Python Bytes - #227 No more awaiting, async comes to SQLAlchemy

Episode Date: March 31, 2021

Topics covered in this episode: Number One, that's "retract plank," not "remove plank." SQLAlchemy 1.4.0 Released django-tenants pre-commit ci Snyk (Python) Package Advisor PyWebIO Extras Joke S...ee the full show notes for this episode on the website at pythonbytes.fm/227

Transcript
Discussion (0)
Starting point is 00:00:00 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly to your earbuds. This is episode 227, recorded March 31st. Nice. I'm Brian Ocken. Hi, Michael Kennedy. I'm Michaela Reyes. Welcome, Michaela. Good to have you here. Thanks, Michael and Brian. I'm a big fan of both of your shows. Oh, thank you. Wonderful.
Starting point is 00:00:23 Yeah, that's really nice. And yeah, it's super cool you could drop in here and be part of your shows. Oh, thank you. Wonderful. Yeah, that's really nice. And yeah, it's super cool. You could drop in here and be part of this show. And before we get on, maybe just tell folks about yourself. What do I do? I'm a software developer for more than 10 years. And then I'm also an organizer of the Python community in the Philippines. So yeah, that's about it. Nice. Should we jump in? Let's jump in. All right. Well, the other day I was on Twitter. Sorry, I made myself laugh.
Starting point is 00:00:54 So Ned Batchelder put out a comment that said, public service announcement, please do not remove old versions from PyPI because it just causes work for people that have to go find your old versions on GitHub. PyPI has a Yank feature that you should use instead. And I didn't know about this Yank. I didn't know about it either. I thought you just have to live with leaving it there or you take it away and cause trouble. Yeah. So this is pretty cool. What it does is, and I should have had a screenshot of this up, but basically in PyPI, when you go in and log into your account, and you go to one of the packages that you want toank this instead of deleting. And apparently this just came out like last year
Starting point is 00:01:46 or a year before, I can't remember, but it's not terribly old and I missed it. Yanking is about the same thing. So yanking leaves it there, but it doesn't automatically grab that version, even if it's within a range that you've specified. The only way PyPI will grab that version is if you specifically have that exact version specified to grab.
Starting point is 00:02:11 And that way, if somebody has a pinned version to just that version, if it's gone, they just won't download anything. So that's not nice. It's just going to crash and their Docker thing won't build or their system won't install or whatever. Something bad, right? Yeah. And then I also wanted to link to uh doug hellman article um about um so you've released a broken package what do you do now and his recommendation is just relax it
Starting point is 00:02:36 happens um just push it out again uh fix it and push it out and so so I generally, I don't know if I've ever thought of the need to Yank because most people probably won't pin the bad version unless they know it works for them. So I guess I wouldn't worry about it too much. It's interesting. I guess this is new as well. This is from May of 2019, this Yank feature, according to the PEP at least, something around that timeframe. So it's pretty new, but it definitely seems like a good feature. Kayla, have you heard of this? I also haven't pushed anything on PyPI yet. Just internal packages.
Starting point is 00:03:13 Yeah, yeah. Then you just tell people, oh, this is broken. Don't use that one. Yeah, if you put it on PyPI, then someone PIP installs, PIP freezes it, they've got it.
Starting point is 00:03:23 So I guess it depends how popular a package is is but even if you have an unpopular one you know you've got a just a thousand downloads a day or something or that's still a very high likelihood that someone's going to grab it i just pushed up something recently i was excited that it got up to like 24 downloads a day no i mean that's that's good i think well i have nothing i have nothing in that scale i'm thinking you know if you're you if you're doing flask or jango or pandas and you push a bad thing like you're gonna hear about it for a long time it's it's gonna be a high stress event or as opposed to like the stuff that i have up there no one would notice as long as i got to it pretty quick i'll stick one of mine up in the in the the extra section at the end okay yeah perfect yeah i was
Starting point is 00:04:03 i was about to ask. So SQL Alchemy, maybe you guys have heard of this. I think it's about something to do with databases, something like that. Yeah. So SQL Alchemy obviously is the most popular ORM for talking to databases without writing raw SQL, which I think for the most part,
Starting point is 00:04:20 this is the way you should be doing it, right? You should be programming with so many things. Just change the connection string and it works. It doesn't matter what underlying operating or underlying database you're talking to it'll figure it out mostly we'll get to that but big news mike bear has been working super hard to get sql alchemy 1.4 out and does it say here it says this is a ton of work that they put into over i believe this this is months of work. And I think it came out last week, but we didn't have time to cover it. So here it is. And this is notable, not just because, oh,
Starting point is 00:04:50 look, at some point release, and there's a few things, but there's a bunch of big changes for people that know about SQL Alchemy. For example, this is the first one that is moving towards SQL Alchemy 2.0, which is a big change of the APIs and things like that. So it introduces a bunch of new APIs, especially around async and await. So this is the first SQL alchemy that natively supports without some kind of external patching thing, natively supports using the ORM to talk to the database using async and await,
Starting point is 00:05:17 allow you to plug into things like fast API and other places in a real scalable way. So that's pretty cool. And yeah, the fact that it's moving on to this 2.0 style is pretty interesting. So yeah, big news, right? Yeah. Yeah, cool. And there's a lot of changes
Starting point is 00:05:33 around working with the ORM towards this new API. So it used to be you would create a session and then you would say session.query of the class you want to query and then like filter and order by and all that kind of stuff. And that stuff is gone. Not removed, but it's not the new style, and it's not the style
Starting point is 00:05:49 that supports async and await. So I'm pulling up here this doc that shows the before and after. So if you wanted to get all the users, you used to say session.query of user all. Now what you do is use this combination of select statements and then executing them. Um, I believe this comes out of the core of SQL alchemy. There's a way to do the core queries and then the ORM queries. And I think it's leaning more on the way that the core work. So now you would say session dot execute selective user. And there's a few more steps for some reason. Then you got to say dot scalers dot all.
Starting point is 00:06:21 You don't do that. What you get back is like a bunch of tuples where some part of the tuple on each entry is the thing you were looking for i believe um so it's not super different but it is not even close to the same so that's that's uh something that people should look at let's see if i can find the async support here i'll just show you one thing that you also i want to point i said normally you can just change what database you talk to. If you're doing the async API, you have to be more specific about it. For example, if you just try to talk to SQLite, it'll crash and says the SQLite driver doesn't support async. Sorry, you can no longer use, you can't use that API to talk to SQLite. But what you can do from this little, I've taken from one of my classes is you can use a different connection string this is from my second fast api course you can say sqlite plus aio sqlite and say i want to use the aio sqlite
Starting point is 00:07:12 driver not the plain sqlite driver for my async connection right yeah so if you do that then you're back to good things go yeah things go as you would expect which is really cool and then you got to do things different instead of creating, you've got to create an async engine. The way you work with the session object is now with the async with block. There's a lot of interesting slight variations going on. But basically, it's really cool that you can now do SQLite or SQLAlchemy and SQLite, I guess. But especially SQLAlchemy against the databases using the ORM in an async and await friendly way. That's the big news.
Starting point is 00:07:46 That's really cool. Yeah. I actually think the changes to the ORM are kind of neat. Yeah, no, I'm not saying I dislike them. You're not just going to be able to put in a wait in front of what you used to do. It's a different API. You got to kind of go through and figure it out. But it's fine.
Starting point is 00:07:59 It's good. I'm really happy to see it. Okay, do you think with SQL Alchemy? Yeah, it looks the new query style is more understandable, I guess. But I'm just worried about those who are using the old version in production. Yeah, I don't know if it's going to go away in SQL Alchemy 2. I'm not sure what the story is there, what the future plans are. But if you want to take advantage of the async and await stuff, you've got to go do new things.
Starting point is 00:08:25 But there's not going to be a lot of old code. I mean, there's going to be no old code doing the old async way because it just wasn't supported at all, right? So it should be okay. Yeah.
Starting point is 00:08:34 All right. Well, that's that for that one. And I think you're up next, right? On your item. I found this Django Tenants package back in 2017. And then I was just surprised that it's still being maintained when I looked at it. So it's a multi-tenancy implementation for Django
Starting point is 00:08:56 typically used for SaaS websites so it's like what's a good use case. Let's say you have a restaurant with franchise, and then you have different branches for each location. Then you can have, for example, your main web app is mywebsite.com, and then you can have, let's say, makati.mywebsite.com or branch2.mywebsite.com. It uses PostgreSQL schemas. So for each tenant, it will use a different schema for each tenant. Okay, cool.
Starting point is 00:09:44 This is really neat because that is such a big challenge. I know people that have sites that they build that their customer wants to log in multiple logins for them. And when they go in there, they want to see their data, but you don't want to have a copy of the website for everyone. You want to have one website that you maintain and it's always filtered to what company are you in? You get to see the data related to that company that account as someone else comes in yeah and this is this is super cool
Starting point is 00:10:10 yeah because the data leaks can cause you lawsuits yeah yeah i mean you could do it yourself right every single query you could say whatever the query is and your company id equals or account id equals whatever it is but if you forget one time, you're in the news in a bad way. Yeah. Yeah. This is very cool. Yeah. I was always curious about how people, I mean, I'm sure there's other ways too, but I was
Starting point is 00:10:35 curious about how people would do that to build a SaaS off of Django. It's interesting. And it's based on domains. So like tenant1.domain.com, tenant2.domain.com, and so on. Yeah. So I like it. I mean, if you're doing Django stuff, it seems like it makes a lot of sense. And this goes down to the actual Django ORM models, right?
Starting point is 00:10:56 Yeah. Yeah. Cool. Well, I don't have any use case for this. I don't think right now, but I can certainly see that a lot of people out there would. I mean, like I said, if you've got a group of people associated with one customer and another group of people associated with another customer, and you want to make sure that only their data is all kind of shared, but not overly shared, then this is a cool use case. Yeah. Nice. Well,
Starting point is 00:11:18 that's a really good find. Yeah. Cool. Awesome. Awesome. All right. All right brian um you ready to commit oh yeah yeah so um you've have i think we've talked about pre-commit i'm pretty sure we have um definitely talked about pre-commit hooks in the small but not necessarily in the framework style i don't know yeah so um so pre-commit uh the well this is the documentation for pre-commit the the normal pre-commit everybody knows and loves and well, this is the documentation for pre-commit the, uh, the normal pre-commit everybody knows and loves. And if you don't know it and love it, you should probably check it out because it's a, it's a, I wanted to bring up a couple of things. One of them is that it's a, it's a lot more than just, um, so I get, I, I I'm along with a lot of other people, uh, ran across pre-commit with things like, I want to remember to run a black and you know,
Starting point is 00:12:06 I know I'm going to run my tests. So I may as well just check, make sure that all the tests passed before I check stuff in. And maybe I'll run the linter and just go ahead and run black over something. And then I don't have to worry about it too much. Things like that before you commit. And that's where pre-commit got its name, But there's a lot more hooks than commit or the pre-commit hook. With the pre-commit tool, you can hook into pre-merge and post-merge and all sorts of entry points around version control. So it's a very powerful tool. And there's this thing when people build up a whole bunch of tooling around it.
Starting point is 00:12:42 And you can also get best in class little hook snippets from other people uh to to plug into it which is really great but if i'm sharing it across a whole bunch of different projects i kind of have to copy that into all the repos but um you don't really have to anymore because uh because now there's a pre-commit ci so uh it's a continuous integration type version uh like a lot of other, like, I don't know, like Travis used to be or something or other sort of CI tools. This is another CI tool chain that you can use and it'll run, you can set up pre-commit hooks and run it over a project. And then one of the nice things about it is you can have a whole bunch of different things set up and configured and run it against multiple projects and have that just set
Starting point is 00:13:30 up in a different place. So this is a really, really kind of a cool tool. And I've been trying it out on a couple of projects. So. Yeah. So we have pre-commit, pre-commit framework, which lets you use pre-commit hooks. There's a lot of layers. It's like turtles all the way down. You can have pre-commit hooks for Git, but they might be written in all different languages like Node or Rust or Python or whatever. And getting those installed and running can be a pain. So there's the pre-commit framework, which lets you not worry about that stuff and just run all these pre-commit hooks from different sources. This is another thing on top of that. This is the pre-commit continuous integration service. So if people have heard of pre-commit hooks from different sources this is another thing on top of that this is the pre-commit continuous integration service so people have heard of pre-commit before this is like extra new stuff that anthony sotili's been working on right yeah yeah and uh he's been uh
Starting point is 00:14:15 doing this on the side for a little while to try to it's a it's believe it's well i've signed up uh with through github and i think it's free for open source projects i don't know the details um but uh yeah anyway i i think it's a neat idea um i occasionally get um so one of the things that's nice about it obviously i'm going to run pre-commit the the hooks but if somebody merges something into my code they can they can choose not to do that and do a merge request and this this allows uh all those hooks to run on all the merge requests. So I'm a big fan of putting stuff in CI because I've seen so many scenarios where people are part of,
Starting point is 00:14:52 some of the people on the team are really excited about this and really want to work with it. And other people, they don't even want to be bothered to figure out what it is. But they're in attention to, it means the builds break
Starting point is 00:15:03 and other stuff goes wrong for the people who are trying to keep, I don't know, the linter happy, the unit test running or whatever it is. Right. And so if you're relying upon pre-commit hooks, this means that everybody gets their pre-commit their, their commit hooks and stuff run and validated, not just the people who didn't, you know, ignore them or whatever. Yeah. Um one example is like just like black, for instance, if you like to run black over your stuff before you check it in, you can just not even see it before people do it.
Starting point is 00:15:33 And one of the nice things about this is it can, it can change, create a new merge request. So one of the things that it'll do is if somebody does a pull request or merge request, whatever, against your project, and you want this stuff run, like for instance, some of them will actually change your code. Black's one that changes your code. So this takes the old merge request, runs black on it,
Starting point is 00:15:52 and then creates a new merge request with the changes. So that's nice. Yeah, cool. Okay, are you using any pre-commit hooks or anything like that with your teams? No, I'm just aware of Black, but when Brian explained it, it's similar to it.
Starting point is 00:16:13 Although it's something that you put on GitHub, did I understand it right? Or whatever your repository is. The continuous integration version, what we're just covering, you can put it on GitHub, and Precommit works with github projects as well um but it's something you run locally so you have it it's it it's run by git pre-commit hooks or triggering the the hooks that you can configure yeah that's a yes it's turtles all the way down
Starting point is 00:16:38 um yeah so brian i don't know if you have any awareness to this or not but i'll ask you anyway just tell me if you don't know um would it still awareness to this or not, but I'll ask you anyway. Just tell me if you don't know. Would it still make sense to put the pre-commit framework locally and have it try to do it locally before it happens in GitHub? So maybe you get a better, more immediate feedback on it or just like depend on the one on the CI server? Of course I do. So that because I want to catch it before I push it up on my own stuff. But if somebody's wants to, you know, do a pull request, I don't even want to look at their code if it doesn't pass. I mean, I mean, it might be a cool idea, but, but if it's, if, if, you know, it's a lot
Starting point is 00:17:18 of work if somebody pushes something and all the tests are broken and whatever. Yeah. And then you don't want to go back and say, oh, I'll accept your PR, but you have to go and run black against it. And then I'll accept it. Like, just make it automatic. Yeah. Just make it automatic.
Starting point is 00:17:30 So yeah. Yeah. Super cool. All right. The next one here comes to us from David Smith. And he, like many of our listeners, is very helpful, sends in things periodically and says, hey, I happened across this thing at sneak, S-N-Y-K.io. And I'm not sure how new this is, but it's quite neat.
Starting point is 00:17:49 So over here, we have the sneak package advisor. And it's not just for Python, it's for many of the things, I guess three of the things at the moment, NPM, PyPI, and Docker. And what you can do is you can go over here, I'll just focus on PyPI for now, and you can put in packages, like they have Django there listed.
Starting point is 00:18:07 So let's put Django in and see what happens. And it will tell you what is the package health score? What is the security story? Have there been issues? Have they been fixed? How often is this being worked on? So many times people who are new to Python or even not new to Python, but new to an area like, you know what?
Starting point is 00:18:23 I want to start using async and await with an ORM. What are my options? I've been using SQL Alchemy and imagine it didn't get as update. I got to switch to something else. What are my choices? Here's four. How do I know which one of those four is still alive, healthy, et cetera, et cetera. So you come in here and you can see some information about it.
Starting point is 00:18:41 I'm going to say that this is not necessarily the best. Let me see if I can find Django without. One of the things I'm seeing that makes me kind of wonder, I clicked on maybe the wrong one. I clicked on a specific version, and it said it was not very popular. I'm like, that can't be right for Django. It's an unpopular package. So it tells you things like, what is the popularity?
Starting point is 00:19:04 And for Django. So this is a key ecosystem project, like too big to fail, sort of what is its maintenance story? It's healthy. Does it have known security concerns? No. Is this community active or whatever? And then also it's cool. It has, you might also look at these other packages like Django is getting 97 flask. It shows right there. Flask is a 93 out of a 100 in its score. And you could open it up and see why. There's a bunch of graphs around here as well. You can see like the commit frequency, the open issues, open PRs, when was the last commit, GitHub forks, all sorts of stuff around here. So number of contributors, go down there and see that. Actually, the community shows like
Starting point is 00:19:41 the recent people. Does it have a code of conduct that i could discover right is it have funding does it have a contributing doc what were the recent security issues all sorts of stuff you know i'm not going to go through all of it but there's a bunch of cool things you can just pull up about other packages and compare them against each other you can pull up like flask if you want and see that side by side and so on so what do you guys think yeah cool right, I think it's neat. It's similar to Django packages.org. Oh, yeah, Django packages.org. Which is, like you said, a similar idea,
Starting point is 00:20:13 but just for like an off layer for Django or a special admin backend for Django. But this is more like for the whole community. Yeah, for the whole Python. Or it supports other languages too, right? Yeah, this sort of, it supports Node and Docker, right? So yeah, I think the idea is probably that more stuff is coming along, but I do like this, you know, if everything else being equal and you can't decide, put two projects in
Starting point is 00:20:41 here and see what it says, right? You can see, like to me, one of the big warning signs of an open source project is if there's a bunch of PRs that are like six months old, nobody's even bothered to respond. You know, somebody has gone to the effort of, I've actually tried to improve this. I've done the work. I've written the tests.
Starting point is 00:20:58 Here it is. Will you just accept it or tell me what else I got to do? And they're not even willing to respond. Like that is a huge red flag. And that kind of stuff will come up here as well. And hey, Anthony Shaw out there in the live stream, is if you sign up with your GitHub creds, Snyk will check your project requirements.txt for you
Starting point is 00:21:16 and raise PRs if there's security issues. Yeah. And if you use PyCharm, the PyCharm security extension, it has Snyk is integrated in. Oh, and Anthony, who makes that PyCharm security extension? That's right. Anthony does that one.
Starting point is 00:21:33 Awesome. Yeah, that's really good work, Anthony. Thanks for that extra information as well. So you can just search a project on there? Yeah, put me on the spot. Search my... Cards? What is it? No, PyTest dash check. PyTest-check. PyTest-check.
Starting point is 00:21:46 Gotcha. Oh, let's see what we get. What are we going to get? Hold on. You're doing pretty good. You got a 65. I mean, look, you were recognized. Look at this.
Starting point is 00:21:59 And you're sustainable with no known security issues. Like, I'm saying this ain't bad, man. I mean, there are fewer committers than in Django, to be fair, but still. It's quite good, right? But I'm surprised that there's 10 contributors. This is just something that I... It's probably my oldest package, so that's... Okay. No, this is pretty good.
Starting point is 00:22:17 It has no security issues. That's pretty good. And you could even embed a little package health score if you wanted to, right? Well, let's figure out how I can get it up. Yeah, get that into the 90s and then embed it. Get it up in the 90s. How about that? Perfect.
Starting point is 00:22:31 Fantastic. All right. Who's next? I guess, Gela, you're next. So there you go. Tell us about this one. So this one has been contributed by one of the shows uh yeah and on twitter uh fans uh and then um when i first looked at it i thought it's just another um it's just another tool that tries to
Starting point is 00:22:57 do away with uh javascript but then when i tried it out uh i guess I kind of had an appreciation for it because it can be used for, yeah, I imagine for hobby projects. Like for people who, oh, wait, let me just explain what it's for. It allows you to build simple applications or browser-based GUI applications without the need to write HTML and JavaScript. So it has input and output modules. It's also based on Tornado when I checked the requirements. Oh, that's really cool. So if you were going to write a script, just a terminal CLI-type application, and it would ask questions like,
Starting point is 00:23:41 input, what is your height in centimeters? Input, what is your weight and it would convert that to a float and then you would print out the information so this has really similar stuff like the input doesn't come from the built-in one it comes from piwebio.input and that'll actually create a text box and because you say the type you'll even get validation like oh this has to be a number that's pretty neat Yeah, I think it can be used for hobby projects, like for people who know how to write Python code but don't want to write HTML and JavaScript.
Starting point is 00:24:12 And also as a teaching tool for, let's say, you're teaching kids the concept of input and output and don't want them to just use the terminal. Yeah. You know, it's really interesting. My daughter wanted to learn Python and get into programming and stuff. And I tried to show her stuff in the terminal. She was just no.
Starting point is 00:24:35 And then we started playing with Anvil, which has a similar, like really simple way to just get like graphical stuff on the screen. And she was all about it. She played with it for hours, creating little apps and quizzes for people and stuff and it's it doesn't seem like a big difference but that visual aspect yeah i think it's pretty big i think people are you know it makes a big difference yeah yeah i was um so i probably use something like this for maybe uh um build scripts for instance used by a team. So sometimes you have like, you know, just a few questions you need to ask somebody.
Starting point is 00:25:08 And you can do that easily on a web form or something like that. But if it's like a script that you're running on the command line and some people don't want to run to have interactive command line, I don't understand that actually personally. But there's definitely people on my team
Starting point is 00:25:23 that will not uh voluntarily run a command line script yeah absolutely and it looks like uh it integrates into existing web frameworks which is cool yeah but it also the way it runs it looks like you might be able to actually patch it up with pi installer and just go here double click this and it'll come up with something yeah yeah yeah the only limitation i see is that when uh once you want to style the html code uh but that's far uh that way far in the future i mean yeah once you probably gotta do css or something like that right yeah cool that's a good pick very nice thanks to the contributor in on twitter yeah absolutely all right that's that's it for me, Brian. You got anything else?
Starting point is 00:26:07 Well, I had teased about just saying that, well, we already talked about PyTest Check a little bit. So the new package that I just put up last week, I guess, was I went ahead and I misunderstood. There's
Starting point is 00:26:24 a package called PyTest Poo, which is a brilliant package that I thought I had it wrong. I thought it put little poo emojis for failed tests. Turns out it didn't. What it does is you had to mark a test with poo. And then it just showed those those whether it passed or failed. And I said, well, I thought, well, we kind of need a distinguisher. So also I don't think I could get my team to use poo emojis. So I created PyTestYuck because I'm a kid of the Mr. Yuck generation, I guess.
Starting point is 00:27:00 And so what it does is you mark a test with yuck. And if it passes, you get a green queasy face. And if it fails, it actually throws up. So this is new and it's download stats are the only day that recorded was 24 downloads. That's actually pretty good for its first day. I'm going to say that's good. It was probably all me. And then, I don't know, a month
Starting point is 00:27:30 ago or so, I did PyTest source paths, which just allows you to specify import paths so that your tests can find your code. And then, as we already showed, PyTest check is the one I've... It's been out for years. It just allows multiple failures. So those are my packages.
Starting point is 00:27:46 No, those are really cool. You've been busy. Yeah. I'll try the yuck package later. Nice. All right. I got a few real quick things to throw out there at the end here as well. Marco Gorelli sent over this project that he's working on called AbsoluteFi Imports.
Starting point is 00:28:04 So if you've got a package that's using relative imports and you would rather to convert it over so all the you know dot and you know from dot or from dot dot whatever import something and turn those into absolute imports it's like one line to me it's a little bit like flint run that against your project that turns all the string formatting to f strings this will do that but for the imports, take them from relative to absolute. So that might be helpful. People got some code to migrate and they want to do it like this. And then I noticed Anthony Shaw was in the audience, but I was already going to cover this. Last week, was it Kelly who said, oh, when I talked about Beanie, the MongoDB ORM, she's like, oh, I thought you were talking about Beanie
Starting point is 00:28:43 Babies. And then somebody threw out that Anthony Shaw should make a Beanie Baby plugin. And it looks like he's already made a Beanie Baby bear. Isn't that amazing? He hit this up like the same day. Well done, Anthony. Thanks for keeping it interactive. That's awesome. Yeah, that's good.
Starting point is 00:29:00 Yeah, cool. And we talked about supply chain issues and hacks and whatnot well this one should take people's breath away like i mean you were like oh you don't want to install from this other other uh install source rather than from like main source on python.org or whatever i was talking about the other day right i'm like i'm building from source at this point this is driving me crazy well php didn't want to use g GitHub. They wanted to have their own like sort of GitHub like thing with their own authentication and all that kind of stuff. Well, somebody broke into that and literally put a backdoor into PHP itself. Think about that. 79% of the websites in the
Starting point is 00:29:37 world run on PHP and the runtime itself had a backdoor in it. Just for a little while, but yeah, I mean, just for a little while. Yeah. Like, so there's, we even got a little bit of a diff here in this Ars Technica article I'm linking to. Like, excuse me, what does this line do? This line executes PHP code from within the user agent if the string, if the user agent includes zero DM.
Starting point is 00:30:01 So you just put your user, you just put the hack you want to run in your user agent and do a request to the server and off it goes that's nuts that's not good so um thankfully that's not python and then this one uh this one was you michaela right yeah it's the last day it's the last day of the march membership drive for uh the psf I mean, they said that you can be a member any time of the year, but it's the last day for their 2000 goal member for March. Yeah, super cool.
Starting point is 00:30:35 Hopefully they're doing well over here. Yeah, yeah. So people, please be part of that if you want. It'd be great to support them that way. All right. And I got to say, Michael, thanks for bringing up Flint. I actually forgot about that, be part of that if yeah if you want to be great to support them that way all right and i gotta say michael thanks for bringing up flint i was actually forgot about that and i need it um and f-l-y-n-t love it yes y-n-t i was googling it for a while until i found it nice yeah i've turned
Starting point is 00:30:57 that loose on some most of the python code i have to live with any frequency i have to go back to it's like just find all the strings and make them f strings then i'll go look at it lovely i love it okay all right speaking of love and stuff how about a joke i love one all right so this one comes um not to us but was found uh and ricardo ferreria put this out on twitter so i thought this would be fun like we've talked about comments before and we've even had those jokes where it's like all about the comments right it's all the crazy things people put in their comments like, you know, hash, I really need to find a better job type of comments. So this one is more visual.
Starting point is 00:31:31 I know some people are more visual in commenting what they're doing. So Brian, this is like a smart speaker or like some kind of conference phone. And on the phone, it's got some buttons. They have little icons like a mute microphone, like a phone number one to like maybe place the call up down volumes have like louder volume less loud volume maybe describe the comments for our listeners well there's dashed lines to go to each button with like a manual or something right with it with like the the same icon that's on the the, just next to it. Just, yeah.
Starting point is 00:32:06 Exactly. This is like just the, you know, slash, slash, or hash, or whatever, of the, you know, logger, logger equals new logger, was the comment, you know, hash a logger. This is the same, but for documenting the user interface. Yeah, that's definitely like the, you know, string user comment, the user. Exactly. Beautiful. Nice.
Starting point is 00:32:31 Well, super fun to BS about Python again with you this week. Thanks, Michaela, for joining us. Thanks, Brian and Michael. Yeah, it was really great to have you here. Thanks for coming. Good to see you, as always, Brian. Bye. Thank you for listening to Python Bytes. Follow the show on Twitter via at Python Bytes.
Starting point is 00:32:48 That's Python Bytes as in B-Y-T-E-S. And get the full show notes at pythonbytes.fm. If you have a news item you want featured, just visit pythonbytes.fm and send it our way. We're always on the lookout for sharing something cool. On behalf of myself and Brian Ocken, this is Michael Kennedy. Thank you for listening and sharing this podcast
Starting point is 00:33:06 with your friends and colleagues.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.