Security and Fellow at the Python Software Foundation 🐍 Trans rights, BLM, Minnesoootan, retro gaming, he/him
Blog: https://sethmlarson.dev
| Blog | https://sethmlarson.dev |
| Signal | sethmlarson.99 |
RE: https://fosstodon.org/@pypi/116335453780319113
There is a ton in this report, like how @pypi is able to respond so quickly to malware thanks to our network of trusted reporters and how to keep yourself secure both as a maintainer and user of Python packages.
Please welcome Stan Ulbrych @stanfromireland as the newest member of the Python core team!
https://discuss.python.org/t/vote-to-promote-stan-ulbrych/106562
I’d like to propose promoting Stan Ulbrych (@Stanfromireland) to core developer. If you’ve been active in the repo lately you probably ran into this enthusiastic triager. I’m now at the proverbial point where applying his “I’d merge this” suggestions feel like a chore – and cases where I disagree feel like nitpicking. Stan started contributing at the end of 2024, was promoted to triager in June, and accumulated 340+ commits in main. He’s active in datetime (to the point where @pganssle asked ...
You can do a lot of things with @sigstore: sign things with workload identity, get attestations in package managers like PyPI, etc. But there's some limitations. For instance, you can't verify a Sigstore bundle in a 16-bit DOS environment.
Until today. Introducing sigstore-c, which prioritizes portability over features (and correctness!) https://blog.sigstore.dev/sigstore-c/
I clearly need to start a wall of “trusted publishing would have prevented this” incidents
Edit: but not axios, maybe! Looks like that one may be full maintainer account compromise.
Creating a personalised bin calendar: https://alexwlchan.net/2026/bin-calendar/
I wrote a quick post about how I create my a fridge calendar that tells me about bin day.
Python stdlib + CSS = 🚮 💚
Niki
Python Package Index
Hugo van Kemenade
Zach Steindler
Tim Schilling
yossarian (1.3.6.1.4.1.55738)
PyCon US
alexwlchan