11 Mar 2025
Planet Python
PyCoder’s Weekly: Issue #672: Binary Data, Tail Calls, Pickles, and More (March 11, 2025)
#672 - MARCH 11, 2025
View in Browser »
Bytes Objects: Handling Binary Data in Python
In this tutorial, you'll learn about Python's bytes objects, which help you process low-level binary data. You'll explore how to create and manipulate byte sequences in Python and how to convert between bytes and strings. Additionally, you'll practice this knowledge by coding a few fun examples.
REAL PYTHON
Python Interpreter Adds Tail Calls
As part of the on-going performance improvement work, Python 3.14 is likely to include an optimization known as a "tail call". Submitted changes are showing a 10% general speedup for some architectures. Read this article to learn the details.
DAROC ALDEN
Ship Integrations With 300+ APIs
Nango is an open source platform that lets you ship robust native integrations with 300+ APIs. We offer hundreds of pre-built integrations, customizable in code, and developer tooling purpose built for scaling and maintaining integrations. For humans and AI agents. Try Nango for free →
NANGO INC. sponsor
Exploiting Python Pickles
Python has a built-in mechanism for serializing and deserializing objects known as "pickling". It comes with the caveat that you should never use it with untrusted data, it can lead to remote code execution.
DAVID HAMANN
Articles & Tutorials
Python while
Loops: Repeating Tasks Conditionally
In this tutorial, you'll learn about indefinite iteration using the Python while loop. You'll be able to construct basic and complex while loops, interrupt loop execution with break and continue, use the else clause with a while loop, and deal with infinite loops.
REAL PYTHON
Positron is Now Available for Beta Testing
Positron is a next-gen data science IDE built by Posit PBC. It's an extensible tool for writing python & exploring data, designed for reproducible research & publishing. Consider trying Positron & offering the devs feedback in this beta period.
POSIT sponsor
Maybe Don't Start With Unit Tests
Should you always start testing your code with unit tests? When does it make sense to look at integration or end-to-end testing as a first step instead? This week on the show, we speak with previous guest Eric Matthes about where to begin testing your code.
REAL PYTHON podcast
Open Graph Images in Django for Social Media
The Open Graph protocol specifies metadata for a webpage that gives third party sites information about the page. The most common use is to provide a preview image for social media sites. This post explains how to combine this into your Django projects.
AIDAS BENDORAITIS
Working With Python Polars
Welcome to the world of Polars, a powerful DataFrame library for Python. In this video course, you'll get a hands-on introduction to Polars' core features and see why this library is catching so much buzz.
REAL PYTHON course
Beating LinkedIn "Queens" With Python
LinkedIn publishes a daily logic puzzle called "Queens" that is a cross between a chess queen placement puzzle and Sudoku. This article shows how to write a Python script to solve the puzzles.
RODRIGO GIRÃO SERRÃO
ASCII Control Characters in My Terminal
Ever wonder about those ASCII control characters in your terminal, like CTRL-C to kill a program? Well wonder no more, Julia breaks down what they are and how they can be used.
JULIA EVANS
A Map of Python
View an interactive graph of the packages at PyPI, showing how many packages depend on each. The post also briefly describes the methodology for producing the chart.
FIEFDOM OF FILES
Pokémon With Reinforcement Learning
David and his colleagues have been using reinforcement learning to beat "Pokemon Red", a single player JPRG from 1996. Learn about how they did it and see the code.
RUBENSTEIN, ET AL
Good Programmers Worry About Data Structures and Their Relationships
This opinion piece discusses a quote from Linus Torvalds, that good programmers worry about data structures and their relationships.
LEONARDO CREED
Which Python GUI Library Should You Use in 2025?
This post compares the Python GUI libraries available in 2025, including PyQT, PySide, TKinter, and Kivy.
MARTIN FITZPATRICK
Projects & Code
Events
Weekly Real Python Office Hours Q&A (Virtual)
March 12, 2025
REALPYTHON.COM
Python Weekend Abuja
March 13, 2025
CODECAMPUS.COM.NG
Python Atlanta
March 13 to March 14, 2025
MEETUP.COM
Python Weekend Abuja
March 15, 2025
CODECAMPUS.COM.NG
Python Weekend Abuja
March 17, 2025
CODECAMPUS.COM.NG
Happy Pythoning!
This was PyCoder's Weekly Issue #672.
View in Browser »
[ Subscribe to 🐍 PyCoder's Weekly 💌 - Get the best Python news, articles, and tutorials delivered to your inbox once a week >> Click here to learn more ]
11 Mar 2025 7:30pm GMT
Real Python: Getting to Know Duck Typing in Python
Python makes extensive use of a type system known as duck typing. This system is based on an object's behavior and interface. Many built-in classes and tools support this type system, which makes them pretty flexible and decoupled.
Duck typing is a core concept in Python. Understanding it will give you deeper insight into how the language works and, more importantly, how to use this approach in your own code.
In this video course, you'll learn:
- What duck typing is and what its pros and cons are
- How Python's classes and tools take advantage of duck typing
- How special methods and protocols support duck typing
- What the alternatives to duck typing are in Python
[ Improve Your Python With 🐍 Python Tricks 💌 - Get a short & sweet Python Trick delivered to your inbox every couple of days. >> Click here to learn more and see examples ]
11 Mar 2025 2:00pm GMT
Python Software Foundation: PSF Distinguished Service Award Granted to Van Lindberg
Van Lindberg, a longtime member of the PSF Board, has been recognized with the PSF's Distinguished Service Award. Van was the co-chair and then Chair of PyCon from 2008-2012, served on the PSF Board for over a decade (2012-2023), including four years as Chair (2012-2016) and seven years as PSF General Counsel from 2016-2023. Throughout his time with us, Van was our go-to expert for all things legal, bringing invaluable insights from the broader open-source world to help the PSF grow and stay ahead of the curve. During his time on the board, Van was instrumental in establishing the PSF as a professional organization able to support the worldwide Python community.
The PSF's Distinguished Service Award (DSA) is granted to individuals who make sustained exemplary contributions to the Python community. Each award is voted on by the PSF Board and they are looking for people whose impact has positively and significantly shaped the Python world. Van's work with the Python community very much exemplifies the ethos of "build the community you want to see."
After receiving the award, Van shared, "I am deeply honored to receive the DSA. The kindness and support of this community are truly exceptional, and I am grateful for every moment I've been able to spend contributing alongside so many excellent people."
From licensing and hiring to fundraising, Van was there every step of the way as the PSF experienced phenomenal growth. His deep understanding of open-source communities-paired with his legal expertise-helped the Foundation navigate challenges and embrace opportunities to better serve the global Python community.
Curious about previous recipients of the DSA or wondering how to nominate someone? Check out the PSF's Distinguished Service Awards page. The PSF also bestows Community Service Awards to recognize outstanding community members- if you'd like to learn more about CSAs and how they differ from DSAs, check out our Service Awards given by the PSF: what are they and how they differ blog post.
11 Mar 2025 11:53am GMT
10 Mar 2025
Planet Python
Real Python: Python News Roundup: March 2025
Spring isn't the only thing in the air-new Python releases are here! Last month, Python's core development team released versions 3.13.2, 3.12.9, and 3.14.0 alpha 5 of the language. The 3.14.0a5 version is the fifth of seven planned alpha releases. You can install this alpha release to try some new and exciting language features.
The PyPy project has also released a new version-7.3.19-featuring interpreters for Python 2.7, 3.10, and the newly introduced Python 3.11.
There's also news from the Python Software Foundation (PSF), PyCon US 2025, PyCascades 2025, and the Python ecosystem.
Let's dive in and explore what's been happening in the world of Python!
Python Core Team Releases Bugfix Versions 3.13.2 and 3.12.9
On February 4, 2025, Python 3.13.2 was released as the second maintenance update for the 3.13 series. Packed with nearly 250 bug fixes and refinements, this release makes Python 3.13 even more stable and developer-friendly.
Python 3.13 introduces significant features and optimizations over Python 3.12, including an improved interactive interpreter and experimental free-threaded build mode. Explore the full changelog for detailed updates and changes in this bugfix release.
On a similar note, Python 3.12.9 was also released on February 4, 2025. It marks the ninth maintenance update in the 3.12 series. This release includes approximately 180 bug fixes, build improvements, and documentation updates since the previous release.
As always, the Python development team continues to enhance the language's stability and performance with each release. For more details, refer to the full changelog. You can also support Python's ongoing development through donations or sponsorship.
Python 3.14 Series Releases Fifth Alpha Version
The Python development team unveiled the fifth alpha release of Python 3.14 on February 11, 2025. This release is part of a series of seven planned alpha releases aimed at testing new features, bug fixes, and the release process before moving into the beta phase on May 6, 2025.
It's important to note that this preview is not recommended for production environments. If you're curious about the future of Python, installing this alpha version lets you explore the upcoming features before the final release. You're encouraged to report any bugs via Python's issues page. Again, for a detailed list of changes, check the full changelog.
PyPy Team Releases Version 7.3.19
The PyPy team has announced the release of version 7.3.19, which features interpreters for Python 2.7 and 3.10 and includes support for Python 3.11 in beta. The team plans to drop support for 3.10 and remove the beta label from 3.11 in the next release.
Read the full article at https://realpython.com/python-news-march-2025/ »
[ Improve Your Python With 🐍 Python Tricks 💌 - Get a short & sweet Python Trick delivered to your inbox every couple of days. >> Click here to learn more and see examples ]
10 Mar 2025 2:00pm GMT
Lucas Cimon: Quelques sites web que j'ai conçu
Au cours des 18 derniers mois, j'ai eu l'occasion de concevoir plusieurs sites web pour des proches et des associations où je suis bénévole.
Dans cet article, je reviens sur mes choix de solutions pour les mettre en place, et partage mes réflexions concernant les alternatives pour concevoir de "petits …
10 Mar 2025 9:08am GMT
Python Bytes: #423 Traveling the Python Universe
<strong>Topics covered in this episode:</strong><br> <ul> <li><strong><a href="https://github.com/danielenricocahall/pysqlscribe?featured_on=pythonbytes">pysqlscribe</a></strong></li> <li><strong><a href="https://fi-le.net/pypi/?featured_on=pythonbytes">A map of Python</a></strong></li> <li><strong><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes">Rust, C++, and Python trends in jobs on Hacker News</a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes"> </a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes">(February</a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes"> 2025)</a></strong></li> <li><strong><a href="https://www.pythonmorsels.com/help-features/?featured_on=pythonbytes">The features of Python's help() function</a></strong></li> <li><strong>Extras</strong></li> <li><strong>Joke</strong></li> </ul><a href='https://www.youtube.com/watch?v=g6JsPyBaOcQ' style='font-weight: bold;'data-umami-event="Livestream-Past" data-umami-event-episode="423">Watch on YouTube</a><br> <p><strong>About the show</strong></p> <p>Sponsored by us! Support our work through:</p> <ul> <li>Our <a href="https://training.talkpython.fm/?featured_on=pythonbytes"><strong>courses at Talk Python Training</strong></a></li> <li><a href="https://courses.pythontest.com/p/the-complete-pytest-course?featured_on=pythonbytes"><strong>The Complete pytest Course</strong></a></li> <li><a href="https://www.patreon.com/pythonbytes"><strong>Patreon Supporters</strong></a></li> </ul> <p><strong>Connect with the hosts</strong></p> <ul> <li>Michael: <a href="https://fosstodon.org/@mkennedy"><strong>@mkennedy@fosstodon.org</strong></a> <strong>/</strong> <a href="https://bsky.app/profile/mkennedy.codes?featured_on=pythonbytes"><strong>@mkennedy.codes</strong></a> <strong>(bsky)</strong></li> <li>Brian: <a href="https://fosstodon.org/@brianokken"><strong>@brianokken@fosstodon.org</strong></a> <strong>/</strong> <a href="https://bsky.app/profile/brianokken.bsky.social?featured_on=pythonbytes"><strong>@brianokken.bsky.social</strong></a></li> <li>Show: <a href="https://fosstodon.org/@pythonbytes"><strong>@pythonbytes@fosstodon.org</strong></a> <strong>/</strong> <a href="https://bsky.app/profile/pythonbytes.fm"><strong>@pythonbytes.fm</strong></a> <strong>(bsky)</strong></li> </ul> <p>Join us on YouTube at <a href="https://pythonbytes.fm/stream/live"><strong>pythonbytes.fm/live</strong></a> to be part of the audience. Usually <strong>Monday</strong> at 10am PT. Older video versions available there too.</p> <p>Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to <a href="https://pythonbytes.fm/friends-of-the-show">our friends of the show list</a>, we'll never share it.</p> <p><strong>Michael #1:</strong> <a href="https://github.com/danielenricocahall/pysqlscribe?featured_on=pythonbytes">pysqlscribe</a></p> <ul> <li>A Python library intended to make building SQL queries in your code a bit easier.</li> <li>A Query object can be constructed using the QueryRegistry's get_builder featuring a dialect (e.g; "mysql", "postgres", "oracle").</li> </ul> <p><strong>Brian #2:</strong> <a href="https://fi-le.net/pypi/?featured_on=pythonbytes">A map of Python</a></p> <ul> <li>Cool visualization of dependencies in PyPI packages</li> <li><a href="https://anvaka.github.io/pm/#/galaxy/python?cx=-2700&cy=377&cz=5622&lx=-0.0869&ly=-0.2315&lz=-0.0338&lw=0.9684&ml=150&s=1.75&l=1&v=2015-09-27T13-00-00Z">Even cooler visualization</a> (linked from main article)</li> </ul> <p><strong>Michael #3:</strong> <a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes">Rust, C++, and Python trends in jobs on Hacker News</a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes"> </a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes">(February</a><a href="https://martin.wojtczyk.de/2025/02/20/rust-c-and-python-trends-in-jobs-on-hacker-news-february-2025/?featured_on=pythonbytes"> 2025)</a></p> <ul> <li>Interesting supply and demand comparisons from at least on source.</li> </ul> <p><strong>Brian #4:</strong> <a href="https://www.pythonmorsels.com/help-features/?featured_on=pythonbytes">The features of Python's help() function</a></p> <ul> <li>Trey Hunner</li> <li>Don't forget how useful and cool help() is.</li> </ul> <p><strong>Extras</strong> </p> <p>Michael:</p> <ul> <li><a href="https://github.com/emmett-framework/granian/releases/tag/v2.0.1?featured_on=pythonbytes">Granian works with FastAPI again</a></li> </ul> <p><strong>Joke:</strong> <a href="https://devhumor.com/media/computer-engineer-vs-geologist?featured_on=pythonbytes">Computer engineer vs. Geologist</a></p>
10 Mar 2025 8:00am GMT
Seth Michael Larson: Post Malone Oreos
@keyframes rotation { from { transform: rotate(0deg); } to { transform: rotate(359deg); } }
Apparently I talk about my love for Post Malone's music too much, because I received not one, but two unsolicited packages of Post Malone Oreos from a friend and a neighbor. So put in your diamond grills and let's try them!
Opening the package was a burst of caramel, like a caramel-scented candle from Bath & Body Works. The smell was so potent I would not be surprised if they didn't pump that in prior to sealing the packaging.
The actual flavor was not as strong, but still pretty sweet (enough to give you a 12Kt toothache). The salt and the shortbread were welcome in toning down the caramel sweetness.
Overall I liked the cookies! If you're a fan of Oreos and caramel then they are a must-try! My recommended musical pairing for these snacks is 'Circles', which in retrospect might have been about Oreo cookies all along! ⚫⚪
If you're curious about the circular word-wrapping (check out the page on desktop) I read this lovely article about CSS shapes from Sara Soueidan. I cropped a picture of an Oreo using iPhone's "Smart Select" feature for making stickers and exported that as a PNG.
10 Mar 2025 12:00am GMT
09 Mar 2025
Planet Python
Ned Batchelder: Faster branch coverage measurement
After nearly two years, I think this is finally ready: coverage.py can use sys.monitoring to more efficiently measure branch coverage.
I would love for people to try it, but it's a little involved at the moment:
- You need to have your own build of Python from the main branch on GitHub, because the CPython side of the work landed after 3.14 alpha 5. Alpha 6 is supposed to arrive within a week, so that will make it easier.
- I haven't released a version of coverage.py to PyPI with this code yet, so you also need to install coverage from GitHub:
-
% python3 -m pip install git+https://github.com/nedbat/coveragepy
Once you have both of those things, set the environment variable COVERAGE_CORE=sysmon
and run coverage as you usually do. If all goes well, it should be faster. Please let me know!
Feedback is welcome in GitHub issues or in the #coverage-py channel in the Python Discord server.
This has been a long journey, starting when I first commented on PEP 669 that underpins this work. Mark Shannon and I have had many back and forths about the behavior of sys.monitoring, finally landing on something that would work for us both.
For the curious: traditionally coverage.py relied on sys.settrace. Python calls my recording function for every line of Python executed. It's simple and effective, but inefficient. After I've been told a line was executed once, I don't need to be told again, but settrace keeps calling my function. The new sys.monitoring that arrived in Python 3.12 lets me disable an event once it's fired, so after the first ping there's no overhead to running that same code multiple times.
It took a while to iron out the event behavior that lets us measure branches as well as lines, but Python 3.14.0 after alpha 5 has it, so we're finally able to announce coverage.py support for people to try out.
09 Mar 2025 8:07pm GMT
08 Mar 2025
Planet Python
Django Weblog: Happy International Women's Day! 🎉 💜
This International Women's Day, we're celebrating a historic milestone in Django's journey! 🚀
For the first time ever, Django has women in every leadership position within the project:
- 2 Django Steering Council members 💜
- 2 DSF Board members 💜
- 2 Django Fellows 💜
This moment is not just about numbers - it's about the impact of years of effort to create a more inclusive and welcoming Django community.
A huge shoutout to Django Girls for introducing countless women to tech and Django, and to Djangonaut Space for mentoring a diverse set of contributors-many of whom have stepped into leadership roles. In fact, 4 out of 6 women who put their name forward in the latest Board elections were Djangonaut Space alumni.
Django thrives when our community grows more diverse, more representative, and more empowered. Today, we celebrate the progress, the leaders, and everyone working to make Django a space where everyone belongs.
Happy International Women's Day! 🎉 💜
08 Mar 2025 9:32am GMT
07 Mar 2025
Planet Python
Real Python: The Real Python Podcast – Episode #242: Eric Matthes: Maybe Don't Start With Unit Tests
Should you always start testing your code with unit tests? When does it make sense to look at integration or end-to-end testing as a first step instead? This week on the show, we speak with previous guest Eric Matthes about where to begin testing your code.
[ Improve Your Python With 🐍 Python Tricks 💌 - Get a short & sweet Python Trick delivered to your inbox every couple of days. >> Click here to learn more and see examples ]
07 Mar 2025 12:00pm GMT
Real Python: Quiz: Python Textual: Build Beautiful UIs in the Terminal
In this quiz, you'll test your understanding of the Python Textual library. This library is used for creating text-based interface applications for the terminal. By working through this quiz, you'll reinforce your knowledge of Textual's key concepts and features.
[ Improve Your Python With 🐍 Python Tricks 💌 - Get a short & sweet Python Trick delivered to your inbox every couple of days. >> Click here to learn more and see examples ]
07 Mar 2025 12:00pm GMT
Brett Cannon: Why I won't be attending PyCon US this year
I normally don&apost talk about politics here, but as I write this the US has started a trade war with Canada (which is partially paused for a month, but that doesn&apost remove the threat). It is so infuriating and upsetting that I will be skipping PyCon US entirely for the first time since 2003 to avoid giving any money to the US economy as a tourist (on top of just not feeling welcome in a state that voted in Donald, let alone in the US overall when Donald won the popular vote).
We have been told this is over fentanyl, but the amount brought into the US through Canada is less than 1%. Plus we spent CAD $1.3 billion on upping our border security and appointing a fentanyl czar that has led to a 97% decrease from Dec 2024 to Jan 2025. And all of this without the US doing something equivalent to try and lower the amount of illegal guns flowing into Canada.
No, this actually seems to be about trying to cripple our economy to annex Canada (no joke). The leader of one of the world&aposs largest, most powerful armies simply cannot stop talking about how they want to annex Canada, which is not comforting (this is why Canadians have not found the "51st state" comment a joke whenever anyone makes it). Donald also can&apost seem to stand calling our prime minister by his proper title which is very disrespectful (hence why I keep using "Donald" in this post; I also refuse to use their preferred pronouns since trans lives matter and I doubt Donald would use anyone&aposs preferred pronouns if they happened to disagree with them).
As Warren Buffett said, "Tariffs are ... an act of war, to some degree". As such, I just can&apost bring myself to voluntarily visit a country for fun that has started an economic war with my home country. This will be the first time I don&apost attend PyCon US physically or virtually since the conference was first named that in 2003, so I&aposm not making this decision lightly.
To be clear, I don&apost blame any Americans who voted for someone other than Donald. I view this as a decision of the current US government and the people who voted for Donald since they said, quite plainly on the campaign trail, that they were going to come after Canada.
So that means, for the foreseeable future, I will hope to see people at Python conferences and core dev sprints outside the US. It&aposs a bit tricky to travel so far when our kid is still so young (not even 1 year old as I write this), but hopefully I can make something work at least on occasion to still see my friends in the Python community in person (luckily PyCascades is scheduled to be held in Vancouver in 2026).
Once all the tariffs are completely repealed (pauses don&apost count as that just makes it a looming threat), visiting states that didn&apost vote for Donald will be considered. But if I&aposm being honest, the way Canadians are reacting makes it feel like the Canada/US relationship has been damaged for at least a generation without a massive campaign on the US side to try and make amends. And that means any travel south of the border is going to be curtailed for a very long time.
07 Mar 2025 1:04am GMT
Seth Michael Larson: Your GitHub Copilot access has been renewed 🤡
As a maintainer of a "popular open source project" ever since Copilot was announced I've been receiving monthly reminders that my free GitHub Copilot access has been renewed.
If I was paying for the service this would be a simple billing reminder, no worries. The only trouble is there is no off switch for maintainers who aren't interested. I have never once used Copilot and actively avoid generative AI features in every product I use, GitHub is no different.
But no, GitHub insists on sending me this email every month with no way to opt-out or disable Copilot. I've tried contacting support and I received no help.
My monthly reminder that I'm probably an MAU justifying further investment in generative AI technology. Thanks, GitHub.
I could create a filter for these emails, but I cannot be the only one that is receiving these emails. Asking hundreds or thousands of people to all opt-out of your spammy emails is not the answer here.
For completeness, here are what my Copilot settings look like in GitHub. Note that the "Enabled" label next to "Copilot in Github.com" is not editable. I don't see a way to disable Copilot or cancel my "subscription". If I'm the one doing something wrong here, please correct me, but I've asked about this on social media before with no responses from anyone.



07 Mar 2025 12:00am GMT
06 Mar 2025
Planet Python
Anarcat: Nix Notes
Meta
In case you haven't noticed, I'm trying to post and one of the things that entails is to just dump over the fence a bunch of draft notes. In this specific case, I had a set of rough notes about NixOS and particularly Nix, the package manager.
In this case, you can see the very birth of an article, what it looks like before it becomes the questionable prose it is now, by looking at the Git history of this file, particularly its birth. I have a couple of those left, and it would be pretty easy to publish them as is, but I feel I'd be doing others (and myself! I write for my own documentation too after all) a disservice by not going the extra mile on those.
So here's the long version of my experiment with Nix.
Nix
A couple friends are real fans of Nix. Just like I work with Puppet a lot, they deploy and maintain servers (if not fleets of servers) with NixOS and its declarative package management system. Essentially, they use it as a configuration management system, which is pretty awesome.
That, however, is a bit too high of a bar for me. I rarely try new operating systems these days: I'm a Debian developer and it takes most of my time to keep that functional. I'm not going to go around messing with other systems as I know that would inevitably get me dragged down into contributing into yet another free software project. I'm mature now and know where to draw the line. Right?
So I'm just testing Nix, the package manager, on Debian, because I learned from my friend that nixpkgs is the largest package repository out there, a mind-boggling 100,000 at the time of writing (with 88% of packages up to date), compared to around 40,000 in Debian (or 72,000 if you count binary packages, with 72% up to date). I naively thought Debian was the largest, perhaps competing with Arch, and I was wrong: Arch is larger than Debian too.
What brought me there is I wanted to run Harper, a fast spell-checker written in Rust. The logic behind using Nix instead of just downloading the source and running it myself is that I delegate the work of supply-chain integrity checking to a distributor, a bit like you trust Debian developers like myself to package things in a sane way. I know this widens the attack surface to a third party of course, but the rationale is that I shift cryptographic verification to another stack than just "TLS + GitHub" (although that is somewhat still involved) that's linked with my current chain (Debian packages).
I have since then stopped using Harper for various reasons and also wrapped up my Nix experiment, but felt it worthwhile to jot down some observations on the project.
Hot take
Overall, Nix is hard to get into, with a complicated learning curve. I have found the documentation to be a bit confusing, since there are many ways to do certain things. I particularly tripped on "flakes" and, frankly, incomprehensible error reporting.
It didn't help that I tried to run nixpkgs on Debian which is technically possible, but you can tell that I'm not supposed to be doing this. My friend who reviewed this article expressed surprised at how easy this was, but then he only saw the finished result, not me tearing my hair out to make this actually work.
Nix on Debian primer
So here's how I got started. First I installed the nix binary package:
apt install nix-bin
Then I had to add myself to the right group and logout/log back in to get the rights to deploy Nix packages:
adduser anarcat nix-users
That wasn't easy to find, but is mentioned in the README.Debian file shipped with the Debian package.
Then, I didn't write this down, but the README.Debian
file above mentions it, so I think I added a "channel" like this:
nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgs
nix-channel --update
And I likely installed the Harper package with:
nix-env --install harper
At this point, harper
was installed in a ... profile? Not sure.
I had to add ~/.nix-profile/bin
(a symlink to /nix/store/sympqw0zyybxqzz6fzhv03lyivqqrq92-harper-0.10.0/bin
) to my $PATH
environment for this to actually work.
Side notes on documentation
Those last two commands (nix-channel
and nix-env
) were hard to figure out, which is kind of amazing because you'd think a tutorial on Nix would feature something like this prominently. But three different tutorials failed to bring me up to that basic setup, even the README.Debian
didn't spell that out clearly.
The tutorials all show me how to develop packages for Nix, not plainly how to install Nix software. This is presumably because "I'm doing it wrong": you shouldn't just "install a package", you should setup an environment declaratively and tell it what you want to do.
But here's the thing: I didn't want to "do the right thing". I just wanted to install Harper, and documentation failed to bring me to that basic "hello world" stage. Here's what one of the tutorials suggests as a first step, for example:
curl -L https://nixos.org/nix/install | sh
nix-shell --packages cowsay lolcat
nix-collect-garbage
... which, when you follow through, leaves you with almost precisely nothing left installed (apart from Nix itself, setup with a nasty "curl pipe bash". So while that works in testing Nix, you're not much better off than when you started.
Rolling back everything
Now that I have stopped using Harper, I don't need Nix anymore, which I'm sure my Nix friends will be sad to read about. Don't worry, I have notes now, and can try again!
But still, I wanted to clear things out, so I did this, as root:
deluser anarcat nix-users
apt purge nix-bin
rm -rf /nix ~/.nix*
I think this cleared things out, but I'm not actually sure.
Side note on Nix drama
This blurb wouldn't be complete without a mention that the Nix community has been somewhat tainted by the behavior of its founder. I won't bother you too much with this; LWN covered it well in 2024, and made a followup article about spinoffs and forks that's worth reading as well.
I did want to say that everyone I have been in contact with in the Nix community was absolutely fantastic. So I am really sad that the behavior of a single individual can pollute a community in such a way.
As a leader, if you have all but one responsability, it's to behave properly for people around you. It's actually really, really hard to do that, because yes, it means you need to act differently than others and no, you just don't get to be upset at others like you would normally do with friends, because you're in a position of authority.
It's a lesson I'm still learning myself, to be fair. But at least I don't work with arms manufacturers or, if I would, I would be sure as hell to accept the nick (or nix?) on the chin when people would get upset, and try to make amends.
So long live the Nix people! I hope the community recovers from that dark moment, so far it seems like it will.
And thanks for helping me test Harper!
06 Mar 2025 8:44pm GMT
PyCon: Support PyLadies: Donate to the PyLadies Auction at PyCon US 2025!
PyCon US 2025 is quickly approaching and we can't wait to see all of you there! We're reaching out to our community to help support one of our favorite events: the PyLadies Auction. Our wonderful community is bursting with creative, artsy, and generous folks and we invite you to donate items to this year's Auction. If you'd like to support PyLadies by making a donation, please fill out the PyLadies Charity Auction donation form. To learn more about the event and what to donate, read on!
What to Donate
Need inspiration? Over the years, we've seen that people love to bid on items that are artsy, nerdy, and Python-specific. Art, decor, customized tech, and vintage PyCon or Python-related swag are all examples of things that will inspire a friendly bidding war. To get more inspiration search 'PyLadies Auction' on social media or check out the PyLadies Instagram.
Items that are personalized or have a story tend to attract bidders- DIYers, artists, crafters, and collectors, this is your time to shine! It's also worth thinking about what will show up well on stage. We have a magnifying camera, but smaller and less colorful items like jewelry and watches might be harder for bidders to see than a big piece of art or an adorable, bright-colored snake stuffy!
Please note that we cannot accept donations of guns, alcohol, cars, real estate, or houses. We may decline other gifts that are inappropriate or impractical at the PSF's discretion (for example, sorry, no real pythons!). Although we would love to accept signed books, we will also not be accepting those this year.
If you've got an item to contribute that you'd like to share in a sneak preview, feel free to post a photo and tag us on the social media platform of your choice!
Donation details
To donate an item, please fill out the PyLadies Charity Auction donation form. This form asks for required information about the person or organization donating, item specifics, and logistics. You will need to indicate if you will ship the item in advance or deliver it in person. You will receive shipping information once you complete the form. The deadline for donations is May 15th, 2025 (that's the Thursday before the event!).About the PyLadies Charity Auction
The thirteenth PyLadies Charity Auction will be held in person during PyCon US 2025 in Pittsburgh, Pennsylvania. It's an evening of fun and refreshments while supporting the PyLadies community!
The Entry cover charge of $45.00 includes dinner and a drink ticket, while the Supporter cover charge of $90.00 includes dinner, a drink ticket, and a $45.00 contribution to PyLadies. We have increased the cover charge due to rising food and venue costs. Everyone who attends will also have access to the cash bar. To save your place at the Auction, add the PyLadies Auction to your PyCon US registration via your dashboard. Last year we sold out, so if you'd like to go, reserve your ticket soon!06 Mar 2025 3:29pm GMT
Django Weblog: Django security releases issued: 5.1.7, 5.0.13 and 4.2.20
In accordance with our security release policy, the Django team is issuing releases for Django 5.1.7, Django 5.0.13 and Django 4.2.20. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
CVE-2025-26699: Potential denial-of-service in django.utils.text.wrap()
The django.utils.text.wrap() and wordwrap template filter were subject to a potential denial-of-service attack when used with very long strings.
Thanks to sw0rd1ight for the report.
This issue has severity "moderate" according to the Django security policy.
Affected supported versions
- Django main
- Django 5.2 (currently at pre-release beta status)
- Django 5.1
- Django 5.0
- Django 4.2
Resolution
Patches to resolve the issue have been applied to Django's main, 5.2, 5.1, 5.0, and 4.2 branches. The patches may be obtained from the following changesets.
CVE-2025-26699: Potential denial-of-service in django.utils.text.wrap()
- On the main branch
- On the 5.2 branch
- On the 5.1 branch
- On the 5.0 branch
- On the 4.2 branch
The following releases have been issued
- Django 5.1.7 (download Django 5.1.7 | 5.1.7 checksums)
- Django 5.0.13 (download Django 5.0.13 | 5.0.13 checksums)
- Django 4.2.20 (download Django 4.2.20 | 4.2.20 checksums)
The PGP key ID used for this release is Sarah Boyce: 3955B19851EA96EF
General notes regarding security reporting
As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see our security policies for further information.
06 Mar 2025 12:35pm GMT