Sign in

Seth Larson

@sethmlarson.fosstodon.org.ap.brid.gy
34 followers 1 following 328 posts

:python: Security, Fellow @ThePSF 🐍 Trans rights, BLM, Minnesoootan, he/him sethmlarson.dev [bridged from fosstodon.org/@sethmlarson on the fediverse by fed.brid.gy ]

PostsRepliesMedia
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 03/06/2025
Thanks to the work of Python Release Managers and all the Developers-in-Residence we have a coordinated #Python #security release of all versions for 5 CVEs all in one day (1 critical, 3 high, 1 medium) […]
fosstodon.org
Original post on fosstodon.org
238
Reposted by Seth Larson
Shonumi @shonumi.mastodon.social.ap.brid.gy · 03/06/2025
New article about the GBKISS LINK is live: shonumi.github.io/articles/art38.ht… This one examines an infrared modem released by Hudson in 1998. This enabled GB-to-PC connections and opened up the internet to the Game Boy. Here, I detail the process of emulating its infrared […]
mastodon.social
Original post on mastodon.social
1108
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 03/06/2025
I'm collecting all 242 unique treasures in #Pikmin 2 across the three regions (US, JP, and PAL). I've created this web page which automatically updates as I collect more treasures while playing on real #GameCube hardware. 👉 sethmlarson.dev/pikmin-2-internatio…
Table showing Pikmin 2 treasures, regions, and areas along with collected datetimes. Some of the treasures have been collected, some haven't yet been collected.
001
Reposted by Seth Larson
retrodotcards.com @retrodotcards.com · 02/06/2025
CaitSith2, an original E-Reader hacker from the early 2000s who made most of the E-Reader tools we still use today said this about printing out dotcodes "The other thing was that refilled <printer ink> cartridges never worked for that purpose, only brand-new ones would" Printing these is so hard!
0181
Reposted by Seth Larson
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 29/05/2025
I am observing #VolunteerResponsibilityAmnestyDay this Spring and published my list ahead of the date to give you a chance to reflect on your own responsibilities. sethmlarson.dev/observing-volunteer… Thanks to @brainwane for creating this time of intentional reflection […]
fosstodon.org
Original post on fosstodon.org
005
Reposted by Seth Larson
daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 29/05/2025
Three key points about the CRA for Open Source maintainers: 1. mere contributors have no obligations, most maintainers have no obligations. Only maintainers that make a profit can be considered manufacturers - the outstanding question is where exactly that line is drawn. (And really, such […]
mastodon.social
Original post on mastodon.social
053
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 29/05/2025
I am observing #VolunteerResponsibilityAmnestyDay this Spring and published my list ahead of the date to give you a chance to reflect on your own responsibilities. sethmlarson.dev/observing-volunteer… Thanks to @brainwane for creating this time of intentional reflection […]
fosstodon.org
Original post on fosstodon.org
005
Reposted by Seth Larson
Hynek Schlawack @hynek.mastodon.social.ap.brid.gy · 28/05/2025
giving a shit: underrated dansinker.com/posts/2025-05-23-who-…
dansinker.com
The Who Cares Era
Earlier this week, it was discovered that the _Chicago Sun-Times_ and the _Philadelphia Inquirer_ had both published an externally-produced "special supplement" that contained facts, experts, and book titles entirely made up by an AI chatbot. There's been a lot written about this (former _Chicago Reader_ editor Martha Bayne's is the best), and I don't need to rehash it all. But the thing that is most disheartening to me is how at every step along the way, nobody cared. The writer didn't care. The supplement's editors didn't care. The biz people on both sides of the sale of the supplement didn't care. The production people didn't care. And, the fact that it took _two days_ for anyone to discover this epic fuckup in print means that, ultimately, the reader didn't care either. It's so emblematic of the moment we're in, the Who Cares Era, where completely disposable things are shoddily produced for people to mostly ignore. AI is, of course, at the center of this moment. It's a mediocrity machine by default, attempting to bend everything it touches toward a mathematical average. Using extraordinary amounts of resources, it has the ability to create something _good enough_ , a squint-and-it-looks-right simulacrum of normality. If you don't care, it's miraculous. If you do, the illusion falls apart pretty quickly. The fact that the userbase for AI chatbots has exploded exponentially demonstrates that _good enough_ is, in fact, good enough for most people. Because most people don't care. (It's worth pointing out that I'm not a full-throated hater and know people—coders, mostly—who work with AI that _do_ care and have used it to make real, meaningful things. Most people, however, use it quickly and thoughtlessly to make more mediocrity.) It's easy to blame this all on AI, but it's not just that. Last year I was deep in negotiations with a big-budget podcast production company. We started talking about making a deeply reported, limited-run show about the concept of living in a multiverse that I was (and still am) very excited about. But over time, our discussion kept getting dumbed down and dumbed down until finally the show wasn't about the multiverse at all but instead had transformed into a daily chat show about the Internet, which everyone was trying to make back then. Discussions fell apart. Looking back, it feels like a little microcosm of everything right now: Over the course of two months, we went from something smart that would demand a listener's attention in a way that was challenging and new to something that sounded like every other thing: some dude talking to some other dude about apps that some third dude would half-listen-to at 2x speed while texting a fourth dude about plans for later. Hanif Abdurraqib, in one of his excellent Instagram mini-essays the other week, wrote about the rise of content that's designed to be consumed while doing something else. In Hanif's case, he was writing about _Time Machine_, his incredible 90 minute deep dive into The Fugees' seminal album _The Score_. Released in 2021, Hanif marveled at the budget, time, and effort that went into crafting the two-part 90 minute podcast and how, today, there's no way it would have happened. He's right. Nobody's funding that kind of work right now, because nobody cares. (It's worth pointing out that Hanif wrote this using Stories, a system that erased it 24 hours later. Another victim of the Who Cares Era.) Of course we're all victims of the biggest perpetrators of this uncaring era, as the Trump administration declares "Who Cares?" to vast swaths of the federal government, to public health, to immigrant families, to college students, to you, to me. As Elon Musk's DOGE rats gnaw their way through federal agencies, not caring is their guiding light. They cut indiscriminately, a smug grin on their faces. That they believe they can replace government workers—people who care an _extraordinary_ amount about their arcane corner of the bureaucracy—with hastily-written AI code is another defining characteristic of right now. I keep coming back to the word "disheartening," because it all really is. Without getting into too many specifics, I recently was involved in reviewing hundreds of applications for something. Over the course of reviewing, I was struck by the nearly-identical phrasing that threaded through dozens of the applications. It was eerie at first, like seeing a shadow in the distance, then frustrating, and ultimately completely disheartening: It was AI. For whatever their reasons, a bunch of people had used a chatbot to help write their answers to questions that asked them to draw from their own, unique, personal experience. They had fed their resumes or their personal websites or their actual stories and experiences into the machine, and it had filled in the blanks, Mad Libs-style. I felt crushed. Until. Until I read an application written entirely by a person. And then another. And another. They _glowed_ with delight and joy and sadness and with the unexpected at every turn. They were human. They were written by people that cared. In the Who Cares Era, the most radical thing you can do is care. In a moment where machines churn out mediocrity, make something yourself. Make it imperfect. Make it rough. Just make it. At a time where the government's uncaring boot is pressing down on all of our necks, the best way to fight back is to care. Care loudly. Tell others. Get going. As the culture of the Who Cares Era grinds towards the lowest common denominator, support those that are making real things. Listen to something with your full attention. Watch something with your phone in the other room. Read an actual paper magazine or a book. Be yourself. Be imperfect. Be human. Care.
004
Reposted by Seth Larson
retrodotcards.com @retrodotcards.com · 28/05/2025
Finally getting around to updating the long neglected website. The front page has been redone, and now I'm giving each game their instruction manual pages. Here's Bomb Hunter's page so far.
The instruction manual page for Bomb Hunter. Still a work in progress.
2322
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 27/05/2025
An awesome development in the #GameCube hacking community: an open source reimplementation of the WaveBird protocol. github.com/loopj/wavephoenix There are tons of WaveBird controllers with no corresponding receiver out there on the market. This makes me want to collect a 4-set of […]
fosstodon.org
Original post on fosstodon.org
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 26/05/2025
15/42 GameCube disks archived. I finally opened my Japanese copy of Pikmin I bought from "Super Potato" a year ago and the disk is so much more visually appealing than the NTSC copy!
NTSC disk is all lime green where the JP disk is yellow and dark green in two halves.
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 25/05/2025
Now that my #GameCube #FlippyDrive is installed and operational I'm slowly using their backup tool to archive my game collection. There's 42 unique titles, ~40 minutes per archive operation so... see you 28 hours later! 😬
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 24/05/2025
What have they done to my boy? #FlippyDrive installation day! Blog post will follow, especially for the Ethernet adapter which isn't documented officially yet #GameCube
000
Reposted by Seth Larson
Erin Kissane @kissane.mas.to.ap.brid.gy · 23/05/2025
I don't think it's possible to be where we are in #uspol (and in the global authoritarian slide) without our information ecosystems being such a mess. There's a ton of work to do on the distribution side of the problem, but also on the info-making side: Even great newsrooms aren't built to make […]
mas.to
Original post on mas.to
2128
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 23/05/2025
Macho Nacho published a video today about the new VMU Pro (Dreamcast) from the same folks that made the MemCard Pro GC. This reminds me how excited I am to finally test out and build something for the MemCard Pro GC once I install my FlippyDrives... I've been sitting on this device for quite a […]
fosstodon.org
Original post on fosstodon.org
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 22/05/2025
While I was away at #PyConUS my two #GameCube FlippyDrives were delivered... 8 player Double-Dash is getting closer 👀
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 21/05/2025
Apparently the only way @signalapp can opt-out of #Windows #Recall exposing all of your private messages is by setting a "this application is DRM" flag. What a lovely and totally thought-out feature Recall is shaping up to be after a year of "iterating" […]
fosstodon.org
Original post on fosstodon.org
003
Reposted by Seth Larson
daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 20/05/2025
Allow us to block Copilot-generated issues (and PRs) from our own repositories on #github github.com/orgs/community/discussio…
github.com
Allow us to block Copilot-generated issues (and PRs) from our own repositories · community · Discussion #159749
Select Topic Area Product Feedback Feature Area Issues Body I find the following two news items on the front page: https://github.blog/changelog/2025-05-19-creating-issues-with-copilot-on-github-co...
42877
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 20/05/2025
We're about 1 month away from #VolunteerAmnestyDay on June 21st. Time to take an inventory of your volunteer responsibilities: www.volunteeramnestyday.net
volunteeramnestyday.net
Volunteer Responsibility Amnesty Day
Volunteer Responsibility Amnesty Day
001
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 18/05/2025
My #PyConUS session is later today, let's find out together if your requirements.txt is haunted? 👻 Join the haunt in Ballroom BC at 1:45PM, don't be scared! us.pycon.org/2025/schedule/presenta… #PyConUS #PyCon #PyConUS2025 #Python #Security
us.pycon.org
Phantom Dependencies: is your requirements.txt haunted?
Did you know there’s more than Python code included in Python packages? This might be a surprise, especially if you’ve … Presented by: Seth Michael Larson
001
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 17/05/2025
I attest that this will be a good talk. Come verify! #PyCon #PyConUS #PyConUS2025
William Woodruff giving a talk "Attestations a new generation of signatures on PyPI"
002
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 17/05/2025
Whoever created this, thank you. This captures the energy of open source perfectly. If you see a problem you can be the one to fix it, and that's amazing! 💪 #PyCon #PyConUS #PyConUS2025
A mirror surrounded by the words "You are the future of Python packaging"
11912
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 17/05/2025
At #PyConUS and wondering what to do after the plenary sessions? Interested in #opensource #security? Dustin Ingram and I are hosting a supply-chain security open space with many talks! Come hang out and meet fellow security-minded Pythonistas in Room 321 at 10:30 […]
fosstodon.org
Original post on fosstodon.org
011
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 16/05/2025
Learning about bees from @dmirth (where is @freakboy3742?) #PyCon #PyConUS #PyConUS2025
000
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 16/05/2025
Cory Doctorow at PyCon US #PyCon #PyConUS #PyConUS2025
011
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 15/05/2025
I'm at the @ThePSF booth RIGHT NOW! Come and meet me! :) #PyCon #PyConUS #PyConUS2025
Seth jumping like a plumber at a question mark block with a pixelated retro gaming style.
031
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 15/05/2025
Security is happening, @miketheman at #PyConUS #PyCon #PyConUS #PyConUS2025
Seth and Mike hacking in the PyCon rooftop track
020
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 15/05/2025
If you're interested in software security at #PyConUS I've compiled a list of all talks, open spaces, and events related to security! 🐍🛡️ sethmlarson.dev/pycon-us-2025-secur… #pycon #pyconus2025 #python #security #oss #opensource
Table of security events at PyCon US with room numbers and times. Click into the link for the full list with content.
011
Reposted by Seth Larson
Brett Cannon @brettcannon.fosstodon.org.ap.brid.gy · 14/05/2025
There were layoffs at MS yesterday and 3 #Python core devs from the Faster CPython team were caught in them. If you know of any jobs, please send them their way (they kind of know Python, CPython, and its internals well 😉): Eric Snow: www.linkedin.com/in/ericsnowcurrent… Irit Katriel: […]
fosstodon.org
Original post on fosstodon.org
1348
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 14/05/2025
#PyCon #PyConUS #PyConUS2025
PyCon US sign outside the convention center next to Liberty Ave street sign
132
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 13/05/2025
Reminder if you're flying to Pittsburgh International Airport that the "Airport Flyer" (28X) bus service costs $3 and drops you off right near the hotels. #PyCon #PyConUS #PyConUS2025
125
Reposted by Seth Larson
daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 12/05/2025
We have a cronjob to spot unwanted utf8 letters in #curl PRs as we have noticed that GitHub will gladly show the for example (identical) Cyrillic version of a letter next to the Latin version in a diff and it is yes, entirely impossible for a human to spot […] [Original post on mastodon.social]
GitHub diff output showing what looks like identical strings as being different. The right one has the Latin 'g' replaced with an Armenian 'g'.
12611
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 12/05/2025
I'm attending #PyConUS 2025 in Pittsburgh, PA from this Wednesday until next Thursday! Reach out and say hello if you want to meet. Here's a list of activities I'll either be hosting or attending: #python #oss #opensource #security #supplychain #pycon #pyconus2025 […]
fosstodon.org
Original post on fosstodon.org
010
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 09/05/2025
Went with an almond croissant from Lynhall for #FediDonutFriday! 🥐
Croissant on a red decorative plate with sunrays scattered across the edges.
000
Reposted by Seth Larson
Darius Kazemi @darius.friend.camp.ap.brid.gy · 09/05/2025
If you spend enough time in the "social media for public good" space, you'll realize there is a subset of people who essentially want to build what I call "Valhalla but for debate club members". Their vision of a perfect social media experience is endless debate about big important ideas where […]
friend.camp
Original post on friend.camp
3414
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 08/05/2025
Definitely going to be the busiest #PyConUS for me to date: Language Summit blogger, sponsor presentation, two meet-and-greet Q&As, a couple short cameos, a regular track talk, emceeing and speaking at the security mini-track... I'm ready! :)
111
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 08/05/2025
A(nimal Cros)SCII: mapping the character encoding for Animal Crossing GC town, player, and passwords to Unicode characters. #animalcrossing #gamecube #retrogaming #unicode sethmlarson.dev/animal-crossci
Animal Crossing character set in a table being mapped to Unicode characters on a web page.
010
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 07/05/2025
Python 3.14 beta is now available, and there is no GPG signatures per PEP 751. Please test your verification of Python artifacts using Sigstore :) #python #gpg #sigstore #security #oss #opensource peps.python.org/pep-0761
peps.python.org
PEP 761 – Deprecating PGP signatures for CPython artifacts | peps.python.org
Since Python 3.11.0, CPython has provided two verifiable digital signatures for all CPython artifacts: PGP and Sigstore.
033
Reposted by Seth Larson
Brett Cannon @brettcannon.fosstodon.org.ap.brid.gy · 06/05/2025
The spec for pylock.toml is up! packaging.python.org/en/latest/spec…
035
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 06/05/2025
@ThePSF Developers-in-Residence Program now has a landing page! 💜 Today we cover the language runtime and security work, maybe there's a gap in the #Python ecosystem your organization would like to see worked on full-time at the PSF? Let's talk! #security #opensource #oss […]
fosstodon.org
Original post on fosstodon.org
010
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 05/05/2025
I wrote about mobile notifications as if they were a network like phone calls and what their future might look like if the value-to-noise ratio continues to worsen. sethmlarson.dev/voicemail-for-notif…
sethmlarson.dev
Voicemail for notifications
I recently saw a thread on Mastodon about the nagging notifications for mobile applications in particular, specifically ones that don't carry any useful information and simply remind you of the app...
100
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 03/05/2025
#uspol mastodon.social/@MEActNOW/114444861…
mastodon.social
MEActNOW (@MEActNOW@mastodon.social)
👏🏼👏🏼👏🏼 BREAKING: The USDA has dropped their lawsuit against Maine over its transgender student athletic policies. “I told him I’d see him in court. Well we did see him in court, and we won,” Gov. Janet Mills said. https://www.pressherald.com/2025/05/02/maine-settles-case-over-frozen-usda-school-funds/
001
Seth Larson @sethmlarson.fosstodon.org.ap.brid.gy · 02/05/2025
I published a new small project called "whichprovides" that's an abstraction over many package manager ecosystems, mostly for generating Package URLs to include in SBOMs: #python #opensource #oss #sbom sethmlarson.dev/new-project-whichpr…
sethmlarson.dev
whichprovides: an abstraction of "yum provides"
This critical role would not be possible without funding from the Alpha-Omega project. I'm announcing a new small project I've created as a part of my work on Software Bill-of-Material...
100
Reposted by Seth Larson
Erin Kissane @kissane.mas.to.ap.brid.gy · 01/05/2025
Mergoat Magazine has turned out to be the (print) subscription of the year for me mergoat.com/mergoat-magazine Southern Appalachian vengeance horticulture with a side of queer & trans everything and p.s. abolish borders
mergoat.com
203
Reposted by Seth Larson
Andy Piper @andypiper.org · 01/05/2025
An opportunity for client app developers, who wants to give this a try? #MastodonAPI fosstodon.org/@sethmlarson/11443291…
fosstodon.org
Seth Larson (@sethmlarson@fosstodon.org)
I did some thinking about how #Mastodon boosting could be improved with smarter clients, a-la TCP congestion protocols #fedi #fediverse https://sethmlarson.dev/better-boosting-on-mastodon-with-smart-clients
003
Reposted by Seth Larson
Dan Fixes Coin-Ops @ifixcoinops.retro.social.ap.brid.gy · 01/05/2025
[AI being bad to a plant] Guy instructs an AI to keep his plant alive. AI overwaters the plant and then panics and tries to use water to flush out the moisture 011.sh/posts/plantmom
011.sh
Can an LLM care for my plants (or at least kill them slower than I do)?
In the Beginning In the beginning, I was bad with plants. I’m not terrible with plants - but much like books, collecting them is a different hobby from actually doing anything with them. I sometimes buy books from the perspective of the person I want to be. “I am a person that reads interesting books” and thus also “I am a person who cares for plants”. Thank goodness for succulents, them hardy beasts. I’m not too hard on myself because I am human after all. But AI will fix that, right? Norbert Wiener, cybernetics, extending our human form, making our lives easier and all that.
103