Python Bytes is a weekly podcast hosted by Michael Kennedy and Calvin Hendryx-Parker. The show is a short discussion on the headlines and noteworthy news in the Python, developer, and data science space.
Afleveringen
-
#503 It’s not 85% HTML
3 november 2026 · 30 min
Topics covered in this episode: Lees meer
Your GitHub language bar is lying (how to fix it)
Python Typing Survey 2026: developers mix type checkers, and AI is writing the hints
Flask Vibe - Build Apps You Can Understand
Python on my wrist: MicroPython on a PineTime
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hostsMichael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.Michael #1: Your GitHub language bar is lying (how to fix it)
GitHub's language bar comes from Linguist, which counts every tracked byte in the repo. Michael's chameleon-rs project read as 75.5% HTML because committed docs-site output and test suites outweighed the Rust engine. Three .gitattributes attributes changed the story: linguist-generated for build output, linguist-vendored for an upstream test suite, and linguist-detectable=false for tests and benchmarks on both sides. The bar now shows the real mix, roughly 62% Rust and 38% Python.
That bar is one of the first things people see on your repo; if generated files skew it, a few lines of .gitattributes tell the truth.
The bar is byte-proportional, so a 9 MB committed docs build can make a Rust project read as mostly HTML
linguist-generated hides build output and collapses those diffs in pull requests too
linguist-vendored covers copied-in code; linguist-detectable=false drops anything from the stats
chameleon-rs went from 75.5% HTML to roughly 62% Rust and 38% Python after a few lines of config
Tests and benchmarks were excluded symmetrically, on bo…
-
#502 Introducing chameleon-rs
27 oktober 2026 · 34 min
Topics covered in this episode: Lees meer
PHP wasn’t the only problem last week
chameleon-rs
Bringing uv and ty together
Stlite runs Streamlit apps entirely in the browser
Extras
Joke
Watch on YouTube
About the show
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.Calvin #1: PHP wasn’t the only problem last week
Three security incidents in one week, each at a different layer: CA trust (eMudhra), the release pipeline (LiteLLM) and a C decoder (Brotli). All three have fixes released.
eMudhra CA: the keys of a compromised eMudhra intermediate CA are now distrusted by CPython. 3.15.1, 3.14.9 and 3.13.17 shipped Oct 21. 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 followed Oct 26 (CVE-2026-115557) and also fix a tarfile filter bypass. Python's post says pip operations are safe even before pip is upgraded.
eMudhra, tooling: pip 26.2.2 bundles certifi 2026.10.19, which removes the root. uv 0.13.4 (GHSA-hq85-5cpj-mr62) and 0.13.5 (rustls-webpki 0.103.16) are the uv fixes. After upgrading uv, run uv python upgrade. Existing venvs need pip upgraded by hand, and the 3.9 and 3.10 builds still bundle a pip that trusts the root.
Anyone holding those intermediate keys can mint certificates for any domain that an unpatched client will accept as valid.
That enables man-in-the-middle attacks: reading or altering HTTPS traffic without a certificate warning.
The risk is highest where the attacker can sit on the network path, such as hostile Wi-Fi, a compromised router or ISP, or a cloud network position.
For Python specifically, the exposed traffic would be package download…
-
#501 A Nod to Sir-Mix-Alot
20 oktober 2026 · 38 min
Topics covered in this episode: Lees meer
Nod: pause your Python program and open a notebook at any line
Polars 2.0 ships: streaming engine by default, spill-to-disk, and a row-order gotcha
django-cachalot caches your ORM queries and invalidates them for you
Towards async transactions in Django
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hostsMichael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: Nod: pause your Python program and open a notebook at any line
Nod (Notebooks-on-Demand) is a JupyterLab extension by Eric Rawn that drops a notebook into a running Python program. Add a notebook() call anywhere, run the program with nod, and execution pauses there with a notebook containing all variables at that point in the call stack. Edits go back to the source file with a button, with cells converted to code and markdown to comments via Jupytext.
It answers the classic 'this would be easier in a notebook' debugging moment without copying snippets out to files.
Like a breakpoint with a notebook inside: the left panel walks the call stack and notebook state switches with it
Install is pip install nodpy plus nod --install-kernel, then run with nod python -m myfile
The round trip back to source is the differentiator; markdown cells become comments, cells become newlines, and notebooks are disposable since the source file recreates them
nodLog() stashes variable values across calls to explore later; the article also pitches notebook() for stepping through AI-gene…
-
#500 Episode 500!
14 oktober 2026 · 1 uur 8 min
Topics covered in this episode: Lees meer
A quick chat with Brian looking back
Extras
Joke
Watch on YouTube
About the show
Brian #1: A quick chat with Brian looking back
Nick #2: Jev and the Case for Boring ML
Vincent Warmerdam from marimo benchmarked Jev, a new "System 1" decision model from TypeSafe AI. In his video It handles classification without the latency or token cost of generative LLMs, which raises a practical question for data teams: where does this fit alongside traditional machine learning?
He tested Jev against classical machine learning models to see if its speed and accuracy hold up on real-world datasets.
General LLMs work well for reasoning, but generating full token streams just to assign a category adds unnecessary latency and cloud cost.
Jev avoids generation entirely by evaluating the input and returning only the decision, which makes it much faster and cheaper than standard chat APIs.
It consistently outperformed eight-shot sentence transformer setups like SetFit out of the box, especially on datasets with dozens of target categories.
Traditional models like logistic regression still matter because they run in single-digit milliseconds on basic CPUs, cost nothing per inference, and keep private data within your own network.
You cannot fine-tune Jev directly, so standard models remain the better choice when your data contains internal company acronyms, product names, or domain slang.
The most practical approach is using Jev to bootstrap initial labels or audit bad training data, then training a small model you can own and run locally.
Brett #3: Announcing the 2026 Python Packaging Council Election Results!
The inaugural Python packaging council (PPC) has been elected and started meeting!
Introduced via PEP 772
5 members elected
Top 2 vote-getters get two-year terms
Other 3 get one-year terms
All members will get two-year terms going forward, staggering the elections
There have been 4 meetings far as well as a meeting with the SC
… -
#499 So many questions??
7 oktober 2026 · 33 min
Topics covered in this episode: Lees meer
PEP 824 brings ?? and ??= to Python for None handling
Python 3.15 gets a surprise RC3, and Python 3.10 reaches end of life
asyncio.shield
Pyxel: the retro game engine for Python
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: PEP 824 brings ?? and ??= to Python for None handling
PEP 824, a new draft from Marc Mueller sponsored by Guido van Rossum, proposes None-coalescing operators for Python 3.16. The ?? operator returns its left-hand side unless that value is None, and ??= assigns a fallback only when the target is None. It revives the long-deferred PEP 505 from over a decade ago, trimmed to just these two operators, with None-aware access split off into PEP 823. The goal is replacing verbose is None checks with something closer to or, but keyed on None instead of truthiness.
Every Python codebase has piles of if x is None fallback code, and this is the first serious move in ten years to give it real syntax.
user.age ?? "unknown" is like or but only falls back on None, so 0, "", and [] pass through instead of getting clobbered
user.name ??= "unknown" replaces the two-line check-then-assign pattern, with left-side subexpressions evaluated and cached exactly once
Precedence sits between or and conditional expressions, matching JavaScript and C#, and ?? lands as a BoolOp in the AST next to and and or
Unlike +=, ??= is a conditional assignment that skips the r…
-
#498 A Tiny Episode
29 september 2026 · 33 min
Topics covered in this episode: Lees meer
MemTensor / MemoryOS PyPI package hijacked via a malicious build backend
TinyMongo
Jev: what to know
One innocent dict read makes attribute access permanently slower
Extras
Joke
Watch on YouTube
About the show
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Calvin #1: MemTensor / MemoryOS PyPI package hijacked via a malicious build backend
On Sept 23 an attacker published backdoored MemoryOS 2.0.34 on PyPI and three bad versions (0.1.21, 0.1.23, 0.1.25) of MemTensor's OpenClaw plugin on npm. PyPI had no clean release that day, so 2.0.34 was the newest.
They pushed commits to MemTensor's own GitHub Actions release pipelines. On PyPI that was a custom Poetry build backend, and on npm a tweaked validation script. Both used BASH_ENV to hand the publish token to the attacker before the real publish ran. SafeDep couldn't confirm how the attacker got push access.
Runs on import, not install: A Go implant called sckit starts when the library loads, so --ignore-scripts won't save you.
It harvests credentials from your home directory (npm and PyPI tokens, GitHub tokens, SSH keys, cloud CLI tokens, .env files) and sends them to skyleen[.]fr servers.
It's a worm: It uses stolen tokens to copy itself into other repos and packages, so the victim list could grow.
If you installed it: Downgrade to MemoryOS 2.0.33 (plugin 0.1.20) and rotate every credential reachable from $HOME. Also kill any running sckit stage0 process and chec…
-
#497 Faster than light profiling
23 september 2026 · 27 min
Topics covered in this episode: Lees meer
Tachyon: A sampling profiler ships in Python 3.15's stdlib
Python Workers are now generally available on Cloudflare
Flet 1.0 - build cross-platform apps in Python
marimo-book: Build static books from marimo notebooks
Extras
Joke
Watch on YouTube
Sponsored by Logfire from Pydantic: pythonbytes.fm/logfire
Connect with the hostsMichael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: Tachyon: A sampling profiler ships in Python 3.15's stdlib
Python 3.15 adds the profiling package per PEP 799: profiling.tracing (where cProfile moved) and profiling.sampling, the new sampler called Tachyon
py-spy and Austin exist but copy raw interpreter bytes with no API, so every CPython release risks breaking them; one in the stdlib is a contract to stop breaking profilers
Defaults: 1 kHz, main thread, wall clock, and a -live top-like view for poking at a slow server
Output is flexible: pstats, -flamegraph, -diff-flamegraph against a baseline, -heatmap on source lines, -opcodes for specialized bytecode, -gecko for Firefox Profiler with GIL and GC markers
Profiling modes: wall, cpu, gil (which function is starving my other threads?), and exception, plus -async-aware to see the task graph instead of just select(), -all-threads, and -subprocesses forking a profiler per child
Near-zero overhead for production; guidance is 10-30 second windows on representative load, and free-threaded builds divide the rate by thread count
Attach to a running PID, same minor version only; ptrace permissions are the main friction. A 3.14 backport already exists on GitHub
…
-
#496 A lake house in Seattle
15 september 2026 · 33 min
Topics covered in this episode: Lees meer
Pandas Should Go Extinct
Pydantic-pint puts real-world units in your Pydantic models
How Libraries Run Rust Inside Python (With PyO3)
AWS acquires DuckLabs
Extras
Joke
Watch on YouTube
Sponsored by Logfire from Pydantic: pythonbytes.fm/logfire
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Calvin #1: Pandas Should Go Extinct
Pandas' slowness pushes teams toward "Big Data" tools (Spark, Databricks) they don't actually need — most workloads never hit true Big Data scale
Amazon Redshift telemetry: ~95% of tables are under 100GB, ~87% of queries touch 80GB or less — that's "Medium Data," not Big Data
Polars and DuckDB fill that gap: single-machine, fast, no cluster required
1 Billion Row Challenge benchmark: Pandas took 4m28s vs. Polars 5.04s and DuckDB 5.19s — DuckDB also used 19x less memory
On a real-world NYC taxi dataset (3GB parquet), pure DuckDB ran 2x faster than pure Pandas while using a fraction of the RAM
Bonus: Apache Arrow lets you pass data between Pandas/Polars/DuckDB with zero copying, so trying them out doesn't mean a full rewrite
Michael #2: Pydantic-pint puts real-world units in your Pydantic models
Pydantic-pint bridges Pydantic and Pint so models can validate physical quantities like 4m or 12 meters instead of bare floats. Fields annotated with PydanticPintQuantity parse user input, convert between compatible units, and serialize quantities back out as strings. That closes a real gap for anything consuming API payloads, config files, or sensor data with measurements, letting you enforce units at the valida…
-
#495 Banned
8 september 2026 · 28 min
Topics covered in this episode: Lees meer
EuroPython 2026 videos are online
The State of Django 2026: Boring is so back
htmx 4.0.0 has been released
🐍 Functionally Zen
Extras
Joke
Watch on YouTube
Sponsored by us! Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Michael #1: EuroPython 2026 videos are online
The EuroPython Society has published all 117 recordings from EuroPython 2026 on the official EuroPython Conference YouTube channel. The conference ran July 13-19 in Krakow, Poland and celebrated the conference series' 25th anniversary. The playlist covers keynotes, panels, lightning talks, and full talk recordings across Python core, web, DevOps, data/ML, embedded, and other tracks.
If you missed EuroPython 2026 in Krakow, this is the complete free on-demand archive of one of the year's biggest European Python events.
117 videos now live on the EuroPython Conference YouTube channel, last updated Aug 17, 2026.
Michael’s personal watch list.
Calvin #2: The State of Django 2026: Boring is so back
State of Django 2026 (JetBrains/DSF survey, ~3,500 devs, 40+ countries) - "boring is so back": Django's core stays reliable while everything around it moves fast
Core is stable: Postgres 76–79% for 5 years running, templates ~80%, 43% already on Django 6.0
AI is routine now (only 10% use none) but workflow's unsettled - Claude Code leads at 35%, and 56% still just use it for chat, not autonomous edits
Tooling is consolidating: uv and Ruff both at 43% adoption, each replacing several older si…
-
#494 Python Wrapture
1 september 2026 · 29 min
Topics covered in this episode: Lees meer
OpenAI's Python SDK has migrated to HTTPX2
TMOG - Native Task Manager for macOS, Windows, and Linux
wrapture - one wrapper for mocking, tracing, and observability
linkedin2md: turn your LinkedIn export into 40+ Markdown files
Extras
Joke
Watch on YouTube
About the show
Sponsored by us!
Support our work through:
Our courses at Talk Python
Consulting from Six Feet Up
Connect with the hosts
Michael: Mastodon / BlueSky / X / LinkedIn
Calvin: Mastodon / BlueSky / X / LinkedIn
Show: Mastodon / BlueSky / X
Join us on YouTube at pythonbytes.fm/live to be part of the audience.
Usually Tuesday at 7am PT.
Older video versions available there too.Finally, if you want an artisanal digest of every week of the show notes in email form?
Add your name and email to our friends of the show list, we'll never share it.Calvin #1: OpenAI's Python SDK has migrated to HTTPX2
The OpenAI Python SDK has migrated to HTTPX2, the Pydantic-stewarded fork of httpx.
Pydantic picked it up citing "limited activity recently" in the original project, promising "a reliably maintained path forward."If you just use the default client, nothing to do.
No code changes.The catch is TLS.
Quoting the guide: HTTPX "previously verified certificates against the CA bundle provided by certifi.
HTTPX2 instead uses the operating-system trust store, and the SDK no longer installs certifi."That "can break certificate verification in minimal container images without system CA certificates, environments using corporate TLS-inspecting proxies, and deployments that relied on a custom or modified certifi bundle."
The fix is SSL_CERT_FILE or SSL_CERT_DIR, or pass your own ssl.SSLContext via verify.
Deeper integrations need real edits: custom clients, auth handlers, hooks, and request mocking all take HTTPX2 objects now, and plain httpx is no longer pulled in transitively.
So import httpx in your own code means declaring it yourself or moving over.Temporary escape…
Vergelijkbare podcasts
-
De Technoloog | BNR
BNR Nieuwsradio
Laatste aflevering 5 november 2026
-
De Grote Tech Show | BNR
BNR Nieuwsradio
Laatste aflevering 5 november 2026
-
Machine Gods
NPR
Laatste aflevering 4 november 2026
-
De Groene Nerds
Aljo Hartgers & Danny Oosterveer // De Podcasters
Laatste aflevering 5 november 2026
-
Bright Podcast
Bright B.V.
Laatste aflevering 4 november 2026
-
Understood: The Big Bet
CBC
Laatste aflevering 26 oktober 2026
- Categorieën
- Nieuws , Technologie
- Status
- Loopt nog
- Verschijnt
- Elke week
- Lengte
- Meestal 35 min
- Afleveringen
- 503
- Laatste aflevering
- 3 november 2026
- Eerste aflevering
- 7 november 2016
- Taal
- Engels