WEBVTT 00:00:00.020 --> 00:00:02.720 Security has always been the vegetables of software. 00:00:03.380 --> 00:00:06.740 Everyone agrees it matters, and somehow it never quite makes it onto the plate. 00:00:07.280 --> 00:00:09.600 At PyCon US this year, that changed. 00:00:09.960 --> 00:00:13.460 For the first time ever, security got its own dedicated day-long track, 00:00:13.860 --> 00:00:16.800 one of just two at the whole conference sitting right next to AI. 00:00:17.480 --> 00:00:19.440 And the room was packed to the back wall. 00:00:20.220 --> 00:00:22.820 On this episode, I'm joined by three people at the center of it. 00:00:23.080 --> 00:00:27.500 Seth Larson, security developer in residence at the Python Software Foundation, 00:00:27.940 --> 00:00:31.000 and very recently a CPython core developer, 00:00:31.420 --> 00:00:34.360 Juanita Gomez, a PhD researcher at UC Santa Cruz 00:00:34.700 --> 00:00:37.600 in open source security who co-chaired the track 00:00:37.920 --> 00:00:41.100 and Mike Fiedler, PyPI's safety and security engineer, 00:00:41.460 --> 00:00:43.400 one of the very few people paid full-time 00:00:43.440 --> 00:00:45.860 to keep the packages you install safe. 00:00:46.460 --> 00:00:48.100 We use the arc of the track's talks 00:00:48.300 --> 00:00:51.000 to take the temperature of Python security right now. 00:00:51.140 --> 00:00:53.220 Supply chain attacks, dependency cool-down, 00:00:53.500 --> 00:00:54.520 zero trust, S-bombs, 00:00:54.980 --> 00:00:57.060 and the push to bring Rust into CPython. 00:00:57.660 --> 00:01:01.300 and why not one of us think security is anywhere close to solved. 00:01:01.840 --> 00:01:03.620 And it turns out that's why the room was full. 00:01:04.440 --> 00:01:10.040 This is Talk Python To Me, episode 556, recorded July 6th, 2026. 00:01:11.579 --> 00:01:14.300 Talk Python To Me, yeah, we ready to roll. 00:01:14.760 --> 00:01:17.180 Upgrading the code, no fear of getting old. 00:01:17.300 --> 00:01:19.800 Async in the air, new frameworks in sight. 00:01:20.040 --> 00:01:20.980 Geeky rap on deck. 00:01:21.280 --> 00:01:22.880 Quarth crew, it's time to unite. 00:01:23.140 --> 00:01:26.020 We started in Pyramid, cruising old school lanes. 00:01:26.360 --> 00:01:27.840 Had that stable base, yes sir. 00:01:27.930 --> 00:01:28.920 Welcome to Talk Python To Me, 00:01:29.030 --> 00:01:32.220 the number one Python podcast for developers and data scientists. 00:01:32.800 --> 00:01:34.120 This is your host, Michael Kennedy. 00:01:34.500 --> 00:01:37.980 I'm a PSF fellow who's been coding for over 25 years. 00:01:38.700 --> 00:01:39.760 Let's connect on social media. 00:01:40.140 --> 00:01:43.280 You'll find me and Talk Python on Mastodon, Bluesky, and X. 00:01:43.520 --> 00:01:45.400 The social links are all in your show notes. 00:01:46.160 --> 00:01:49.680 You can find over 10 years of past episodes at talkpython.fm. 00:01:49.860 --> 00:01:53.060 And if you want to be part of the show, you can join our recording live streams. 00:01:53.420 --> 00:01:53.880 That's right. 00:01:54.100 --> 00:01:57.340 We live stream the raw uncut version of each episode on YouTube. 00:01:57.940 --> 00:02:02.360 Just visit talkpython.fm/youtube to see the schedule of upcoming events. 00:02:02.600 --> 00:02:06.220 Be sure to subscribe there and press the bell so you'll get notified anytime we're recording. 00:02:07.040 --> 00:02:08.720 This episode is brought to you by Sentry. 00:02:09.039 --> 00:02:10.280 Don't let those errors go unnoticed. 00:02:10.560 --> 00:02:12.080 Use Sentry like we do here at Talk Python. 00:02:12.580 --> 00:02:15.440 Sign up at talkpython.fm/sentry. 00:02:16.160 --> 00:02:19.400 Talk Python and Python Bytes both now have MCP servers. 00:02:20.080 --> 00:02:24.360 Point your AI at 10 plus years of Python episodes, transcripts, and show notes. 00:02:24.790 --> 00:02:24.920 Free. 00:02:25.470 --> 00:02:29.540 Click MCP in the nav at talkpython.fm and at pythonbytes.fm. 00:02:31.140 --> 00:02:35.120 Juanita, Mike, Seth, welcome all of you to Talk Python. 00:02:35.700 --> 00:02:36.120 Hi. 00:02:36.480 --> 00:02:36.660 Hello. 00:02:37.860 --> 00:02:41.240 Awesome to have some of you back, some of you here for the first time. 00:02:41.350 --> 00:02:42.080 Really, really great. 00:02:42.410 --> 00:02:45.540 So we're going to talk about Python security. 00:02:46.200 --> 00:02:57.800 And I believe, Seth, I saw that you wrote up a post article just thinking back on this kind of unique Python security track and this extra focus at PyCon US this year. 00:02:58.380 --> 00:03:08.180 I thought, hey, that'd be great to just get everyone involved together, at least everyone involved in the track, not all eight, seven or eight speakers, whatever that number adds up to be many, many speakers. 00:03:08.760 --> 00:03:19.360 And just kind of talk broadly about Python security and use this arc of the topics and talks covered at PyCon and the security track as maybe a backdrop. 00:03:19.740 --> 00:03:21.140 So welcome, welcome. 00:03:21.840 --> 00:03:29.820 Now, before we get into that exactly, let's just do quick introductions about who you are and how you're involved in stuff. 00:03:30.060 --> 00:03:31.160 Juanita, you want to kick us off? 00:03:31.360 --> 00:03:31.560 Sure. 00:03:32.300 --> 00:03:33.080 My name is Juanita. 00:03:33.600 --> 00:03:37.060 I am a PhD researcher right now at UC Santa Cruz. 00:03:37.500 --> 00:03:42.180 I work with the hospital at my university doing research in open source security and sustainability. 00:03:42.680 --> 00:03:46.100 And I've been involved in like the Python and the Sign2Pay Python community for a while. 00:03:46.320 --> 00:03:51.000 So, yeah, I got invited to coaching on the track and that was very exciting. 00:03:51.640 --> 00:03:55.600 Very cool. Where are you in your PhD? Are you past qualifying exams? 00:03:56.200 --> 00:03:57.380 I'm graduating in August. 00:03:58.420 --> 00:04:02.260 What? Oh, my God. That's awesome. Congratulations. You're far past it. 00:04:02.780 --> 00:04:04.680 So what's the plans after? 00:04:05.480 --> 00:04:17.880 I just got a job. I can't talk about it yet, but I just got a job. But I'm going to industry. I'm going to keep working on security and sustainability in open source mostly. But yeah, an industry. 00:04:18.320 --> 00:04:23.120 Cool. Congratulations on both finishing the PhD and getting a job straight away. That's super cool. 00:04:23.420 --> 00:04:23.760 Thank you. 00:04:24.160 --> 00:04:25.740 Yeah. Mike, welcome back. 00:04:25.940 --> 00:04:33.720 Hey, glad to be here. Mike Fiedler, PyPI Safety and Security Engineer, working for the Python 00:04:34.160 --> 00:04:40.700 Software Foundation based out of New York City. I'm coming up on my third year here at the PSF, 00:04:40.900 --> 00:04:47.000 which is a full milestone that I will be sharing with my compatriot here, Seth. 00:04:47.640 --> 00:04:53.139 Very cool. And I know thanks for all the work. It's been, I think, pretty impactful in three 00:04:53.160 --> 00:05:00.220 years already. Yeah, it's been kind of a wild ride of kind of incorporating this because I was a 00:05:00.460 --> 00:05:07.980 volunteer PyPI admin and contributor long before this job opened up. And having the ability to sit 00:05:08.080 --> 00:05:16.640 here and think about and work on security features and stuff for PyPI full-time has been a big eye 00:05:16.740 --> 00:05:23.780 opener as to kind of where the gaps were and kind of where they remain, but also kind of what are 00:05:23.900 --> 00:05:29.640 the very important things that we can do in the interim immediately while building up the kind of 00:05:29.780 --> 00:05:36.220 the piece by piece bits that we need to get to these longer term ideas, but being able to kind 00:05:36.220 --> 00:05:41.400 of still make progress while we're getting there. Again, it's that notion of like rebuilding the 00:05:41.400 --> 00:05:45.919 plane while you're flying it. Like, okay, well, we had the plane, but now we're like adding better 00:05:45.940 --> 00:05:51.920 sensors better kind of steering better throttles better better toggles while we're still flying 00:05:52.320 --> 00:05:58.040 and that flight is accelerating yeah 100 and seat belts i think seat belts belong in the security 00:05:58.500 --> 00:06:04.080 airplane analogy uh probably but again it's arguable sometimes seat belts are a problem 00:06:04.350 --> 00:06:10.379 so like yeah it becomes a very good discussion of trade-offs and balances and kind of what what 00:06:10.400 --> 00:06:16.740 actually will move a needle versus this is a nice to have uh you know ashtray yeah ashtrays oh my 00:06:16.740 --> 00:06:23.040 gosh i remember i remember when there are ashtrays on airplanes yeah that was crazy i'm like why is 00:06:23.040 --> 00:06:27.680 there still an ashtray on this airplane like i know they're not gonna let anyone use it fun fact 00:06:27.700 --> 00:06:33.140 they still have them in airplane bathrooms because while it is against the law they still want you to 00:06:33.240 --> 00:06:38.819 have a safe place to throw an ash your cigarette but if you're gonna violate the law so that way 00:06:38.680 --> 00:06:41.620 you don't throw it into the trash can and set something on fire. 00:06:41.880 --> 00:06:48.580 Seems reasonable. Seems reasonable. So as a way of a segue, Mike, I'll have you take this first, 00:06:48.640 --> 00:06:54.640 and then Seth, you can pick this up. You pointed out being full-time on this project versus a bunch 00:06:54.660 --> 00:06:59.560 of kind of contributors who get excited about part of it, but then there's this whole herding 00:06:59.720 --> 00:07:08.640 cats across thousands, hundreds of thousands of projects and users and contributors. And 00:07:08.660 --> 00:07:14.960 role to this versus just like a core dev type of situation, you know? Yeah, I think there's kind of 00:07:14.990 --> 00:07:20.960 two facets here, right? And there is very much a trade-off, right? When it's full-time volunteers, 00:07:21.390 --> 00:07:25.240 you get what you pay for, which is nothing, right? You haven't paid for anything. Volunteers are 00:07:25.240 --> 00:07:29.640 going to do what volunteers want to do, and they're going to do their best effort. When you hire 00:07:29.840 --> 00:07:36.400 somebody, then you set expectations and you try to make sure that you meet them, right? The double-edged 00:07:36.420 --> 00:07:42.580 sword there is that by hiring full-time employees, volunteers often will take a step off because it's 00:07:42.580 --> 00:07:48.060 like, okay, I don't need to volunteer as much as I used to because now someone's getting paid for 00:07:48.400 --> 00:07:54.720 to do it. So it's both a good thing because it highlights and focuses effort on areas that need 00:07:55.000 --> 00:08:02.340 kind of sanitization and focused effort to make progress, but it also gives volunteers a much 00:08:02.360 --> 00:08:08.560 needed break, which then in turn puts more pressure on the full-time employees to execute, 00:08:09.100 --> 00:08:16.560 which again, not enough capacity, not enough time. So we're doing our best here, but it's shown that 00:08:16.780 --> 00:08:23.200 if you do pay for a focused security effort, you do get good security outcome. And I think that's 00:08:23.300 --> 00:08:30.640 the takeaway for me and for anybody is if you pay for it, they will cut. Fair. Seth, welcome back. 00:08:30.920 --> 00:08:31.360 Hey, Michael. 00:08:32.000 --> 00:08:38.140 So quick intro for people who haven't listened to your episodes and then maybe your thoughts on this full-time thing. 00:08:38.340 --> 00:08:43.700 Yeah, so I, everyone, Seth Larson, a security developer in residence at the Python Software Foundation. 00:08:44.340 --> 00:08:49.120 I work primarily on kind of like everything that is not IPI backend. 00:08:49.420 --> 00:08:55.380 So that's the Python language, the runtime, the security response team for Python and pip, 00:08:56.080 --> 00:09:01.420 packaging tools and standards, and then kind of like how Curie World interacts with Python and vice versa. 00:09:01.570 --> 00:09:03.000 Right. So like CBE and all that. 00:09:03.890 --> 00:09:05.600 And recently a core developer, very recently. 00:09:06.740 --> 00:09:12.700 So to answer the how does this role and all that interacting with volunteers, 00:09:13.420 --> 00:09:20.660 My the way that I've tried to like because my space is like so large, my area of where I'm trying to focus. 00:09:21.050 --> 00:09:27.040 What I end up doing is I try to find projects that are obviously like high impact, all of that. 00:09:27.050 --> 00:09:31.420 Right. Like you don't want to be doing things. You don't want to be nibbling or what is the there's a snacking. 00:09:31.680 --> 00:09:38.880 That's the phrase for it. You don't want to be snacking, but you also don't want to be doing things that volunteers could technically do. 00:09:39.280 --> 00:09:50.940 Right. So if it's a job that is or a task or a project that a volunteer could do, maybe I will like pause and wait on that because I'll leave space for someone to potentially contribute there. 00:09:51.120 --> 00:10:08.780 And then the things that are less likely to get volunteer contributions, things like spinning up a CBE numbering authority for the Python Software Foundation or being an admin on the PSRT where or the Python security response team where you're doing things like, OK, we're going to like be monitoring for spam being sent to our email thread. 00:10:08.900 --> 00:10:19.140 Like volunteers maybe don't want to do that, but maybe they would want to be on the security response team contributing to coordinating vulnerability reports and then getting like acknowledged for their work. 00:10:19.340 --> 00:10:21.880 Right. Like in the in the NCD record and advisory. 00:10:22.520 --> 00:10:25.480 So that's kind of like how I think about it, because the area is so wide. 00:10:25.580 --> 00:10:32.680 I try to make sure that I leave space for other people to contribute just in case that people do get around to it before I end up getting to it. 00:10:32.820 --> 00:10:38.080 So we want to build the community volunteer muscle also, not just have it be on work. 00:10:38.100 --> 00:10:50.780 Yeah, that's really cool. How much do you focus on popular third party projects like Django? I mean, Django already has full time people above Flask or something like that versus just pure Python? 00:10:50.940 --> 00:11:01.780 Yeah, so I would say my time doesn't necessarily always like land directly on the project, but I do spend time responding to maintainers if they have questions. 00:11:02.270 --> 00:11:11.080 So like, for example, David from Flask, him and I have talked many times about how to do like a security response program or a threat model or, you know, hey, I'm seeing this. 00:11:11.360 --> 00:11:13.920 Like, can you help? Like, what what should I do in this situation? 00:11:14.100 --> 00:11:19.400 Like, we've talked about that and I've talked about it with many other maintainers, not just Flask, just to try to give them like advice. 00:11:19.740 --> 00:11:27.860 But then also whenever, like one of the nice things about this role being at like a nonprofit is that you can be super, super open. 00:11:28.170 --> 00:11:33.360 You don't have to like keep the secrets to yourself about like what you've done and like how you've seen success. 00:11:33.920 --> 00:11:45.460 So like we publish everything that we do and like where we see success and people in theory can just like take that copy paste it into their projects or their processes and have a better time than they were before. 00:11:45.710 --> 00:11:46.900 So people can learn from each other. 00:11:47.170 --> 00:11:48.680 I really do appreciate that part of the work. 00:11:49.020 --> 00:11:53.360 That is a bit of a unique aspect of doing an open source security thing as opposed to, 00:11:53.380 --> 00:11:54.220 I can't talk about it. 00:11:54.380 --> 00:11:56.000 This is, no, we don't talk about anything. 00:11:56.140 --> 00:11:57.160 So very interesting. 00:11:57.980 --> 00:11:59.320 Let's talk about this track. 00:11:59.860 --> 00:12:04.940 So there's this trailblazing Python security that talks about, for the first time ever, 00:12:05.140 --> 00:12:09.120 a day-long track devoted to the latest in Python security. 00:12:09.400 --> 00:12:14.460 And if you pull up the schedule of talks, I believe it was Saturday was the track. 00:12:15.080 --> 00:12:17.460 And that was, there was just a whole room. 00:12:17.640 --> 00:12:19.380 And what I also liked, it was a room, wasn't it? 00:12:19.660 --> 00:12:22.080 That was like a fixed place, so you didn't have to keep moving. 00:12:22.360 --> 00:12:22.500 Yeah. 00:12:22.760 --> 00:12:27.860 So Juanita, you want to kick us off and talking about why this, why do you guys focus on this 00:12:28.240 --> 00:12:28.680 this year? 00:12:28.840 --> 00:12:32.560 And, you know, why did you decide it's going to take a specific slot in? 00:12:32.940 --> 00:12:35.940 There's only two dedicated slots, security and AI. 00:12:36.180 --> 00:12:37.120 And I think that's very fitting. 00:12:37.380 --> 00:12:38.420 But tell us about this track. 00:12:38.800 --> 00:12:38.940 Okay. 00:12:39.160 --> 00:12:44.780 Well, I will let Seth talk about how did the idea come to place because I was not part 00:12:44.780 --> 00:12:45.040 of that. 00:12:45.240 --> 00:12:47.460 but I'm going to talk about why I think it's important 00:12:47.650 --> 00:12:48.860 and why it was important in the conference. 00:12:49.860 --> 00:12:53.640 I think security is something that's parallel to everything in Python. 00:12:53.970 --> 00:12:56.200 I think that if you're a maintainer for a package, 00:12:56.310 --> 00:12:59.880 I think having security somewhere on your mind should be a thing. 00:13:00.120 --> 00:13:02.700 You should be thinking about security when you're developing a thing. 00:13:03.410 --> 00:13:09.420 And I think there's a big gap in maybe the time that maintainers spend 00:13:09.660 --> 00:13:11.820 thinking about security or even the expertise. 00:13:13.140 --> 00:13:26.440 And so I think this track was like a big opportunity for people that work in PyVon as maintainers or as users to just learn about some important security things when thinking about like their development processes. 00:13:27.079 --> 00:13:32.660 I thought it was great that it was like a dedicated track because I think it highlights the importance of security. 00:13:33.030 --> 00:13:38.980 Like it's not a bunch of talks that are kind of like in the schedule that people just kind of like figure out they want to go to. 00:13:38.980 --> 00:13:42.380 But it's like we like made it a thing by making it like a full track. 00:13:42.980 --> 00:13:50.500 And I think that elevates the importance of security within Python, which I think it's not necessarily always the case. 00:13:50.780 --> 00:13:55.660 I think every time I talk to Mike, I'm like, why are you the only getting paid for doing Python security? 00:13:56.840 --> 00:14:02.680 I think increasing the awareness of the importance of security is very important. 00:14:02.720 --> 00:14:05.280 And I think that the track, I think, was meant to do that. 00:14:05.660 --> 00:14:13.300 How much do you think what were in those seven talks is representative of the broader security 00:14:13.420 --> 00:14:17.380 space, you know, getting your PhD, studying the stuff like you get maybe a little more 00:14:17.540 --> 00:14:18.900 than just Python view? 00:14:19.380 --> 00:14:21.000 Like, what did it capture? 00:14:21.120 --> 00:14:21.760 And what did it miss? 00:14:21.760 --> 00:14:22.000 I guess. 00:14:22.520 --> 00:14:27.960 I think, honestly, we made it a track that was diverse enough that we could capture like 00:14:28.300 --> 00:14:32.960 very different things within the security brother, like image. 00:14:33.500 --> 00:14:38.920 And I also think that a lot of the things that we talked about are not even necessarily Python specific. 00:14:39.460 --> 00:14:41.400 Like you should care about credentials. 00:14:41.690 --> 00:14:43.220 You should care about phishing. 00:14:43.220 --> 00:14:50.000 Like all of these things are things that you should care about, whether you do Python or C or any other like language development. 00:14:51.080 --> 00:14:59.540 I think that something that maybe I was missing a little bit after I like saw maybe after the conference, 00:14:59.820 --> 00:15:07.140 I was thinking about, I would have liked maybe like an intro version of security, something. 00:15:07.290 --> 00:15:12.160 I think something that I work with in my research is actually like security practices, 00:15:13.000 --> 00:15:15.100 mostly for like starting projects. 00:15:15.530 --> 00:15:18.240 I work with like literally university projects. 00:15:19.090 --> 00:15:23.140 And like the goal of my OSP is to improve the practices of the university projects. 00:15:23.580 --> 00:15:27.560 And some of them are maybe not as advanced to take on some of the, 00:15:27.880 --> 00:15:30.120 like I would say more advanced security practices. 00:15:30.640 --> 00:15:32.240 And so maybe something like that 00:15:32.420 --> 00:15:35.160 is something that maybe we did not capture as much, 00:15:35.360 --> 00:15:36.580 like basic things, 00:15:37.110 --> 00:15:38.640 like literally just going to GitHub 00:15:39.000 --> 00:15:41.440 and like switching some switches 00:15:41.800 --> 00:15:44.160 on the configurations of like your repository. 00:15:44.620 --> 00:15:46.320 Some of those things maybe were missing. 00:15:46.430 --> 00:15:48.460 And I think there's value on that for people 00:15:48.600 --> 00:15:51.940 that are like literally nowhere in the security like path. 00:15:52.540 --> 00:15:53.200 But apart from that, 00:15:53.200 --> 00:15:55.300 I think the diversity was really good on the track. 00:15:55.560 --> 00:15:56.500 I love it. 00:15:56.620 --> 00:16:00.140 I think that'd be a great talk to kick off the track and like security 101. 00:16:00.500 --> 00:16:03.420 Let's not get hacked the first week or something like that, you know? 00:16:04.020 --> 00:16:05.140 Maybe I'll do it next year. 00:16:05.680 --> 00:16:06.520 Yes, let's do it. 00:16:06.560 --> 00:16:07.640 I would love to see that. 00:16:08.880 --> 00:16:13.780 Like, for example, maybe just add a little bit of rate limiting and some logging. 00:16:13.890 --> 00:16:15.740 So if something does happen, you could actually tell. 00:16:15.910 --> 00:16:17.240 And, you know, these kinds of things, right? 00:16:17.240 --> 00:16:19.760 It would be, you know, there's a whole list of that stuff, right? 00:16:19.980 --> 00:16:25.000 Another idea that like came up in when we were thinking about how the track went and how the themes. 00:16:25.200 --> 00:16:30.560 this is this is funny to his idea so i you're gonna have to correct me but uh the idea of like 00:16:30.660 --> 00:16:36.140 having a little bit more interactivity uh to kind of shake things up as opposed to it being because 00:16:36.220 --> 00:16:40.400 i mean with security with these talks maybe you're expecting it to i mean it's obviously like more 00:16:40.660 --> 00:16:45.060 experts based but that ends up if you're in a talk format it's mostly talking to people but having 00:16:45.300 --> 00:16:49.120 something like a panel where you start off with like a few questions to kind of set the theme 00:16:49.460 --> 00:16:54.180 and then you kind of open it up to kind of get some vibes from the audience uh about like what 00:16:54.160 --> 00:16:59.600 questions they're having, make it more interactive in that way. That seemed really interesting to me 00:16:59.740 --> 00:17:02.640 as well. So we're going to see if we can experiment with that next year. 00:17:03.240 --> 00:17:05.800 So am I hearing you say there's going to be a one next year? 00:17:06.060 --> 00:17:07.780 We're hoping for it, for sure. 00:17:08.720 --> 00:17:11.640 We think that we should have another one next year. I mean, 00:17:11.980 --> 00:17:15.020 there was no indication that we shouldn't do this again, is what we saw. 00:17:16.079 --> 00:17:18.780 Honestly, I mean, security might be solved next year. 00:17:19.100 --> 00:17:19.800 Oh, yeah. 00:17:19.839 --> 00:17:20.480 That'd be great, wouldn't it? 00:17:20.760 --> 00:17:21.100 For sure. 00:17:21.240 --> 00:17:23.260 AI will solve all of our security problems. 00:17:23.360 --> 00:17:24.900 It's what I've been told, what I've read. 00:17:25.400 --> 00:17:28.060 Mike, you're trying to take us down a path that is a very different path. 00:17:28.940 --> 00:17:32.200 Well, I mean, it's been a few minutes and we haven't said AI yet. 00:17:32.300 --> 00:17:34.720 Well, no, you actually did because you introduced the other tracks. 00:17:35.600 --> 00:17:35.740 Yeah. 00:17:36.310 --> 00:17:39.560 Well, we only mentioned it in passing, but not with regard to this topic. 00:17:39.650 --> 00:17:42.420 I do think actually maybe if we get some time, I do want to talk to you about it. 00:17:43.680 --> 00:17:44.640 There's a lot to cover. 00:17:45.140 --> 00:17:45.960 There is so much. 00:17:46.160 --> 00:17:50.360 Maybe this could just be its own show that we could go into because there is a lot to cover. 00:17:50.580 --> 00:17:52.700 I think there's like positives and negatives, 00:17:53.000 --> 00:17:54.820 and that kind of sums up AI right there, doesn't it? 00:17:55.180 --> 00:17:56.460 It sums up everything, honestly. 00:17:56.740 --> 00:17:58.500 It sums up a lot of life, yes. 00:18:00.380 --> 00:18:00.960 Hey, one second. 00:18:01.779 --> 00:18:04.180 Normally, this would be an ad break from Sentry, 00:18:04.520 --> 00:18:05.220 but not this time. 00:18:05.580 --> 00:18:07.640 Let's just thank them for supporting the show 00:18:07.840 --> 00:18:09.140 and get right back to the conversation. 00:18:09.640 --> 00:18:13.020 Also, visit talkpython.fm/sentry after the show. 00:18:13.260 --> 00:18:13.820 Thanks, Sentry. 00:18:15.020 --> 00:18:16.000 It's a lot of gray. 00:18:16.580 --> 00:18:18.060 Yeah, not so much black and white, a lot of gray. 00:18:19.820 --> 00:18:21.480 So it was like standing room only? 00:18:21.960 --> 00:18:24.820 I mean, that sounds like that bodes well for our next year. 00:18:25.100 --> 00:18:26.180 Yeah, next year, hopefully. 00:18:26.580 --> 00:18:28.420 I mean, it'd be really great to even have a bigger room. 00:18:29.310 --> 00:18:32.720 Or, yeah, we were quite happy with the turnout. 00:18:32.830 --> 00:18:34.920 We had a few talks that basically it was standing room 00:18:35.320 --> 00:18:37.080 and there was nowhere else to come into the room. 00:18:37.400 --> 00:18:40.000 So that's always great to see as an organizer for a first-time event 00:18:40.300 --> 00:18:41.940 is when the room is too small. 00:18:42.380 --> 00:18:43.660 It means you're doing something right. 00:18:44.280 --> 00:18:44.620 Exactly. 00:18:45.960 --> 00:18:49.360 You've overachieved compared to what you were trying to work with or whatever. 00:18:49.780 --> 00:18:52.140 Yeah, I guess just one in the test, 00:18:52.840 --> 00:18:57.140 what was your experience just co-sharing a track and so on? 00:18:57.240 --> 00:18:59.000 What was it like being on that side of the conference? 00:19:00.080 --> 00:19:03.400 I think it was, I thought it was great because I think, 00:19:04.280 --> 00:19:07.740 so I've actually been organizing SyPyre also for a couple of years. 00:19:08.200 --> 00:19:09.280 And for the longest time, 00:19:09.440 --> 00:19:13.040 I've actually tried to bring security as a conversation at SyPyre. 00:19:13.360 --> 00:19:16.000 So I've learned a couple of like reds of a feather session, 00:19:16.460 --> 00:19:19.060 but having a security track seems a little impossible. 00:19:19.500 --> 00:19:31.380 I don't know, like it's so I don't know, like making making this happen at PyCon was it made me really, really happy because it gets you the opportunity to bring people to talk about the things that you really care about. 00:19:31.910 --> 00:19:35.300 Like security in Python is really like personal to me. 00:19:35.400 --> 00:19:36.760 I care a lot about it. 00:19:36.830 --> 00:19:42.800 And I think part of the problem is the lack of awareness of some of the things that we discussed at the shark. 00:19:42.980 --> 00:19:48.580 So I thought it was a great opportunity to just kind of bring that awareness into the table and making it happen. 00:19:48.660 --> 00:19:50.180 Just like being part of that conversation. 00:19:51.000 --> 00:19:53.120 I felt really proud of doing that. 00:19:53.320 --> 00:20:01.940 And I think also, I think like Seth and I and other couple of people we had, I mean, I had a lot of fun reviewing some of the talks that people submitted. 00:20:02.880 --> 00:20:06.500 We were unfortunately like limited to like eight slots. 00:20:06.880 --> 00:20:11.080 But there was a lot of things that I learned by just reading some of the talk proposals. 00:20:11.120 --> 00:20:15.740 So it was like, I think it was also like a learning experience for me to be part of the truck. 00:20:16.120 --> 00:20:29.480 Yeah, I was going to say, compared to Juanita, my experience with organizing sessions and talks and conferences, this is like the very first time that I've like really dipped my toe into organizing at this level for a conference. 00:20:30.320 --> 00:20:32.280 So it was a lot of learning for me. 00:20:32.680 --> 00:20:34.640 And I thought it was a great experience. 00:20:34.860 --> 00:20:38.340 I think other people could definitely like would enjoy doing this too. 00:20:39.060 --> 00:20:46.080 So now I'm like just understanding and learning all of these things that are about how a conference track or a talk schedule is put together. 00:20:46.680 --> 00:20:51.700 And for me, like the day of stuff was like so, so much. 00:20:52.280 --> 00:20:56.420 It's you're running around and it was like very on the fly. 00:20:56.980 --> 00:21:00.980 And, you know, they have all the recommendations that once the ball is rolling, it's like it's rolling. 00:21:01.040 --> 00:21:02.000 And it was really, really fun. 00:21:02.120 --> 00:21:03.660 I don't know. We had a lot of fun up there. 00:21:03.700 --> 00:21:05.280 I think that it was a great session. 00:21:05.660 --> 00:21:07.040 The energy was so positive. 00:21:07.480 --> 00:21:10.760 People are always coming up to you afterwards and saying, oh, that was amazing. 00:21:11.350 --> 00:21:12.760 Thank you for doing this, all of that. 00:21:12.870 --> 00:21:14.580 And it was a really great experience. 00:21:15.240 --> 00:21:15.380 Cool. 00:21:15.810 --> 00:21:17.380 Yeah, PyCon was really fun this year, too. 00:21:17.850 --> 00:21:19.660 I thought Long Beach was a pretty nice venue. 00:21:19.940 --> 00:21:22.580 There's some nice food carts and other things to do there. 00:21:22.760 --> 00:21:24.940 So that was really looking forward to back then. 00:21:25.660 --> 00:21:30.240 Yeah, now that we know the cool little bar open, you know, rooftop bars or outside bars, 00:21:30.460 --> 00:21:34.440 we can just go meet up and hang out with friends or the cool restaurant you want to go back to or whatever. 00:21:34.940 --> 00:21:35.000 Yeah. 00:21:35.740 --> 00:21:45.400 My first event there was to rent one of those like Lime or Bird scooters and just spend an hour riding around the town and the beach just to like get used to it and then going to check in. 00:21:45.720 --> 00:21:46.340 So very fun. 00:21:46.760 --> 00:21:56.080 Let's bring it over to the conference with the first of seven, I think we have seven, six or seven tracks that I put up for us to kind of riff on here. 00:21:56.660 --> 00:22:00.620 And that would be by none other than Mike Fiedler, an anatomy of a fishing campaign. 00:22:01.020 --> 00:22:01.440 What is this? 00:22:01.760 --> 00:22:02.320 Oh, boy. 00:22:02.640 --> 00:22:03.180 What is this? 00:22:03.660 --> 00:22:06.880 So this was the first track of the day, wasn't it? 00:22:07.720 --> 00:22:07.880 Yeah. 00:22:08.280 --> 00:22:09.040 I'll tell you what this is. 00:22:09.190 --> 00:22:10.940 This is why we can't have nice things, Mike. 00:22:11.060 --> 00:22:12.280 This is why we can't have nice things. 00:22:13.380 --> 00:22:14.960 It really is true, right? 00:22:15.120 --> 00:22:21.800 Like there's, for me, it was a good opportunity to kind of do a little storytelling education 00:22:22.760 --> 00:22:25.800 because these are cases that happen, right? 00:22:26.020 --> 00:22:32.019 And this was a novel enough one that I was like, this deserves some disambiguation because 00:22:32.040 --> 00:22:36.160 people hear phishing attack is like, oh yeah, yeah, yeah, yeah. This was different, right? 00:22:36.960 --> 00:22:45.080 And I was very kind of excited to speak and be selected for the spot. And you mentioned standing 00:22:45.160 --> 00:22:49.420 room only. Standing up there on the stage and looking out into a large room and seeing people 00:22:49.700 --> 00:22:56.220 standing at the back wall and not seeing little dotted seats available throughout the room was a 00:22:56.300 --> 00:23:00.720 little intimidating because it's like, you know, sometimes people don't sit in all the seats and 00:23:00.660 --> 00:23:15.520 That's fine. Or like the first two rows are empty. But no, Juanita and Seth had basically packed this room with people, not intentionally, but purely purely by curating the timeline and like setting the tone of like, yeah, this is this is going to be a story. 00:23:16.580 --> 00:23:33.060 And I was able to relate my personal firsthand experience of dealing with a phishing campaign that some of our users were tricked into visiting a website that was basically a proxy for PyPI. 00:23:34.000 --> 00:23:43.800 In previous phishing campaign attempts, a lot of folks talk about building a byte for byte or pixel perfect version of a different website and steering traffic to that. 00:23:44.080 --> 00:24:04.320 Here, they didn't even need to do that. They just threw up another proxy in front of it. And it was, you know, using email addresses that are like publicly available that maintainers put on their GitHub profiles and put in their, you know, Python package metadata. And they farmed out and emailed some unknowable number of maintainers. 00:24:04.560 --> 00:24:07.620 What an interesting security issue, right? 00:24:07.770 --> 00:24:14.840 Like you've got to be pretty sure that the login people use for their GitHub is probably the same email address that they've registered at PyPI. 00:24:15.360 --> 00:24:21.920 And the packages that you want to take over from PyPI linked to their GitHub repo, right? 00:24:22.020 --> 00:24:25.400 It's a really, it really does condense what you've got to do. 00:24:25.740 --> 00:24:26.560 A little bit, right? 00:24:26.680 --> 00:24:30.620 Like so in a lot of phishing campaigns, it's kind of a spray and pray, right? 00:24:30.720 --> 00:24:34.380 They're casting a very wide net and they're going to email 2 million people. 00:24:34.820 --> 00:24:37.440 And if they get two, that's a success for them, right? 00:24:37.960 --> 00:24:40.960 Because we have to defend 100% of the time. 00:24:41.260 --> 00:24:43.640 They only have to be right once or twice, right? 00:24:44.220 --> 00:24:46.100 And they were in this case. 00:24:47.700 --> 00:24:50.760 Again, PyPI is open source, right? 00:24:50.780 --> 00:24:52.220 You can read on the entire code base. 00:24:52.260 --> 00:24:54.220 You can see what our email templates look like. 00:24:55.020 --> 00:24:59.720 And you can see that, yeah, we do ask maintainers now and then to do an action. 00:25:00.240 --> 00:25:03.120 And they emailed maintainers and asked them to do an action. 00:25:03.640 --> 00:25:05.600 And these maintainers did an action. 00:25:05.940 --> 00:25:08.160 They did what they were asked to do. 00:25:08.760 --> 00:25:12.600 For example, you emailed people a couple of years ago and said, hey, you need to turn on 2FA. 00:25:12.880 --> 00:25:13.040 Yeah. 00:25:13.460 --> 00:25:15.920 And that's totally legitimate. 00:25:16.040 --> 00:25:19.680 And sometimes we will email people and say, hey, there's a problem with your metadata. 00:25:19.920 --> 00:25:20.720 Go in and fix it. 00:25:20.880 --> 00:25:23.640 We will occasionally tell people there's a problem. 00:25:24.300 --> 00:25:29.060 This one in particular would tell them it wasn't using our email infrastructure. 00:25:29.780 --> 00:25:34.400 You know, if you had anti-spam things, then like maybe it would have caught it. 00:25:34.550 --> 00:25:41.200 But it didn't because the mail was coming from the domain advertised for this hack. 00:25:41.500 --> 00:25:46.960 And it was basically showing instead of PyPI.org, PyPJ.org. 00:25:47.260 --> 00:25:58.560 And I would challenge you at, you know, looking at an email on your phone to hover on a link and see that difference between an I and a J in the lowercase Arial font on your phone. 00:25:58.720 --> 00:26:00.080 Like, you're not going to notice it, right? 00:26:00.320 --> 00:26:03.920 Humans, I have no qualms for the humans that fell for this, right? 00:26:04.100 --> 00:26:06.200 Like, they did what they were supposed to do. 00:26:06.520 --> 00:26:12.920 What was annoying about this attack is we've been talking about 2FA for a very long time now, 00:26:13.360 --> 00:26:16.160 and this is still phishing. 00:26:17.000 --> 00:26:21.280 You know, you can still get phished with certain forms of two-factor authentication, 00:26:21.800 --> 00:26:28.460 notably the time-based one-time password that were TOTP or what folks might think of your, like, QR code. 00:26:28.700 --> 00:26:30.280 or Google Authenticator app, 00:26:30.460 --> 00:26:32.120 all of those things are the same thing. 00:26:32.460 --> 00:26:34.020 Whereas if you used WebAuthn 00:26:34.240 --> 00:26:37.760 or the underlying technology for pass keys 00:26:38.180 --> 00:26:39.280 or like a YubiKey, 00:26:39.960 --> 00:26:43.280 that's requiring a different sort of 2FA 00:26:43.560 --> 00:26:44.860 that is more phishing resistant. 00:26:45.280 --> 00:26:47.560 So anybody who had the phishing resistant part 00:26:47.820 --> 00:26:49.280 was not subject to this attack. 00:26:50.120 --> 00:26:50.500 And then 00:26:50.500 --> 00:26:51.640 I think it might be worth 00:26:51.640 --> 00:26:55.480 maybe just a quick conversation on that 00:26:55.480 --> 00:26:57.379 because I totally agree 00:26:57.400 --> 00:26:59.720 because you could just proxy, they send over the thing, 00:26:59.840 --> 00:27:03.640 and you've got 30, 15, whatever seconds to then, you know, 00:27:03.940 --> 00:27:05.380 curry those credentials over, 00:27:05.540 --> 00:27:08.440 and you probably are fine to hack through with a proxy, right? 00:27:08.700 --> 00:27:12.120 I mean, I think it's, I think the TOTP ones are more, 00:27:12.500 --> 00:27:15.860 like if somebody gets a hold of your credentials and they're leaked, right, 00:27:15.960 --> 00:27:18.500 that's not enough to get in anymore, right? 00:27:19.120 --> 00:27:20.600