#377 A Dramatic Episode

Topics covered in this episode:

• justpath
• xz back door
• LPython
• dramatic
• Extras
• Joke

Watch on YouTube

About the show

Sponsored by ScoutAPM: pythonbytes.fm/scout

Connect with the hosts

• Michael: @mkennedy@fosstodon.org
• Brian: @brianokken@fosstodon.org
• Show: @pythonbytes@fosstodon.org

Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesdays at 11am PT. Older video versions available there too.

Finally, if you want an artisanal, hand-crafted digest of every week of

the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.

Michael #1: justpath

• Inspect and refine PATH environment variable on both Windows and Linux.
• Raw, count, duplicates, invalids, corrections, excellent stuff.
• Check out the video

Brian #2: xz back door

• In case you kinda heard about this, but not really.
• Very short version:
  • A Microsoft engineer noticed a performance problem with ssh and tracked it to a particular version update of xz.
  • Further investigations found a multi-year installation of a fairly complex back door into the xz by a new-ish contributor. But still contributing over several years. First commit in early 2022.
  • The problem is caught. But if it had succeeded, it would have been bad.
  • Part of the issue of how this happened is due to having one primary maintainer on a very widely used tool included in tons-o-Linux distributions.
• Some useful articles
  • Everything I Know About the XZ Backdoor - Evan Boehs - recommended read
• Don’t think your affected? Think again if you use homebrew, for example:
  • Update and upgrade Homebrew and xz versions
• Notes
  • Open source maintenance burnout is real
  • Lots of open source projects are maintained by unpaid individuals for long periods of time.
  • Multi-year sneakiness and social bullying is pretty hard to defend against.
  • Handing off projects to another primary maintainer has to be doable.
    • But now I think we need better tools to vet contributors.
    • Maybe? Or would that just suppress contributions?
• One option to help with burnout:
  • JGMM, Just Give Maintainers Money: Software Needs To Be More Expensive - Glyph

Michael #3: LPython

• LPython aggressively optimizes type-annotated Python code. It has several backends, including LLVM, C, C++, and WASM.
• LPython’s primary tenet is speed.
• Play with the wasm version here: dev.lpython.org
• Still in alpha, so keep that in mind.

Brian #4: dramatic

• Trey Hunner
• More drama in the software world. This time in the Python.
• Actually, this is just a fun utility to make your Python output more dramatic.
• More fun output with terminaltexteffects
  • suggested by Allan

Extras

Brian:

• Textual how has a new inline feature in the new release.

Michael:

• My keynote talk is out: The State of Python in 2024
• Have you browsed your github feed lately?
• 3.10, 3.9, 3.8 security updates

Joke: Definition of terms