I'm going to pronounce it forĝejo. The other ways just sound wrong.
Home
Public posts preserved on my own site.
Using my own mastodon client today because it has tag bundles, i.e. I can see the tags and searches for python & its dozens of variations, pycon & its dozens of variations, in one feed.
@bms48 d'oh! will fix.
It is still got a way to go but here is a tool for making the missing #pypi user profile.
But Matt, where do you put the signature or rel=me? In a package!
Pypi is pretty meager for profile info, but you can publish a #python package with a whole website in it.
This is what the static site works like, with light debranding. I left pypi in the name because there are a lot of packages with `pypi-` in the name.
♡ 1 ↻ 0It is yet another "publish a cryptographic signature on two sites to prove you own it"
♡ 0 ↻ 0
"Kids Bowl Free" -yeah, nah, they're not smooth enough to roll all the way down the alley, even if the really scrunch up.
#securitytxt is trying to solve the problem of "who do I tell that this library is insecure" which is adjacent to what I keep wondering "who has published this package" I think, "well, the build server with a short lived credential" is a pretty vacuous answer.
I finally know how to publish a package that will be successful and installed on every machine in the world and it sounds... easy?
<at my funeral>: "And I leave my remaining wealth to the first heir to contractually agree with the estate to maintain my 55 #pypi packages and update them forever."
I'm pretty sure that is what companies think open source maintainers do.
@d0ppl3r@defcon.social three way tie.
Only 78,000 PR request and we can fix `pull_request_target`
https://github.com/search?q=path%3A*.yml+%22pull_request_target%3A%22&type=code
Digital signature to prove.... I can do a digital signature.
```
pypi-profile-proof: eyJwIjoicHlwaS1wcm9maWxlLW1hdHRoZXdkZWFubWFydGluIiwidSI6Im1hdHRoZXdkZWFubWFydGluIiwicyI6Imh0dHBzOi8vbWFzdG9kb24uc29jaWFsL0BtaXN0ZXJzcWwvMTE2NTY0MDAxODk0MDA2NzUyIiwiaSI6MTc3ODk0MzUwNywiZSI6MTgxMDQ3OTUwNywibiI6IktYbUlwdjk4RndWMEhoYVlEUGc0MmciLCJnIjoiSF9KX0JZdmkzOFh3MDZrcHRCUkwwZ1RSaEJ5cXFpcWlRU2JDVEdmcTk3eEEzWU5STUtYVDN6REtPYU5yZGpNbmFBblBNQ0VyUzFtRk0yUXpiWFRmQUEifQ
```
IDEA: Unproductivity System. Use notebooks, lists, calendars, to reduce your productivity to a manageable level so you can get some recreation done.
IDEA: for a youtube video "I quite my 3 figure indie game developer job"
IDEA: PEP for a new type, object({}), also called a DictInABox
Best new features in python 3.15
https://www.infoworld.com/article/4166693/the-best-new-features-in-python-3-15.html
Pet peeve. You never know if your installed #python has #tkinter included or not. It seems to be completely random.
3.12.0, nope. 3.13.0, nope. 3.14.4 yes!
♡ 1 ↻ 0
Went to the grocery store and I guess I am in Scandinavia, I haven't seen prices this high since I was in Iceland
Is python 3.15 the best to date? I don't know, maybe you should try dating humans.
Github actions experiments
- Run GHA parallel jobs, 35s but used 2 build minutes
- Run GHA serial jobs used 1 minute
- Run each job in worktree in parallel threads, 45 seconds.
Docker containers in parallel complete faster end to end but double the minutes.
If I had any economic incentives, I probably could cut my build minute usage by 1/3 or 1/2 with better parallelism
I sort of want this, but it should cold read as well
You had coffee... or tea today... or cola.... your significant other is mad at you.... you sort of feel like.... a cookie
Damn, I got another idea. "What if you could install packages as inert data packages and work with them with roughly the same API as `importlib.resources` but with the reassurance that no code runs, no pth shenanigans, no malicious code on import, no setup.py japes.
Well, there goes the weekend. Or the next, also gotta finish this last idea.
I'm back to creating the missing pypi profile page.
General idea:
pipx install pypi-profile
pipx inject pypi-profile matthewdeanmartin
pypi-profile serve
Then the page would spin up in a website, and allow searching and displaying installed pypi profiles and some cryptographic signature thing so you the app can verify signatures at "profile" sites. (like rel=me with signatures) This would extend id beyond "this build server* built this package"
`*` probably hijacked due to gh actions vulns
$$$ - hosted webserver
$$ - self hosted mini computer in the closet
$ - static files hosted somewhere, built by build runner
¢ - website published as a package
Trying out a #wxpython based mastodon client
This is #govtech I guess. Fascist and authoritarian regimes attack epistemology, the idea that there is any truth beyond authority, i.e. things are true because your Dad, minister or great leader said they are true, so non-sense like UFOs is respectable as research on climate change. What is true is what feels good to believe.
@TheQuinbox can you put a license onto QuinterApp, or declare one here and I can copy your affirmation into my fork? I want to convert it to support mastodon. Thanks!
@TheQuinbox MIT is fine, but if you have a preference for another license, that's fine, too
♡ 0 ↻ 0
Places you can get your free CI build minutes instead of GitHub
- travis
- codeship
- werker
- snap ci
- shippable
- webapp.io
oh wait, all of those found out that giving away build minutes wasn't viable.
- gitlab
- circleci
- bitbucket
oh wait all of those have cut free minutes to something pretty small
That leaves GitHub. Do you want 80% uptime and free or do you want to pay for your build minutes?
Pretty much only the people paying for GitHub have a valid reason to complain and maybe they should be complaining that the freeloaders are overloading the system.
♡ 1 ↻ 0
What could be easier, just write a little bit of yaml, careful when you are typing the hash.
```yaml
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
```
This might as well be considered a binary format, in the sense that it has large parts that you don't want human hands touching it.
Supercomputers can do 1 trillion flops per second.
I can do about 54 flops per 7 years. Seriously. I should make yet another package discoverability website.
Build scripts for a modern age
- proof of specs, i.e. some thought went into asking the bot what to do.
- proof of use, i.e. some human tried it out in a realistic use case
I think the artifacts for these are like blog posts or a video of you clicking through the app, not so much unit tests or end-to-end tests.
"If you’ve got a vibe coded thing which you have used every day for the past two weeks, that’s much more valuable to me than something that you’ve just spat out and hardly even exercised."
https://simonwillison.net/2026/May/6/vibe-coding-and-agentic-engineering/♡ 1 ↻ 0(To be clear, you should still ask your bots and humans to lint, check types, do the unit tests, but when a bot does all of them, it doesn't mean the same thing until realistic use by a human happens)
♡ 0 ↻ 0
How to write an awesome #gitlab pipeline. Make everything dependent on branch name. That way you got no way to test it and you will be continually surprised that what works on one branch fails on the next.
And use extends especially when the hierarchy is split across dozens of files and dozens of template repos. Keep adding layers, more and more! Aim for infinity.
Heaven forbid anything should ever be repeated far better to have 1 yaml stanza inherit from 1,000, nay 1,000,000. And you might say, but Matt, really 56 layers of yaml cake is more than enough and I say, if you chose 55 more than you needed, why did you stop at 55?
♡ 1 ↻ 0
IDEA: Airgapped server room where the servers are kept in hard vacuum. Keeps out troublesome ops people.
@ppb1701 The lawyers get paid in cash tho
Is your clanker, your past self, or those people who used to work in your code base lazy?
Get a report of all the skips and ignores from a bunch of python linters.
@gitlabreleasenotifyer so noisy!
Just in the venv for the app that scans the dependency tree for #zizmor flaws, there are 88 repos that I'd need to file Pull Request to fix my supply chain. This is going to take years.
(this runs zizmor against every repo for every dependency to find out who is likely to turn into a malicious artifact next)
If you run #zizmor on your on repo and fix the github actions there, you gain just about nothing if your entire dependency tree doesn't do the same. Malicious actors will stop targeting your app and target the 200+ softer targets in the dependency tree.
hot take: polyamory solves an economic problem, probably the high cost of housing. I'm too lazy to check google scholar, surely this isn't a novel idea.
IDEA: combine match.com and redfin.com into one site to create next unicorn company.
♡ 0 ↻ 0
It makes people around here angry to do cross person productivity comparisons for developers (the fastest vs the slowest developer is 10x faster for a task), but I think it is true that sleepy distracted Matthew Martin is 10x slower than well rested, hyperfocused Matthew Martin.
Made a gui for urllib, also known as a browser.
Sort of like lynx, sort of like postman.
Wait 2 weeks before trying it out.