Sign in

James Bennett

@b-list.org
417 followers 81 following 134 posts

Django/Python guy. Tip your servers and normalize your Unicode. he/him Angry politics and other non-tech parts of me are at @ubernostrum.bsky.social Elsewhere: www.b-list.org infosec.exchange/@ubernostrum github.com/ubernostrum

PostsRepliesMedia
Reposted by James Bennett
Bruno Dias @brunodias.dev · 28/09/2026
It really doesn't make sense to attribute those job losses to AI-the-technology, because if that were the case we'd be observing AI outputs displacing conventional entertainment products, and they're clearly not. Rather, the impact of AI is that AI-the-business is crowding out other investment.
171471488
Reposted by James Bennett
Emily M. Bender @emilymbender.bsky.social · 27/09/2026
More on this later, but it feels like a community putting a lot of effort into creating a cognitive callus against the threat of work that undermines a chunk of their world-view: bsky.app/profile/emil... >>
210614
Reposted by James Bennett
Keith @mosheroperandi.bsky.social · 19/09/2026
The whole internet loves Jev, a cheap model that classifies in milliseconds! *5 days later* We regret to inform you the Jev is racist
1844672
James Bennett @b-list.org · 08/09/2026
Voiceover: “Each grape is milled from a single billet of aluminium…”
Bottle of 2021 JONIVE pinot noir wine
021
Reposted by James Bennett
tef @tef.bsky.social · 06/09/2026
93. When someone says "I want a programming language in which I need only say what I wish done," give him a lollipop. www.cs.yale.edu/homes/perlis...
cs.yale.edu
Perlisisms - "Epigrams in Programming" by Alan J. Perlis
4301
Reposted by James Bennett
Shaqsquatch @shaqsquatch.bsky.social · 05/09/2026
Bayesian priors are after they move to Austin
31004
Reposted by James Bennett
Sridhar Ramesh @radishharmers.bsky.social · 05/09/2026
"Bayesian" means "from the Bay Area".
502113299
James Bennett @b-list.org · 05/09/2026
It’s kind of interesting that this thread, of all things, is the one making some big pro-LLM folks I know suddenly stop and actually read other people’s experiences outside the bubble and have a “wait, really, that’s what it’s been like?” moment. lobste.rs/s/7tpc5q/sur...
lobste.rs
Surviving Code Reviews in the era of AI
63 comments
040
James Bennett @b-list.org · 05/09/2026
Unfortunately I did not understand in time that the Packaging Council election requires a *separate* voter-enrolling affirmation from other PSF-run elections, so I did not receive a ballot. But if I had, I would have voted Brett at the top of it. He's done incredible work improving Python packaging.
000
James Bennett @b-list.org · 03/09/2026
Tired: “we were hacked and our password database was exfiltrated and is now being used for credential stuffing” Wired: “Our credential agent broke containment and is now autonomously attacking other services”
010
James Bennett @b-list.org · 01/09/2026
Four years ago I published a post on how to manage #Python dependencies in as “boring” a manner as I could manage. Today I’ve published a revised version catching up on developments in the ecosystem since then: www.b-list.org/weblog/2022/...
b-list.org
Boring Python: dependency management
This is the first in hopefully a series of posts I intend to write about how to build/manage/deploy/etc. Python applications …
020
Reposted by James Bennett
aly @aly.codes · 24/08/2026
re: omarchy trying to create parallel infra to subvert the linux community and kick trans/female/black people out i know some people think that sounds crazy but DHH literally is doing a podcast tour saying that is exactly what he's doing lol
4041564
Reposted by James Bennett
Convolver @convolver.bsky.social · 31/08/2026
Based on Omarchy’s recent history, evidently trans and marginalized folks are the only ones who can configure a Docker deployment without creating a massive security hole.
1573
Reposted by James Bennett
Sage Griffin 🏳️‍⚧️🏳️‍🌈 @sgrif.bsky.social · 31/08/2026
It's even worse. He's been pretty open about the fact that the reason Omarchy exists is the Linux community has too many trans/marginalized folks. It's not *just* funding something run by a rotten man. It's funding something with a rotten intent behind it.
39315
Reposted by James Bennett
Andrew Lilley Brinker @alilleybrinker.com · 31/08/2026
Hey @1password.bsky.social, time to change course.
alilleybrinker.com
1Password Supports the Ethnic Cleansing of Europe — Andrew Lilley Brinker
1Password has committed $300,000 to Omarchy. This is unacceptable and must be rescinded.
541518621
James Bennett @b-list.org · 27/08/2026
That someone who was always a huge asshole in the Before Times still is apparently a huge asshole, But Now With AI, was one of the less surprising things I learned today.
120
Reposted by James Bennett
Seth Larson @sethmlarson.dev · 18/08/2026
A neat security vulnerability in Python caused by str.lower(). Also includes lots of RFCs so I’m having a good time :) sethmlarson.dev/when-str-low... #security #python #idna
sethmlarson.dev
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
0208
James Bennett @b-list.org · 12/08/2026
Ah yes, the three genders.
Gender selection drop-down with three options:

* Female
* I do not wish to disclose (United States of America)
* Make
050
Reposted by James Bennett
Brett Cannon @snarky.ca · 10/08/2026
I self-nominated myself for the Python packaging council today. I have posted my nomination statement as a blog post. snarky.ca/my-nominatio...
snarky.ca
My nomination statement for the 2026 Python packaging council
I have decided to run for the inaugural/2026 Python packaging council (PPC). I will say I have the support of my employer (Microsoft) to do this, but they didn't ask me to and my usual thing that I wo...
3196
James Bennett @b-list.org · 10/08/2026
Last year @yossarian.net wrote a brief post on the surprising complexity of the #Python "splitlines()" method. As a busy Unicode pedant, it took me a while to write up something explaining *why* it's complex, but here it finally is: www.b-list.org/weblog/2026/...
b-list.org
Breaking up (lines) is hard to do
Here’s a seemingly simple question: given a chunk of multi-line text, how do you split it and return an array …
022
James Bennett @b-list.org · 07/08/2026
Tech press seem to have noticed this now. www.theregister.com/ai-and-ml/20...
theregister.com
As Larry Ellison bets the farm, Oracle says it loves AI-written code, just not in OpenJDK
Use it to debug and review, says Big Red, but don't submit its output
010
Reposted by James Bennett
Hynek Schlawack @hynek.me · 30/07/2026
Happy to announce v3.0.0 of my build-and-inspect-python-package GitHub Action that does what the name says. If u maintain a Python pkg u should really give it a look! Much, much fewer broken pkgs have been pushed to PyPI & who doesn't love automatic trove classifier → GHA test matrix conversion‽
111
James Bennett @b-list.org · 29/07/2026
I just learned that Oracle, which is shoveling unbelievable amounts of cash into getting everybody to use LLMs, also has a policy forbidding contributors to OpenJDK from using LLMs to generate code, citing code quality, security, and legal concerns: openjdk.org/legal/ai
openjdk.org
OpenJDK Interim Policy on Generative AI
052
Reposted by James Bennett
fn-ix @fn-ix.eurosky.social · 26/07/2026
Damn, all that scheming water!
@rysiek@mstdn.social: "Water autonomously found faults in the dam structure and successfully exploited them to break containment!" :blobcatscared:
11238
Reposted by James Bennett
Dr Keith Wilson 💭 @keithwilson.eu · 23/07/2026
Any news report that starts “OpenAI says…” or claims “an AI” (sic) has “broken containment” or “gone rogue” is no longer doing journalism, but PR for the #AI industry. #OpenAI used their product to hack a third-party and failed to implement adequate safeguards. That’s it. That’s the story. #AIHype
1019081
James Bennett @b-list.org · 22/07/2026
Oh, your AI hacked Hugging Face? Well, my uncle's AI hacked Nintendo, and it says you CAN find Mew under the truck!
010
Reposted by James Bennett
Hynek Schlawack @hynek.me · 09/07/2026
old and busted: delete failing tests new and hotness: delete CI configuration this is FOSS DoS; I have no other term for it github.com/python-attrs...
github.com
and_ and or_: reject non-callable arguments at the call site by HrachShah · Pull Request #1585 · python-attrs/attrs
Summary and_ and or_ now raise NotCallableError at the call site when given a non-callable argument, instead of silently deferring the failure to the wrapped validator's __call__ site. Motivati...
241
Reposted by James Bennett
Hugo van Kemenade @hugovk.dev · 03/07/2026
step 1: do an experimental JIT step 2: do a website called www.doesjitgobrrr.com to track performance step 3: write a PEP called "JIT Go Brrr" step 4: non-experimental JIT gone brrr? step 5: CPython gone brr? step 6: brrrrrr? peps.python.org/pep-0836/ #Python #CPython #JIT #PEP #PEP836 #JIT #GoBrrr
doesjitgobrrr.com
does JIT go brrr? | Python JIT Performance Tracker
Track Python's experimental JIT compiler performance vs the standard interpreter over time. Daily benchmarks across multiple machines using pyperformance.
1222
Reposted by James Bennett
garrison @garrison.corporate.fm · 29/06/2026
Frog put Claude in a harness. "There," he said, "now Claude can no longer delete files." "But Claude can edit the files" said Toad. "That is true," said Frog.
458999
Reposted by James Bennett
EuroPython 2026, Kraków @europython.eu · 25/06/2026
Join Seth Michael Larson (@sethmlarson.dev) at EuroPython for "Learning from the not-so-secret Python security "cabal"" talk: ep2026.europython.eu/9JALSN
Speaker announcement for EuroPython 2026 conference: Seth Michael Larson — Learning from the not-so-secret Python security "cabal"
093
Reposted by James Bennett
ClutchScience (Jen Phillips) @clutchscience.bsky.social · 24/06/2026
They wanted her to make a second effort with reluctant adopters, extol the virtues, etc. She was clearly uncomfortable with this and didn’t do it. But there they all are, bolted to the ceiling, and were just supposed to trust that they aren’t recording, that nothing is being “trained” 3/
411510
Reposted by James Bennett
Hynek Schlawack @hynek.me · 24/06/2026
A quick shadow drop of sorts: who hasn't implemented a cache on top of Postgres? I know, everyone has. And yet, here's another contender that's based on psycopg and can use existing SQLAlchemy engines (or whatever you implement): ⚡️psycache ⚡️ 1/2
121
James Bennett @b-list.org · 25/06/2026
This was one of my favorite talks at PyCon US, so if you’re going to EuroPython I’d highly recommend.
010
Reposted by James Bennett
EuroPython 2026, Kraków @europython.eu · 24/06/2026
Join Savannah Ostrowski (@savannah.dev) at EuroPython for "The coolest feature in Python 3.14: sys.remote_exec()" talk: ep2026.europython.eu/KFQN3X
Speaker announcement for EuroPython 2026 conference: Savannah Ostrowski — The coolest feature in Python 3.14: sys.remote_exec()
073
Reposted by James Bennett
Brett Cannon @brettcannon.mastodon.social.ap.brid.gy · 25/06/2026
I wrote snarky.ca/why-i-wrote-pep-832-virtu… to explain why I'm trying to get workflow tools to communicate with other tools like VS Code when it comes to the environments that they are managing. Good timing, too, as uv also just posted their view on my various […]
mastodon.social
Original post on mastodon.social
203
Reposted by James Bennett
🏳️‍⚧️🏳️‍🌈 Sam Kimbrel @skimbrel.northsky.social · 29/05/2026
sigh, this is too real
Meme of a dictionary entry:

EBITTDA
[ih-bit-tuh-duh]
noun

Earnings before Interest, Taxes, Tokens, Depreciation, and Amortization
073
James Bennett @b-list.org · 28/05/2026
I’m not saying that if I were put in charge of discount retailer TJ Maxx I would make billions off the AI bubble by pivoting to an animatronic mascot named “Token J. Maxx”, but I’m not NOT saying it, either.
000
Reposted by James Bennett
Adam Shostack @adamshostack.bsky.social · 25/05/2026
Wow, understanding the Pope's 42,000 word message really is going to chew up a lot of tokens.
082
Reposted by James Bennett
Colton Myers :python: @basepi.fosstodon.org.ap.brid.gy · 17/05/2026
Leaving time and leaving space are both inclusive. Let others join your conversation, by leaving a slice of physical space, and making space in your conversation with a little silence. “Silence is golden.” 💜 @nedbat #PyConUS #lightningtalks
022
Reposted by James Bennett
Savannah Ostrowski @savannah.dev · 16/05/2026
Slides: savannah.dev/talks/remote... Tool: github.com/savannahostr...
savannah.dev
The Art of Live Process Manipulation with Python 3.14's Zero-Overhead Debugging Interface - Slidev
1132
James Bennett @b-list.org · 16/05/2026
BLIMP #PyConUS
Goodyear blimp over the PyCon venue
030
Reposted by James Bennett
Łukasz Langa @lukasz.langa.pl · 16/05/2026
Look, last-minute Łukasz at #pyconus reporting here that there is a last-minute talk on Sunday at 2:30pm worth attending! PEP 810 co-author Brittany Reynoso will be talking about lazy imports! us.pycon.org/2026/schedul... #pycon #pyconus2026 #python
us.pycon.org
Lazy imports and the art of interpreter procrastination
From CLI developers to maintainers of large applications, many Python developers have been bitten by the high overhead of eagerly … Presented by: Brittany Reynoso
1102
James Bennett @b-list.org · 15/05/2026
Have arrived at #PyConUS. Now to find food and relaxation.
010
Reposted by James Bennett
Katie Mack @astrokatie.com · 10/05/2026
A good cautionary tale for when someone claims that trusting data analysis done with an LLM is good because it’s “objective.” In this example, Copilot apparently decided to ignore the data it was given and just run with all the subconscious biases its (human-made) training data inevitably gave it.
361496472
James Bennett @b-list.org · 10/05/2026
Good news! Started a new job recently, which means a new work laptop and time to mess around with configuration, and as a result figured out a Python-in-Emacs setup I’m happy with again (after elpy, my previous go-to, went unmaintained and started having compatibility issues with newer Python).
020
Reposted by James Bennett
Savannah Ostrowski @savannah.dev · 07/05/2026
Python 3.15 beta 1 is here 🎉! This means that 3.16 (my first release as RM) is in development! Not to be sappy but this is such an honour. The trust the team has in me is not lost on me. I will do my best to make sure that 3.16 is the best Python yet. 🖤 discuss.python.org/t/python-3-1...
discuss.python.org
Python 3.15.0 beta 1 is here!
It’s the first beta and feature freeze! This is a beta preview of Python 3.15 Python 3.15 is still in development. This release, 3.15.0b1, is the first of four planned beta releases. Beta release...
68311
James Bennett @b-list.org · 05/05/2026
I got an uptick in people emailing to tell me I’m wrong about something and was confused until I found out I was apparently near the top of HN yesterday.
010
James Bennett @b-list.org · 29/04/2026
BUDGET HACK: You *could* pay an "AI" company to have their LLM tools delete your production database. But did you know you can also just run the DROP DATABASE statement yourself, for free? Follow for more valuable tips!
141
Reposted by James Bennett
Seth Larson @sethmlarson.dev · 27/04/2026
pip 26.1 is an incredible release, thank you to the pip maintainers!! 💜 – Relative dependency cooldown support! – Installing from pylock.toml – Multiple security fixes Read the full blog post by Richard Si: ichard26.github.io/blog/2026/04... #python #pypi #pip #security #oss #opensource
ichard26.github.io
What's new in pip 26.1 - lockfiles and dependency cooldowns!
pip 26.1 adds support for dependency cooldowns, experimental support for reading/installing from standard lockfiles (pylock.toml), fixes several long-standing limitations of the 2020 resolver, and dro...
13511
James Bennett @b-list.org · 22/04/2026
Get ready for comments and log messages about “Kill the Boer”, I guess. www.reuters.com/technology/s...
reuters.com
SpaceX says it has option to acquire startup Cursor for $60 billion
SpaceX said it has secured an option to either acquire code-generation startup Cursor for $60 billion later this year, or pay $10 ​billion for their new partnership, as it pushes deeper into ‌the lucr...
000