Voiceover: “Each grape is milled from a single billet of aluminium…”
James Bennett
@b-list.org
Django/Python guy. Tip your servers and normalize your Unicode. he/him Angry politics and other non-tech parts of me are at @ubernostrum.bsky.social Elsewhere: https://www.b-list.org/ https://infosec.exchange/@ubernostrum https://github.com/ubernostrum
93. When someone says "I want a programming language in which I need only say what I wish done," give him a lollipop. www.cs.yale.edu/homes/perlis...
Perlisisms - "Epigrams in Programming" by Alan J. Perlis
cs.yale.edu
Paul Frazee@pfrazee.com · 5d agoWe should stop thinking about software as anything other than getting the computer to do what we want it to do for us
It’s kind of interesting that this thread, of all things, is the one making some big pro-LLM folks I know suddenly stop and actually read other people’s experiences outside the bubble and have a “wait, really, that’s what it’s been like?” moment. lobste.rs/s/7tpc5q/sur...
Surviving Code Reviews in the era of AI
63 comments
lobste.rs
Unfortunately I did not understand in time that the Packaging Council election requires a *separate* voter-enrolling affirmation from other PSF-run elections, so I did not receive a ballot. But if I had, I would have voted Brett at the top of it. He's done incredible work improving Python packaging.
Brett Cannon@brettcannon.mastodon.social.ap.brid.gy · 6d agoI have to admit that having a company make a corporate blog post about endorsing PPC nominees was a bit startling for me (and not because they didn't endorse me; the people that were listed are all good candidates). I haven't decided if I don't care or if I don't like having a company making […]
Tired: “we were hacked and our password database was exfiltrated and is now being used for credential stuffing” Wired: “Our credential agent broke containment and is now autonomously attacking other services”
Four years ago I published a post on how to manage #Python dependencies in as “boring” a manner as I could manage. Today I’ve published a revised version catching up on developments in the ecosystem since then: www.b-list.org/weblog/2022/...
Boring Python: dependency management
This is the first in hopefully a series of posts I intend to write about how to build/manage/deploy/etc. Python applications …
b-list.org
re: omarchy trying to create parallel infra to subvert the linux community and kick trans/female/black people out i know some people think that sounds crazy but DHH literally is doing a podcast tour saying that is exactly what he's doing lol
Based on Omarchy’s recent history, evidently trans and marginalized folks are the only ones who can configure a Docker deployment without creating a massive security hole.
It's even worse. He's been pretty open about the fact that the reason Omarchy exists is the Linux community has too many trans/marginalized folks. It's not *just* funding something run by a rotten man. It's funding something with a rotten intent behind it.
That someone who was always a huge asshole in the Before Times still is apparently a huge asshole, But Now With AI, was one of the less surprising things I learned today.
A neat security vulnerability in Python caused by str.lower(). Also includes lots of RFCs so I’m having a good time :) sethmlarson.dev/when-str-low... #security #python #idna
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
sethmlarson.dev
I self-nominated myself for the Python packaging council today. I have posted my nomination statement as a blog post. snarky.ca/my-nominatio...
My nomination statement for the 2026 Python packaging council
I have decided to run for the inaugural/2026 Python packaging council (PPC). I will say I have the support of my employer (Microsoft) to do this, but they didn't ask me to and my usual thing that I wo...
snarky.ca
Last year @yossarian.net wrote a brief post on the surprising complexity of the #Python "splitlines()" method. As a busy Unicode pedant, it took me a while to write up something explaining *why* it's complex, but here it finally is: www.b-list.org/weblog/2026/...
Breaking up (lines) is hard to do
Here’s a seemingly simple question: given a chunk of multi-line text, how do you split it and return an array …
b-list.org
Tech press seem to have noticed this now. www.theregister.com/ai-and-ml/20...
As Larry Ellison bets the farm, Oracle says it loves AI-written code, just not in OpenJDK
Use it to debug and review, says Big Red, but don't submit its output
theregister.com
James Bennett@b-list.org · last mo.I just learned that Oracle, which is shoveling unbelievable amounts of cash into getting everybody to use LLMs, also has a policy forbidding contributors to OpenJDK from using LLMs to generate code, citing code quality, security, and legal concerns: openjdk.org/legal/ai
Happy to announce v3.0.0 of my build-and-inspect-python-package GitHub Action that does what the name says. If u maintain a Python pkg u should really give it a look! Much, much fewer broken pkgs have been pushed to PyPI & who doesn't love automatic trove classifier → GHA test matrix conversion‽
I just learned that Oracle, which is shoveling unbelievable amounts of cash into getting everybody to use LLMs, also has a policy forbidding contributors to OpenJDK from using LLMs to generate code, citing code quality, security, and legal concerns: openjdk.org/legal/ai
OpenJDK Interim Policy on Generative AI
openjdk.org
Oh, your AI hacked Hugging Face? Well, my uncle's AI hacked Nintendo, and it says you CAN find Mew under the truck!
old and busted: delete failing tests new and hotness: delete CI configuration this is FOSS DoS; I have no other term for it github.com/python-attrs...
and_ and or_: reject non-callable arguments at the call site by HrachShah · Pull Request #1585 · python-attrs/attrs
Summary and_ and or_ now raise NotCallableError at the call site when given a non-callable argument, instead of silently deferring the failure to the wrapped validator's __call__ site. Motivati...
github.com
step 1: do an experimental JIT step 2: do a website called www.doesjitgobrrr.com to track performance step 3: write a PEP called "JIT Go Brrr" step 4: non-experimental JIT gone brrr? step 5: CPython gone brr? step 6: brrrrrr? peps.python.org/pep-0836/ #Python #CPython #JIT #PEP #PEP836 #JIT #GoBrrr
does JIT go brrr? | Python JIT Performance Tracker
Track Python's experimental JIT compiler performance vs the standard interpreter over time. Daily benchmarks across multiple machines using pyperformance.
doesjitgobrrr.com
Frog put Claude in a harness. "There," he said, "now Claude can no longer delete files." "But Claude can edit the files" said Toad. "That is true," said Frog.
amos@fasterthanli.me · 2mo agoagent: let's delete this file harness: 🚨 DANGER NOPE CAN'T DO THAT 🚨 agent: let's replace this file with the empty string harness: 😌 thank god yes that's better 💆
Join Seth Michael Larson (@sethmlarson.dev) at EuroPython for "Learning from the not-so-secret Python security "cabal"" talk: ep2026.europython.eu/9JALSN
They wanted her to make a second effort with reluctant adopters, extol the virtues, etc. She was clearly uncomfortable with this and didn’t do it. But there they all are, bolted to the ceiling, and were just supposed to trust that they aren’t recording, that nothing is being “trained” 3/
A quick shadow drop of sorts: who hasn't implemented a cache on top of Postgres? I know, everyone has. And yet, here's another contender that's based on psycopg and can use existing SQLAlchemy engines (or whatever you implement): ⚡️psycache ⚡️ 1/2
This was one of my favorite talks at PyCon US, so if you’re going to EuroPython I’d highly recommend.
EuroPython 2026, Kraków@europython.eu · 3mo agoJoin Savannah Ostrowski (@savannah.dev) at EuroPython for "The coolest feature in Python 3.14: sys.remote_exec()" talk: ep2026.europython.eu/KFQN3X
