin Hendryx-Parker: I agree with this person's take on,
Calvin Hendryx-Parker: like, it's a bunch of little tools
Calvin Hendryx-Parker: that are my tools
Calvin Hendryx-Parker: and I need a good place to host them.
Calvin Hendryx-Parker: And I want to share them
Calvin Hendryx-Parker: with my little community.
Michael Kennedy: Yeah, like I've been publishing
Michael Kennedy: silly little tool for decades.
Michael Kennedy: And that was from even the SourceForge days, right?
Calvin Hendryx-Parker: This is the essence of like open source,
Calvin Hendryx-Parker: the cathedral and the bazaar,
Calvin Hendryx-Parker: like that whole bit.
Calvin Hendryx-Parker: Exactly.
Michael Kennedy: And so one of the reasons CodeBurg is blocking LLMs
Michael Kennedy: is because they think there can't be a community
Michael Kennedy: and therefore it's a fake project.
Michael Kennedy: This guy's like, I got a bunch of projects
Michael Kennedy: that don't have community,
Michael Kennedy: but they're important to me.
Michael Kennedy: And I think that's actually the majority.
Michael Kennedy: This results in censorship for me.
Michael Kennedy: But the same thing is, what if you just charged for the ones or had a very high or very strong rate limit for interactions?
Michael Kennedy: And if your AI does too much to burden our infrastructure, well, then, you know, maybe you cover that or you move them over to a portion of infrastructure that's even slower.
Michael Kennedy: Right. I don't know.
Michael Kennedy: But there's a whole lot of concrete ideas from this.
Michael Kennedy: I regret moving to Kudberg.
Calvin Hendryx-Parker: Anyway.
Calvin Hendryx-Parker: It's amazing that was the first post, like first result for a valid search for their terms of service.
Calvin Hendryx-Parker: I know, that's a strong own goal right there.
Calvin Hendryx-Parker: Speaks volumes right there.
Calvin Hendryx-Parker: Well, the others are going to emerge.
Calvin Hendryx-Parker: Obviously, the fact that we still live in an open world with a fairly open internet, people can build their distributed blockchain DAO version of GitHub if they want.
Michael Kennedy: Well, I'm looking forward to setting up.
Michael Kennedy: We should build on Codeberg.
Michael Kennedy: Oh my gosh.
Michael Kennedy: Okay.
Michael Kennedy: All right, sorry.
Michael Kennedy: That was a bit of a detour.
Michael Kennedy: A fun detour.
Michael Kennedy: But let me tell you about our sponsor, actually.
Calvin Hendryx-Parker: You should.
Calvin Hendryx-Parker: I think this is important.
Michael Kennedy: Yeah, because there's some really cool stuff
Michael Kennedy: that Logfire from Pydantic is doing.
Michael Kennedy: And this is a bit of an alternative worldview,
Michael Kennedy: one that I definitely agree with.
Michael Kennedy: But Logfire is about monitoring and observing and understanding what your AI agents and other web apps like FastAPI and Postgres and so on are up to.
Michael Kennedy: So it's 2 a.m.
Michael Kennedy: Your AI agent has failed.
Michael Kennedy: Why?
Michael Kennedy: Was it the model, a tool called the database?
Michael Kennedy: Most observability tools can't tell you because they only see part of your stack, like your web stack or something.
Michael Kennedy: Pydantic Logfire sees all of it.
Michael Kennedy: One trace across your agents, LLMs, APIs, and database.
Michael Kennedy: Down to the infrastructure, services, Kubernetes, and hosts.
Michael Kennedy: It's built on open telemetry with SDKs for Python, TypeScript, and Rust.
Michael Kennedy: And it works with any OTEL-compatible language.
Michael Kennedy: Every prompt, token count, cost right next to your vector searches and API calls.
Michael Kennedy: You query everything with Postgres-compatible SQL.
Michael Kennedy: And you give that to your coding agent through the Logfire MCP.
Michael Kennedy: So stop guessing, read the trace, Identic Logfire.
Michael Kennedy: AI is still just engineering, as we said.
Michael Kennedy: So visit pythonbytes.fm/Logfire today and sign up.
Michael Kennedy: You'll get 10 million records for free every month, no credit card expired.
Michael Kennedy: And this is a pretty cool thing as well.
Michael Kennedy: I need to add Logfire to my app so that I get this cool feature.
Michael Kennedy: How do you do it?
Michael Kennedy: They have a button that'll copy some markdown text to your clipboard and you click it and it says onboard your coding agent.
Michael Kennedy: So it just gives you instructions you can hand to Claude or Codex specifically what it needs to do to integrate your app with Logfire.
Michael Kennedy: So I think that's super cool.
Michael Kennedy: So thank you to Pydantic and Logfire for supporting the show.
Calvin Hendryx-Parker: Actually, I love the idea of the observability of grabbing the prompts and the costs and the token usage.
Calvin Hendryx-Parker: more folks are going to be heading down this route because it's been very hard to
Calvin Hendryx-Parker: analyze the return on investment of using these tools.
Calvin Hendryx-Parker: And as the costs potentially rise and subscriptions maybe shift and go away,
Calvin Hendryx-Parker: you're going to want to know this kind of data to make good decisions.
Calvin Hendryx-Parker: We're doing this right now at Six Feet Up.
Calvin Hendryx-Parker: Are you? Awesome.
Calvin Hendryx-Parker: Yeah, we're having these kinds of discussions, I should say.
Calvin Hendryx-Parker: And I could probably use a tool like this.
Michael Kennedy: Well, I don't buy Steadafim slash Longfire.
Calvin Hendryx-Parker: Oh, you know, there's a code there.
Calvin Hendryx-Parker: That's a good one for us.
Michael Kennedy: Yeah, fantastic.
Michael Kennedy: All right.
Michael Kennedy: Yeah, it's a super cool platform.
Michael Kennedy: And like I said, right here, just onboard with your code agent, click that, and then paste it.
Michael Kennedy: What's really interesting is that the instructions say things like, your user may have just clicked this and not actually read it yet.
Michael Kennedy: So please work them through this.
Michael Kennedy: Those are some good people.
Calvin Hendryx-Parker: They were doing the good work right there.
Michael Kennedy: Yeah, same thing, a call in a team knows what they're doing over there.
Michael Kennedy: I love it.
Michael Kennedy: So does Brett.
Michael Kennedy: Brett Cannon knows a few things as well.
Michael Kennedy: Brett Cannon does know a few things.
Calvin Hendryx-Parker: Actually, this is important.
Calvin Hendryx-Parker: And again, I feel like the last few episodes, I've been on a bit of a security run with things.
Calvin Hendryx-Parker: And this is continuing it.
Calvin Hendryx-Parker: And he's got some great ideas.
Calvin Hendryx-Parker: When he was writing his nomination post for the 2026 Python Packaging Council nomination or elections,
Calvin Hendryx-Parker: part of his pitch why he should be there is we need a secure supply chain for the Python ecosystems around building reproducible builds.
Calvin Hendryx-Parker: And so right now, we don't have technically reproducible builds on PyPI, but they're not
Calvin Hendryx-Parker: far away.
Calvin Hendryx-Parker: There's like he identified three gaps in the current process to get us to a point where
Calvin Hendryx-Parker: we have basically the good design goal for him is zero friction.
Calvin Hendryx-Parker: Can producers upload something to PyPI?
Calvin Hendryx-Parker: They shouldn't have to do anything.
Calvin Hendryx-Parker: And all the work lands on the build backends and installers to track and trace and allow
Calvin Hendryx-Parker: you to know where your software came from that you're installing. We all are aware of the
Calvin Hendryx-Parker: LiteLLM exploit that happened back in March. And part of that was because of a supply chain
Calvin Hendryx-Parker: injections into the build process. The other one here is like he mentioned SolarWinds,
Calvin Hendryx-Parker: that SolarWinds attack from a few years back. Again, a supply chain injection during the build process.
Calvin Hendryx-Parker: So gap number one is nothing right now records the source code, where the source code distribution
Calvin Hendryx-Parker: came from so if you add in a json descriptor it can capture you know when you install it where
Calvin Hendryx-Parker: it's from what get repo is the canonical source of truth for that code and it's something that'd be
Calvin Hendryx-Parker: very important for you to know if you're going to go back through and do an audit of the tools
Michael Kennedy: or the code and dependencies that you have into your build process interesting so you might
Michael Kennedy: be able to have a another tier of trust than just it's on pypi but yeah yeah here's how it's built
Calvin Hendryx-Parker: Yeah, exactly. And if you combine those with the PyPI two-factor and security measures that they've
Calvin Hendryx-Parker: been putting in place, this gives you a little more comfort with where something came from.
Calvin Hendryx-Parker: Gap number two is during the build, in the build tools and during the build process,
Calvin Hendryx-Parker: having a software bill of materials. So referred to as an SBOM. We can do this with PEP 770
Calvin Hendryx-Parker: has a convention for this. Software distributions can't because there are tarball plus like some
Calvin Hendryx-Parker: package info stuff. So if you have a wheel, you can basically enable this already. So the first
Calvin Hendryx-Parker: two things, very little friction. A file that describes where your GitHub repository is. The
Calvin Hendryx-Parker: second one is using wheels and PEP 770 to have software build materials in there. So either don't
Calvin Hendryx-Parker: use SDIS or move to the SDIS V2 support for this. And then basically the mechanisms already exist
Calvin Hendryx-Parker: for tying this all together in the pyproject.toml.
Calvin Hendryx-Parker: There's a build system section.
Calvin Hendryx-Parker: If it has a defined entry point,
Calvin Hendryx-Parker: so then backends can record their own environment
Calvin Hendryx-Parker: and you can reinstall and rerun the build.
Calvin Hendryx-Parker: So the goal being, again, if I build the software today
Calvin Hendryx-Parker: and if I build the software six months from now
Calvin Hendryx-Parker: or 18 months from now,
Calvin Hendryx-Parker: I should get the exact same binary each time
Calvin Hendryx-Parker: and there should be no worry
Calvin Hendryx-Parker: or at least a way to audit and trace back what happens.
Calvin Hendryx-Parker: So now trusted third parties can report
Calvin Hendryx-Parker: successful reproductions back to PyPI, which can display like an independently reproduced by
Calvin Hendryx-Parker: some authority surfaced in the index. So installers can also prefer reproduced files.
Calvin Hendryx-Parker: So PyPI would have to have a couple of changes to support surfacing this data and making
Calvin Hendryx-Parker: decisions based on that data. This is not a nice to have. This is definitely, it's not a requirement.
Calvin Hendryx-Parker: This is basically like you need to have this as part of your build process or else you're not
Calvin Hendryx-Parker: considered a top level or a first class citizen in PyPI because it shouldn't be hard to do.
Michael Kennedy: One of the things about the reproducibility that you hinched on right there at the end,
Michael Kennedy: I think is cool. I look at, say, the hash or whatever of the binary that I got. And then
Michael Kennedy: if I want to rebuild that myself, I should get the same hash if I follow the steps or something
Michael Kennedy: like that, right? Which is super cool. Yeah. But so many things can be very variable. I mean,
Calvin Hendryx-Parker: the GCC compiler on your system,
Calvin Hendryx-Parker: the minor versions of Python,
Calvin Hendryx-Parker: the architecture, whether it was ARM or x86.
Calvin Hendryx-Parker: There's a whole bunch of variables that go on in there.
Calvin Hendryx-Parker: It'd be nice to be able to get those from a trusted source.
Calvin Hendryx-Parker: And PyPI is obviously doing great work
Calvin Hendryx-Parker: at making sure we get safe wheels
Calvin Hendryx-Parker: and distributions of software.
Michael Kennedy: Yeah, definitely some great folks,
Michael Kennedy: including Seth and Mike,
Calvin Hendryx-Parker: over there working on this.
Calvin Hendryx-Parker: Well, and thanks to Seth Larson for listening to his idea and helping him check over this blog post.
Calvin Hendryx-Parker: So the right folks are involved all around.
Calvin Hendryx-Parker: That Python Packaging Council nomination, I think the voting is happening soon.
Calvin Hendryx-Parker: I didn't actually note down when it is, but I can't imagine why we wouldn't want Brett to be on that panel of people.
Calvin Hendryx-Parker: Exactly.
Calvin Hendryx-Parker: He's got the right ideas.
Calvin Hendryx-Parker: I'm all for this.
Calvin Hendryx-Parker: Just because to keep the world safe, we need to have these kinds of table stick ideas built into our infrastructure of Python
Michael Kennedy: and the build systems.
Michael Kennedy: Yeah, and Brett's been working in packaging
Michael Kennedy: and package adjacent stuff for a long time recently.
Calvin Hendryx-Parker: Yeah, so go enable these features.
Calvin Hendryx-Parker: You'll start participating in the ecosystem
Calvin Hendryx-Parker: and then eventually PyPI will support it
Calvin Hendryx-Parker: and you'll be able to know that the software you're getting
Calvin Hendryx-Parker: has come from verified sources.
Calvin Hendryx-Parker: Maybe that's an extreme, not verified sources,
Calvin Hendryx-Parker: but at least the build can be reproduced.
Calvin Hendryx-Parker: Yeah.
Calvin Hendryx-Parker: Verifiable.
Calvin Hendryx-Parker: Verifiable, not verified.
Calvin Hendryx-Parker: Subtle difference.
Michael Kennedy: yeah okay so now moving moving on we have a extra extra extra here all about it a whole
Michael Kennedy: section of extras well this is when there are so many extras that i'm like this can no longer be
Michael Kennedy: extra it must be hoisted up into a top level topic all right and i don't know i've got a sidebar full
Calvin Hendryx-Parker: of them so let's see i got questions about one of these here for sure all right let's go well
Michael Kennedy: You talked about the security fixes of like 3.11 and so on, 3.11.6 and beyond.
Michael Kennedy: We also got a new...
Calvin Hendryx-Parker: They are.
Calvin Hendryx-Parker: Some of them have landed in 3.14.
Michael Kennedy: Yeah.
Michael Kennedy: So 3.14.7 is out.
Michael Kennedy: And sometimes these are like, we've changed some minor setting or whatever.
Michael Kennedy: This is a proper release of Python.
Michael Kennedy: And I know it's mid-August and in a month and a half, we're going to have 3.15, which is
Michael Kennedy: very exciting.
Michael Kennedy: But there's a couple interesting takeaways here.
Michael Kennedy: Plus, you should just install this.
Michael Kennedy: So under security, it doesn't fit on my screen,
Michael Kennedy: the number of single sentence things fixed.
Michael Kennedy: So that alone tells you maybe we should pay attention.
Michael Kennedy: So like here, for example, the one you talked about,
Michael Kennedy: GitHub 15987, the tarball extract.
Michael Kennedy: And then there's another one somewhere in here,
Michael Kennedy: like this is the workaround of that fix, also fixed.
Michael Kennedy: But there's some denial of service-ish things
Michael Kennedy: like element tree find all from XML parsing
Michael Kennedy: or even web page parsing has quadratic behavior
Michael Kennedy: if you give it certain types of inputs.
Michael Kennedy: And that means you could create
Michael Kennedy: like a element tree find all bomb type of thing.
Michael Kennedy: So there's a bunch of this complexity stuff here.
Michael Kennedy: But this is also a proper release.
Michael Kennedy: So I'm going to scroll at a high rate
Michael Kennedy: the entire time that I'm talking.
Michael Kennedy: And it is way still going on.
Michael Kennedy: This is all core Python internals, not even the standard library.
Michael Kennedy: Ooh, okay.
Michael Kennedy: And then, now maybe that was a standard library as well, but also build and then Windows and Mac.
Michael Kennedy: I mean, there are pages and pages and pages of changes here.
Michael Kennedy: And if you go up one, like I said, there's an interesting theme.
Michael Kennedy: So if you look at free, free threaded.
Michael Kennedy: Yep.
Michael Kennedy: Oh, wow.
Michael Kennedy: This is one of the, I mean, it is lighting up the find section.
Michael Kennedy: Yeah, the little scroll bar highlight that shows where the find lands.
Michael Kennedy: There are so many race conditions that are getting fixed.
Michael Kennedy: This is just something Python has not really had to deal with.
Michael Kennedy: And I don't know how I feel about this, Calvin.
Michael Kennedy: I'm very excited about free-threaded, but there's this many fixes now.
Calvin Hendryx-Parker: They should have skipped the.7 and made it.15, like 3.14,.15.
Calvin Hendryx-Parker: I know.
Michael Kennedy: It's the lead-in to 3.15 or whatever, right?
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: Yeah, but in the core built-ins, there's just tons of, like,
Michael Kennedy: Fix the data race condition and free-threaded build of gc.gen count.
Michael Kennedy: Fix the potential deadlock on intern from string and other functions on the free-threaded build.
Michael Kennedy: And so if you're doing stuff with free-threaded, you definitely want to go through this.
Calvin Hendryx-Parker: I hope some folks who've been posting blog posts around free-threading go redo their benchmarks against this release to see how that has changed.
Calvin Hendryx-Parker: Yeah, 100%.
Michael Kennedy: Okay, well, that was one of them.
Michael Kennedy: That's a lot.
Michael Kennedy: I know.
Michael Kennedy: That was just one of the things.
Michael Kennedy: Remember you gave me homework last time?
Michael Kennedy: I'm like, oh, I just, I literally just added the MCP server for Python bytes.
Michael Kennedy: And you said, oh, Michael, that'll hold that protocol is out of date.
Michael Kennedy: You got it.
Michael Kennedy: There's a new one.
Michael Kennedy: I'm like, no.
Michael Kennedy: Well, I upgraded it.
Michael Kennedy: So Python bytes, it's MCP server, which only existed last week.
Michael Kennedy: Now uses the, let me see if I get this from memory.
Michael Kennedy: 2026.0728 version two protocol, which is more stateless.
Michael Kennedy: So it's backwards compatible with the old ones,
Michael Kennedy: and it now adopts the new one.
Michael Kennedy: So that's pretty cool.
Michael Kennedy: And also for Talk Python,
Michael Kennedy: they were basically a similar update there.
Calvin Hendryx-Parker: So how long did that take you?
Calvin Hendryx-Parker: I mean, were you able to just point the clankers at it
Calvin Hendryx-Parker: and say go?
Michael Kennedy: The clankers grinded for a while to probably an hour.
Michael Kennedy: Yeah, probably took an hour.
Michael Kennedy: It was a pretty significant amount of turn.
Michael Kennedy: But no worries, I got it done.
Michael Kennedy: Nice.
Michael Kennedy: You know, if I had run on Fast MCP,
Michael Kennedy: which is now just MCP server, I believe,
Michael Kennedy: is the name of the project now, probably would have been better, even though there were breaking
Michael Kennedy: changes. But this is integral. It's just a part of the Quart Flask app that are these websites.
Michael Kennedy: And so it had a little more low-level stuff. But at the same time, it wasn't. I mean,
Michael Kennedy: my active time was probably 15 minutes. But I had to verify and check. And so, oh, let me go over
Calvin Hendryx-Parker: to Claude and ask it if it still knows how to talk to it. Think of the scale you can handle now.
Calvin Hendryx-Parker: I mean, people can just hammer your MCP service now.
Michael Kennedy: I know.
Michael Kennedy: It's so stateless.
Michael Kennedy: They can just ask it questions all day long.
Michael Kennedy: All day long.
Michael Kennedy: And in principle, I don't really mind.
Michael Kennedy: I mean, I'm not inviting to not to do this amount of service because I do get that sometimes
Michael Kennedy: and it's not fun.
Michael Kennedy: But it is all the database backed indexed queries.
Michael Kennedy: So it is like sub millisecond usually when you ask questions like this.
Michael Kennedy: So it's pretty cool.
Michael Kennedy: All right.
Michael Kennedy: Yeah.
Michael Kennedy: Remember we talked about AgentsView.
Michael Kennedy: I believe you brought this up.
Michael Kennedy: And I'm like, all right, so crazy that on my M5 Pro MacBook Pro, I see some portion of my work and projects reported.
Michael Kennedy: And then I go to my mini and I see some other portion, the complement of my work reported.
Michael Kennedy: And then I'm like, well, I finally set up Postgres Sync, which is really cool.
Michael Kennedy: So if you set up this Postgres Sync thing, you just get a web page that you can host.
Michael Kennedy: I'm hosting it on Tailscale, super private behind all my stuff.
Calvin Hendryx-Parker: Nice.
Michael Kennedy: And then that gives you a unified view.
Michael Kennedy: There's just a little daemon sort of thing that runs on each machine that just, you know,
Michael Kennedy: normally it's running on SQLite.
Michael Kennedy: It just looks at SQLite, goes, what's changed?
Michael Kennedy: And it just pushes those changes and merges them on a Postgres thing that's running in Docker on my mini behind Tailscale.
Calvin Hendryx-Parker: I have a question for you on that because we're using agents view a little more to help with that analysis
Calvin Hendryx-Parker: and looking at our users and models.
Calvin Hendryx-Parker: The Postgres sync, could you have multiple users push into it?
Calvin Hendryx-Parker: Because that's exactly what I think I want to do.
Michael Kennedy: The one thing to be a little careful of, and I kind of would like to just say,
Michael Kennedy: could we just not put this data here at all, is it syncs the actual chat conversation, the chat log.
Calvin Hendryx-Parker: The sessions.
Calvin Hendryx-Parker: Because you're getting the full fidelity of the agent's view, but in a centralized spot.
Michael Kennedy: Yeah, I mean, it is cool that you can go and do things like hit command K
Michael Kennedy: and then do vector and semantic search across your work.
Michael Kennedy: But at the same time, the more people send in stuff in,
Michael Kennedy: it's plausible that you could write another script
Michael Kennedy: that just deletes that data.
Calvin Hendryx-Parker: Yeah.
Michael Kennedy: After, right, like just goes and just zeroes it out
Michael Kennedy: because there's actually zero words in this,
Michael Kennedy: even though the token count was recorded and so on.
Michael Kennedy: I haven't tried that, but possible.
Calvin Hendryx-Parker: I like the fact you can do like,
Calvin Hendryx-Parker: I guess it even mentions their team dashboard.
Michael Kennedy: Yeah, exactly.
Michael Kennedy: And I am a team of one for this,
Michael Kennedy: but I'm still working in two places and I need it
Michael Kennedy: because otherwise it doesn't work.
Calvin Hendryx-Parker: Yeah, yep.
Calvin Hendryx-Parker: I've got the same.
Calvin Hendryx-Parker: I'm going to set that up.
Michael Kennedy: All right.
Michael Kennedy: Let's carry on this order.
Michael Kennedy: Like I said, this is why this had to be promoted.
Michael Kennedy: Brian Okken.
Michael Kennedy: Hey, Brian.
Michael Kennedy: He had talked over last year on the show about working on Lean TDD, TDD Without the Waste,
Michael Kennedy: and sort of redoing that.
Michael Kennedy: And he has just released the Audible version.
Michael Kennedy: How cool is this?
Calvin Hendryx-Parker: I like that.
Calvin Hendryx-Parker: And it's him narrating it, too.
Calvin Hendryx-Parker: So if you missed Brian's voice from this podcast, you can go over and listen to him read the
Michael Kennedy: whole book to you.
Michael Kennedy: It's pretty wild.
Michael Kennedy: Like, this is audible.
Michael Kennedy: And it's Brian.
Michael Kennedy: Yeah, it is Brian.
Michael Kennedy: And he did a really good job.
Michael Kennedy: It sounds, you know, professional and great.
Michael Kennedy: And I very much like it.
Michael Kennedy: And I know that when he was working on this book,
Michael Kennedy: one of his goals was to not make it too overburdened with code samples
Michael Kennedy: such that it could be an audio book that is actually worth listening to.
Michael Kennedy: So link into that and check that out.
Michael Kennedy: Two more things.
Michael Kennedy: These have to do with Talk Python courses.
Michael Kennedy: So I talked to someone recently who wanted to take a course from Talk Python.
Michael Kennedy: And they said, well, this is really great.
Michael Kennedy: And this is exactly what I want to take.
Michael Kennedy: But it turns out our company, our organization,
Michael Kennedy: has some subscription to some other junkier Python training thing
Michael Kennedy: that I don't want to use.
Michael Kennedy: But they said if they're going to cover it, I have to use their Python thing,
Michael Kennedy: not some other random internet thing that who knows what it is, right?
Michael Kennedy: So I thought, well, that's not right.
Michael Kennedy: Shouldn't people be able to, you know, if you're a company, get a sense of this is a good thing for your company.
Michael Kennedy: So if you work for especially a large company, this falls into that category.
Michael Kennedy: I have a program that I set up for you called a free Python training evaluation for teams.
Michael Kennedy: So what it is, is for up to 15 people, they get complete free access to one of the, pick one, one of the Talk Python 60 courses.
Michael Kennedy: And then you can go through it.
Michael Kennedy: And then that team can report back like, hey, was this worth doing?
Michael Kennedy: We maybe bring Talk Python as a vendor into your company.
Michael Kennedy: You get a really nice dashboard of how all your students are doing,
Michael Kennedy: going through the course.
Michael Kennedy: And yeah, so who's redeemed the seats?
Michael Kennedy: Are they finished?
Michael Kennedy: Like all that kind of stuff.
Michael Kennedy: You can download updates and so on.
Michael Kennedy: No MCP server though.
Michael Kennedy: Not for this.
Michael Kennedy: But you could download the CSV and then go to town on it, right?
Michael Kennedy: So everybody gets basically free access to the course, mobile apps, all that.
Michael Kennedy: So if you work for a team, if I work for a large company and you have a team there and there's like a lot of restrictions on what training options are available, please reach out to me, Michael at talkpython.fm.
Michael Kennedy: Let's set one of these up.
Michael Kennedy: It costs you nothing to try it out.
Calvin Hendryx-Parker: Get the name brand training.
Michael Kennedy: Exactly.
Calvin Hendryx-Parker: Not the generic lookalike.
Michael Kennedy: Exactly.
Michael Kennedy: Not the generic where you've got to press play every single video and navigate around.
Michael Kennedy: Not good.
Michael Kennedy: And related to that, I've also set up a government procurement page that gives all...
Michael Kennedy: Wow, you're fancy.
Michael Kennedy: That's really fancy.
Michael Kennedy: It existed before, but it wasn't on a page where people knew that they could get it.
Michael Kennedy: So it lists our sam.gov unique ID.
Michael Kennedy: So if you work for a government entity, there's all these rules like, oh, it has to be registered with this thing.
Michael Kennedy: And it has to be active.
Michael Kennedy: And you have to have a 508 report on your accessibility, et cetera, et cetera.
Michael Kennedy: I put all that stuff up here.
Michael Kennedy: So if you work for a government and you would like a governmental agency, especially the U.S., please check it out.
Michael Kennedy: This all makes it super easy.
Michael Kennedy: You probably have to address this kind of stuff some of the time.
Calvin Hendryx-Parker: It looks like you put a lot of work into this, and it shows.
Calvin Hendryx-Parker: Thank you.
Calvin Hendryx-Parker: It's amazing.
Michael Kennedy: Thank you.
Michael Kennedy: All right.
Michael Kennedy: Well, those were many extras.
Michael Kennedy: Those were many, many extras.
Michael Kennedy: We are done with the extras.
Calvin Hendryx-Parker: I've got one extra, which is a follow-up to last week's episode around the post-quantum key exchange.
Calvin Hendryx-Parker: And the fine folks over at Astral have made a new release of uv.
Calvin Hendryx-Parker: That's what it was like five days ago.
Calvin Hendryx-Parker: And it now supports and prefers post-quantum key exchange.
Calvin Hendryx-Parker: So they've already got your back.
Calvin Hendryx-Parker: You can opt in to TLS diagnostics,
Calvin Hendryx-Parker: but you're going to get post-quantum key exchange out of the box
Calvin Hendryx-Parker: when you're using uv node.
Calvin Hendryx-Parker: So I thought that was pretty cool.
Michael Kennedy: You know what?
Michael Kennedy: Just bookend it with uv.
Michael Kennedy: Well done.
Michael Kennedy: Astral.
Michael Kennedy: Open AI team.
Calvin Hendryx-Parker: so far they're still doing again the good work i appreciate their what they're putting out there
Calvin Hendryx-Parker: for the community and keeping the again staying on top of us like that's really cool that
Calvin Hendryx-Parker: this has we went from one week being announced to next week it's in use and you're getting it
Michael Kennedy: yeah that's super cool and i think i do think they're doing a great job so yeah yep so grab
Michael Kennedy: the latest version of uv yeah i love it all right are you ready for a joke let's close it out do it
Michael Kennedy: This joke is called beware of dog.
Michael Kennedy: Oh.
Michael Kennedy: We've all seen the beware.
Calvin Hendryx-Parker: Yeah, Mushu made his appearance last week on the show.
Michael Kennedy: Yes, exactly.
Michael Kennedy: Exactly.
Michael Kennedy: We've all seen the signs.
Michael Kennedy: Do you really, is it just a, be careful, there is a dog here?
Michael Kennedy: Or is it like a dangerous, aggressive dog?
Michael Kennedy: We don't know.
Michael Kennedy: But this one is aggressive.
Michael Kennedy: Oh, let me tell you.
Michael Kennedy: So there's a big sign that says, warning, beware of dog.
Michael Kennedy: He uses Kali Linux.
Michael Kennedy: So you're laughing.
Michael Kennedy: Tell people what Kali Linux is for those who don't know.
Calvin Hendryx-Parker: For those security folks who are looking to do some pen testing,
Calvin Hendryx-Parker: you may have installed Kali Linux in the past.
Calvin Hendryx-Parker: So it provides some attack tools to let you go after other people's servers,
Calvin Hendryx-Parker: or your own, hopefully.
Michael Kennedy: Yeah, yeah.
Calvin Hendryx-Parker: Not others.
Michael Kennedy: It basically is a distribution that bundles a whole host of things
Michael Kennedy: you would separately install if you were a pen tester, hacker sort of thing.
Michael Kennedy: And it comes ready to go, right?
Calvin Hendryx-Parker: That needs to be the new logo for Kali Linux,
Calvin Hendryx-Parker: like a big junkyard dog with a big like spiked collar exactly love it terminal with the uh the
Calvin Hendryx-Parker: name and address on it there's no place like one two seven zero zero one exactly tattooed on his arm
Calvin Hendryx-Parker: you know i'm a sucker for dad jokes that i will laugh every time i know these are these are
Michael Kennedy: pretty solid these are pretty solid so beware the dog he's his cali Linux all right well that is it
Michael Kennedy: for the show, Calvin,
Michael Kennedy: thank you for being here with all of us.
Michael Kennedy: Yeah, you bet.
Michael Kennedy: And check out Pydantic Logfire
Michael Kennedy: at pythonpys.fm slash logfire.
Michael Kennedy: Really appreciate them supporting the show.
Michael Kennedy: Update your Pythons.
Michael Kennedy: Yes.
Michael Kennedy: uv, Python, even had an upgrade.
Michael Kennedy: So for in-place point release upgrades for uv,
Michael Kennedy: you can just, there's a single command now
Michael Kennedy: to update all of them.
Michael Kennedy: So just do that.
Calvin Hendryx-Parker: Stay safe out there.
Michael Kennedy: That's right.
Michael Kennedy: Bye, y'all.
Calvin Hendryx-Parker: See ya.