Another excellent PyCon AU. To all my US and EU based friends, I really do think it’s the best Python conference and you should come for 2027!
Remote
Noah K
@coderanger@cloudisland.nz
mastodon 4.5.18I casts the spells that makes the peoples fall down!
323 Followers
173 Following
50 Posts
Joined November 18, 2022
.@benno@eigenmagic.net “that’s the end of me ranting about [redacted]”
NARRATOR: No it wasn’t.
Replying to
@daisy@cloudisland.nz /me has been writing PyCon slides about this today :) My hot take is that normal code review is reconstructing enough fragments of the author's mental state to confirm _that_ was correct, the code itself is just a window into the mental state. The large pile of linear algebra does not posses a "mental" let alone any states thereof.
Boosted by @octothorpe@mastodon.online
Quick Friday task to improve your personal security: go check your browser and text editor plugins, and disable any you haven't used lately. You can always turn them back on later.
I really can't overstate just how much all the social hubs for software people (of all kinds) are dying due to bots and spam. Across the board, places to learn the craft of building good software are being locked down because the tide of capital-c Content™ is unceasing. I have been a community organizer for approaching 20 years now and I have no idea what to do anymore. Weather the storm and hope the price of LLM inference soon reflects its actual costs? Ban everyone that looks suspicious? I've ranted before that manual verification isn't a useful answer and I stand by that, but public spaces have an even harder problem than projects vetting contributions. We _can't_ vet everyone posting to r/python or the kubernetes slack, it's literally impossible. The next generation isn't just being handed The Robot as an easy way to "learn" (maybe? when it's not completely wrong?), for many it's the only way left. The last teacher left standing.
In honor of the passing, I share the only thing I know about Norwegian royalty: they have a penguin in the royal guard https://en.wikipedia.org/wiki/Nils_Olav
Can someone please show me how to see when a given container image tag on GHCR was pushed because all I can find is "over 1 year ago " on the page. They can't really be this bad at things, can they?
Replying to
@SnoopJ@hachyderm.io @brass75@twit.social If you want a coincidence, it's also Gregor Mendel's birthday and the anniversary of the Seneca Fall's Convention which kickstarted a lot of organized feminism in the US.
Preface: This is not a dunk or an I Told You So. It is a reminder that other (better?) worlds can exist.
GitHub Actions is clearly all over the tech news lately. A repeated weak point across the industry. I, for the most part, do not use GHA and you don't have to either. When I started my current job I set up Buildkite (replacing an unmaintained Concourse instance), wrote a ~100 line Python script using PyYAML and Jinja to give us a bit of composability, and then just wrote whatever CI scripting I needed. That's it, 100% written by me and my team other than those two libraries. And it works just fine. Took a week or two to get things going originally and we add new snippets every year or so.
Don't Repeat Yourself and Not Invented Here are good principles but you can always opt out when you feel like there are reasons to. Time reinventing wheels can be an investment in the future. If you feel you _must_ always use public tools due to lack of resources, maybe rethink your timelines.
Replying to
@AlSweigart That's the SomethingAwful approach and I think that's strong evidence it doesn't work, it's always been awash with sockpuppets and bots. Also creates massive economic power imbalance issues.
Replying to on hachyderm.io
lengthy digression, nuclear energy/physics, nuclear weapons
Replying to
@bitprophet@social.coop @nik@nkantar.social I’m neuromazeofith, I don’t make mana but I can deny good attacks
Replying to
@ancoghlan Somewhere deep in my nihilistic anxiety I worry that this is some kind Revenge of Dunbar's Number. That trying to maintain communities of this size is, eventually, a denial-of-service attack on the human psyche. Twitter even in its heyday felt like a mental DDoS and it's only getting worse. My life would be so much worse in this new world where everything must be local, and I don't want that to be the path.
Replying to
@raiderrobert @AlSweigart That is fair, for a long time I tried to encourage local mentorship and that is far more resilient to whatever mess the world is turning into. But anything organizing that at scale puts things right back to square one so folks just have to luck into the mentorship funnel? I guess it's something but feels bad :(
Replying to
@hynek@mastodon.social @nedbat@hachyderm.io I frequently ask people who insist on C because it's close to the metal or whatever: "Okay, is production going to deploy to a PDP11? Because I can make that happen." They do not often find this amusing.
Replying to
@emairi@cloudisland.nz "Good luck with that, my contract rate to fix your automation will be 10 times my current hourly"
Replying to
@emairi The new is always built on the bones of the old. When I was in Uni I loved to buzz the career fair booth of the one nearby company desperately trying to hire OpenVMS engineers, ask them leading questions that made it clear I knew it, and then walk away.
Replying to
@froztbyte@mastodon.social @glyph@mastodon.social @SnoopJ@hachyderm.io To put my bias on the table, I still watch their stuff some of the time but I've become acutely aware of how every single piece of "content" is some kind of cross-promotional effort and it's pretty annoying at this point.
Replying to
@hynek@mastodon.social @freakboy3742@cloudisland.nz @chrisjrn@social.coop there was a time when SourceForge seemed unstoppable and then one day it was … gone
Replying to on mastodon.social
@mogwai_poet@mastodon.social how dare you take jobs away from grad students making up names on clay tablets
Replying to
@emairi@cloudisland.nz US banks are currently paying through the nose for COBOL devs because almost all ATM cores are still on it.
Replying to
@stanfromireland@mastodon.social Subsidized runners are a different question. Microsoft could donate the same amount of Azure VMs. And I would argue they should give a lot more, but that's a bigger problem to solve. Free or reduced-cost compute for FOSS CI is a nice pot-sweetener but it shouldn't stop us from pushing the tech giants to properly support their dependencies.
Replying to
@Ashedryden Yeah. Notable features include Charles Dance as Lord Vetinari (amazing) and good enough charisma from everyone except maybe Adora to carry the mild mangling of the story.
Replying to
@Ashedryden Toys, live action Ghost in the Shell, Tomorrowland (maybe honorable mention for Going Postal TV movie adaption but that deserves like 60% of its under-rated-ness).
Replying to
@robinadams I hope you plan to build that software in assembly on punchcards or something. It's easy to talk about local community software when you ignore the shoulders of giants on which pretty much everything stands.
Replying to
@malwareminigun @chansecodina It would help a little, it would have created a new roadblock to this kind of attack. But in the end all that roadblock does is force an attacker to spend extra time finding a weak point somewhere in the strong-set, one person who is indirectly trusted but does a bad job vetting new friends. Maybe that adds a year to the timeline but we have 100% proof that these attackers are extremely patient so I don't feel much better overall. And of course the next time this happens, a human won't have been doing anything for that year, it will be some horrible LLM conglomeration spinning a loop with minimal oversight.
@AlSweigart@mastodon.social Wander to the edge of the abyss and speak the cursed quotes into being.
Replying to
@davidism@mas.to a thing i didn’t see in the comments, Django puts its finger on the scale because db_default is such a new feature, prior to that you had to with nullable when adding a new column or it would break during rollout.
Replying to
@jacob@social.jacobian.org I clicked subscribe on the main GitHub issue a few days and man it’s ridiculous
Replying to
@freakboy3742@cloudisland.nz https://github.com/stonerl/Thaw is the current active fork last I checked.
Boooooo no Tam walker.
Replying to
@malwareminigun I think you might be misunderstanding this as being about package security, which I'm not sure anyone is discussing web-of-trust for? The recent push between projects like Vouch and humans.json has been to do maintainer-level trust analysis. I posit this will be ineffective.
Replying to
@malwareminigun To the best of my knowledge that is not true. What has been reconstructed of Jia (for lack of a better name) getting added was mostly via sock-puppets and pressure tactics. The original maintainer was effectively bullied into adding them, relatively cursory checks showed this person didn't exist until shortly before the attack started.
Replying to
@whack@hachyderm.io I continue liking Deckset. It's far simpler but the benefits of editing in pure markdown are nice.