Podcasts about software developers

In 2020, a gastroenterologist in Glasgow did the math on his new research study and came up with 30,000 samples, arriving over two years from three cities and a dozen hospitals. He asked around about how researchers keep track of that. The answer was Microsoft Excel. Shaun Chuah had written some HTML by hand in Notepad back in high school and that was about the whole of his programming experience, so he opened the Django tutorial and started reading. Six years later that app is Foundry120, holding 10 terabytes of clinical and genomics data with an agentic AI running on top of it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Talk Python Courses Links from the show Guest Shaun Chuah: github.com Up and Running with Rust Course: talkpython.fm Foundry120: www.foundry120.com Designing Data Intensive Applications: www.oreilly.com Microsoft Foundry: ai.azure.com ChatIBD: www.chatibd.com Blog: shaunchuah.github.io @drshaunchuah: x.com github.com/shaunchuah: github.com Watch this episode on YouTube: youtube.com Episode #560 deep-dive: talkpython.fm/560 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Web UIs for your reverse proxy Wagtail 8.0 is hot off the presses RISC-V is now officially supported by CPython Django's annual releases make every version an LTS Extras Joke Watch on YouTube About the show Sponsored by Logfire from Pydantic: pythonbytes.fm/logfire Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Web UIs for your reverse proxy Traefik, nginx, and Caddy all sit in front of a lot of self-hosted infrastructure, and all three are configured by hand-editing files. Three active projects put a control plane on top: Traefik Manager (Python + Flask), Nginx UI (Go + Vue), and caddy/ui (React + Node). All three are additive rather than replacements - none of them take ownership of your config away from you - which is the part that matters when the thing has write access to production routing. Traefik Manager is the Python one: Flask 3.1 and Gunicorn for the control plane, a lightweight Go agent for remote instances, currently v1.10.0 with an Android companion app. Nginx UI is a single Go binary at 11.3k stars, with a block-style config editor, an Ace editor doing LLM completion on nginx syntax, and an MCP server so agents can drive it. caddy/ui runs as two containers next to your existing Caddy, reads and writes your Caddyfile directly, and uses Caddy's /adapt API to validate before reload - no Docker socket required. Each one edits the config the underlying server already reads, so your files stay the source of truth and you can drop the UI without unwinding anything. Undo is a first-class feature across all three - timestamped backups with optional Git history, config version compare and restore, Caddyfile snapshots with one-click rollback. Observability is where they diverge: Traefik Manager does CrowdSec and a visual route map, Nginx UI does server metrics, caddy/ui streams access logs over SSE and pulls p50/p95/p99 off Caddy's Prometheus endpoint. Maturity spread is wide - Nginx UI has 11.3k stars, caddy/ui has 4 and was built in a single Claude session - and caddy/ui ships with auth off by default, so set CADDY_UI_USER and JWT_SECRET before it goes anywhere near a public interface. Calvin #2: Wagtail 8.0 is hot off the presses Link: https://github.com/wagtail/wagtail/releases/tag/v8.0 Custom base page models are now supported, so projects aren't locked into subclassing Wagtail's Page as shipped (Matt Westcott). New v3 REST API handles both read and write CMS operations, a first for Wagtail's API. A global registry for permission policies, plus full customizability for the remaining page views via PageViewSet. AVIF and WebP images are no longer auto-converted to PNG by default, a real behavior change to watch on upgrade. Five security fixes: page admin API restrictions, document identification by SHA1 hash, descendant collections in the Documents/Images API, snippet copy permissions, and the page translation endpoint. Formalized Django 6.1 support, and CI now runs on uv with a lockfile. Sponsor: Logfire from Pydantic Your AI agent failed at 2am. Was it the model? A tool call? The database? Most observability tools can't tell you, because they only see part of your stack. Pydantic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database. Down to the infrastructure: services, Kubernetes, and hosts. It's built on OpenTelemetry, with SDKs for Python, TypeScript, and Rust, and it works with any OTel-compatible language. Every prompt, token count, and cost, right next to your vector searches and API calls. You query everything with Postgres-compatible SQL. And so can your coding agent, through the Logfire MCP server. Stop guessing. Read the trace. Pydantic Logfire. AI, it's still just engineering. Visit pythonbytes.fm/logfire today and sign up today. Get 10M records free every month, no card required. You can even click “Onboard with your coding agent” to copy a prompt to have claude or codex integrate Logfire into your app. Thanks to Pydantic for supporting the show. Calvin #3: RISC-V is now officially supported by CPython Link: https://blog.python.org/2026/08/riscv-now-officially-supported/ CPython added RISC-V as a tier 3 platform under PEP 11, specifically the 64-bit Linux target riscv64-unknown-linux-gnu. RISC-V is an open ISA anyone can implement, unlike x86 and ARM, and its market is projected to quadruple by 2032. The RISE Project donated real RISC-V machines for buildbots; the author's work was funded by a Sovereign Tech Agency fellowship. What changes: the port is now a maintained compatibility target, so CPython changes are less likely to quietly break it. What doesn't: no python.org installers, no binary wheel parity for native extensions. Next up: RISC-V runners in CPython CI for pre-merge feedback, then a push toward tier 2, plus architecture-specific optimizations. The ask is testing. If you have RISC-V hardware, build CPython, run your test suite, file what breaks. Tier 3 is the weakest support tier. PEP 11 tier 3 requires a core developer contact and a buildbot, but failures on tier 3 platforms explicitly do not block a release. Saying "ongoing CI/testing expectations" oversells it. The honest bit is "someone is now on the hook for it, and breakage gets noticed," not "it's guaranteed working." Worth the caveat that this is Linux SBCs, not microcontrollers. A VisionFive 2 counts, an ESP32-C6 or Pico 2 does not. Those are 32-bit non-Linux parts where MicroPython is still the answer. Michael #4: Django's annual releases make every version an LTS Starting with Django 2028, Django will move to one January feature release per year, adopt calendar-based version numbers, and support every release for three years. The old distinction between standard and LTS releases disappears, giving teams a predictable annual upgrade path that aligns more closely with Python's own release and support cadence. Every Django release becomes the safe, long-supported choice, so teams no longer need to wait for a specially designated LTS version or absorb two years of changes at once. Each release gets one year of mainstream bug fixes followed by two years of security and data-loss fixes. New releases support the three latest Python versions and add the next Python release during their first year. Calendar versioning begins with Django 2028, followed by Django 2029 and so on. Three Django versions will be supported at any time, giving third-party packages a clearer rolling target. Nothing changes before 2028, and existing commitments for Django 5.2 LTS and 6.2 LTS remain in place. Extras Calvin: The Python docs now document the time complexity of built-in types https://docs.python.org/3.16/library/time-complexity.html Thinking in Python - Bruce Eckel's free book https://thinkinginpython.com/ Michael: prune_uv_pythons.py - Prune uv-managed Python installs, keeping only the newest patch per minor version Runs automatically in my system “upgrade” script: upgrade-output-2026.png Started using Ollama cloud models for my Hermes assistant. Thanks to Jeff Triplett I learned they are not just local models. Joke: The Tao of Programming - Book Seven: Corporate Wisdom

Dipesh Rawat is a Software Developer at IBM, CNCF Ambassador, CNCF Kubestronaut and SIG Docs Tech Lead. A contributor across multiple Kubernetes release cycles, he serves as the Release Lead for Kubernetes v1.37.   Do you have something cool to share? Some questions? Let us know: - web: kubernetespodcast.com - mail: kubernetespodcast@google.com - twitter: @kubernetespod - bluesky: @kubernetespodcast.com   News of the week CNCF Announces Kubeflow's Graduation, Solidifying a Standard for Cloud Native AI Operations CNCF Announces Graduation of Cloud Native Buildpacks, Advancing the Standard for Container Builds Gateway API v1.6: TCPRoute and UDPRoute Graduate to Standard KubeCon EU CFP Links from the interview Kubernetes v1.37: Garhwal Kubernetes 1.37 Sneak Peak Blog

Your site is down. It's 3am. Is it a bug, a bill, or a breach? You can't tell yet, and everyone is watching you find out. Matt Lea has spent fifteen years being the person companies call when an outage is costing them real money per hour, and his whole argument is that everything you'd want in that moment gets decided months earlier, on ordinary afternoons, when someone chose the convenient thing. We walk his top twelve dos and don'ts in AWS - infrastructure as code, IAM roles instead of access keys, private subnets, no wildcards, no public buckets - and I push on which of them actually matter if you're one person on a small VPS. Then we get to Cloud War Games, where Matt breaks things on purpose so your team's first real incident isn't their first incident. Let's get into it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Talk Python Courses Links from the show Guest Matt Lea: linkedin.com Talk Python Certificates: training.talkpython.fm/certificates Schematical: schematical.com CloudWarGames.com: cloudwargames.com Zero to Hero on AWS Security: www.oreilly.com Repo: github.com Custom Wheel Offset: customwheeloffset.com 2012 TechCrunch Disrupt Hackathon: techcrunch.com tech comics: schematical.com shhgit: github.com Zero Trust in 200ms: Implementing Identity-Per-Transaction: us.pycon.org Coolify: coolify.io returned to full GA Nov 2025: aws.amazon.com Signed URLs/cookies: docs.aws.amazon.com Cloudflare: www.cloudflare.com Bunny Shield: bunny.net Cloud War Games One: www.youtube.com Cloud War Games Two: www.youtube.com LinkedIn: linkedin.com YouTube: youtube.com KnocKnoc: knocknoc.io Watch this episode on YouTube: youtube.com Episode #559 deep-dive: talkpython.fm/559 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Python 3.12.14, 3.11.16, 3.10.21 - security releases Codeberg's AI-code ban tests its role as a GitHub alternative Brett Cannon: what's missing for reproducible builds on PyPI nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. Extra extra extra, hear all about it Extras Joke Watch on YouTube Sponsored by Logfire from Pydantic pythonbytes.fm/logfire This episode is brought to you by Pydantic Logfire. It's observability for AI apps from the team behind Pydantic - agents, LLMs, APIs, database, and infrastructure in a single trace, queried with Postgres-compatible SQL. Your coding agent can query it too, through their MCP server. I'll tell you more later. Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Python 3.12.14, 3.11.16, 3.10.21 - security releases https://blog.python.org/2026/08/python-31214-31116-31021/ Source-only security releases for the three branches now in security-fix-only mode; release team blamed the European solar eclipse for the timing. tarfile hardening. Multiple path-traversal bypasses of the data filter closed, including a symlink escape that bypassed the CVE-2025-4330 fix; extract() now applies the filter to link targets too. Four fresh CVEs: CVE-2026-2297 (SourcelessFileLoader not using io.open_code() for .pyc), CVE-2026-4224 (expat crash on deeply nested content models), CVE-2026-3644 (control chars in http.cookies.Morsel), plus the completed CVE-2021-4189 fix in ftplib.ftpcp. Quadratic-complexity DoS cleanup across the stdlib: HTMLParser, configparser regexes, unicodedata.normalize(), csv.Sniffer.sniff(), and ElementTree XPath index predicates. Header/injection fixes: CR/LF rejected in HTTPConnection.set_tunnel(), control chars blocked in wsgiref.handlers status, and webbrowser now rejects leading dashes (plus a %action prefix bypass). http.client now caps chunked trailer lines and 1xx interim responses at 100 each - a hostile server could previously hang the client forever despite a socket timeout. Memory-safety odds and ends: stale pointers in lzma/bz2/zlib decompressors after MemoryError, a bz2 stack overflow on reuse-after-error, and bundled libexpat bumped to 2.8.3. If you're still on 3.10, 3.11, or 3.12 - and you extract tarballs from anywhere you don't fully control - this one's not optional. Michael #2: Codeberg's AI-code ban tests its role as a GitHub alternative Armin's article “Codeberg Divides” Armin Ronacher argues that Codeberg's new terms, which prohibit projects mostly written with generative AI, create a vague and difficult-to-enforce boundary. His larger concern is that a democratically governed host can still be unpredictable or ideologically narrow, weakening Codeberg's potential as a broad European alternative to GitHub. The strongest question for Python developers is whether repository hosting should judge legal open source by how code was produced, or focus on behavior and resource abuse. “Mostly generated” is hard to measure in modern codebases where developers mix handwritten code, completions, agents, and generated refactors. Ronacher suggests clearer alternatives: ban all LLM involvement, or target autonomous repository spam, abusive resource use, and low-quality generated contributions directly. Codeberg is free to choose a values-driven community, but that may conflict with being predictable, neutral infrastructure and a serious GitHub competitor. Worth discussing: can open-source communities set meaningful AI boundaries without driving maintainers and projects into opposing camps? Very first search for these terms lands on this page. Codeberg looked like a viable alternative. … Unfortunately, the latest update to its terms of service seems to mark a first step in changing one part I moved there for, namely the “freedom” part. Sponsor: Logfire from Pydantic Your AI agent failed at 2am. Was it the model? A tool call? The database? Most observability tools can't tell you, because they only see part of your stack. Pydantic Logfire sees all of it. One trace across your agents, LLMs, APIs, and database. Down to the infrastructure: services, Kubernetes, and hosts. It's built on OpenTelemetry, with SDKs for Python, TypeScript, and Rust, and it works with any OTel-compatible language. Every prompt, token count, and cost, right next to your vector searches and API calls. You query everything with Postgres-compatible SQL. And so can your coding agent, through the Logfire MCP server. Stop guessing. Read the trace. Pydantic Logfire. AI, it's still just engineering. Visit pythonbytes.fm/logfire today and sign up today. Get 10M records free every month, no card required. You can even click “Onboard with your coding agent” to copy a prompt to have claude or codex integrate Logfire into your app. Thanks to Pydantic for supporting the show. Calvin #3: Brett Cannon: what's missing for reproducible builds on PyPI Framing came out of his 2026 Python Packaging Council nomination - the secure-supply-chain gap he found is that Python has no defined way to do reproducible builds at all. Design goal is zero friction: producers uploading to PyPI shouldn't have to do anything. The work lands on build backends and installers. Gap #1: nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. Gap #2: recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. The replay mechanism already exists: [build-system] in pyproject.toml is a defined entry point, so if backends recorded their own environment, you could reinstall and re-run the build. Payoff idea: trusted third parties report successful reproductions back to PyPI, which displays "independently reproduced by X" - surfaced in the index API so installers could prefer reproduced files. Explicitly framed as a perk, not a requirement - roughly SLSA build level 1, no shaming projects that don't opt in. Verbal kicker option: "And don't think pure-Python wheels are off the hook. Something built that wheel, and if that something was compromised, so is your wheel. SolarWinds was a build-process attack." Michael #4: Extra extra extra, hear all about it Python 3.14.7 Upgraded the MCP servers to 2026-07-28 v2 protocols (talk python, python bytes) Got agentsview running synced via postgres Talk Python courses, teams trial offering Talk Python courses, government procurement offering Lean TDD audio book is out Extras Calvin: uv now prefers post-quantum key exchange - https://github.com/astral-sh/uv/releases/tag/0.12.4 Joke: Beware of dog

Topics covered in this episode: Claude Code /insights Post-quantum crypto lands in Python MCP goes stateless — and FastMCP gets renamed inshellisense - IDE style command line auto complete Extras Joke Watch on YouTube About the show Sponsored by Xweather Xweather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server so your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. Michael will tell you more about them later in the show. Get started for free at pythonbytes.fm/xweather Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Claude Code /insights Michael's Insights: michael-kennedy-claude-code-insights-2026-08-09.html Be careful sharing these outputs, they include details references to your projects, errors, security findings, etc. ;) /insights reads your last 30 days of local session transcripts and hands back an interactive HTML report on how you actually work. One command, zero setup: type /insights in a session, or run claude -p "/insights" from the shell for a non-interactive version that just prints the path Reads what's already on disk: pulls session logs from ~/.claude/projects/, skipping agent sub-sessions and anything under 2 messages or 1 minute Project areas: clusters your sessions into themes like "CLI Tooling" or "Documentation" with session counts Friction analysis: categorizes where things went wrong by root cause - and quotes your own prompts back at you Interaction style: tells you whether you're a delegator or a micromanager, plus which workflows are worth doubling down on Actually actionable: suggests concrete CLAUDE.md additions and Claude Code features you're not using The catch: Haiku does the per-session classification, so the first run takes several minutes; results cache to ~/.claude/usage-data/facets/ and the report lands at ~/.claude/usage-data/report.html Calvin #2: Post-quantum crypto lands in Python pyca/cryptography 48 ships ML-KEM (key establishment) and ML-DSA (signatures) — NIST's post-quantum standards, now one pip install away. Big deal because it's the 11th most-downloaded package on PyPI (~1.2B downloads/month) and sits under Ansible, Certbot, Airflow, and paramiko. No PQ there, no PQ anywhere in Python. Trail of Bits did the work (Rust bindings, cross-backend API, tests, AWS-LC backend support), funded by the Sovereign Tech Agency. Timing tracks a June 22 White House order setting federal deadlines: PQ key establishment by end of 2030, PQ signatures by end of 2031. Not a drop-in swap — the wire sizes explode. ML-DSA-65 signatures are 3,309 bytes vs Ed25519's 64; ML-KEM-768 public keys are 1,184 bytes vs X25519's 32. Hardcoded field sizes and length prefixes will bite. API looks like the existing asymmetric primitives, except ML-KEM is encapsulate/decapsulate rather than a Diffie-Hellman exchange. SLH-DSA (the hash-based conservative backstop) is still in progress. The primitives are here, but protocols haven't caught up — so you won't be running post-quantum Certbot this week. Sponsor: Xweather You're using agents that can write code, summarize documents, and automate workflows. But they're missing one thing: awareness of the world around them. This is where today's sponsor, Xweather comes in. Xweather combines enterprise-grade weather intelligence with agent-ready APIs, natural language capabilities, and an MCP server built for tools like Claude, Codex, Copilot, and modern IDEs – so your agents can adapt workflows, automate responses, and make better decisions based on real-world conditions. Backed by Vaisala, whose instruments fly on NASA missions to Mars, Xweather delivers trusted data and unique insights that go beyond conditions to actual impact – from real-time lightning strikes to road surface forecasts. Start with 15,000 free API calls each month and pay only for what you use as you grow. Xweather is your full weather stack, for developers by developers. Start building for free today at pythonbytes.fm/xweather. The link is in your podcast player's show notes and on the episode page. Thanks so much to Xweather for supporting Python Bytes. Calvin #3: MCP goes stateless — and FastMCP gets renamed From Philipp Acsany over at Real Python The 2026-07-28 spec landed July 28 and the Python SDK shipped 2.0.0 the same day. Biggest rewrite since MCP launched, and it's breaking on purpose. Context for scale: the Tier 1 SDKs are pulling close to half a billion downloads a month, with TypeScript and Python each past a billion total. The headline is the stateless core. The initialize/initialized handshake and the Mcp-Session-Id header are both retired — protocol version, client identity, and capabilities now ride in _meta on every request, with an optional server/discover RPC if a client wants capabilities up front. Any request can land on any instance behind plain round-robin, no shared storage. Server-initiated calls are the hard part of the migration. Sampling, elicitation, and roots/list no longer call back to the client; instead the server returns resultType: "input_required" and the client retries with inputResponses attached. Multi Round-Trip Requests, MRTR. Also: Mcp-Method and Mcp-Name are now required headers so gateways route on headers instead of cracking JSON bodies, and missing-resource errors move to standard 32602. Deprecation sweep with an actual policy behind it — Roots, Sampling, Logging, and the legacy HTTP+SSE transport all deprecated with a twelve-month minimum offramp. Tasks graduated out of the experimental core into a real extension, which is what the formalized extensions framework was for. MCP Apps is now an official extension too, so a tool call can return sandboxed interactive HTML. Auth picked up RFC 9207 issuer validation, issuer-bound credentials, and a shift from DCR toward CIMD. Python SDK 2.0 is where it gets personal: FastMCP is now MCPServer, no alias, no shim. McpError → MCPError. Wire types went snake_case (is_error, input_schema) and moved to a standalone mcp_types package, with mcp.types kept as a permanent alias. One Client object replaces the old transport + ClientSession + initialize() stack. httpx became httpx2. Sync handlers run on worker threads now, so asyncio.get_running_loop() raises inside them. The good news: one MCPServer serves both protocol eras, so 2025-era clients keep working with nothing to configure, and a Resolve(fn) parameter lets one tool body cover MRTR and the old path. 1.x is maintenance-and-security-fixes only — pin mcp>=1.28,

Thought leadership expert Bill Sherman joined me on Ditching Hourly to discuss how experts can scale their ideas to create impactful thought leadership. Bill shares insights from his extensive experience in helping individuals and organizations codify and amplify their ideas.In this episode, we delve into the nuances of thought leadership, from defining it to exploring business models and the importance of a focused target audience. Bill also discusses the impact equation and how to effectively communicate ideas to create lasting influence.00:00 - Introduction to Bill Sherman00:19 - Journey into Thought Leadership01:51 - Defining Thought Leadership05:41 - Emerging Thought Leaders08:44 - The Thought Leadership Handbook13:09 - Business Models of Thought Leadership16:49 - Target Audience Importance21:49 - Licensing and Certification25:09 - Alternatives to Writing a Book33:39 - Impact Equation43:47 - Final ThoughtsGuest bioBill Sherman is the COO of Thought Leadership Leverage and lead author of The Thought Leadership Handbook. For more than twenty years he's helped executives, authors, and experts take their ideas to scale — and he co-hosts the Leveraging Thought Leadership podcast, now past 700 episodes.Website » https://aha-moments.com/Book » https://thoughtleadershiphandbook.com/LinkedIn » https://www.linkedin.com/in/bill-sherman-aha-moments/Podcast » https://thoughtleadershipleverage.com/thought-leadership-podcasts/

As AI evolves from conversational chatbots to autonomous agents, CPUs are becoming an increasingly important part of the infrastructure equation. In this episode, The New Stack speaks with Bhumik Patel of Arm and Mo Farhat of Google about how CPUs act as an “air traffic controller” for agentic workloads, handling orchestration, data preparation, semantic search, vector databases, code execution and API calls alongside GPUs and TPUs. Smaller AI models, including summarizers and evaluators, can also run effectively on CPUs for specialized tasks.  As agents increasingly generate and execute code, secure sandboxing becomes critical. Google's gVisor and GKE Agent Sandbox provide isolation and scalable environments, with the latter supporting up to 300 sandboxes per second per cluster. The discussion also explores efficiency and cost, with Google highlighting Axion's price-performance and energy-efficiency advantages across different workload types. Ultimately, the shift toward agentic AI is creating a more diverse compute environment where CPUs, GPUs and TPUs each play complementary roles in delivering scalable, efficient AI applications. Learn more from The New Stack around the latest in CPUs in the world of AI agents:  AI Agents Will Eat Enterprise Software, Just Not in One Bite  How to ground AI agents in accurate, context-rich data  Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

Every company has one. The little internal tool that Jane built back in 2021, and then Jane left. Nobody understands it, nobody will touch it. There are two unwritten rules around it: don't change it, it's working. And if you break it, you bought it. That's dark-matter enterprise software. For every app you can actually see, there are ten of these sitting in the shadows, frozen. Michael Booth thinks that just changed. He read my article on hyper-personal software and ran with it, writing about hyper-team software: small teams inside big companies finally building the tools that were never going to get built. We cover where this works, where it quietly goes wrong, and the guardrails that keep it from turning into a mess. Let's get into it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Python in Production Talk Python Courses Links from the show Guest Michael Booth: github.com Talk Python AI Integrations: talkpython.fm/blog From Hyper-Personal to Hyper-Team Software: Small Team-Built, AI-Assisted Tools Inside the Enterprise: www.databooth.com.au What hyper-personal software looks like (MK's article): mkennedy.codes Databooth Site: www.databooth.com.au Wall Street just lost $285 billion because of 13 markdown files: martinalderson.com SaaSpocalypse is real but everyone is panicking about the wrong thing: www.reddit.com Warp Terminal: www.warp.dev Watch this episode on YouTube: youtube.com Episode #558 deep-dive: talkpython.fm/558 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Does moving faster with AI mean you get to skip the laws that governed every software project before it? Milan Milanovic argues the opposite, the old laws of software engineering now apply twice as hard.In this episode, Milan Milanovic, CTO and author of Laws of Software Engineering, returns to unpack why the laws that have quietly governed software projects for decades are more relevant than ever in the AI era. He walks through Gall's Law and why AI lets teams generate complex systems on unvalidated assumptions faster than ever, Conway's Law and how it now runs twice, shaping both human organizations and agent topologies, and Goodhart's Law and the trap of “tokenmaxxing” as a metric. Milan also covers Hofstadter's Law and the 90-90 rule, explaining why the last 10% of a project still takes as long with AI in the loop, and the Dunning-Kruger effect, where vibe coders overestimate their skills while senior engineers underestimate theirs. The conversation closes with his advice for juniors entering the field, his top five must-read books, and how he personally uses AI for research and planning rather than implementation.Key topics discussed:Gall's Law: the trap of generating complex systems with AIConway's Law now runs twice, on humans and on AI agent topologyWhy software architects should help design your org chartGoodhart's Law and the danger of “tokenmaxxing” as a metricThe 90-90 rule: why AI's last 10% still costs half the projectDunning-Kruger effect on vibe coders and expertsWhy less code beats more, even with AI writing it for freeTimestamps:(00:00) Trailer & Intro(03:02) What Inspired Milan to Write Laws of Software Engineering?(05:32) How Did a Book on Software Laws Reach Such a Global Audience?(06:49) How Should You Read the Laws of Software Engineering Book?(08:51) Why Does the Book Cover People and Planning, Not Just Technical Laws?(11:07) What Is Gall's Law in Software Engineering?(14:46) How Can You Apply Gall's Law When Using AI?(17:34) What Is Conway's Law in Software Engineering?(19:34) How Should Big Corporations Build New Products Without Structural Reorganization?(21:26) How Does Conway's Law Apply to Small AI-Powered Product Teams?(23:25) What Is Goodhart's Law in Software Engineering?(25:52) What Are the Best Examples of Counterbalance Metrics for Leaders Today?(28:06) What Kind of Outcomes Should You Actually Measure?(31:01) What Is Hofstadter's Law in Software Engineering?(33:35) How Does Hofstadter's Law Apply in the Age of AI?(36:41) What Is the Dunning-Kruger Effect?(40:10) How Does the Dunning-Kruger Effect Apply to Experienced Engineers Learning AI?(42:46) Are Any of These Laws Becoming Less Relevant Because of AI?(44:32) What Does the Lindy Effect Say About the Fate of Software Developers?(47:49) What Is the Best Career Advice for Junior Developers Entering the AI Landscape?(50:34) What Are the Top Five Must-Read Books for Software Engineers?(55:46) How Can Software Engineers Apply These Laws in Their Daily Work?(57:26) 3 Tech Lead Wisdom_____Milan Milanovic's BioMilan Milanović is the CTO and the author of Laws of Software Engineering. He holds a PhD in Computer Science, has more than 20 years of experience across .NET, Azure, and mobile development, and is a Microsoft MVP. He runs Tech World With Milan, a software engineering newsletter and community followed by more than 400,000 engineers. He writes about architecture, engineering leadership, and how AI is changing the way software gets built.Follow Milan:LinkedIn – linkedin.com/in/milanmilanovicTwitter / X – @milan_milanovicPersonal website – milan.milanovic.org Book's website - lawsofsoftwareengineering.com Newsletter - newsletter.techworld-with-milan.comLike this episode?Show notes & transcript: techleadjournal.dev/episodes/266.Follow @techleadjournal on LinkedIn and Instagram.Buy me a coffee or become a patron.

Pricing strategist Shannon Mattern joined me on Ditching Hourly to discuss how to present pricing options in a project proposal based on the mindset of the buyer: investment-minded, expense-minded, and hustle-minded. In this episode, we dive into Shannon's Package Matrix method, a framework she developed to offer clients different levels of service and pricing options. We explore how to implement this strategy, manage client expectations, and ensure timely payments.00:00 Introduction00:25 Shannon's Background01:24 Overcoming Pricing Challenges02:24 Package Matrix Method06:23 Implementing Package Matrix10:58 Sales Process and Payment Terms17:21 Handling Client Delays20:58 Sales Cycle and Proposal Strategy28:03 Presenting Proposals39:51 Follow-up and Decision Deadlines47:19 Final Thoughts and ResourcesShannon Mattern is a pricing strategist and the creator of the Package Matrix™ Method. She's also the host of the Profitable Web Designer and Anchor High podcasts, and founder of Web Designer Academy, where she helps women web designers move from undercharging to premium pricing. You can connect with Shannon at https://shannonmattern.com or on LinkedIn at https://linkedin.com/in/shannonmattern

Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall. On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe. We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show Guests Juanita Gomez: linkedin.com Mike Fiedler: miketheman.dev Seth Michael Larson: sethmlarson.dev Trailblazing Python Security: us.pycon.org Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com Dependency Cooldowns: cooldowns.dev Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com FedRAMP: www.gsa.gov Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com Rust for CPython project: blog.python.org pre-PEP: discuss.python.org Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com SBOMit: github.com Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com Volatility: volatilityfoundation.org Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com zizmor: docs.zizmor.sh GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io andrew/pycon: data & analysis for the GitHub Actions security talk: github.com GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com PyCon US YouTube channel: www.youtube.com SBOMit: adding verification to SBOMs (OpenSSF): openssf.org Ecosystems: ecosyste.ms Watch this episode on YouTube: youtube.com Episode #557 deep-dive: talkpython.fm/557 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Doist CTO Gonzalo Silva says AI is reshaping software development, but success depends on restraint rather than rapid feature expansion. Instead of chasing every AI capability, Doist prioritizes “subtraction over addition,” removing features that fail to deliver lasting value despite development investment. After experimenting with nearly 20 AI concepts, the company found success with Ramble, an AI-powered voice task capture feature, while remaining model-agnostic through rigorous testing and evaluations.  Internally, developers use a variety of AI coding tools rather than standardizing on one platform, while Doist OS—a companywide AI assistant with nearly 100 shared skills—helps employees across all functions work more effectively. Silva also outlined Doist's approach to AI-powered automations, separating AI-driven workflow generation from deterministic execution to improve reliability and reduce token costs. Throughout its AI strategy, the company emphasizes purposeful features, privacy, transparency, and continuous improvement, ensuring AI enhances user productivity without compromising product quality or trust. Learn more from The New Stack around developer productivity:  Developer Productivity in 2025: More AI, but Mixed Results Optimizing for Developer Productivity Creates a Winning DevEx Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

As AI coding agents accelerate software development, they also create new challenges for site reliability engineers (SREs), who are increasingly responsible for debugging systems that no single human fully understands. In this episode ofThe New Stackpodcast, Sam Farid and Nate Heinrich of Chronosphere argue that AI agents should also be used for root-cause analysis, helping teams diagnose failures more quickly as model capabilities continue to improve.  Rather than immediately purchasing a commercial solution, they recommend organizations first build an in-house AI SRE. The process of documenting systems, dependencies, and operational knowledge creates valuable context that enables AI agents to troubleshoot effectively while improving institutional knowledge. Although Chronosphere offers its own AI SRE platform, the hosts emphasize that building an internal prototype helps teams understand their needs before evaluating vendor tools. As AI-generated code becomes more common, organizations that invest in mapping their systems and leveraging AI for operations will be better equipped to reduce downtime and support increasingly complex software environments. Learn more from The New Stack around AI SREs:  5 ways SRE AI agents are set to augment human capabilities The Future of AI in SRE: Preventing Failures, Not Fixing Them AI Reliability Engineering: Welcome to the Third Age of SRE Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

”Expertise whisperer” Wes Wheless joined me on Ditching Hourly to talk about turning corporate expertise into a solo consulting business. We talked about his new book, The Expert's Privilege, how corporate professionals can recognize transferable expertise, why visual IP helps consultants explain their work, and what to do before making the leap from employee to independent consultant.Chapters01:35 - From Corporate to Consulting03:48 - Pivoting Toward Solo Consultants06:16 - Daily Email, Authority, and Visual IP11:46 - The Expert's Privilege18:36 - Why Corporate Experts Undervalue Their Skills23:23 - Excavating Your Expertise27:18 - Finding Your Zone of Genius32:44 - From Self-Examination to Market Validation35:30 - What to Do Before You Leave Corporate40:22 - A Book Is FOR Someone44:23 - Writing the Book With Support52:06 - Launch Strategy and Early ResultsAbout WesWes Wheless is an "expertise whisperer," founder of Develop My IP, and creator of The Lightbulb, a daily email for corporates-turned-consultants.After two consecutive tech layoffs, Wes traded a 20-year corporate career spanning consulting, enterprise, and startups for a solo practice helping experts turn their knowledge into IP, frameworks, and "intellectual headshots."Wes holds business degrees from The Wharton School and Kellogg School of Management and lives in Seattle, Washington. The Expert's Privilege is his first book.LinksResources & Services: weswheless.comThe Expert's Privilege: wesbook.comBuy on Amazon: buywesbook.comThe Lightbulb email: lightbulbemail.comFen Druadin, Book Midwife: fendruadin.com (00:00) - Introduction (01:35) - From Corporate to Consulting (03:48) - Pivoting Toward Solo Consultants (06:16) - Daily Email, Authority, and Visual IP (11:46) - The Expert's Privilege (18:36) - Why Corporate Experts Undervalue Their Skills (23:23) - Excavating Your Expertise (27:18) - Finding Your Zone of Genius (32:44) - From Self-Examination to Market Validation (35:30) - What to Do Before You Leave Corporate (40:22) - A Book Is for Someone (44:23) - Writing the Book With Support (52:06) - Launch Strategy and Early Results (55:31) - Where to Find Wes ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

Topics covered in this episode: Some more things about Django I've been enjoying Who cleans up after the vibe-coding party? Where Did All Your AI Tokens Go? AgentsView to the rescue! Careful with phishing all Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Some more things about Django I've been enjoying Julia Evans is learning "2010-style" web dev (Django + SQL + server-rendered HTML) after years of Go backends and JS-heavy frontends Query builders: likes defining custom QuerySet classes with chainable filter methods (.approved().future().with_tags()) — more readable than raw SQL Template filters: highlights urlize, linebreaksbr, json_script, and especially querystring for building/modifying query-string links in templates Migrations: still loves Django's auto-generated migrations — 19 and counting on her project Skips inheritance for class-based views; prefers function-based views for sharing code, though fine using Django's own mixins/interfaces Performance surprise: CPU profiling (via py-spy) — not slow DB queries — revealed the culprit; she'd accidentally disabled the cached template loader, and re-enabling it took throughput from ~2-3 req/s to ~12 req/s on a $10/mo VM Michael #2: Who cleans up after the vibe-coding party? FT Magazine piece by Sam Learner (July 11) on AI coding tools overwhelming open source maintainers - sent in by listener Dylan McConnell, whose main point was that this ran in the Financial Times, not a dev blog. cURL as the case study - Daniel Stenberg has been the only full-time person on it for years; libcurl has been installed an estimated 20+ billion times with 3,000+ listed contributors. Bug bounty killed - cURL ended its paid security bounty program in January, citing an "explosion of AI slop reports" that take real time to debunk and drain morale. Extractive contributions - authoring a PR is now nearly free, reviewing one still costs a human; tldraw's Steve Ruiz closed outside contributions entirely, asking why he'd want someone else writing the easy part. Guido weighs in - van Rossum says projects are holding emergency meetings over the slop flow, and notes LLM patches tend to touch unrelated parts of a file, making review more tedious. "Vibe Coding Kills Open Source" - paper from Miklós Koren's group: packages frequently recommended by coding models saw big download jumps with no matching engagement, breaking the reputation loop that sustains maintainers. Stack Overflow flatlined - over 100,000 questions a month before ChatGPT, under 1,500 last month, with the response rate cut roughly in half; the public archive is now stale training data. The course-creator angle - Josh Comeau's newest web dev course launched at about a third of prior enrollment, and he worries about devs who never learn which questions to ask. But the most interesting portion is what was omitted. Focused on: The end of the curl bug-bounty Omitted: High-Quality Chaos Why the omission is interesting It fits a narrative. The FT piece is a maintenance-and-decline story, and January-Stenberg is a perfect witness for it. April-Stenberg complicates it - same person, same project, better data, opposite direction on the specific claim being used. The tell is already in the article. Learner quotes Stenberg saying AI tools are much better at finding problems than fixing them. That's the April thesis in one line, and it goes undeveloped. Reason for the shift is process, not vibes. Killing the bounty removed the cash incentive and the venue change filtered the rest. Worth saying out loud, because "AI reports got better" isn't quite it - "no bounty plus a real triage platform" is closer. Joke too: Sarah O'Connor wrote a related piece (is this just before skynet launches?) Calvin #3: Where Did All Your AI Tokens Go? AgentsView to the rescue! Local-first desktop/web app for browsing, searching, and analyzing your past AI coding agent sessions (Claude Code, Codex, Copilot, Cursor, Gemini, Aider, and dozens more) Auto-discovers session files on your machine — no config needed; everything stored locally in SQLite, no cloud/accounts agentsview usage is a drop-in ccusage alternative — reads from pre-indexed SQLite, reports run 80–220× faster on large histories New Activity dashboard shows peak concurrency, active vs. idle time, agent-minutes, and cost — filterable by project/agent/machine, with a -json CLI report too Full-text + optional semantic search across every session; also imports Claude.ai/ChatGPT chat exports Install via pip install agentsview, uvx agentsview, brew install --cask agentsview, or download desktop binaries from GitHub Releases Michael #4: Careful with phishing all The situation I pass this along because it was a pretty sneaky bit of targeted phishing, and happened to play off an old interaction in bandit's repo. As usual with phishing scams there are a bunch of tells that this isn't legitimate, but just enough plausibility that I could see falling for it in a weak moment. Relative nobodies like me haven't historically been worth the effort to hit with scams this specific. Agents change the game though :-/. Be careful out there folks! Original message From: "Patrick (Blacktrace)" [HTML_REMOVED] To: LISTENER EMAIL Subject: Your Bandit #1350 (B105 NextToken false positive) -- just fixed that exact case Date: Wednesday, July 15, 2026 12:02 AM Hi AJ, Saw your Bandit issue #1350 -- the B105 hardcoded-password false positive on the string NextToken. I build a deterministic gate that filters that class of Bandit noise, and #1350 was literally the case I just fixed: NextToken / next_token / page_token / nextPageToken now stay quiet, while a genuine hardcoded token like api_token="sk-live-..." still fires. Verified against your exact case. 30-second paste: https://blacktrace.co/noise-eraser Where it still trips, published: https://blacktrace.co/kruc Curious whether it clears what you hit -- and if it trips on something of yours, that's the more useful reply. Patrick, Blacktrace I asked Claude for some analysis too. It was pretty good at finding them. The message name-drops enough real detail to feel legit, but the structure is pure phishing - everything in it exists to get AJ onto blacktrace.co. The strongest ones: Freemail sender, corporate signoff. Signs as "Patrick, Blacktrace" but sends from emailpjv@gmail.com. Real company outreach comes from the company domain, not a personal Gmail - and there's no last name. Over-specific targeting. It mirrors AJ's exact public activity - issue #1350, the B105 rule, the NextToken false positive, even the token variants. That's the "just enough plausibility" AJ flagged, and it's exactly what agents make cheap: scrape a GitHub issue, auto-generate tailored bait. Legit cold outreach rarely reads your history back to you this precisely. The entire payload is two links. Strip the technical flattery and the message is just "paste here" plus "see results here." When the whole point of an email is the click, that's the tell. "30-second paste." Low-friction urgency, and "paste" most likely means paste your source into their tool - handing your code to a stranger's site. Exfiltration dressed as convenience. Brand-new, no-reputation domain. blacktrace.co has no track record, and the name is doing some ominous work. The /kruc slug is random noise, not how real product pages get named. Precise-sounding jargon that's actually vague. "Deterministic gate," "noise-eraser" - impressive, empty. Bolted onto correct real details (B105 is the Bandit hardcoded-password test, sk-live- is a Stripe live-key prefix) to borrow credibility. The disarming close. "if it trips on something of yours, that's the more useful reply" - engineered humility that flatters your expertise and baits a response. Makes engaging feel like you're doing them a favor, which drops your guard. Extras Calvin: DjangoCon US 2026 is rapidly approaching, August 24-28, Chicago Ruff v0.16.0 massively expands its default rule set Ruff now enables 413 rules by default, up from 59 https://astral.sh/blog/ruff-v0.16.0 Michael: Completely redesigned the home page. Try /insights in Claude Code (terminal) Joke: We're Safe

For years, "Django and async" came with an asterisk. The docs themselves warned you off it. Scary performance notes, a story that felt half-finished. Well, that story just got rewritten, literally, and the person who rewrote it is here to tell you why the old framing was wrong. Carlton Gibson is a former Django Fellow, sat on the security team for eight years, and he's on the steering council. On this episode we get into the async topic doc rewrite, what actually remains versus what was just fear, the new Tasks framework in 6.0, DB-level cascades and fetch modes landing in 6.1, and why free-threading is the bet that's about to pay off big for Django. If you've been told Django's async story isn't ready, this is the episode that puts that myth to bed. Episode sponsors Sentry Error Monitoring, Code talkpython26 Python in Production Talk Python Courses Links from the show DjangoCon Europe: djangocon.eu PyCon Italia: pycon.it Django on the Med: djangomed.eu Django Mantle: noumenal.es PyPI: pypi.org release notes: docs.djangoproject.com on_delete: docs.djangoproject.com Fetch modes: docs.djangoproject.com HttpRequest.multipart_parser_class: docs.djangoproject.com async topic doc: docs.djangoproject.com docs: docs.djangoproject.com DEP 14: github.com django-tasks: github.com django-tasks-local: github.com Celery: docs.celeryq.dev PEP 703: peps.python.org free-threading HOWTO: docs.python.org PEP 779: peps.python.org ASGI: docs.djangoproject.com PGBouncer: www.pgbouncer.org Channels: channels.readthedocs.io sync_to_async / async_to_sync: docs.djangoproject.com noumenal.es: noumenal.es Django Chat: djangochat.com @carlton@fosstodon.org: fosstodon.org Article: Cutting Python Web App Memory Over 31%: mkennedy.codes Watch this episode on YouTube: youtube.com Episode #556 deep-dive: talkpython.fm/556 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Author, financial advisor, and former management consultant Brian Herriot joined me on Ditching Hourly to talk about pursuing time freedom before financial freedom.Brian and I talk about his new book Time Freedom, the difference between time freedom and financial freedom, how flexible work can bridge the gap, and what he learned from using early readers, workshops, and hybrid publishing to turn his ideas into a book.Chapters00:00 - Brian's Time Freedom Story02:58 - Why Brian Wrote the Book05:30 - Choosing Hybrid Publishing09:53 - Building the Business Behind the Book12:16 - Time Freedom vs Financial Freedom16:46 - Making Nine Months Cover Twelve19:47 - Remote Work and Flexible Work23:18 - Who Can Actually Do This?27:17 - Early Readers and Draft Feedback31:51 - Tools for Testing a Book33:32 - Testing Ideas Before Writing36:00 - Writing the First Draft40:26 - The Time Freedom Framework46:52 - Writing a Better Ending50:44 - Counterintuitive Money AdviceResources We MentionedTime Freedom preorder pageTime Freedom CalculatorTime Freedom PodcastBrian Herriot on LinkedInWrite a Must-Read by AJ HarperAJ HarperPage Two SimplifiedMike MichalowiczMike Michalowicz on The Business of AuthorityWrite Useful Books / Rob FitzpatrickHelp This BookHeroic Public SpeakingCharlie Hoehn on The Knowledge Project with Shane ParrishGuest BioBrian Herriot is the founder of Time Freedom and the author of Time Freedom: Rethink Your Work and Money to Create a Life You Love Now. He is an author, speaker, registered investment advisor, financial advisor, business consultant, and co-host of The Time Freedom Podcast. His professional background includes management consulting roles at Accenture and Point B, as well as a director position at UCSF Health. Learn more at https://timefreedom.life/. (00:00) - Brian's Time Freedom Story (02:58) - Why Brian Wrote the Book (05:30) - Choosing Hybrid Publishing (09:53) - Building the Business Behind the Book (12:16) - Time Freedom vs Financial Freedom (16:46) - Making Nine Months Cover Twelve (19:47) - Remote Work and Flexible Work (23:18) - Who Can Actually Do This? (27:17) - Early Readers and Draft Feedback (31:51) - Tools for Testing a Book (33:32) - Testing Ideas Before Writing (36:00) - Writing the First Draft (40:26) - The Time Freedom Framework (46:52) - Writing a Better Ending (50:44) - Counterintuitive Money Advice ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

In this episode with The New Stack Agents, Frederic Lardinois, NVIDIA's Joey Conway says advances in AI over the past year have dramatically improved the capabilities of local models, making them practical for enterprise and personal use alongside frontier cloud models. Rather than replacing large models, Conway envisions a “system of models” where specialized local models handle routine, cost-sensitive, or privacy-focused tasks, while larger frontier models tackle more complex reasoning. He explains that organizations can fine-tune smaller open models using domain-specific data, creating expert AI agents that reflect the specialized roles found within businesses.  NVIDIA supports this ecosystem through open models, training tools, and software such as NeMo, Dynamo, and Nemotron. Conway also highlights the growing importance of agentic harnesses, which give AI models access to tools, memory, and iterative workflows, significantly improving performance and reducing costs. Looking ahead, he expects AI orchestration to become increasingly important, with intelligent routing systems selecting the right model for each task based on complexity, cost, latency, and data governance requirements, enabling enterprises to balance performance, security, and efficiency. Learn more from The New Stack around NVIDIA's latest updates in AI: Palantir and Nvidia want to change who owns government AI  Nvidia's best model is now live Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

Topics covered in this episode: django-orjson Best Django Redis configuration for speed and size Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Django Steering Council backs the Triptych Project Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Michael #1: django-orjson Adam Johnson dropped django-orjson - drop-in replacements for the Django and DRF pieces that touch JSON, swapping stdlib json for orjson, the Rust-based library. Headline numbers: 10x faster serialization, 2x faster deserialization. The interesting question is why this needs to be a package at all. pip install orjson is the easy part. Adam's actual pitch: adopting it "isn't easy, especially when your framework uses json in many different parts." Django scatters JSON across JsonResponse, the test client and test case classes, the json_script template tag, and more. There's no single hook to grab, so you get a library that catches them all. Adam is refreshingly honest about the scale of the win. His words: "While database queries tend to dominate the typical Django application's runtime, the time spent in serialization and deserialization can still be significant." He calls it "a nearly free performance win" - not "this will 10x your app." That's a claim about cost, not magnitude, and it's worth keeping those straight. Worth flagging what the post doesn't cover: caveats. There are none in the article, but orjson has real ones. Django and Flask both render datetimes as RFC 822 HTTP-date (Wed, 15 Jul 2026 12:00:00 GMT); orjson does ISO 8601. It can't do ensure_ascii, it rejects NaN and Infinity (which stdlib happily emits), and it raises on Decimal. If you've got a JS client parsing dates, that's a wire-format change. Who should actually take this? If you're a DRF shop shoveling JSON all day, yes - it's cheap and it's real. If your app mostly renders HTML templates, you're optimizing a slice of runtime that's already near zero. The problem Adam's package solves doesn't exist in Flask or Quart. They already centralize every JSON operation - jsonify, request.get_json(), the test client, the |tojson filter - behind one provider object at app.json. So there's no library to install. It's about ten lines: import orjson from quart.json.provider import JSONProvider # or flask.json.provider class OrjsonProvider(JSONProvider): def dumps(self, obj, **kwargs) -> str: return orjson.dumps(obj).decode() # provider must return str def loads(self, s, **kwargs): return orjson.loads(s) app.json = OrjsonProvider(app) The numbers on talkpython.fm Evaluated it, measured it, and skipped it. The biggest JSON payload we serve is our MCP server returning a cached episode transcript, about 139 KB. Swapping the provider saves 0.119 milliseconds per request. That total response takes 1.1 ms We got 4.1x, not 10x - and the reason is the good lesson. Payload shape decides your speedup. The 10x is for structure-heavy data, lots of small keys where stdlib burns time in Python-level dispatch per item. Our hot payload is one giant transcript string, so the work is escaping and memcpy Calvin #2: Best Django Redis configuration for speed and size Peter Bengtsson revisits a classic: his 2017 "Fastest Redis configuration for Django" benchmark now has a 2026 update posted this week. The 2017 post pitted django-redis serializers (json, ujson, msgpack, pickle) and compressors (zlib, lzma) against each other; conclusion was msgpack + zlib as the sweet spot - avoid the json serializer, it's fat and slow. The 2026 update narrows focus to just compressors: default (no compression), zlib, lzma, and newcomer zstd. New results: lzma compresses best but is slowest; zstd is the fastest compressor on Ubuntu; differences between them are very small. Big takeaway across both: compression buys you a lot of space (2–3.5x smaller) for very little speed cost - worth it for Redis where memory is the constraint. Caveat from the author: results depend heavily on your data - his test stores short strings of numbers, so benchmark your own workload. Michael #3: Linus Torvalds puts the foot down against Anti-AI Kernel Maintainers Write up on Ars. Really good coverage by Maximillian: Time to wake up (for some) Torvalds said that “Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away.” I agree with Max, putting your head in the sand and waiting for AI to go away will likely mean you won't be working professionally in software development in the coming years. The statement came amid a lengthy thread arguing about the use of Sashiko, an “agentic Linux kernel code review system” that its creators claim can, in tests, independently find 53.6 percent of the bugs that would end up being fixed by human coders in later commits. “We're not forcing anybody to use [LLM tools], but I will very loudly ignore people who try to argue against other people from using it,” Torvalds said. “Anybody who points to the problems at AI had better be looking in the mirror and pointing at themselves at the same time,” Torvalds wrote. Calvin #4: Django Steering Council backs the Triptych Project Django Steering Council issued a Letter of Collaboration backing Carson Gross & Alex Petros's funding bid for the Triptych Project - three proposals to make HTML more expressive natively, in every browser. The three additions: PUT/PATCH/DELETE methods for forms, button actions (buttons that fire HTTP requests without a wrapping form), and partial page replacement. Distills the core ideas from HTMX/Unpoly/Turbo into the HTML standard itself - no JS, no library, nothing to ship or maintain. Current focus is button actions (WHATWG #12330): Logout instead of wrapping a button in a form. Relevant to Django directly - think the admin submit row and disguised delete links; Django 6.0's template partials were already inspired by these patterns. How to help: companies can send non-binding letters of support on letterhead; individuals can read the proposals and weigh in on the WHATWG issues. Extras Calvin: DOOMQL - A playable first-person shooter whose framebuffer is a SQL query. Michael: Granian 2.7.9 fixes WSGI threadpool scheduler starvation/underscaling Welcome Calvin post Joke: Solving all bugs

Topics covered in this episode: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it JupyterLab 4.6 and Notebook 7.6 are out! Tau – new small, readable terminal coding agent Django Tasks and Django 6.1 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: The trusted-publishing debate: how to do it right vs. why you shouldn't trust it https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/ (Brett Cannon) and https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing (William Woodruff) Trusted Publishing (PyPI's OIDC-based auth scheme, also now used by npm, RubyGems, crates.io, NuGet) replaces long-lived API tokens with short-lived, auto-scoped credentials tied to CI/CD machine identity. Yossarian's post: it's purely an authentication mechanism between a machine identity and a package — it says nothing about package safety or quality. PyPI deliberately avoids any "verified/trusted" badge for it, unlike its verified-URL checkmarks. Same logic applies to PyPI attestations: anyone can sign with any machine identity they control, so an attestation's presence isn't itself a trust signal. Bottom line from that post: don't confuse "trusted" (machine-to-machine) with "trustworthy" (human judgment about the package). Snarky.ca's companion piece is more practical: given GitHub Actions compromises in the news, the real fix is 3 concrete steps — run zizmor to lock down workflow permissions/checkout credentials and pin actions to commit hashes, adopt Trusted Publishing to eliminate stored PyPI tokens, and require manual approval via a GitHub environment before any publish job runs. Takeaway for listeners: Trusted Publishing is good hygiene for how you authenticate to PyPI, but it's not a substitute for securing your CI pipeline itself — or for actually vetting the packages you install. Michael #2: JupyterLab 4.6 and Notebook 7.6 are out! Michał Krassowski's rundown - a chunky minor release: 68 features, 97 bug fixes, 95 contributors, one of the biggest ever. Scratchpad console (Notebook 7.6 headliner) - a console next to your notebook sharing its kernel, for throwaway experiments. Ctrl+B. Jump to last-edited cell - new commands hop through recently edited cells. File browser glow-up - Date Created column, editable breadcrumbs with Tab-completion, and Open in Terminal. Debugger - sources open in the main area, floating step/continue overlay, live kernel-sources filter. Custom layouts (Lab) - activity bar top/bottom, draggable panels, four-way tab splits, per-panel Ctrl+scroll zoom. ~5x faster extension builds - webpack → Rspack, and jupyter-builder means no full Lab install needed to build extensions. Keyboard/a11y - add shortcuts from the UI (no JSON), Find & Replace in Edit menu (Ctrl+H). Calvin #3: Tau – new small, readable terminal coding agent Tau – new small, readable terminal coding agent (Python 3.12+), built as both a working tool and a teaching project for how coding agents work under the hood Install via uv tool install tau-ai, pipx, or pip; ships a tau CLI Three-layer architecture: tau_ai (provider-neutral model layer) → tau_agent (reusable "brain": messages, tools, events, loop) → tau_coding (CLI/TUI, file & shell tools, sessions) Supports OpenAI, Anthropic, OpenAI Codex, OpenRouter, Hugging Face, and custom/local OpenAI-compatible endpoints Built-in tools (read/write/edit/bash), durable JSONL sessions with resume/branching, project instructions via AGENTS.md, and context compaction Core harness is UI-agnostic — same brain can power the TUI, print mode, or a custom frontend — usable as a standalone library too Michael #4: Django Tasks and Django 6.1 Django 6.0 finally ships first-party background tasks (django.tasks) - out of Jake Howard's DEP 14, accepted May 2024, after two decades of everyone bolting on Celery/RQ/Huey. It's an API, not a worker. Django handles task definition, validation, queuing, and result storage - it does not execute them. You bring the backend. The default backend traps people. ImmediateBackend runs tasks inline on the request thread and blocks until done - so out of the box .enqueue() backgrounds nothing (a 5-second task means a 5-second response). The other built-in, DummyBackend, runs nothing at all. Both are dev/test only. Nice API otherwise: slap @task on a function, call .enqueue(), get back a TaskResult you look up later by id - with async twins like aenqueue(). Gotcha: args and return values must survive a JSON round-trip, so a tuple sneakily comes back as a list. The community local backend to know: django-tasks-local by Chris Beaven (SmileyChris). A ThreadPoolExecutor backend that gives real background threads with zero infrastructure - no Redis, no Celery, no database - plus a ProcessPoolBackend for CPU-bound work → github.com/lincolnloop/django-tasks-local Its catch: results live in memory, so pending tasks vanish on restart or deploy. Great for dev and low-traffic production; for persistence, drop to Jake Howard's django-tasks (DatabaseBackend + worker command). Extras Calvin: Fixing the dictionary with Python 3.14 — Hugo van Kemenade stumbled on - and got fixed - a markup bug in the OED's own citation of a 1706 use of the pi symbol. Michael: Bunny DNS is now free Jokes: What's the object-oriented way to become wealthy? Inheritance To understand what recursion is... You must first understand what recursion is 3 SQL statements walk into a NoSQL bar. Soon, they walk out They couldn't find a table.

In this episode, Mark Russinovich, CTO of Microsoft Azure revealed Brain, the AI-powered AIOps system that continuously monitors Azure's health, detects incidents, identifies root causes, and increasingly automates responses such as pausing problematic deployments and notifying affected customers. Built on Azure Resource Graph, Brain creates a real-time digital twin of Azure, mapping dependencies across hundreds of services, data centers, and regions. Although Brain predates the generative AI boom, years of data engineering, standardized service-level indicators (SLIs), and machine learning laid the foundation for today's capabilities.  Brain combines standardized SLIs, service-specific monitoring, and third-party signals to detect anomalies, while ML models dynamically establish service baselines and correlate outages with software rollouts. Microsoft says automated notifications have reduced customer support tickets by four to six times, with 80–90% of Brain-covered services receiving notifications within 15 minutes, often in under five. The company is also layering LLM-powered agents, called Triangle, on top of Brain to streamline incident routing and eventually enable AI agents to autonomously troubleshoot and remediate outages.   Learn more from The New Stack around the latest in Microsoft Azure: Meet Brain, the AI that decides when Azure is officially down  Microsoft's pitch to enterprises: Ditch Azure Repos for GitHub, despite its rocky reliability record  Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

Coding agents have gotten really good at one kind of work. You scope a feature, edit some files, run the tests, ship it. It all happens on disk. But that is not how data work feels. You load something, you look at it, you run a cell, you watch how it responds, and you decide the next move from whatever is sitting in memory. And until now, your agent couldn't see any of that. It only saw the files. Never the live state. This episode, that wall comes down. marimo pair drops a coding agent right inside a running notebook, with full access to every variable Python is holding in memory. The notebook becomes a shared canvas. You point, it runs the code. You tell it to zoom in on the Picasso paintings, and the chart just updates. No MCP tools to wire up, no schema to describe. Just Python, and an agent that can finally see what you see. Trevor Manz is back to walk us through it. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show marimo pair: marimo.io/pair Course transcripts announcement: talkpython.fm/blog anywidget: Jupyter Widgets made easy: talkpython.fm marimo: marimo.io blog: marimo.io GitHub: github.com given this: martinalderson.com llms.txt: talkpython.fm mcp: talkpython.fm cli: talkpython.fm open issues: github.com Discord: marimo.io Marimo Pair: marimo.io OpenCode: opencode.ai AI Tooling for Software Engineers in 2026: newsletter.pragmaticengineer.com Watch this episode on YouTube: youtube.com Episode #555 deep-dive: talkpython.fm/555 Episode transcripts: talkpython.fm Theme Song: Developer Rap

You ask an AI a question and it answers with total confidence. Most of the time, a confidently wrong answer is just an annoyance. But what if the question is medical, and there's a real patient on the other end? In that world, a hallucination isn't a bug, it's a patient-safety event. Sumit Gundawar is a London-based software engineer who builds the clinical platform for a UK longevity and aesthetic-medicine clinic, and his whole argument is that in high-stakes AI, the model is the easy part. Earning trust is the real engineering. We dig into grounding, refusal logic, human-in-the-loop design, and the messy frontier of longevity and biohacking, plus a live demo of an assistant that refuses to answer when it can't back up the claim. Let's get into it. Episode sponsors Six Feet Up Talk Python Courses Links from the show Guest Sumit Gundawar: linkedin.com Course transcripts announcement: talkpython.fm/blog Sumit Gundawar - JAX London Speaker: jaxlondon.com Anthropic: anthropic.com OpenAI Platform: platform.openai.com Anthropic: anthropic.com LangChain: langchain.com OWASP: owasp.org Pydantic: pydantic.dev EU AI Act - Regulatory Framework: digital-strategy.ec.europa.eu HIPAA - HHS: www.hhs.gov NHS: www.nhs.uk Llama: llama.com Qwen - QwenLM on GitHub: github.com OpenAI Platform: platform.openai.com Hugging Face: huggingface.co Llama: llama.com Granola: www.granola.ai HIPAA - HHS: www.hhs.gov CodeRabbit: www.coderabbit.ai Cursor Origin: cursor.com GitHub Status: www.githubstatus.com Midjourney Medical: www.midjourney.com Neko Health: www.nekohealth.com CERN: home.cern ATLAS Experiment: atlas.cern Watch this episode on YouTube: youtube.com Episode #554 deep-dive: talkpython.fm/554 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Business development director and Raleigh commercial real estate enthusiast Jed Byrne joined me on Ditching Hourly to walk through the entire process of self-publishing his first book, Start Small Selling, from idea validation to Kickstarter funding to final production.We cover testing your book idea with real money, writing a first draft in 35 days, running a Kickstarter campaign to fund professional editing, finding and working with developmental editors, designing a book cover on a budget, and publishing through KDP and Lulu.Chapters(00:00) - Who Is Jed Byrne? (03:19) - The Hyper-Local Newsletter (07:59) - Why Write a Book? (11:41) - Testing the Idea (14:05) - The Writing Process (21:56) - The Kickstarter (31:04) - Building the Editing Team (36:23) - The Timeline (45:49) - Working with a Developmental Editor (52:40) - Designing the Cover (57:26) - Publishing with KDP and Lulu (01:00:00) - Start Small, Start Now Guest BioJed Byrne is a business development director at Barnhill Building Group, a North Carolina-based general contracting firm. Outside his day job, he runs Oak City CRE, a platform focused on Raleigh commercial real estate that includes a weekly Substack newsletter, a podcast, consulting, and his first book, Start Small Selling. You can reach Jed at books@oakcitycre.com.Resources Mentioned In This EpisodePeopleJed ByrneJed Byrne on LinkedInJonathan StarkTim FerrissSeth GodinNoah KaganRob FitzpatrickTucker MaxPat FlynnChandler BoltTim GrahlRochelle MoultonCorey QuinnMike MichalowiczDerek SiversDaniel PinkJed / Raleigh / AECOak City CREThe Top Five by Oak City CREDirt NC podcastBarnhill Building GroupStart Small Selling KickstarterStart Small Selling on AmazonUrban Land InstituteULI TriangleJed's book email from the episode - books@oakcitycre.comBooks / Book-Building ResourcesMillion Dollar Weekend by Noah KaganThe Mom Test by Rob FitzpatrickWrite Useful Books by Rob FitzpatrickHelp This BookThe Workshop Survival GuideThe Scribe MethodSelfPublishing.com / Self-Publishing SchoolReedsyEditorial Freelancers AssociationChicago Manual of StyleISBNs / BowkerAtticusPublishing / Production / Selling PlatformsKickstarterAmazon KDPLuluBlurbShopifyUpworkFiverrOtterpineMicrosoft WordCanvaInkscapeUSPS Media MailPodcast / Episode ReferencesMike Michalowicz on The Business of Authority ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

Join our next FASO Show Live!https://artists.boldbrush.com/p/the-faso-showLearn the magic of marketing  with us here at BoldBrush!boldbrushshow.com--To start off the season, we sat down with fine artist and former software developer Maureen Dunlap. Maureen shares how a childhood immersed in traditional oil painting, guided by mentor Arthur Maynard, eventually wound its way through typography, photo typesetting, and front-end development before circling back to a full-time art career. Maureen talks about rebuilding her painting practice after years away, moving from fast alla prima pieces to highly detailed, indirect paintings that draw on Art Nouveau, Art Deco, Pre-Raphaelite, and Baroque influences. She describes her richly layered seascapes, lace-draped still lifes, and narrative figurative works that often live in ornate vintage or trompe l'oeil frames, all infused with her whimsical titles and maximalist sensibility. Maureen also opens up about the realities of being a full-time artist later in life, balancing joy and financial stability, diversifying income with small works and jewelry, navigating social media and online sales, and her growing desire to teach the next generation of painters.Maureen's FASO site:maureendunlap.com/Maureen's Social Media:facebook.com/profile.php?id=100083217888057instagram.com/maureenjdunlapMaureen's Jewelry Store:instagram.com/the.wonder.cabinet

Send us Fan MailIn this episode, Scott Kuhlman and Chasity Owens sit down with Founder Jesse Sprague, Director of Research & Intelligence Phinehas Lampman, and  Software Developer and Data Scientist Kathleen Matos from Axon Intelligence to talk about the future of wildland fire investigation, origin and cause documentation, data science, remote sensing, AI, drone imagery, and fire investigation technology. The conversation explores how the new app EchoSpectra is helping investigators organize field data, document wildland fire indicators, track GOA/SOA development, export maps and photo logs, and strengthen the scientific method through better case organization. The group also discusses how computer vision, mapping, drone-based imagery, and pattern recognition may shape the future of both wildland and structure fire investigations, while also touching on firefighter health, smoke exposure, Valley Fever, and the need for better respiratory protection in the field.Thank you for listening! If you enjoyed the episode, give us 5 stars, hit the follow button, and subscribe on Spotify, Apple Podcasts, and anywhere you are listening in from. Follow us on social media!Instagram: @infocusfire_podcastLinkedIn: INFOCUS podcastFacebook: INFOCUS podcastTikTok: @infocus_podcast

Topics covered in this episode: dust - a better du Hermes Agent: The AI agent that grows with you llm-coding-agent 0.1a0 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: dust - a better du du + Rust = dust - a fast, visual, intuitive disk-usage CLI Run dust and immediately see the biggest directories and files without piping through sort, head, or awk Smart recursive output focuses on what matters instead of dumping every folder Colored bars show relative size and parent/child hierarchy, making “where did the space go?” obvious Perfect for Python projects bloated by .venv, caches, Docker volumes, downloaded datasets, and local AI models Install via brew, cargo install du-dust, conda-forge, Scoop, Snap, deb-get, or GitHub releases Calvin #2: A Way better ARchive format for Python packaging war - new archive format spec from Astral (same team as uv/ruff), v0.0.2, still no binary encoding defined yet Header-Index-Store layout: header IDs the file, index maps names to store offsets, store holds compressed data Index uses a finite-state transducer (FST) to dedupe common path prefixes across entry names Supports three entry types (file, directory, link) and three compression modes (store/DEFLATE/zstd), plus an "executable" metadata flag Unpacking is atomic - writes to a temp dir, then renames into place, so a failed extract never leaves a half-unpacked directory Strict name-segment rules (no NUL/control chars, no leading/trailing whitespace, blocks Windows-reserved names like CON/PRN) to avoid path traversal and cross-platform footguns Michael #3: Hermes Agent: The AI agent that grows with you Hermes Agent is an open-source, Python-built AI agent framework from Nous Research - think ChatGPT-style assistant, but connected to your tools, files, shell, browser, calendar, memory, and messaging apps I'm using it in Discord as a long-running agent conversation, not just a one-off chatbot session Hermes can connect through a gateway to platforms like Discord, Telegram, Slack, WhatsApp, email, webhooks, and more - so the same assistant can follow you across surfaces In my setup, I can send Hermes voice/text from Discord, keep project context across turns as threads, and ask it to actually do things: read GitHub repos, run commands, edit files, schedule calendar events, generate drafts, and verify results A fun workflow: I can trigger one-shot actions from an Apple Watch shortcut - dictate a request, send it to Hermes, and have the agent execute it asynchronously Hermes has persistent memory, so it can remember durable preferences and facts - for example, how I like my research formatted It also has “skills,” which are reusable procedures the agent can load later, so Hermes can self-improve over time instead of rediscovering the same workflow repeatedly It supports scheduled jobs / cron-style automations, so it can proactively watch for releases, send summaries, run checks, or remind you about things It's provider-agnostic: OpenRouter, Anthropic, Google, xAI, local models, Nous Portal, and others The big idea: Hermes turns an LLM from “a chat box I visit” into “an agent I can reach from anywhere that knows my workflows and can take real actions and learns over time.” Calvin #4: llm-coding-agent 0.1a0 Simon Willison built a Claude/Codex-style coding agent on top of his llm library, using an alpha of the llm package plus his python-lib-template-repo Built almost entirely via prompted TDD - asked an agent to write a spec.md, then commit + implement with red/green tests, occasionally hitting a real OpenAI key to sanity-check Shipped to PyPI as an alpha: uvx --prerelease=allow --with llm-coding-agent llm code Tool set mirrors familiar coding-agent primitives: read_file, edit_file (exact string replace + diff), write_file, list_files, search_files, execute_command Also exposes a Python API - CodingAgent(model="gpt-5.5", root=..., approve=True).run(...) - which Simon didn't ask for but got anyway Demo: llm code --yolo told GPT-5.5 to build a SwiftUI CLI clock; model correctly noted SwiftUI isn't really CLI-friendly and still produced an ASCII-art time display Extras Calvin: Slides, but for developers https://sli.dev/ Wanna reduce your token usage…. only issue is that its lossy https://github.com/teamchong/pxpipe PEP 772 - Python Packaging Council inaugural election dates set, nominations open July 28, voting September 1-15 Michael: What the pls? revisited! Joke: Min requirements for Linux

Principal at Superstruct and author David Guttman joined me on Ditching Hourly to talk about using OpenClaw and AI agents to delegate outcomes instead of micromanaging code.We talked about AI employees, chat-based agents, why OpenClaw feels different from coding tools, how David qualifies repeatable tasks for delegation, secure setup choices like Tailscale, and what collapsing software costs could mean for developers who still sell their time.(00:00) - Introduction to David Guttman (00:41) - From Superstruct Teams to AI Employees (05:19) - Testing Devin Against a Human Engineer (09:39) - What OpenClaw Adds to AI Agents (11:40) - Vibe Coding from Anywhere (15:52) - Pretending You Do Not Know How to Code (21:13) - Software Quality, Risk, and Real Requirements (23:56) - How OpenClaw Has Changed (31:52) - Qualifying Tasks for an AI Employee (37:07) - The Secure OpenClaw Setup Process (40:38) - Local Machines vs Cloud Servers (45:52) - Tailscale and Remote Access Security (48:08) - Teaching Clients to Train Their Agent (53:02) - Ask the Agent Before Asking the Expert (01:00:44) - Life-Changing Client Use Cases (01:03:34) - Disposable Software and the Future of Developers (01:09:44) - Productivity, Pricing, and Value (01:13:31) - Where to Find David David Guttman is the Principal at Superstruct, where he helps solopreneurs and founders set up AI employees. He is the author of The Superstruct Manifesto, as well as Fullstack Node.js and Fullstack React, and has held engineering leadership roles at Outlier.org and Interlincx after earlier work with Disney and AT&T Interactive. Learn more at davidguttman.com and david.app. ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

Harness has introduced Autonomous Worker Agents, a new capability that allows enterprises to replace rigid CI/CD pipeline scripts with AI agents that can deploy applications, run tests, and perform security scans while operating under existing governance, security, and audit controls. Unlike Harness' existing expert agents, which assist developers with coding and pipeline creation, Worker Agents autonomously execute pipeline tasks within customer-controlled infrastructure. Agents are defined using simple Markdown files, draw context from the Harness Software Delivery Knowledge Graph, and run in sandboxed environments with scoped permissions and policy enforcement.  Harness also provides built-in audit trails that record prompts, decisions, and outcomes, along with token budgets and approval gates to control AI costs. The launch includes an Agent Marketplace featuring Harness-managed, certified partner, and community-built agents. CEO Jyoti Bansal said production AI agents require far stronger safeguards than coding assistants, positioning Harness' governance and knowledge graph as key differentiators. Looking ahead, the company envisions fully autonomous software engineering, where AI agents manage the software lifecycle while humans oversee high-risk decisions. Learn more from The New Stack around AI software delivery: AI won't speed up software delivery - nothing has How to solve the AI paradox in software development with intelligent orchestration  Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

Topics covered in this episode: Free-threaded Python: past, present, and future django-admin-site-search Qwen 3.6 27B is the sweet spot for local development A large batch of PEPs are finalized Extras Joke Watch on YouTube Show Intro Sponsored by us! Support our work through: Our courses at Talk Python Consulting from Six Feet Up Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: Free-threaded Python: past, present, and future The GIL has prevented true multi-threaded parallelism in CPython since the beginning — multiple past attempts to remove it failed on performance grounds Sam Gross at Meta finally solved it; his work became PEP 703 and ships as free-threaded CPython today Python 3.13 was experimental with 20–40% single-threaded slowdown; 3.14 brought that to 0–10% Python 3.15 (October 2026) delivers a unified ABI — one extension binary works on both GIL and free-threaded builds Already >50% of the top PyPI binary wheels support free threading Wouters predicts free-threaded becomes the default between 3.16–3.20 (2027–2031), with the GIL eventually disappearing next decade Michael #2: django-admin-site-search via Adam Parkin A global/site search modal for the Django admin, by Ahmed Aljawahiry. Hit cmd+k anywhere in the admin and you get a command-palette-style search window, kind of like the one in VS Code. It doesn't just search one model's list page. It searches your entire site in one box: App labels Model labels and field attributes Actual model instances (your data) Two ways to search the instances: model_char_fields (the default): runs an __icontains across every CharField (and subclasses) on the model. Zero config, works out of the box. admin_search_fields: defers to each ModelAdmin's existing get_search_results(), so it respects the search_fields you've already set up. The part I like: it's permission-aware out of the box. Users only see results for the apps and models they actually have view permission on, so you're not leaking anything through search. Results appear as you type, with throttling/debouncing so you're not hammering the server on every keystroke, and it's full keyboard nav: cmd+k to open, up/down to move, enter to go. It's responsive, does dark and light mode, and it pulls Django's built-in admin CSS variables so it just matches whatever admin theme you're running. Under the hood it's Alpine.js, but bundled into static so there's no external CDN dependency. Setup is about what you'd expect: pip install django-admin-site-search, add it to INSTALLED_APPS, mix the AdminSiteSearchView into your AdminSite, and drop a few template includes into base_site.html. Supports Python 3.8 through 3.14 and Django 3.2 through 6.0, MIT licensed, and everything is overridable if you want to skip certain models, add TextField matching, etc. Calvin #3: Qwen 3.6 27B is the sweet spot for local development Qwen 3.6 27B is being called the first local model that genuinely competes as a general-purpose intelligence — benchmarks put it at roughly mid-2025 frontier level (comparable to GPT-5 / Claude Sonnet 4.5) Runs locally via llama.cpp; on an M5 MacBook Max with 8-bit quantization + multi-token prediction, it hits ~32 tokens/sec using ~42GB RAM 4-bit quantization gets it under 18GB, runnable on 32GB devices; Nvidia RTX cards run it even faster The dense 27B is recommended over the faster MoE 35B A3B — author prefers higher quality output over raw speed Privacy and reliability are the pitch: fine-tunable, can't be taken down, suitable for sensitive/proprietary data Author sees this as a stepping stone — frontier open-weight models like GLM 5.2 are now locally runnable with company-grade hardware, and smarter-still local models are coming Michael #4: A large batch of PEPs are finalized A bunch of PEPs went from accepted to final. 668, 687, 691, 699, 701, 703, 728, 770, 773, 829 But this wasn't them making their way into CPython. It's an admin sorta thing. (Thanks PyCoders) See the commit. Extras Calvin: More fun bling for your terminal this time - https://charm.land/ Michael: Follow up from pls, What the pls? Thanks Pito. Joke: BEMoji A production-grade utility and component framework built entirely on emoji class names via Jeff Triplett

This episode is a fun crossover from our Python news and tips podcast, Python Bytes. We have had some big changes over there. Brian Okken has moved on and Calvin Hendryx-Parker has joined the show as the new co-host. To kick off this new era, we decided to do a longer and more personal episode called "All Our Tools". The idea is both of us talk about some of our most useful day-to-day developer and business owner tools that we think you all would find useful. It was so well received, that I'm bringing it to you all as a crossover episode. Enjoy and we hope you find something new and awesome to help you with your software and data science day to day. Episode sponsors Sentry Error Monitoring, Code talkpython26 Python in Production Talk Python Courses Links from the show @calvinhp@sixfeetup.social: sixfeetup.social @calvinhp.com: bsky.app calvinhp.com: calvinhp.com Original airing on Python Bytes: pythonbytes.fm pi: pi.dev superpowers: github.com Warp.dev: Warp.dev OhMyZSH: ohmyz.sh Commandbookapp.com: Commandbookapp.com Blink: blink.sh kitty: sw.kovidgoyal.net mosh: mosh.org tmux: github.com Claude code: www.anthropic.com Claude.md: Claude.md MacWhisper: goodsnooze.gumroad.com Handy: handy.computer Tailscale: tailscale.com Talk Python episode with Alex: talkpython.fm Telescopo: www.telescopo.app Typora markdown: typora.io formal documentation for many of my open source packages: mkennedy.codes Great Docs: posit-dev.github.io Statement on the US government directive to suspend access to Fable 5 and Mythos 5: www.anthropic.com No second date: x.com Watch this episode on YouTube: youtube.com Episode #553 deep-dive: talkpython.fm/553 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Part 2 of a 2-part episode From WEDI's Spring 2026 Conference, WEDI Board Member Pam Grosze (PNC Bank) concludes her conversation with leaders from several EHR platforms, discussing 0057 updates, ecosystem readiness—how providers should assess payer and vendor performance, what governance models actually drive outcomes, and where WEDI can help establish practical standards, metrics, and playbooks to move the market forward. The panel: Hans Buitendijk, Senior Director, Interoperability Strategy, Oracle Health Jason Vogt, Manager Development, APIs and Structured Documents, Meditech Sean Cotter, Software Developer, Epic Mohammad Chebli, VP of Interoperability, NextGen Gillian McCabe, Director of Product Management, Authorization Management, athenahealth

More than two decades after AWS helped usher in the public cloud era, many organizations are reassessing whether a cloud-first strategy still delivers the cost and operational benefits it once promised. While hyperscalers such as AWS, Azure and Google Cloud have built enormously successful businesses, cloud spending has become a growing concern for customers as usage expands and costs continue to rise. On this episode of The New Stack Makers, Summit's Byron Dill argues that many enterprises have become overly reliant on public cloud infrastructure, using it for workloads that may be better suited to private environments. Rather than treating the cloud as a one-size-fits-all solution, Dill advocates for a more segmented approach that places workloads where they make the most sense based on cost, security and management requirements. The conversation draws parallels to the rapid adoption of AI, where organizations often discover unexpected costs after implementation. Dill explores when repatriating workloads from the public cloud to private infrastructure can reduce expenses, simplify data management and improve control, while examining the costs, timelines and industries best positioned to benefit from a private cloud strategy.   Learn more from The New Stack around cloud spending:  How to Cut Cloud Waste Without Constricting Developer Productivity  AI agents need to spend money — Stripe and iWallet are building the rails  Join our community of newsletter subscribers to stay on top of the news and at the top of your game. 

Topics covered in this episode: Backup Docker volumes locally or to any S3 Pyodide 314.0 Release nb-cli: A Command-Line Interface for AI Agents and Notebook Automation Hindsight Agent Memory That Learns Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python AWS Community Day Midwest tomorrow Wednesday the 24th in downtown Indianapolis, Six Feet Up is sponsoring and there are 2 Sixies presenting Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an bonus digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Backup Docker volumes locally or to any S3 Via Bryan Weber (thanks Bryan!), who spotted it over on Virtualization HowTo. Find Bryan at bryanwweber.com. offen/docker-volume-backup is a lightweight companion container that backs up the volumes your apps actually depend on, then ships them somewhere safe. It's tiny: written in Go and about 25MB compressed, roughly 1/20th the size of the shell-based image (jareware/docker-volume-backup) that inspired it. Drop it into your docker compose file as a backup service, mount the volumes you care about as read-only, and you're off. Push backups to a pile of destinations: a local directory, plus any S3, WebDAV, Azure Blob Storage, Dropbox, Google Drive, or SSH-compatible target. Mix and match as many as you want in one run. Recurring cron-style backups in a Compose setup, or one-off backups straight from the Docker CLI. Production-friendly touches worth calling out: Rotates away old backups so you don't quietly fill the disk. GPG encryption for your archives. Notifications on finished and failed runs (so you find out about failures before you need the backup). Stop a container during backup for a consistent snapshot using a simple docker-volume-backup.stop-during-backup=true label, then auto-restart it. Run custom commands during the backup lifecycle (great for a database dump before the file copy). Docker Swarm support, plus arm64 and arm/v7 builds. Hello, Raspberry Pi homelab. Fun aside from Bryan: he searched our back catalog for this tool and the search came back so fast he thought it hadn't run. Love to hear it. Calvin #2: Pyodide 314.0 Release PEP 783 is the real news — Pyodide maintainers used to hand-build 300+ packages. Now anyone can publish Pyodide wheels to PyPI with cibuildwheel. The version jump from 0.29 to 314.0 is intentional — it now tracks the Python version, so 314.x = Python 3.14. Binary compatibility is locked per Python cycle, meaning packages you build today won't break on the next Pyodide release. sqlite3, ssl, and lzma are back in the default stdlib — no more await pyodide.loadPackage("sqlite3"). Bigger download, but a much smoother experience for newcomers. bigint precision bug is fixed — values above 2^53 were silently losing precision when crossing the Python/JS boundary. The new JsBigInt type makes the roundtrip correct. Worth flagging if anyone is doing numeric work in a browser app. Experimental TCP sockets in Node.js — you can now connect Pyodide to a real database (MySQL, PostgreSQL, Redis tested) when running server-side. Blurs the line between "Python in the browser" and "Python runtime anywhere Wasm runs." Michael #3: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation From Piyush Jain (Jupyter and LangChain maintainer) on the Jupyter blog: nb-cli: A Command-Line Interface for AI Agents and Notebook Automation. nb-cli is an experimental, Rust-based CLI to read, write, execute, and search Jupyter notebooks. The premise: agents are great at CLIs but terrible at hand-editing the nested JSON in an .ipynb, so let them operate on the notebook from the outside instead of running inside it. Works with or without a Jupyter server. No server? It reads/writes .ipynb files directly and talks to kernels over ZeroMQ. Connected to a live JupyterLab, your edits show up instantly via Y.js (the same CRDT Jupyter uses). Smart output format: instead of token-heavy JSON or ambiguous plain markdown, it uses @@cell / @@output sentinels with inline metadata. Less wasted context, unambiguous structure, and it degrades gracefully on truncation. The payoff is composability. "Add a summary section and run it" becomes one shell pipeline instead of six agent tool calls. And nb search notebook.ipynb --with-errors returns only the failing cells, so the agent skips the cells that worked. Claude Code tie-in: it ships as an agent skill. npx skills install jupyter-ai-contrib/nb-cli and your agent can drive notebooks via nb. Out of jupyter-ai-contrib, which aims to become an official Jupyter AI subproject. Still early (crates.io is at v0.0.5), so kick the tires before anything load-bearing. See also marimo-pair. Calvin #4: Hindsight Agent Memory That Learns AI agents forget everything between sessions — Hindsight gives them persistent memory that learns over time Simple three-method API: retain(), recall(), reflect() — store, retrieve, and reason over memories TEMPR retrieval runs semantic, keyword, graph, and temporal search in parallel for accurate results Automatically consolidates related facts into durable observations instead of piling up duplicates pip install hindsight-all runs the entire server in-process; integrates with LangChain, LlamaIndex, Pydantic AI, CrewAI, and more Extras Calvin: Clanker: A Word For The Machine **Ponytail — You know him. Long ponytail. Oval glasses. Has been at the company longer than the version control** **Klangk: Multi-User AI Sandboxing, Collaboration and Coding Platform** Cursor announces Origin performative-ui to quick start your new idea Michael: Astral Joins OpenAI: The Interview SpaceX to acquire Cursor And OpenAI renews Open Source support Portuguese subtitles are now available for Talk Python courses DSF is hiring including Six Feet Up support Joke: Oh Babe…

Learning and development facilitator Nikki Cross joined me on Ditching Hourly to share how she turned business books into a private podcast book club that helps members apply what they read.Nikki explains the mechanics of her Inner Work Business Book Club, how she uses a private podcast to turn book ideas into implementation, and why structure matters when business books are trying to change behavior instead of merely transferring information.Learn more about Nikki Cross and her work at The Inner Work. (00:00) - Introduction (00:22) - Nikki's Inner Work Business (01:38) - From Public Podcast to Private Book Club (06:32) - How the Book Club Episodes Work (13:51) - Reading Along, Listening Along, or Both (20:58) - From Edutainment to Implementation (24:03) - Fluff, Structure, and Business Books (31:42) - Choosing Books and Integration Months (36:50) - Books as Cheap Expertise, Audio as Proof (41:43) - How to Find Nikki ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

OpenAI just acquired Astral, the company behind uv, Ruff, and ty. And if your first thought was "wait, is uv toast?", you are not alone. But here's the twist Charlie Marsh shared with me: he thinks they may ship more open source at OpenAI than they ever did at Astral. On this episode, we get into the acquisition, the mixed feelings, the future of your favorite Python tools, and what it's like to build right at the center of the AI universe. Episode sponsors Sentry Error Monitoring, Code talkpython26 Talk Python Courses Links from the show Guest Charlie Marsh: github.com The announcement: astral.sh OpenAI: openai.com uv: github.com ty: github.com Ruff: github.com pyx: astral.sh Codex team: openai.com Anthropic did something similar by acquiring Bun: www.anthropic.com Daily Stars Explorer: emanuelef.github.io Agentic AI Programming for Python: training.talkpython.fm Python Web Security: OWASP Top 10 with Agentic AI: training.talkpython.fm Episode #552 deep-dive: talkpython.fm/552 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: pi + superpowers Terminal: Warp.dev + OhMyZSH {Blink,kitty} + mosh + tmux Claude code MacWhisper or Handy Tailscale Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training Six Feet Up is hosting a LinkedIn Live Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Calvin: @calvinhp@sixfeetup.social / @calvinhp.com (bsky) Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: pi + superpowers terminal-first, open-source coding agent Session management is a first-class citizen Extension model is what makes pi special — it's aggressively composable Superpowers brings a structured software development methodology as loadable skills Steps back and asks you what you're really trying to do “hand you the keys to the car” mode vs guardrails might not be for everyone Michael #2: Terminal: Warp.dev + OhMyZSH If you're using the base terminal with default settings, you have so much head-room for improvement. I've been using Warp.dev since Elvis talked me into it. ;) Remarkable terminal but the AI side of things is a bit junky, can be turned off OhMyZSH gives better autocomplete e.g. git branch [HTML_REMOVED] lists all branches in the local repo! Commandbookapp.com is excellent to keep the terminal focused on terminal things and more server commands and other automation in Command Book. Calvin #3: {Blink,kitty} + mosh + tmux Kitty Terminal — GPU-accelerated terminal emulator for macOS, Linux, and Windows with support for graphics, ligatures, and a powerful tiling layout system built right in. Blink Shell — The go-to terminal for iPad/iPhone power users; full SSH and Mosh client with a gorgeous interface built specifically for mobile professional workflows. Mosh — Mobile Shell replaces SSH for remote connections, surviving network switches, sleep cycles, and flaky Wi-Fi with zero dropped sessions — essential for staying connected to long-running agentic jobs. tmux — Terminal multiplexer that keeps sessions alive on your Linux server indefinitely; detach from a Mosh session on your Mac, reconnect from your iPad, and your agent is right where you left it. The combo — Kitty or Blink + Mosh + tmux creates a "persistent remote brain" pattern: your beefy Linux homelab runs the compute-heavy agent sessions 24/7, and any device becomes a thin client to drop in and out at will. Michael #4: Claude code I prefer the IDE experience, the new PyCharm + Claude integration is really good. VS Code too. Why IDE? Because we should still be present with our code and managing context is much easier. Use the best/latest models on high thinking. “Speed” is not your friend, it's just shortcuts. Create skills and agents and use them. Curate your own rules (e.g. Talk Python's Claude.md) Works well on non-coding things. Just create a folder, put a ton of files in there and it's like NotebookLM + Chat + more. Calvin #5: MacWhisper or Handy Transcribes your speech using your choice of Whisper or Parakeet models. All transcription is done on your device, no data leaves your machine. Automatic Speaker Recognition with local models. Handy is more basic, but open source and runs on all platforms. Michael #6: Tailscale No need to open ports at all, Tailscale makes machines inside the same network accessible to each other Works great for laptops, desktops, etc. But also available for servers. Though I still use cloud firewalls for servers. How I use it: My dev database server, preloaded with QA data, is always running on my home mac mini m4 pro. All my apps look for that server before looking locally and tailscale makes them always accessible to each other My local LLMs expose OpenAI API compatible APIs. Tailscale makes these accessible even while traveling or at a coffee shop. Use my mini as an exit node. All traffic is routed outbound from my local fiber network. Great to restricted IPs like accessing my servers without caring about the local IP. Screen share back to my home machines even while traveling. Listen to the Talk Python episode with Alex for a deeper conversation. Extras Calvin: Telescopo great Mac Markdown viewer/editor. Michael: One more: Typora markdown editor. Created formal documentation for many of my open source packages using Great Docs. Via Mark Little: Statement on the US government directive to suspend access to Fable 5 and Mythos 5 Joke: No second date

If you've ever been to PyCon, you know one of the best parts of the expo hall is Startup Row, a stretch of booths where early-stage companies built on Python show off what they're creating. But only attendees get to walk that lane, so let's bring it to everyone. In this episode, we stroll down Startup Row together. We kick things off with the organizers, Jason and Shay, who share the program's origin story going back to Paul Graham and the PSF, plus some surprising stats, including two unicorns among the alumni. Then we meet five startups: Tetrix, bringing AI to institutional investing in private markets. Arcjet, security that lives inside your app as an SDK. Phemeral.dev, serverless hosting built for Python web apps. CapiscIO, an identity and authority layer for AI agents. And Pixeltable, a multimodal database from Marcel Kornacker, co-creator of Apache Parquet. See if you can spot the theme running through them all. Let's go for a walk. Episode sponsors AgentField AI Talk Python Courses Links from the show Guests Naunidh Bhalla: linkedin.com Grant Gittes: linkedin.com Marcel Kornacker: linkedin.com Beon de Nood: linkedin.com Chinmaya Joshi: linkedin.com David Mytton: linkedin.com Shea Tate-Di Donna: linkedin.com Jason Rowley: linkedin.com Azul Garza: github.com Renée Rosillo: linkedin.com Tetrix: tetrix.co Tetrix Jobs: tetrix.co Arcjet: arcjet.com Pixeltable: pixeltable.com Phemeral.dev: phemeral.dev CapiscIO: capisc.io Episode #551 deep-dive: talkpython.fm/551 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Vulnerability and malware checks in uv HTTP GET requests with the Python standard library Millions of AI agents imperiled by critical vulnerability in open source package alembic-git-revisions Extras Joke Watch on YouTube About the show Goodbye and Thanks Brian Thanks Calvin for being part of this and future episodes! Also new time for the live show. Thanks Brian for all the hard work over the years. Calvin #1: Vulnerability and malware checks in uv release just yesterday by Astral https://astral.sh/blog/uv-audit uv audit scans dependencies for known vulnerabilities and abandoned packages via the OSV database — runs 4–10x faster than pip-audit Malware check runs on every install/sync, catching actively malicious packages (credential stealers, etc.) before they execute — including ones PyPI quarantined but lockfiles can still reference Enable malware scanning with UV_MALWARE_CHECK=1 — it's opt-in and in preview Future roadmap includes a resolver that steers toward vulnerability-free versions and install-time warnings scoped to newly added deps only Michael #2: HTTP GET requests with the Python standard library If you're doing HTTP in Python, you're probably using one of three popular libraries: requests, httpx, or urllib3. There have been issues with httpx lately. Niquest is another option: Drop-in replacement for Requests. Automatic HTTP/1.1, HTTP/2, and HTTP/3. WebSocket, and SSE included. But maybe less is more, especially in the age of agentic AI A good candidate needs two things to be true at once, not one: the used surface is small, and the behavior behind that surface is shallow. Calvin #3: Millions of AI agents imperiled by critical vulnerability in open source package "BadHost" (CVE-2026-48710) is a critical vulnerability in Starlette — the ASGI framework underlying FastAPI — with 325 million weekly downloads; also affects vLLM, LiteLLM, and most MCP server tooling The exploit is trivial: injecting a single character into an HTTP Host header bypasses path-based authentication, and can lead to credential theft, SSRF, and in some cases remote code execution MCP servers are a prime target since they store credentials for external services (email, databases, cloud accounts) — exposed data in the wild includes biopharma clinical trial DBs, full mailboxes, HR/PII pipelines, and AWS topology Fix is available — patch to Starlette 1.0.1 immediately; use the free scanner at mcp-scan.nemesis.services to check if your servers are still running a vulnerable version Open source sustainability footnote: the maintainer triages near-daily security reports solo, in his free time — most are AI-generated noise, and real ones like this still compete for the same evenings and weekends Michael #4: alembic-git-revisions By Julien Danjou from Mergify Automatic Alembic migration chaining based on git commit history. No more Multiple head revisions are present for given argument 'head'. See the introductory article Caused by two migrations landed with the same down_revision, and Alembic doesn't know which one comes first. The fix is always the same: someone manually edits the migration file to re-chain the revisions. The insight: git already knows the order Extras Calvin: GNU make can do pattern matching in the target. Not new at all, mentioned in the 1994-era docs. just and task don't have this super power on the target name yet. train-%: uv run ./train.py $* --save-hyper-params --overwrite $(TRAIN_ARGS) Michael: Updated my HTTP client using packages from httpx to httpx2: listmonk, umami, and memberful. For motivation, see this reddit thread. Joke: Accurate

Erik Torenberg speaks with tech analyst Benedict Evans about the current state of AI, what has changed over the past year, and which questions remain unanswered. The conversation covers coding agents, foundation models, AI infrastructure spending, software economics, and the tension between today's AI excitement and the long-term realities of technology adoption. Evans discusses why coding has emerged as AI's first breakout use case, how previous platform shifts can help frame the current moment, and why many of the most important questions about AI remain unresolved. Along the way, they explore the future of software, enterprise adoption, consumer behavior, and whether AI models ultimately capture value themselves or become infrastructure for the next generation of applications.   Resources: Follow Benedict Evans on X: https://x.com/benedictevans Follow Erik Torenberg on X: https://x.com/eriktorenberg Stay Updated:Find a16z on YouTube: YouTubeFind a16z on XFind a16z on LinkedInListen to the a16z Show on SpotifyListen to the a16z Show on Apple PodcastsFollow our host: https://twitter.com/eriktorenberg Please note that the content here is for informational purposes only; should NOT be taken as legal, business, tax, or investment advice or be used to evaluate any investment or security; and is not directed at any investors or potential investors in any a16z fund. a16z and its affiliates may maintain investments in the companies discussed. For more details please see a16z.com/disclosures. Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.

Founder of Upshift, Shawn Yeager, joined me on Ditching Hourly to talk about how AI is killing the billable hour and what professional services firms can do about it. Jonathan and Shawn dig into judgment versus execution, what firms should commercialize after AI, why cost-cutting is only the first move, and how agent workflows change what small and midsize firms can do.00:00 - Introduction01:54 - AI and the billable hour03:56 - The judgment sandwich05:19 - Strategy, execution, and hidden value09:06 - Client conversations about AI pressure13:26 - Validating AI output15:29 - Judgment, marketing, and cost of being wrong17:07 - AI transformation and commercialization20:08 - The hard parts big firms still need humans for22:20 - Cost recovery versus new offerings25:35 - Agents as extra employees26:40 - Interns versus chiefs of staff28:44 - Scaffolding agent workflows30:12 - From chatbots to delegated workflows37:00 - AI adoption inside firms42:01 - Closing remarksShawn Yeager runs Upshift, a firm focused on helping professional services firms understand what they sell after AI. His career has focused on emerging technology and getting it to market, including work on Microsoft's first browser team, the SaaS/cloud wave, mobile, Bitcoin, and AI. His background is in computer science, and his work has included sales, marketing, partnerships, consulting, Accenture, early-stage startups, and his own ventures. Learn more at upshiftco.com. (00:00) - Introduction (01:54) - AI and the billable hour (03:56) - The judgment sandwich (05:19) - Strategy, execution, and hidden value (09:06) - Client conversations about AI pressure (13:26) - Validating AI output (15:29) - Judgment, marketing, and cost of being wrong (17:07) - AI transformation and commercialization (20:08) - The hard parts big firms still need humans for (22:20) - Cost recovery versus new offerings (25:35) - Agents as extra employees (26:40) - Interns versus chiefs of staff (28:44) - Scaffolding agent workflows (30:12) - From chatbots to delegated workflows (37:00) - AI adoption inside firms (42:01) - Closing remarks ----Do you have questions about how to improve your business? Things like:Value pricing your work instead of billing for your time?Positioning yourself as the go-to person in your space?Productizing your services so you never have to have another awkward sales call or spend hours writing another custom proposal?Book a one-on-one coaching call with me and get answers to these questions and others in the time it takes to get ready for work in the morning.Best of all, you're covered by my 100% satisfaction guarantee. If at the end of the call, you don't feel like it was worth it, just say the word, and I'll refund your purchase in full.To book your one-on-one coaching call, go to: https://jonathanstark.com/callI hope to see you there!

Topics covered in this episode: CVE-2026-48710: A Maintainer's Perspective daily-stars-explorer Markdown to pdf with pandoc and typst postman2pytest Extras Joke Watch on YouTube About the show Brian #1: CVE-2026-48710: A Maintainer's Perspective Marcelo Trylesinski suggested by Lee Luocks Short version: users of Starlette: upgrade to Starlette 1.0.1 security professionals: we can't treat open source projects like corporations This top link is a Starlette security advisory with the title Missing Host header validation poisons request.url.path, bypassing path-based security checks The CVE apparently caused some negative press targeting starlette. However, “the vulnerability came from the application pattern and the deployment, never from something Starlette intended.” A quote from an OSTIF article: “This bug is a classic “responsibility gap” where if this maintainer didn't patch, thousands of exposed projects would have to individually secure their projects. In doing this work, they've voluntarily taken on the responsibility to protect the ecosystem from long-term systemic harm. As with all open source projects, they owed us nothing and could have left this to be everyone else's problem and took the extraordinary steps of helping the ecosystem.” Both X40 D-Sec and Ars Technica expected immediate fixes and responses from Starlette. That's not good. We can do better. Michael #2: daily-stars-explorer Explore the full history of any GitHub repository.

You wake up, brew the coffee, open GitHub, and there it is. Another pull request on your open source project. Thirteen thousand lines added. No issue filed first. No discussion. Just "here, please review this for me." Over the past year, GitHub activity has spiked roughly twelve times in a few short months, and a huge chunk of that signal is landing on the same small group of maintainers who were already stretched thin. The curl bug bounty got buried under AI-generated noise. Jazzband, the home of Django classics like pip-tools and the Django debug toolbar, hit what its maintainer called an "apocalypse" and started sunsetting. Even CPython just shipped fresh guidelines on AI-assisted contributions this week. So what does all of this actually look like from the receiving end of the pull request? On this episode, Paolo Melchiorre joins us to tell that story from inside the maintainer's chair. Paolo is a director of the Django Software Foundation, an organizer of PyCon Italy, a Django Girls coach, and he has spent the past year carefully collecting examples of how AI is reshaping open source contributions. The good, the bad, and the extra fingers. We dig into his PyCon US talk on AI-assisted contributions and maintainer load, why AI is best understood as an amplifier rather than a new kind of contributor, the wildly different policies across 86 open source foundations, whether projects banning AI today are reacting to last year's models. Episode sponsors AgentField AI Talk Python Courses Links from the show Guest Paolo Melchiorre: github.com DSF: www.djangoproject.com djangonaut-space: djangonaut.space PyCon Italia: 2026.pycon.it uDjango: github.com My PyCon US 2026 post: www.paulox.net AI-Assisted Contributions and Maintainer Load: www.paulox.net Senior Engineer Tries Vibe Coding: www.youtube.com Code Rabbit AI PR Reviews: www.coderabbit.ai GitHub Usage Graphs: github.blog Update on CPython's AI Policies: fosstodon.org High-Quality Chaos from Curl: daniel.haxx.se The Generative AI Policy Landscape in Open Source: redmonk.com Watch this episode on YouTube: youtube.com Episode #550 deep-dive: talkpython.fm/550 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Your documentation has two audiences now - humans reading the rendered HTML, and AI agents trying to make sense of your library. Rich Iannone and Michael Chow from Posit are back on Talk Python with a brand new Python documentation tool called Great Docs that takes both seriously. Rich is the creator of Great Tables, and before that the R package GT, the man has a serious eye for design, and he's pointed that energy at the Python docs ecosystem. We'll talk about how Great Docs spins up a polished site in three commands, why every page ships as Markdown for your favorite LLM, how it leans on Quarto for executable code blocks and tabbed install sections, and where it lands against Sphinx, MkDocs, and Zensical. Plus, you'll meet Tablin. Here we go. Episode sponsors Sentry Error Monitoring, Code talkpython26 Temporal Talk Python Courses Links from the show Guests Michael Chow: github.com Rich lannone: github.com Python Web Security with OWASP Top 10 and Agentic AI Course: talkpython.fm Great Docs: posit-dev.github.io/great-docs Great Tables: posit-dev.github.io GT Episode: talkpython.fm Sphinx: www.sphinx-doc.org mkdocs: www.mkdocs.org Zensical: zensical.org Hugo: gohugo.io Ghost: ghost.org Rs pkgdown: pkgdown.r-lib.org Quarto: quarto.org quickstart: posit-dev.github.io llms.txt file: llmstxt.org llms.txt: talkpython.fm mcp: talkpython.fm cli: talkpython.fm Watch this episode on YouTube: youtube.com Episode #549 deep-dive: talkpython.fm/549 Episode transcripts: talkpython.fm Theme Song: Developer Rap

Topics covered in this episode: Dumb Ways for an Open Source Project to Die How to create a pylock.toml lockfile https://github.com/facebook/Lifeguard Choosing a Python Logging Library in 2026 Extras Joke Watch on YouTube About the show Sponsored by us! Support our work through: Our courses at Talk Python Training The Complete pytest Course Patreon Supporters Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: Dumb Ways for an Open Source Project to Die Core categories The maintainer left The maintainer is still there Sabotage and capture The release pipeline broke Force majeure The world moved on The project split - Examples Bulma PRs still from 2023, issues and PRs with no maintainer response for years, last release 1.5 years ago diskcache Similar, got hired by OpenAI, crickets after that Brian #2: How to create a pylock.toml lockfile Tim Hopper Tim walks through using uv, pip and pdm to create pylock.toml files. Recommendation: use uv export --format pylock.toml -o pylock.toml He also has How to install from a pylock.toml lockfile with pip but the short version is: use -r because tools treat it like a requirements file Michael #3: https://github.com/facebook/Lifeguard Lifeguard is a static analyzer to detect Lazy Imports incompatibilities and ease the adoption overhead for Lazy Imports in Python. I'm more excited about lazy imports after my Cutting Python Web App Memory Over 31% experience Some Python patterns depend on imports executing immediately. For example: Module-level side effects — a module that registers a handler or modifies global state at import time will behave differently if that import is deferred. The registry pattern — a module that registers itself (e.g., adding to a global dict) when imported will silently fail to register under Lazy Imports. sys.modules manipulation — code that reads or writes sys.modules assumes prior imports have already executed. Metaclasses and __init_subclass__ — class creation side effects may depend on imports being resolved. Project Stage: Beta Lifeguard is in active development. We are aiming to be ready for general use by the Python 3.15 final release. Brian #4: Choosing a Python Logging Library in 2026 Ayooluwa Isaiah " which libraries matter, how they compare, where they overlap with the standard module, and when each one makes sense.” The slant with this article is the need to log json output, which seems reasonable as things like API entry and exit point logging will include json. Covered libraries standard library logging with a hat tip to python-json-logger Same site has a guide to setting up python-json-logger structlog Loguru Logbook picologging Some benchmarks with structlog, stdlib+json, and Loguru, with structlog coming out faster I liked the Loguru example I'm going to have to try @logger.catch and logger.exception() for easily logging exceptions and serialize=True to enable JSON output. Extras Brian: When Women Stopped Coding - Planet Money segment , spotted on BlueSky from Savannah Ostrowski Lean TDD is now leaner Still working on audio version, but some great changes in 0.7.1 version Ch 6, TDD Interpretations, move ATDD and some of BDD to chapter Ch 7, Change name to TDD with Teams: BDD and ATDD Ch 9, Lean TDD, streamline steps and chapter Ch 10, Change name to Lean TDD with Teams: Lean ATDD Ch 11, Lean TDD with AI, Add short discussion about guardrails and security Michael: New course: Python Web Security: OWASP Top 10 with Agentic AI All courses now with Spanish subtitles, see announcement Joke: Stop texting me

What if your database worked more like Git? Every change captured as an immutable event you can replay, instead of a single mutating row that quietly forgets its own history. That's event sourcing, and Chris May is back on Talk Python, fresh off our Datastar panel, to walk us through what it actually looks like in Python. We'll cover the core patterns, the libraries to reach for, when not to use it, and why event sourcing turns out to be a surprisingly good fit for AI-assisted coding. Episode sponsors Sentry Error Monitoring, Code talkpython26 Temporal Talk Python Courses Links from the show Guest Chris May: everydaysuperpowers.dev Intro to event sourcing e-book: everydaysuperpowers.gumroad.com Domain-Driven Design: The Power of CQRS and Event Sourcing: How CQRS/ES Redefine Building Scalable System: ricofritzsche.me DDD: www.amazon.com Understanding Eventsourcing (Martin Dilger): www.amazon.com Event Sourcing Explained using Football Video: www.youtube.com Why I finally embraced event sourcing and why you should too article: everydaysuperpowers.dev valkey: valkey.io diskcache: talkpython.fm eventsourcing package: github.com eventsourcing docs: eventsourcing.readthedocs.io John Bywater: github.com Datastar: data-star.dev Microconf: microconf.com Event Modeling & Event Sourcing Podcast: podcast.eventmodeling.org Python Package Guides for AI Agents: github.com Iodine tablets AI joke: x.com KurrentDb: www.kurrent.io Watch this episode on YouTube: youtube.com Episode #548 deep-dive: talkpython.fm/548 Episode transcripts: talkpython.fm Theme Song: Developer Rap