Seth Larson

:python: Security, Fellow Python Software Foundation (npub1vv8…6fhk) 🐍 Trans rights, BLM, Minnesoootan, he/him

https://sethmlarson.dev

:indieweb: Blog: https://sethmlarson.dev
:signal: Signal: sethmlarson.99

Public Key

npub1xhwh40lc054jjcw69d3tl77a32gtj29katwyl5xvq4kxjv8ytxaqgx9evl

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrtht6hlu862efv8dzkc4ll0wc4y9e9zmw4hz06rxq2mrfxrj9nwspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsrw9x5j

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1xhwh40lc054jjcw69d3tl77a32gtj29katwyl5xvq4kxjv8ytxaqgx9evl

Show more details

Last Notes

2025-06-03 21:51:25 GMT

- reply

The PSF Developers-in-Residence program makes this possible, check out how the @npub1vv8…6fhk supports the Python ecosystem with full-time staffing:
https://www.python.org/psf/developersinresidence/

2025-06-03 21:48:20 GMT

Thanks to the work of Python Release Managers and all the Developers-in-Residence we have a coordinated #Python #security release of all versions for 5 CVEs all in one day (1 critical, 3 high, 1 medium)
https://discuss.python.org/t/python-3-13-4-3-12-11-3-11-13-3-10-18-and-3-9-23-are-now-available/94367

2025-05-29 19:18:15 GMT

I am observing #VolunteerResponsibilityAmnestyDay this Spring and published my list ahead of the date to give you a chance to reflect on your own responsibilities.
https://sethmlarson.dev/observing-volunteer-amnesty-day
Thanks to @npub1hv5…xq0v for creating this time of intentional reflection. It's been useful for me to put into words and actions what I have probably needed to do for some time.

2025-05-17 18:20:03 GMT

Whoever created this, thank you. This captures the energy of open source perfectly. If you see a problem you can be the one to fix it, and that's amazing! 💪
#PyCon #PyConUS #PyConUS2025
https://cdn.fosstodon.org/media_attachments/files/114/524/544/478/930/025/original/843e7e08224bbd53.jpeg

2025-05-16 20:35:48 GMT

Learning about bees from @npub1tzz…5lkc (where is @npub1gfx…gnlz?)
#PyCon #PyConUS #PyConUS2025
https://cdn.fosstodon.org/media_attachments/files/114/519/424/724/422/899/original/eef560bba7ea7f11.jpeg

2025-05-16 14:02:22 GMT

Cory Doctorow at PyCon US
#PyCon #PyConUS #PyConUS2025
https://cdn.fosstodon.org/media_attachments/files/114/517/877/612/021/763/original/3f28a1f88ca8f896.jpeg

2025-05-15 12:58:29 GMT

If you're interested in software security at #PyConUS I've compiled a list of all talks, open spaces, and events related to security! 🐍🛡️
👉 https://sethmlarson.dev/pycon-us-2025-security-mini-summit
#pycon #pyconus2025 #python #security #oss #opensource
https://cdn.fosstodon.org/media_attachments/files/114/511/962/188/601/072/original/c8d9794ea58821f2.png

2025-05-06 15:02:50 GMT

@npub1vv8…6fhk Developers-in-Residence Program now has a landing page! 💜
Today we cover the language runtime and security work, maybe there's a gap in the #Python ecosystem your organization would like to see worked on full-time at the PSF? Let's talk!
#security #opensource #oss
https://www.python.org/psf/developersinresidence/

2025-05-02 13:28:26 GMT

- reply

Woo! Congrats @npub1css…jy3n! 👏👏👏

2025-04-15 19:11:54 GMT

Regardless of what happens with CVE/NVD, the PSF will continue publishing advisories for CPython through our OSV database and to the [email protected] mailing list.
Please subscribe to those data sources to guarantee delivery of vulnerability data about CPython.
https://github.com/psf/advisory-database

2025-04-14 14:09:21 GMT

Did you know that I'm co-organizing a supply-chain security mini-track at the #PyConUS2025 open spaces?
Open source users and maintainers are invited to attend for short talks and discussions with security-interested Pythonistas.
https://sethmlarson.dev/pycon-us-2025-security-mini-summit
#security #oss #pyconus #pycon

2025-04-10 14:03:41 GMT

Tomorrow is #FediDonutFriday, don't miss out! 🍩

2025-02-27 15:21:27 GMT

So I'm trying out #VIvaldi browser (@npub19rt…adh9) on #Ubuntu and I'll report back with what I think.
So far the initial setup and tinkering has been going well, I've got my password manager, feed reader all setup. Every optional piece of fluff that is "useful for someone but not me" has been dismissable or can be hidden from view. Great initial impression 👍
https://vivaldi.com

2025-02-26 22:08:30 GMT

How to turn a Firefox evangelist into a Firefox hater in just one easy step 😠 Mozilla, quit the games. Drop this or I drop you.
EDIT: A less frightening take on this change from someone who probably knows more? https://infosec.exchange/@ubernostrum/114072117220314039
https://fosstodon.org/@npub1yg8…ccz0/114071999402980952

2025-02-20 14:36:21 GMT

Positive action after an investigation, yay! https://www.404media.co/public-library-ebook-service-to-cull-ai-slop-after-404-media-investigation-3/?ref=daily-stories-newsletter

2025-02-06 14:35:26 GMT

Some really good news: Sovereign Tech Agency (@npub1yng…nhrk) has announced their first cohort of Fellows, and among them is a friend: @npub1xvu…jmp8 🥳
Congrats Hugo and everyone! Having chatted with Mirko last year I am really excited for this program to show how impactful paying a handful of maintainers full-time can be.
Read Hugo's blog on the Fellowship: https://hugovk.dev/blog/2025/im-excited-to-join-the-sovereign-tech-fellowship/

2025-02-05 02:10:06 GMT

That time of month again for my uncancellable auto-renewing GitHub Copilot subscription email (despite having never used Copilot or asked for this... :blobcatangery:) Note that there's no "unsubscribe" button, either.
https://cdn.fosstodon.org/media_attachments/files/113/948/840/975/144/258/original/2a590225b29d6ee7.png

2025-01-29 13:04:32 GMT

Chúc mừng năm mới! Happy New Year, everyone! 🐍🧧

2025-01-28 18:24:53 GMT

The threat of Trump EOs has caused the National Science Foundation to pause grant review panels. Critically for Python and PyPI security I spent most of December authoring and submitting a proposal to the "Safety, Security, and Privacy of Open Source Ecosystems" program. What happens now is uncertain to me.
Shuttering R&D only leaves open source software users more vulnerable, this is nonsensical in my mind given America's dependence on software manufacturing.
https://www.npr.org/sections/shots-health-news/2025/01/27/nx-s1-5276342/nsf-freezes-grant-review-trump-executive-orders-dei-science

2025-01-19 19:01:14 GMT

Finally! https://sethmlarson.dev/how-to-disable-copilot-in-github
Thank you @npub1te8…pgc3 for making me aware #github #copilot

2025-01-16 05:13:46 GMT

- reply

diffoscope is one of my favorite little tools! Highly recommended :)

2025-01-13 17:12:03 GMT

Meta is scared of Pixelfed. This is the biggest endorsement of Pixelfed that I've seen so far.
https://fosstodon.org/@npub1kxu…9fca/113819524021365621

2025-01-11 16:35:56 GMT

I'm giving @npub1fh7…ee83 a spin, really love the idea of a non-profit open source code repository so its members can control. If I enjoy the service enough perhaps I'll become a voting member.
Anyone have specific features or stories about Codeberg they'd be willing to share?
https://codeberg.org/sethmlarson

2024-12-23 20:45:11 GMT

- reply

I don't think the implementation side is difficult either, here's ActiveState's: https://github.com/pypi/warehouse/blob/main/warehouse/oidc/models/activestate.py
The more difficult part is becoming a secure OIDC provider with a sufficient audience to justify the work being done for PyPI.

2024-12-23 20:41:17 GMT

- reply

Yes! And these docs were used by ActiveState I presume to become their own Trusted Publisher provider. https://docs.pypi.org/trusted-publishers/internals/#how-do-i-become-a-trusted-publishing-provider

2024-12-23 20:37:43 GMT

- reply

Happy to chat about the feature!

2024-12-18 15:58:15 GMT

- reply

Making the transition to a senior engineer makes you wish there was a "Google Doc Wrapped"

2024-12-18 14:21:19 GMT

Now That's What I Call Wrapped (I don't listen to music...) :blobfoxcomputer:
https://git-wrapped.com/profiles/sethmlarson
https://cdn.fosstodon.org/media_attachments/files/113/674/272/920/613/898/original/562b68cc2fd52459.png

2024-12-17 05:25:40 GMT

- reply

haha I was at the game!! My wife advanced to the next round in fantasy playoffs from Moore's performance too. Was a fun game to be there :)
https://cdn.fosstodon.org/media_attachments/files/113/666/495/656/986/007/original/23eaa6159c4c5ce2.png

2024-12-13 20:49:44 GMT

- reply

Yeah... maybe this is some excess bemoaning of the use of AI-generated images in articles quoting my article about how AI is being abused. Ho hum

2024-12-13 20:45:40 GMT

In this era of generated AI images for every article, is OpenGraph actually useful? Seems more like everyone does it to maximize screen real-estate, not to enhance signal and understanding of the contained content.

2024-12-11 14:40:29 GMT

- reply

Yeah but has AI solved all your problems yet?

2024-12-05 19:51:32 GMT

Surprise, @npub1545…mva5 is now pushing Copilot on the home screen 🤢
Keep in mind that I've never signed up for Copilot, have disabled Copilot in every way that's possible, and yet I still have a "Copilot Individual Subscription" which comically has "Enabled" as a text field amongst drop-downs for disabling specific features and buttons for signing up for professional services.
https://cdn.fosstodon.org/media_attachments/files/113/601/948/471/403/260/original/44c64ece656b5b47.png

2024-12-03 19:16:31 GMT

I've noticed a concerning trend of "slop security reports" being sent to open source projects. Here are thoughts about what platforms, reporters, and maintainers can do to push back:
#oss #opensource #security
https://sethmlarson.dev/slop-security-reports?utm_campaign=mastodon

2024-12-02 14:35:14 GMT

- reply

As a data point: I've been continuing to enjoy your writing as a feed reader, keep it up! 💜

2024-11-22 16:18:25 GMT

My work on supply-chain security has only been possible through the "Developers-in-Residence" program at the Python Software Foundation.
Security work is unlikely to be anyone's favorite thing to do with #Python, my job is to do that work! Consider me Python's security janitor 🧼🫧🧽
You can support my mission! 🚀 The PSF is hosting its end-of-year fundraiser
where direct donations go to lovely programs like the Developers-in-Residence. Thank you for your consideration.
https://www.python.org/psf/donations/2024-q4-drive/

2024-11-21 17:52:40 GMT

Idle thought, what if Python typing allowed this?
dict[str, any]
🤔

2024-11-20 17:00:27 GMT

- reply

Scorecard was developed with multiple incorrect premises. The key one being that it's "for" two completely different user groups (OSS maintainers and users), but has the same UI for both.
Instead of "this project has a maintained score of 5" Scorecard could say: "YOU, the user, aren't contributing: get your hands dirty or pay up".
If Scorecard had all the features for providing an "interactive per-project" security roadmap without scores, that would be lovely for maintainers! Alas

2024-11-20 14:19:22 GMT

Wrote a short guide on how to purchase cheap ROMs from Steam for Genesis and Mega Drive (before they're removed on December 9th!)
Don't miss out on $5 Dr. Robotnik's Mean Bean Machine 🫘
#retrogaming #sega #genesis #megadrive
https://sethmlarson.dev/sega-genesis-and-mega-drive-games-and-roms-from-steam

2024-11-19 02:54:50 GMT

- reply

no not yet, but Matt has some resources and tools for developing for Z80 w/ the E-Reader's specific APIs.
https://github.com/city41/ereader-system-resources-z80
https://github.com/city41/z80-assembler

2024-11-19 02:33:46 GMT

Congrats Matt Greer for solving software distribution! E-Reader card with Solitaire delivered in an envelope by mail earlier today. Love it! 😍 (https://retrodotcards.com)
#gameboy #gba #retrogaming
https://cdn.fosstodon.org/media_attachments/files/113/507/275/107/254/206/original/2bf96458daec2e71.png

2024-11-14 20:02:24 GMT

Published some early validation results from my "SBOM for #Python packages" project. TLDR: I forked auditwheel and added some rudimentary SBOM record-keeping for bundled libraries and showed that today's SCA tools are able to use that information out-of-the-box. Full instructions and work in the post:
https://sethmlarson.dev/early-promising-results-with-sboms-and-python-packages

2024-11-14 18:28:27 GMT

It's frustrating that every announcement for a new security feature that includes the word "GitHub" immediately gets swarmed by comments and conspiracy theories about GitHub.
I'm an anti-monopolist and want there to be a multitude of ways we build open source software, but I believe security features are different: mostly because they are either enabled by default or largely ignored.
GitHub is important to support because it's where 84% (372,841 / 440,821) of Python packages on PyPI are built.

2024-11-11 15:44:21 GMT

- reply

Yes! I need to link to your post somewhere, really great advice.

2024-11-11 14:50:31 GMT

Today is my 5-year blog-iversary! 😊 Writing had a positive impact on my life, I would love to see more people writing and sharing on the internet. I wrote a few pieces of advice for new prospective writers:
https://sethmlarson.dev/writing-for-the-internet

2024-11-08 17:11:26 GMT

Please enjoy this picture of an e-Reader looking monolithic while getting it's ROM backed up using an #Epilogue GB Operator.
https://cdn.fosstodon.org/media_attachments/files/113/448/421/492/846/775/original/b818114b382fddb3.png

2024-11-05 17:58:42 GMT

- reply

What an awful default. A star is not a follow, isn't that the whole point of "following" a repo?

2024-11-05 17:55:18 GMT

Did @npub1545…mva5 just destroy the homepage feed by making it uncontrollably AI-recommended (and therefore, completely full of things I don't care about)? Looks like yes.

2024-11-03 21:54:30 GMT

- reply

Oh no worries! I basically want Omnivore back again, it fit the way I wanted to consume the web so cleanly 😢

2024-11-03 21:48:07 GMT

- reply

Is that a read-it-later service? I didn't immediately see support for pulling in feeds and newsletter articles?

2024-11-03 21:39:34 GMT

I wasn't happy with Feedbin's "read it later" functionality, so I am now trying out Inoreader's trial. So far so good, the functionality appears to match what I need (feeds, newsletters, read-it-later, tags, and an API) but their API quotas are really aggressive especially for a paid service. Only was able to import 120 of my 160+ feeds for now...
After Omnivore was so suddenly gone I'm feeling the need to encode my work into a format like OPML too instead of only in a service.

2024-11-01 13:37:14 GMT

- reply

👏 👏 👏 Wish I could like this multiple times.
I never liked this metaphor, I think software graduating to this level of maturity should be celebrated! The challenges are there might not be any "easy" tasks to cut your teeth on or "shiny" development work to attract new contributors. In that way I can see software "dying" due to lack of maintainers.
We need to change our view of meaningful maintenance / stewardship of mature code to be more positive.

2024-10-29 18:53:19 GMT

#Python is #1 on GitHub. #GitHubUniverse
https://cdn.fosstodon.org/media_attachments/files/113/392/220/970/207/419/original/18de8d17b17308d4.jpeg

2024-10-24 13:43:13 GMT

- reply

If it's happening enough to justify you might make the logo a QR code (with the real logo embedded, of course). Perhaps you could switch the logo to the QR version only on desktop (based on screen size) since presumably if you're already on mobile you're unlikely to be able to scan the QR code on your own.

2024-10-24 13:34:24 GMT

- reply

This setup is incredible, nice work! I've started sharing my slides and references right at the beginning of the presentation via QR code and folks seem to really enjoy the experience.

2024-09-28 01:19:02 GMT

- reply

What an awesome idea, I would love to see this done for PyCons too (there are just so any it's hard to keep track of them all when they upload VODs!)

2024-09-12 02:40:02 GMT

This is the kind of EV tech I'm rooting for: https://restofworld.org/2024/electric-vehicle-conversions-uruguay/

2024-09-10 17:57:49 GMT

Another shining example of #opensource ecosystems collaborating through open standards and implementations! 🥳
Rust has an RFC for Trusted Publishers based on PyPI's implementation and the implementers guide @npub17jk…g7cv and I coauthored for the OpenSSF Securing Software Repos WG:
https://github.com/rust-lang/rfcs/pull/3691

2024-09-07 02:39:37 GMT

- reply

I haven't adopted uv anywhere for similar reasons. 100% agreed on money being the magic, it turns out you can do a whole lot with 8 hours a day.

2024-08-29 13:59:51 GMT

Per the latest #Python Developers Survey:
37% of respondents said they'd contributed to an open source project in the past year! 🤯
This is an incredible result for #Python, open source relies on folks contributing back so I am feeling hopeful for our ecosystem 😊
https://fosstodon.org/@ThePSF/113045617381785895

2024-08-12 15:57:30 GMT

Last week the White House published its summary of the Request for Information on OSS security, and there's a lot to be excited about! 🤩
https://www.whitehouse.gov/oncd/briefing-room/2024/08/09/fact-sheet-biden-harris-administration-releases-end-of-year-report-on-open-source-software-security-initiative-2/

2024-08-07 03:30:50 GMT

- reply

man, I need a micro blog... 😅

2024-08-05 13:52:03 GMT

I authored a new guide about implementing Trusted Publishers! ✨
This guide was written with help from many folks at the OpenSSF Securing Software Repos WG (thank you!) If you maintain a software package repo or are interested in how Trusted Publishers works, give it a read 😊
https://openssf.org/blog/2024/08/05/new-guide-for-package-repositories-to-adopt-trusted-publishers/?utm_content=302874134&utm_medium=social&utm_source=twitter&hss_channel=tw-1290363651162021888

2024-06-03 19:21:56 GMT

- reply

I like it, but probably won't be getting one. The most interesting feature IMO is the USB-C video out, wish that Analogue had something similar!