Python Bytes - #492 Codeberg Puts Head in Sand

Starting point is 00:00:00 Hello and welcome to Python Pites. When we deliver Python news and headlines directly to earbuds, this is episode 492, recorded August 18th, 2026. I'm Michael Kennedy. And I'm Calvin Hendricks-Marker. This episode is brought to you by Logfire. So thank you to Logfire from Piedantic. Check them out at Pythonbytes.com.

Starting point is 00:00:21 It's about observability for your AI apps and beyond. Tell you more about them later. Connect with us on social, links on the website. part of the live show, check it out on the website, Pythonbytes.fm. It's live. And we have a really cool newsletter that we send out mostly every week with all sorts of extras. So you can sign up there as well. Just visit the website, click the newsletter, do the thing. We'll keep it private and not abuse it. Speaking of abuse. We're good people, you're good people. Let's make sure we keep people safe, Michael. Exactly. Sometimes you can have nice things on the internet. That's true. And well,

Starting point is 00:00:56 Well, the good thing is that with the solar eclipse in Europe last week, a new release came out of some security updates for Python 312, 311, and 310. The key bit here, well, there's a lot of key bits, which is there's lots of security updates that have happened. They're pretty important if you're doing certain kinds of activities. So, for example, if you are using tar files to, if you're extracting tar files with any of these versions of Python, you are going to want to update ASAP. because this basically fixed a path traversal bypass of the data filter. So a SimLink escape that could bypass bits and pieces here and get people access to places they're not supposed to be. Kind of important.

Starting point is 00:01:40 Now, the important bit here is that this is only a source release. It's a source release only. If you want to upgrade to these versions of Python, that 312, 14, 11, 16, and 310, 21, you are going to have to download the source tarball or patch. your existing build process to get these released into your production environments. But if you are on these versions, you're going to want to get those things patch. I mean, it's nice that these are insecurity.

Starting point is 00:02:05 There's not a binary version. I have to use this? There is not a binary version of these been released. These are in security fix only mode. I mean, hopefully you're getting into Python 313 and 314 as they are the current releases. It's nice that the community supports these versions that far back. I don't know when 310 was released. but it was quite a while ago.

Starting point is 00:02:27 And you've got to be able to stay on top of these. This is in your hands now. This is kind of more of a do-it-yourself. But at least the fixes are available. So tar file is a big one. There are four fresh CVEs that are being covered by these fixes here. One of them is for the sourceless file loader. The other one is the cookies morsel,

Starting point is 00:02:49 which there's basically a couple of fixes there on that. And then the FTP lib, FTPC. So there's also a bunch of denial of service type fixes, some cleanups in a HTML parser, config parser, Unicode data normalize,

Starting point is 00:03:05 element tree XPath bits, there's some header injection fixes. Again, just lots of cleanups around the edges. Michael, have you ever used the web browser module from the standard library? I'm learning now there's a web browser module. There is a web browser module. It allows you to pop a web browser module.

Starting point is 00:03:23 It allows you to pop a web browser module. browser. That's pretty handy. I've used it for a couple like little demo-y type things, but there was a allowed control character in there that would have caused an action prefix bypass. So if folks were sneaky and knew those things existed, they could basically jump in and bypass some security controls. The HTTP client also now caps chunked trailer lines and the 100 responses to 100 each. So a hostile server could previously hang a client, even if you had a socket time on in place. So Lots of memory safety stuff, lots of little cleanups. Again, it's a pretty sweeping set of security fixes,

Starting point is 00:03:59 and they chose to release it down because as good as time as any. There's no set schedule for these specific releases on these older versions of Python. Excuse me. But it's good. We've got people watching our backs and making sure we stay secure out there.

Starting point is 00:04:15 Like you say, you can go look at the release notes. There's a ton of fixes in here. It's a really long set of releases and fixes that went into us. Thanks to all. the Python core devs and volunteers and people submitting patches, I'm sure some of this stuff probably came out of the new models that are able to detect these kinds of pieces, but obviously humans are putting the pieces into place. So go be safe out there, Michael. And upgrade your Python's always something I'm worried about. Yeah, I mean.

Starting point is 00:04:43 Upgrade your Python, please. Here's also one of those reasons why I kind of want to stay on top. Yeah. Of having a fairly new version and it'll be like, oh, we're not going to touch it. And hey, it's three eight but it works it's like yeah but when this kind of jump this stuff comes out of the blue you're all of a sudden scrambling to get your app to run rather than just a point release yeah it's it's hard to argue for the old stance of like well just because it works it should just stay in production or even if it's behind a firewall or behind some kind of level of protections we've seen that these models can now chain together multiple vulnerabilities to get access to spaces they weren't supposed to get access to all that's required at this point is setting good goals for

Starting point is 00:05:24 the agentic AI tools and they can get around a lot of things if they're given unfettered acts, but even not unfettered access. Even if they're sandboxed in, they could still do this. So keep up to date. Again, this is a reason for staying on the latest released version of Python, but the community does support backpatches. You just got to go build them yourself. I'll have more on that later on the building. Maybe. So yes, but maybe. Maybe. Maybe. What do you got? My favorite way to install Python is UV Python install, right? And a quick, I just upgraded it. You got to upgrade and get the latest.

Starting point is 00:06:04 It's just kind of out. It doesn't pull the list. Someone's got built packages in there. It does 31116. Ooh. And 31214. That looks like they packaged it into Python built standalone. That's nice.

Starting point is 00:06:16 Well, it's good to see the astral folks. I've got our back. Yes, obviously. Like, that's a theme, right? It's definitely a theme. Well, there you go. go, well, if you're on this older version of Python, you might need to just go upgrade to UV at this point

Starting point is 00:06:30 and save yourself some headache. Yeah, yeah, absolutely. You could technically just use UV to manage your Python and still, I don't know. Yeah, you don't need it. You don't necessarily, yeah, you can do the rest of the way you're currently doing it. Right.

Starting point is 00:06:42 But if you're going to jump in there, you might as well modernize and fix. You're already in there. You're already in there. You're already in there. Okay. Speaking of, you gave a quick shout out to give an AI agent some kind of go-find bugs. And I 100% agree. You and I both likened this to

Starting point is 00:07:01 running a lender for the first time. I'm like there's a thousand errors. Oh, my God, it's so much. Yeah. Right. So stay on top of these things. But these tools are causing a, some places a ripple, other places, a tidal wave. And Codeberg is one of those places that, I don't know, like, I'm not sure how to feel about Codeberg. I, in principle, like it. But, But I think people want Codeberg to be more than Coburg wants to be. Let's say that. What the heck is Codeberg? What is Codeberg?

Starting point is 00:07:31 It is a GitHub alternative, let's say. Okay. Evolved out of previous attempts to create a GitHub alternative. It's a nonprofit community-led effort with a democratic process that provides services to free and open source projects, such as Git hosting using Forgeo, pages, CICD, and so on. So it's already got this restriction like, hey, it's only for free and open-source. open source stuff. It's not for just general paid software, private repos and so on, right? Fine. So that's kind of, it's a mission and that's what it is. But a lot of people are looking at GitHub

Starting point is 00:08:06 going, I mean, just yesterday, GitHub was down. I'm like, oh, man, I guess I'll try this PR again in a half hour because it couldn't load the PR stuff. And then I just got the unicorn, which kind of feels like it's supposed to be amazing, but it's a bad unicorn. Should have like a leather jacket and be smoking or something. I don't know. I know. Kind of the fail. whale of GitHub. Yes, exactly. And there might be people out there that don't know the fail whale, but oh my gosh, that Twitter went down bad in the beginning. Yeah, so it's like the fail whale. Early days. But right now, I just pulled this up into the top of the Kodberg page at time recording. Yeah, the number two is interesting. There's just like, there's stuff we don't want

Starting point is 00:08:43 here. And we don't approve of it and it needs to get the heck out. Even if it is free and open source, it still needs to get the heck out. Okay. So I feel like this was just, there's stuff we don't like, let's get it out. And the number two, you pointed out and laugh at is like, cryptocurrency projects are no longer allowed. And like, you know, I'm fine with that. Like, whatever. Okay. Okay. If that's your mission to just not have that kind of stuff, I'm here for it. Like, cryptocurrency is weird. I'm not 100% against it, but it's just. I'm not either. So that's why I thought it's kind of weird. There's definitely some opinions here that had a thought process going on behind them that we're not seeing the full story.

Starting point is 00:09:17 I guess we can go see the full change. But yeah, but this first one is is quite weird. LLM generated content is being restricted more specifically if you have a project that they somehow decide they believe it is majority LLM banned. Even if it has been here for a long time, it has gotten a lot of attention and a lot of maybe even wrote it by hand to start, but then you do some mega refactoring that touches every file. Banned. So you may like that.

Starting point is 00:09:47 You may not. It seems a little extreme, given that we just recently covered. Linus Torvald saying, like, look, using AI to review our stuff is a tool. It feels a bit myopic to me. And fine, like I said, this is their project. They can do it, but people have thoughts. People have a lot of thoughts. Wait, Armin has a thought?

Starting point is 00:10:09 Could you imagine? Armand Roniker has a thought. And he wrote, and the reason a lot of people have thoughts is they were like, I would just love a GitHub alternative. Like, for different reasons. Some people are just like, I don't like the way GitHub works. It's been down a lot. Other people are like, I want a European company, not just an American company to kind of be

Starting point is 00:10:27 a first class player in this space, right? And whatever, like all those people are like, but Kodberg is now broken, so that's out. And that was my hope, right? Like, Obi-1, you're my only Ove. Oh, OB-1 doesn't like all of them content. Well, I guess he's out. Anyway, so Armin wrote an article called Kodberg Divides, and so they changed their terms of service, as I said.

Starting point is 00:10:51 They're entirely within the rights to do this. It's a democratic process. But democracies don't inherently make good decisions. That's what it's saying, right? So GitHub's never been democratic, and it's plenty of not to like. But as a core piece of infrastructure, it's been reliable, right? So, I don't know. How do you even enforce this majority?

Starting point is 00:11:13 Like I said, if I have a project, let's say a web app that uses some CSS front front end and I ask AI to change the CSS front end around, even though I wrote all the code, all the back end. It's in the diff perspective, chances are it's going to overwhelm the back end amount of code if I have to have it rewrite every bit of HTML because it's grid versus Flexbox versus whatever. This is grunt work stuff that the AIs can be directed very easily to take care of for us as humans. Yeah. And so, I mean, here's sort of the thoughts. It's a real shame that open source and free software communities are splitting this deeply over LLM and agents. They're as, you know, just we all, we all already acknowledge copyright issues,

Starting point is 00:11:59 energy use, those kinds of things. But it's also just how software's being made, right? And people need to, projects are going to need to figure out how to coexist. And yeah, if you want GitHub to face true competition, this is not it. Yeah, this is not going to work. Michael, I got an idea. Okay. We're going to do a blockchain project.

Starting point is 00:12:19 to host a GitHub alternative that is a distributed autonomous organization, and it's going to have like smart contracts and rules. We're going completely the other direction. You're making my ears hurt just a little bit with that word. So what about this? What if we go back a little further and we can like do a sweet arc? Like what if we do like a bit torrent hosted smart contract backed? Even more.

Starting point is 00:12:45 Like the layers go deep. But you know, the decentralization aspect of the BitTorin totally makes sense here. I think we could make this go. We could totally make it go. All right. So that was that was Armist's lot. I wish this was more forward-looking in a place that we could depend on rather than a place that divides and just kicks a bunch of people up. Now, one of the reasons I'm sure they did this is, well, these AI things use 20 times as much resources.

Starting point is 00:13:10 Yeah. Yeah. Okay. So I just search for the terms to see kind of, you know, Codeberg terms. I came up with this website. The domain is amazing. But it says, I asked literally just for the terms of service of Codeburg.

Starting point is 00:13:26 And the first thing that comes up is I regret migrating to Codeburg. And this is actually a really interesting and well-thought-out article. So this person just recently left GitHub and moved all their projects over here because they're like, ah, GitHub is kind of getting clunky. And I have just pure open source and so on. So GitHub looked like a viable. alternative, which is like this is the main spine running through this conversation. So with, it's like, unfortunately, the last, the latest update to its terms of service seemed to mark the

Starting point is 00:13:57 first step in changing one part I moved there for, namely freedom is now gone. I can't work on it. And one of the interesting things about this term, I'll move on from this section in just a second. But from their, their terms is the content that harms the reputation of Codeberg, which is like, we don't have a great reason for it. And one of the criteria they use, is it has to have a community behind it in order for it to be legit and LLMs and AI don't make community, right?

Starting point is 00:14:24 Right? It seems like from the blog post, it seems like many vibe coders don't realize that they don't actually have a community around them. And I think that that cuts at two things. One, casting all of this stuff as vibe coders and just

Starting point is 00:14:37 junk users who don't really know what they're doing, that's already kind of... There's a valid practice of agentic engineering in producing software. Yes. And this seems to lump it all in with like, is a bunch of these idiots that don't know what they're doing

Starting point is 00:14:52 and we want them off our community. It sounds like a bunch of people who were against the stuff two years ago and have never tried it. You don't realize the effect it has. So just to wrap this up, this person says, look, I have a bunch of solo developer open source projects. And my community is people who just ask for features or ask me to change something.

Starting point is 00:15:15 They're just people who want something from the software. They're not really a community with rich discussions, right? And so I agree with this person's take on, like, it's a bunch of silly little tools that are my tools. And I need a good place to host them. And I want to share them with my little community. Yeah, like I've been publishing silly little tool for decades. And that was from even the Source Forge days, right? This is the essence of like open source, the cathedral and the bazaar, like that whole bit.

Starting point is 00:15:43 Exactly. And so one of the reasons Codeberg is blocking LLMs is because they think there can't be a community and therefore it's a fake project. This guy's like, I got a bunch of projects. They don't have community, but they're important to me. And I think that's actually the majority. This results in censorship for me. But the same thing is, what if you just charged for the ones or had a very high rate or very strong rate limit for interactions? And if your AI does too much to burden our infrastructure, well, then, you know.

Starting point is 00:16:14 Maybe you cover that or you move them over to a portion of infrastructure that's even slower, right? I don't know. But there's a whole lot of concrete ideas from this I regret moving to Kudberg. Anyway. It's amazing that was the first post. Like first result for a valid search for their terms of service. I know. That speaks volume.

Starting point is 00:16:33 That's a strong own goal right there. Speaks volumes right there. Well, the others are going to emerge. Obviously, the fact that we still live in an open world with a fairly open Internet, people can build their distributed blockchain Dow version of get up if they want. Well, I'm looking forward to setting up. We should build on Codeberg. Oh, my gosh.

Starting point is 00:16:55 Okay. All right, sorry. That was a bit of a detour. A fun detour, but let me tell you about our sponsor, actually. You should. I think this is important. Yeah, because there's some really cool stuff that logfire, and from Panicic is doing if and this is a bit of a an alternative worldview and one that I definitely

Starting point is 00:17:21 agree with but logfire is about monitoring and observing and understanding what your AI agents and other web apps like fast API and Postgres and so on are up to so it's 2 a.m. your AI agent has failed why was it the model a tool call the database most observability tools can't tell you because they only see part of your stack, like your web stack or something. Pyndic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database.

Starting point is 00:17:52 Down to the infrastructure, services, Kubernetes, and hosts. It's built on open telemetry with SDKs for Python, TypeScript, and Rust. And it works with any O-Tel-compatible language. Every prompt, token count, cost right next to your vector searches and API calls. You query everything with Postgres compatible,

Starting point is 00:18:11 SQL, and you give that to your coding agent through the Logfire MCP. So stop guessing, read the trace, identical logfire. AI is still just engineering, as we said. So visit Pythonbytes.com slash logfire today and sign up. You'll get 10 million records for free every month, no credit card expired. And you can, this is a pretty cool thing as well. I need to add Logfire to my app so that I get this cool feature. How do you do it?

Starting point is 00:18:39 They have a button that will copy some markdown text to your clipboard, and you click it. It says, onboard your coding agent. So it just gives you instructions you can hand a clod or codex specifically what it needs to do to integrate your app with Logfire. So I think that's super cool. So thank you to Piedantic and Logfire for supporting the show. Actually, I love the idea of the observability of grabbing the prompts and the costs and the token usage. more folks are going to be heading down this route because it's been very hard to analyze

Starting point is 00:19:11 the return on investment of using these tools and as the costs potentially rise and subscriptions maybe shift and go away, you're going to want to know this kind of data to make good decisions. We're doing this right now at six feet up. Are you? Awesome. Yeah, we're having these kinds of discussions,

Starting point is 00:19:26 I should say, and I could probably use a tool like this. Well, I don't buy Sted of M slash Longfire. Oh, you know, there's a good one for us. Yeah, fantastic. All right. Yeah, it's a super cool platform. And like I said, right here, just on board with your coding agent, click that, and then paste it. What's really interesting.

Starting point is 00:19:44 Is it the instructions say things like, your user may have just clicked this and not actually read it yet. So please, you know, work them through this. Those are some good people. They were doing the good work right there. Yeah, save your call on a team knows what they're doing over there. I love it. So does Brett. Brett Cannon knows a few things as well.

Starting point is 00:20:03 Brett Cannon does know a few things. Actually, this is important. Again, I feel like the last few episodes I've been on a bit of a security run with things. And this is continuing it, and he's got some great ideas. When he was writing his nomination post for the 26 Python Packaging Council nomination or elections, part of his pitch why he should be there is we need a secure supply chain for the Python ecosystems around building reproducible builds. And so right now, we don't have technically reproducible builds on Pi Pi, but they're not far away.

Starting point is 00:20:41 He identified three gaps in the current process to get us to a point where we have basically the design goal for him is zero friction. Can producers upload something to Pi Pi Pi? They shouldn't have to do anything. And all the work lands on the build backends and installers to track and trace and allow you to know. where your software came from that you're installing. We all are aware of the light LLM exploit that happened back in March and part of that was because of a supply chain injections into the build process. The other one here is like he mentioned solar winds that solar winds attack from a few years back. Again a supply chain

Starting point is 00:21:25 injection during the build process. So gap number one is nothing right now records the source code just where the source code distribution came from. So if you add in a JSON descriptor. It can capture when you install it, where it's from, what Git repo is the canonical source of truth for that code. That's something that would be very important for you to know if you're going to go back through and do an audit of the tools or the code dependencies that you have into your build process.

Starting point is 00:21:51 Interesting. So you might be able to have another tier of trust than just it's on Pi Pi Pi. Yeah. Yeah. Here's how it's built. Yeah, exactly. And if you combine those with the Pi Pi, two-factor and security. measures that they've been putting in place.

Starting point is 00:22:05 This gives you a little more comfort with where something came from. Gap number two is during the build, in the build tools and during the build process, having a software bill of materials, so referred to as an S-bomb. We can do this with PEP 770 has a convention for this. Software distributions can't because they're a tarball plus some package info stuff. So if you have a wheel, you can basically enable this already. So the first two things, very low friction. A file that describes where your GitHub repository is.

Starting point is 00:22:37 The second one is using wheels and the PEP770 to have software build materials in there. So either don't use S-dist or move to the S-DISV2 support for this. And then basically the mechanisms already exist for tying this all together in the Pipeproject.t. There's a build system section. if it has a defined entry point, so then backends can record their own environment, and you can reinstall and rerun the build. So the goal being, again, if I build the software today, and if I build the software six months from now or 18 months from now,

Starting point is 00:23:12 I should get the exact same binary each time, and there should be no worry or at least a way to audit and trace back what happens. So now trusted third parties can report successful reproductions back to IPI, which can display like an independently reproduced by some authority, surfaced in the index so installers can also prefer reproduced files. So Pi Pi would have to have a couple changes to support surfacing this data and making decisions based on that data. This is not a nice to have. This is definitely a requirement. This is basically you need to have this as part of your build process or else you're not considered a top

Starting point is 00:23:49 level or a first class citizen in Pi Pi Pii because it shouldn't be hard to do. One of the things about the reproducibility that you hinged on right there at the end, I think is cool as I look at say the hash or whatever of the binary that I got and then if I want to rebuild that myself I should get the same hash if I follow the steps or something like that right which is exactly cool yeah but so many things can be very variable I mean the the the GCC compiler on your system the minor versions of Python the architecture whether it was arm or in you know x86 like there's a whole bunch of variables that go on in there it'd be nice to be able to get those from a trusted source. And PIPI is obviously doing great work at making sure we get

Starting point is 00:24:33 safe wheels and distributions of software. Yeah. Yeah. Definitely some great folks, including Seth and Mike over there working on this. Yeah. And thanks to Seth Larson for listening to his idea and helping him check over this blog post. So the right folks are involved all around. That Python Packaging Council nomination, I think the voting is happening soon. I didn't actually note down when it is. But I can't Imagine why we wouldn't want Brett to be on that panel of people. Exactly. He's got the right ideas. I'm all for this.

Starting point is 00:25:04 Just because to keep the world safe, we need to have these kinds of table stick ideas built into our infrastructure of Python and the build systems. Yeah. And Brett's been working in packaging and package adjacent stuff for a long time recently. Yeah. So go enable these features. You'll start participating in the ecosystem. And then eventually, Pi, I will support it.

Starting point is 00:25:25 And you'll be able to know that. the software you're getting has come from verified sources. Maybe that's the extreme. Not verified sources, but at least the build can be reproduced. Verifiable. Verifiable. Verifiable.

Starting point is 00:25:38 Not verifiable. Settled difference. Yeah. Okay. So now, moving on, we have a extra, extra, extra. I hear all about it. A whole section of extras?

Starting point is 00:25:52 Well, this is when there are so many extras that I'm like, this can no longer be extra. It must be hoisted up into a top-level topic. All right. And I don't know, I've got a sidebar full of them. So let's see what they got here. I got questions about one of these here for sure. All right. Let's go. Well, you talked about the security fixes of like 311 and so on, 3116 and beyond. We also got a new. They are. Some of them have landed in 314. Yeah. So 314.7 is out. And sometimes these are like we've changed some minor setting or whatever. This is a proper release of Python. And I know it's mid-August and in a month and a half we're going to have 315, which is very exciting. But there's a couple interesting

Starting point is 00:26:36 takeaways here. Plus, you should just install this. So under security, like it doesn't fit on my screen, the number of single-set things fixed. So that alone tells you, maybe we should pay attention. So like here, for example, the one you talked about GitHub 1519-8-7, the tarball extract. And then there's another one somewhere in here, like, this is the workaround of that fix, also fixed. But there's some denial of service-ish

Starting point is 00:27:03 things like elementary find-all from XML parsing or even web page parsing as quadratic behavior if you give it certain types of inputs, and that means you could create like an element tree find-all bomb type of thing.

Starting point is 00:27:19 So there's a bunch of this complexity stuff here. But this is also a proper really. So I'm going to scroll at a high rate the entire time that I'm talking. And it is way still going on. This is all core Python internals, not even the standard library. Oh, okay. And then, now maybe that was standard library as well, but also build and then Windows and Mac. I mean, there are pages and pages and pages of changes here. And if you go up one, like I said, there's an interesting theme. So if you look at free, free threaded. Yep. Oh, wow. This is one of the,

Starting point is 00:27:52 There, I mean, it is lighting up the fine section. Yeah, the little scroll bar highlight that shows where the fine lands. There are so many race conditions that are getting fixed. This is just something Python has not really had to deal with. And I don't know how I feel about this, Calvin. I'm very excited about free-threaded, but there's this many fixes now. They should have skipped the dot 7 and made it dot 15, like 3.14.15. I know.

Starting point is 00:28:20 It's the lead-in to 315 or whatever, right? Yeah. Yeah, but in the core built-ins, there's just tons of, like, fixed the data-raised condition, a free-threaded build of gc.gand-ccount, fix a potential deadlock on intern from string and other functions on the free-threaded build, you know. And so if you're doing stuff with free-threaded,

Starting point is 00:28:40 you definitely... I hope some folks who've been posting blog posts around free-threading go redo their benchmarks against this release to see how that has changed. Yeah, 100%. Okay, well, that was one of them. That's a lot. I know.

Starting point is 00:28:54 That was just one of the things. Remember, you gave me homework last time. I'm like, oh, I just, I literally just added the MCP server for Python Bites. And you said, oh, Michael, that'll hold that protocol is out of date. You got to, there's a new one? I'm like, no. Well, I upgraded it. So Python Bites, it's MCP server, which only existed last week now uses the, let me see if I get

Starting point is 00:29:19 this from memory, 20206-07-28 version 2 protocol which is more stateless so it's backwards compatible with the old ones and it now adopts the new one so that's pretty cool and also for talk python and they were basically a similar update there so how long did that take you I mean you were able to just point the the clankers at it and say go the clinkers grinded for a lot to probably an hour yeah probably just like an hour it was a pretty significant amount of turn but no worries it got it done Nice. You know, if I had run on Fast MCP, which is now just MCP server, I believe, is the name of the project now, probably would have been better, even though they were breaking changes. But this is integrated. It's just a part of the Quart Flask app that are these websites.

Starting point is 00:30:08 And so it had a little more low-level stuff. But at the same time, it wasn't. I mean, my active time was probably 15 minutes. But I had to verify and check and say, oh, let me go over to Claude and ask it if it still knows how to talk to it. Think of the scale you can handle now. I mean, people can just hammer your MCP service now. I know. It's so stateless, they can just ask it questions all day long.

Starting point is 00:30:28 All day long. And in principle, I don't really mind. I mean, I'm not inviting to not to study the amount of service. Because I do get that sometimes and it's not fun. But it is all the database backed indexed queries. So it is like sub-millissecret, usually when you ask questions like this. So it's pretty cool. All right.

Starting point is 00:30:48 Yeah. Remember we talked about agents. view. I believe you brought this up and I'm like, I did you rise in the last two weeks? So crazy that on my M5 Pro MacBook Pro, I see some portion of my work in projects reported. And then I go to my mini and I see some other portion, the complement of my work reported. And then I'm like, well, I finally set up Postgres sync, which is really cool. So if you set up this Postgres sync thing, you just get a web page that you can host I'm hosted on Tailscale, super private behind all my stuff.

Starting point is 00:31:23 Nice. And then that gives you a unified view. There's just a little Damon sort of thing that runs on each machine that just, you know, normally it's running on SQL Lite. It just looks at SQL Lite goes, what's changed? And it just pushes those changes and merges them on a Postgres thing that's running in Docker on my mini behind Tailscale. I have a question for you on that because we're using agents view a little more to help

Starting point is 00:31:46 with that analysis and looking at our users of models. The Postgres sync, could you have multiple users push into it? Because that's exactly what I think I want to do. The one thing to be a little careful of, and I kind of would like to just say, could we just not put this data here at all, is it syncs the actual chat conversation, the chat log. The sessions. So you're getting the full fidelity of the agent's view, but in a centralized spot. Yeah, I mean, it is cool that you can go and do things like hit Command K and then do vector and semantic search across your work. but at the same time, the more people send it's plausible that you could write another script

Starting point is 00:32:24 that just deletes that data. Yeah. After, right, like just goes and just zeros it out because there's actually zero words in this, even though the token count was recorded and so on. I haven't tried that, but possible. I like the fact that you can do like a, I guess it even mentions their team dashboard. Yeah, exactly. And I'm a team of one for this, but I'm still working in two places and I need it because

Starting point is 00:32:45 otherwise doesn't work. Yeah. Yep. I got the same. I'm going to set that up. All right, let's carry on this order. Like I said, this is why this had to be promoted. Brian Ockin. Hey, Brian.

Starting point is 00:32:56 Hey, Brian. He had talked over the last year on the show about working on Lean TDD, TDD without the waste, and sort of redoing that. And he has just released the audible version. How cool is this? I like that. And it's him narrating it, too. So if he missed Brian's voice from this podcast, you can go over and listen to him, read a whole book to you. It's pretty wild. Like, this is audible. And it's Brian. Yeah, it is Brian. And

Starting point is 00:33:23 he did a really good job. It sounds, you know, professional and great. And I very much like it. And I know that when he was working on this book, one of his goals was to not make it too overburdened with code samples such that it could be an audiobook that is actually worth listening to. So, link into that and check that out. Two more things. These have to do with Talk Python courses. So I talked to someone recently who wanted to take a course from Talk Python. And they said, well, this is really great. And this is exactly what I want to take. But it turns out our company or our organization has some subscription to some other junkier Python training thing that I don't want to use. But they said if they're going to cover it,

Starting point is 00:34:04 I have to use their Python thing, not some other random internet thing that who knows what it is, right? So I thought, well, that's not right. Shouldn't people be able to, you know, if you're a company, get a sense if this is a good thing for your company. So if you work for especially a large company, this falls into that category, I have a program that I set up for you called a free Python training evaluation for teams. So what it is is for up to 15 people, they get complete free access to one of the,

Starting point is 00:34:34 pick one of the Talk Python 60 courses, and then you can go through it and then that team can report back like, hey, was this worth doing? So we maybe bring Talk Python as a VATON. into your company. You get a really nice dashboard of how all your students are doing, going through the course. Yeah. So who's redeemed the seats? Are they finished? Like, all that kind of stuff. You can download updates and so on. No MCP server, though. Not for this. Not for this. But you could download the CSV and then go to town on it, right? So everybody gets

Starting point is 00:35:09 basically free access to the course, mobile apps, all that. So if you work for a team, for a large company and you have a team there and there's like a lot of restrictions on what training options are available. Please reach out to me, Michael at Talk Python.com. Let's set one of these up. It costs you nothing to try it out. Get the name brand training. Not the generic lookalike. Exactly. Not the generic where you've got to press play every single video and navigate around. Not good. And related to that, related to that, I've also set up a government procurement page. that gives all. Wow, you're fancy.

Starting point is 00:35:45 That's really fancy. It existed before, but I didn't, it wasn't on a page where people knew that they could get it. So it lists our sam.gov unique ID. So if you work for a government entity, there's all these rules like, oh, it has to be registered with this thing. And it has to be active. And you have to have a 508 report on your accessibility, et cetera, et cetera. I put all that stuff up here. So if you work for a government and you would like, like a governmental agency, especially the U.S., please check it out.

Starting point is 00:36:11 This is all, this all makes it super easy. You probably have to. to address this kind of stuff some of the time. Looks like you put a lot of work into this. And it shows. Thank you. Thank you. All right.

Starting point is 00:36:21 Well, those were many extras, but... It's a many, many extras. We are done with the extras. I've got one extra, which is a follow-up to last week's episode around the post-Quantum key exchange. And the fine folks over at Astral have made a new release of UV. That's what is like five days ago. And it now supports and prefers post-quantum key exchange.

Starting point is 00:36:42 So they've already got to. you're back um you can opt in to tLS diagnostics but uh you're going to get post quantum key exchange out of the box when you're using uv no so that that's pretty cool you know what just book in it with uv well done well done astral er open a i too yeah that's awesome so far they're still doing again the good work i appreciate their what they're putting out there for the community and keeping again staying on top of us like that's that's that's that's really cool that this has we went from one week being announced to next week it's in use and you're getting it yeah that's super cool and I think I do think they're doing a great job so

Starting point is 00:37:23 yeah yeah so grab the latest version of you being yeah I love it all right are you ready for a joke I'm ready for a joke close it out do it this joke is called beware of dog oh we've all we've all seen yeah musho made his appearance last week on the show yes exactly exactly we we've all seen the signs do you really is it just a be careful there is a dog here or is it like a dangerous aggressive dog we don't know but this one is aggressive oh let me tell you so there's a big sign that says warning beware of dog he uses collie lennox so you're laughing tell people what collie lennox is for those who don't know for those security folks who are looking to do some pen testing you may have installed calli linux

Starting point is 00:38:08 in the past so it's uh it provides some attack tools to let you go after other people's servers or your own, hopefully. Yeah, yeah. It basically is a distribution that bundles a whole host of things you would separately install if you were a pen tester, hacker sort of thing. And there's just, it comes ready to go, right? That needs to be the new logo for Colley Linux, like a big junkyard dog with a big, like, spiked collar. Exactly.

Starting point is 00:38:32 Love it. Terminal with the name and address on it. There's no place like 127001. Exactly. Tattooed on his arm. You know I'm a sucker for dad jokes. I will laugh every time. I know.

Starting point is 00:38:48 These are pretty solid. These are pretty solid. So you wear the dog. He's his Calli Linux. All right. Well, that is it for the show. Calvin. Thank you for being here, as all of us.

Starting point is 00:38:58 Yeah, you bet. And check out Pidentic logfire at Pythonbystitefm slash Logfire. Really appreciate them support in the show. Update your pythons. Yes. UV, Python. Even had an upgrade. So for in place, point release upgrades for UV.

Starting point is 00:39:11 There's a single command now to update all of them. So just do that. Stay safe out there. That's right. Bye y'all. See ya.

Python Bytes - #492 Codeberg Puts Head in Sand

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.