Mike Fiedler
@miketheman.com
Code Gardener. Wrangler of the Unusual. Roller Derby referee. AWS Hero. PyPI Maintainer. Shakshuka lover. he/him
https://miketheman.dev
https://miketheman.dev
Getting in the right mindset for my 13th #AWS #reInvent conference in Las Vegas.
It's much longer than the early 3-day conference style, with a new idea this year - a hackathon on a bus all day Sunday
Watch and cheer for our team Royal Blue! 👑💙
builder.aws.com/content/3515...
It's much longer than the early 3-day conference style, with a new idea this year - a hackathon on a bus all day Sunday
Watch and cheer for our team Royal Blue! 👑💙
builder.aws.com/content/3515...
November 27, 2025 at 2:08 PM
Getting in the right mindset for my 13th #AWS #reInvent conference in Las Vegas.
It's much longer than the early 3-day conference style, with a new idea this year - a hackathon on a bus all day Sunday
Watch and cheer for our team Royal Blue! 👑💙
builder.aws.com/content/3515...
It's much longer than the early 3-day conference style, with a new idea this year - a hackathon on a bus all day Sunday
Watch and cheer for our team Royal Blue! 👑💙
builder.aws.com/content/3515...
There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects.
TL,DR: Adopt Trusted Publishing 🔐🚀📦
blog.pypi.org/posts/2025-1...
TL,DR: Adopt Trusted Publishing 🔐🚀📦
blog.pypi.org/posts/2025-1...
PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats - The Python Package Index Blog
Shai-Hulud is a great worm, not yet a snake. Attack on npm ecosystem may have implications for PyPI.
blog.pypi.org
November 26, 2025 at 9:02 PM
There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects.
TL,DR: Adopt Trusted Publishing 🔐🚀📦
blog.pypi.org/posts/2025-1...
TL,DR: Adopt Trusted Publishing 🔐🚀📦
blog.pypi.org/posts/2025-1...
Reposted by Mike Fiedler
Hey all, I'm seeking a new job. 👋
If you have any leads or connections 👉 that would be much appreciated.
More details of what I'm looking for in the attached screenshot with alt text as that would be too long for a post.
If you have any leads or connections 👉 that would be much appreciated.
More details of what I'm looking for in the attached screenshot with alt text as that would be too long for a post.
November 24, 2025 at 3:21 PM
Hey all, I'm seeking a new job. 👋
If you have any leads or connections 👉 that would be much appreciated.
More details of what I'm looking for in the attached screenshot with alt text as that would be too long for a post.
If you have any leads or connections 👉 that would be much appreciated.
More details of what I'm looking for in the attached screenshot with alt text as that would be too long for a post.
Reposted by Mike Fiedler
🚨 New for #PyConUS 2026! 🚀
We’re adding 2 dedicated Talk tracks:
🔒 Trailblazing Python Security – making Python & PyPI safer
🤖 The Future of AI with Python – AI tools, ethics, & learning
Submit your talk before December 19! pycon.blogspot.com/2025/11/trai...
We’re adding 2 dedicated Talk tracks:
🔒 Trailblazing Python Security – making Python & PyPI safer
🤖 The Future of AI with Python – AI tools, ethics, & learning
Submit your talk before December 19! pycon.blogspot.com/2025/11/trai...
Join us in “Trailblazing Python Security” at PyCon US 2026
PyCon US 2026 is coming to Long Beach, California ! PyCon US is the premiere conference for the Python programming language in North Americ...
pycon.blogspot.com
November 18, 2025 at 4:21 PM
🚨 New for #PyConUS 2026! 🚀
We’re adding 2 dedicated Talk tracks:
🔒 Trailblazing Python Security – making Python & PyPI safer
🤖 The Future of AI with Python – AI tools, ethics, & learning
Submit your talk before December 19! pycon.blogspot.com/2025/11/trai...
We’re adding 2 dedicated Talk tracks:
🔒 Trailblazing Python Security – making Python & PyPI safer
🤖 The Future of AI with Python – AI tools, ethics, & learning
Submit your talk before December 19! pycon.blogspot.com/2025/11/trai...
Vacation was amazing, heading home now. Hope I don't freeze!
November 23, 2025 at 7:37 PM
Vacation was amazing, heading home now. Hope I don't freeze!
Reposted by Mike Fiedler
Since 2015, the PSF Grants Program has awarded over $3M to support Pythonistas worldwide. The program’s on pause, but you can keep that impact alive and help bring us closer towards reopening 💛💙
Read grantee stories and donate today: donate.python.org
#Python #PythonForEveryone
Read grantee stories and donate today: donate.python.org
#Python #PythonForEveryone
November 13, 2025 at 12:10 PM
Since 2015, the PSF Grants Program has awarded over $3M to support Pythonistas worldwide. The program’s on pause, but you can keep that impact alive and help bring us closer towards reopening 💛💙
Read grantee stories and donate today: donate.python.org
#Python #PythonForEveryone
Read grantee stories and donate today: donate.python.org
#Python #PythonForEveryone
New @pypi.org blog
TL, DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab.com Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!
#Python #SupplyChain #Security
Read it here: blog.pypi.org/posts/2025-1...
TL, DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab.com Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!
#Python #SupplyChain #Security
Read it here: blog.pypi.org/posts/2025-1...
Trusted Publishing is popular, now for GitLab Self-Managed and Organizations - The Python Package Index Blog
Expansion of Trusted Publishers feature for more impact
blog.pypi.org
November 10, 2025 at 8:08 PM
New @pypi.org blog
TL, DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab.com Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!
#Python #SupplyChain #Security
Read it here: blog.pypi.org/posts/2025-1...
TL, DR:
- Trusted Publishing used for 25% of all files uploaded in Oct 2025
- @gitlab.com Self-Managed now in beta
- Pending Publishers can be added for Organizations, too!
#Python #SupplyChain #Security
Read it here: blog.pypi.org/posts/2025-1...
Reposted by Mike Fiedler
As the PSF heads into our end-of-year fundraiser this month, we want to “connect the dots” and share a full picture of our current financial outlook: what’s happening, why, and how you can help sustain the future of Python and the PSF. 🧵
Connecting the Dots: Understanding the PSF’s Current Financial Outlook
As the PSF heads into our end-of-year fundraiser, we want to share information to help “connect the dots” and show a more complete picture of the PSF’s current financial outlook. You’ve heard from us on subjects related to our financial position from several different angles recently (a list of those posts is below). We’ve prioritized proactive communications, because we believe in transparency, we have trust in our community, and we value keeping you informed— we know how invested in and impacted by our work you are. We now want to pull those threads together in order to create some shared clarity on the big picture, and, hopefully, inspire you to action to support our fundraising efforts.
pyfound.blogspot.com
November 4, 2025 at 12:12 PM
As the PSF heads into our end-of-year fundraiser this month, we want to “connect the dots” and share a full picture of our current financial outlook: what’s happening, why, and how you can help sustain the future of Python and the PSF. 🧵
Reposted by Mike Fiedler
Archive formats like ZIP and tar can be abused to undermine the integrity of Python package users 📦 Learn how PSF Developer-in-Residence Seth Larson is strengthening Python's security with the #Python community in the new white paper "Slippery ZIPs and Sticky tar-pits" with Alpha-Omega:
Improving security and integrity of Python package archives
Security and integrity of the Python packaging ecosystem is critical, and the smallest unit of a packaging ecosystem is a "package". Python packages use existing archive formats like ZIP and tar to distribute Python projects to their users. Archives seem simple on the surface, but many ZIP and tar features can be abused to confuse implementations into seeing different contents of the same archive.
pyfound.blogspot.com
October 30, 2025 at 3:12 PM
Archive formats like ZIP and tar can be abused to undermine the integrity of Python package users 📦 Learn how PSF Developer-in-Residence Seth Larson is strengthening Python's security with the #Python community in the new white paper "Slippery ZIPs and Sticky tar-pits" with Alpha-Omega:
Software is hard.
Context: SFO to EWR (I hope!!!)
Context: SFO to EWR (I hope!!!)
October 30, 2025 at 5:26 PM
Software is hard.
Context: SFO to EWR (I hope!!!)
Context: SFO to EWR (I hope!!!)
This is a great read on how much (or little!) goes into making PyPI a resource most folks don't have to think heavily about, like many utilities or public works.
What have you done this year to #OpenSource sustainable?
What have you done this year to #OpenSource sustainable?
PyPI serves billions of requests daily- but sustaining it isn’t free. The PSF joined the OpenSSF & others in calling for organizations to invest in sustainable open infrastructure. Learn what this means for #PyPI, the PSF, & how our community can pitch in:
Open Infrastructure is Not Free: PyPI, the Python Software Foundation, and Sustainability
In September, the Python Software Foundation (PSF) co-signed the Open Infrastructure is Not Free: A Joint Statement on Sustainable Stewardship Letter published by the Open Source Security Foundation (OpenSSF) as a steward of the Python Package Index (PyPI). As a follow up, I would like to share a bit more about the concerns expressed in this letter as they relate to our community and the PSF.
pyfound.blogspot.com
October 29, 2025 at 2:23 PM
This is a great read on how much (or little!) goes into making PyPI a resource most folks don't have to think heavily about, like many utilities or public works.
What have you done this year to #OpenSource sustainable?
What have you done this year to #OpenSource sustainable?
Reposted by Mike Fiedler
Hearts at the PSF are full today from the responses about the recent grant turn down news we shared. All of your kind words of support & solidarity, as well as your donations & new memberships, mean the world to us. We're so grateful to be in community with each of you 💛🐍💙
TLDR; The PSF has made the decision to put our community and our shared diversity, equity, and inclusion values ahead of seeking $1.5M in new revenue. Please read and share. pyfound.blogspot.com/2025/10/NSF-...
🧵
🧵
The official home of the Python Programming Language
www.python.org
October 28, 2025 at 7:04 PM
Hearts at the PSF are full today from the responses about the recent grant turn down news we shared. All of your kind words of support & solidarity, as well as your donations & new memberships, mean the world to us. We're so grateful to be in community with each of you 💛🐍💙
On my way to #GitHubUniverse - anyone I know going to be there as well?
October 26, 2025 at 12:33 PM
On my way to #GitHubUniverse - anyone I know going to be there as well?
Dunno who or how, but the feature in @brew.sh CLI to display a spinner during downloads instead of a wide progress bar is a nice little improvement.
It might have been there for a while, I only noticed it today.
Thanks for doing what you do in #OpenSource!
It might have been there for a while, I only noticed it today.
Thanks for doing what you do in #OpenSource!
October 24, 2025 at 2:08 PM
Dunno who or how, but the feature in @brew.sh CLI to display a spinner during downloads instead of a wide progress bar is a nice little improvement.
It might have been there for a while, I only noticed it today.
Thanks for doing what you do in #OpenSource!
It might have been there for a while, I only noticed it today.
Thanks for doing what you do in #OpenSource!
Reposted by Mike Fiedler
Check out this post by @diegor.it about the latest CPython sprint! We send a special thanks to Arm for hosting the event and investing in the future of #Python 💛🐍💙 pyfound.blogspot.com/2025/10/cpyt...
CPython Core Dev Sprint 2025 at Arm Cambridge: The biggest one yet
pyfound.blogspot.com
October 20, 2025 at 4:46 PM
Check out this post by @diegor.it about the latest CPython sprint! We send a special thanks to Arm for hosting the event and investing in the future of #Python 💛🐍💙 pyfound.blogspot.com/2025/10/cpyt...
Does your org run a self-managed version of @gitlab.com and publish your own #Python packages to @pypi.org ?
If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.
If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.
October 14, 2025 at 2:14 PM
Does your org run a self-managed version of @gitlab.com and publish your own #Python packages to @pypi.org ?
If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.
If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.
Maybe the friction involved in starting a fresh project helped forestall creating net new things all the time and inspired us to look for existing solutions, and potentially extend/contribute to them.
With the ability to quickly imagine your idea into reality, are we in a new era of software slop?
With the ability to quickly imagine your idea into reality, are we in a new era of software slop?
October 12, 2025 at 9:24 PM
Maybe the friction involved in starting a fresh project helped forestall creating net new things all the time and inspired us to look for existing solutions, and potentially extend/contribute to them.
With the ability to quickly imagine your idea into reality, are we in a new era of software slop?
With the ability to quickly imagine your idea into reality, are we in a new era of software slop?
Clear, and to the point. Great way to think about your career, from @danielleheberling.xyz
danielleheberling.xyz/blog/time-to...
danielleheberling.xyz/blog/time-to...
Should I Stay or Should I Go? | Danielle's Blog
A framework for deciding when it's time to leave your current company, based on evaluating what you're building, who you're working with, and the technology you use.
danielleheberling.xyz
October 8, 2025 at 1:31 PM
Clear, and to the point. Great way to think about your career, from @danielleheberling.xyz
danielleheberling.xyz/blog/time-to...
danielleheberling.xyz/blog/time-to...
Reposted by Mike Fiedler
Just released! 🚀
Please install and enjoy Python 3.14! 🥧
discuss.python.org/t/python-3-1...
#Python #Python314 #release
Please install and enjoy Python 3.14! 🥧
discuss.python.org/t/python-3-1...
#Python #Python314 #release
October 7, 2025 at 2:29 PM
Just released! 🚀
Please install and enjoy Python 3.14! 🥧
discuss.python.org/t/python-3-1...
#Python #Python314 #release
Please install and enjoy Python 3.14! 🥧
discuss.python.org/t/python-3-1...
#Python #Python314 #release
I just backed Container on @kickstarter.com www.kickstarter.com/projects/boa...
Container, GRUNTZ, and Triangulation
Out of print for far too long—the legendary Container returns! + Discover GRUNTZ's sharp duels and Triangulation's witty word-guessing.
www.kickstarter.com
October 7, 2025 at 2:25 PM
I just backed Container on @kickstarter.com www.kickstarter.com/projects/boa...
The final two games for @gothamderby.bsky.social home season happened last night in Brooklyn. They were both really good games, and the championship game was a close, hard-fought nail-biter with some truly awesome displays of athleticism.
Support your local #rollerderby league!
Support your local #rollerderby league!
October 5, 2025 at 1:57 PM
The final two games for @gothamderby.bsky.social home season happened last night in Brooklyn. They were both really good games, and the championship game was a close, hard-fought nail-biter with some truly awesome displays of athleticism.
Support your local #rollerderby league!
Support your local #rollerderby league!
Attackers continue to find creative ways to expose credentials, often the first step in a larger scale supply chain attack.
A campaign targeted GitHub Actions to steal PyPI tokens—PyPI wasn’t compromised and no PyPI packages were published by the attackers. Stay safe: review your tokens, rotate any exposed ones, and use short-lived, scoped GitHub Actions tokens. Details:
Token Exfiltration Campaign via GitHub Actions Workflows - The Python Package Index Blog
Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.
blog.pypi.org
September 26, 2025 at 12:53 PM
Attackers continue to find creative ways to expose credentials, often the first step in a larger scale supply chain attack.
Reposted by Mike Fiedler
The PSF joined the @openssf.org & others in signing “Open Infrastructure is Not Free.” Funding gaps in the open source industry mean critical infrastructure lacks support. Corporations benefiting from it must invest to sustain it.
Read more ➡️
Read more ➡️
September 23, 2025 at 2:57 PM
The PSF joined the @openssf.org & others in signing “Open Infrastructure is Not Free.” Funding gaps in the open source industry mean critical infrastructure lacks support. Corporations benefiting from it must invest to sustain it.
Read more ➡️
Read more ➡️
Cool to see @abc7ny.bsky.social do a short piece on password security, promoting second factor authentication. Progress!!
September 22, 2025 at 11:32 PM
Cool to see @abc7ny.bsky.social do a short piece on password security, promoting second factor authentication. Progress!!
Oh, Claude.
> Thanks for pushing back - you saved me from recommending a square peg for a round hole.
> Thanks for pushing back - you saved me from recommending a square peg for a round hole.
September 18, 2025 at 11:19 PM
Oh, Claude.
> Thanks for pushing back - you saved me from recommending a square peg for a round hole.
> Thanks for pushing back - you saved me from recommending a square peg for a round hole.