Brett Cannon

#Python core developer; snarky #Canadian

Sponsor: https://github.com/sponsors/brettcannon/
Blog: https://snarky.ca
GitHub: https://github.com/brettcannon/
Notes: https://opensource.snarky.ca

Public Key

npub139gmplm2d5syujhrat2gx6gutampwx5cz9el7qr02a6r0tj3xycsrjcwvw

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsgj5dsla4x6gzwft3744yrdyw97ashr2vpzullqph4waph4egnzvgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hsz9nhwden5te0wfjkccte9ec8y6tdv9kzumn9wswqxs9m

Publishing to

relay.momostr.pink

relay.damus.io

relay.primal.net

Author Public Key

npub139gmplm2d5syujhrat2gx6gutampwx5cz9el7qr02a6r0tj3xycsrjcwvw

Show more details

Last Notes

2026-07-22 21:40:50 CEST

RE: https://mastodon.online/@mullvadnet/116957571811403553
Unfortunately the blog post is the usual "it's the individual, not the company" line without acknowledging that people are upset because the company sends money to said individual. People don't want to be indirectly funding these politics and unless you say that person is no longer directly getting money from the company which facilitates that money, I don't want to give you my money.
#note1y7n…f8we

2026-07-21 01:59:38 CEST

Wasmtime now has GC and exception handling support!
https://bytecodealliance.org/articles/wasmtime-gc
The GC support is useful for having **much** smaller Wasm files when you compile straight to Wasm (i.e. my WASI builds won't use it).
The exception handling support should help with long jumps in C code. For Python that would be useful for porting MicroPython to WASI.

2026-07-17 00:00:17 CEST

I want sticker books for all the stickers I get at a conference, like a sticker-based remembrance book of my conference travels.

2026-07-16 01:23:51 CEST

I **finally** got a PoC for a #WASI distribution for #CPython! Looking for feedback at https://discuss.python.org/t/108168 .

2026-07-07 22:47:44 CEST

If you use GitHub Actions to publish to PyPI, I wrote a blog post outlining what I consider the key things you can do to secure your publishing workflow.
https://snarky.ca/how-to-publish-to-pypi-using-github-actions-securely/
If you don't use GitHub Actions for publishing, this post will NOT be of interest to you.

2026-06-27 07:14:29 CEST

Another example where a bit of funding to fix some tech that would benefit a lot of people in this world, but no one does it because it seemingly wouldn't turn a profit.
https://lr0.org/blog/p/arabic/

2026-06-08 22:23:03 CEST

https://pyrefly.org/blog/too-many-type-checkers/ makes the reasonable case that you should type check your tests with as many type checkers as possible while sticking to one for your actual code. That way you minimize those "<type checker> didn't like your API" issues.

2026-05-26 01:35:25 CEST

That feeling when you're well into your 5th month of debating how to manage virtual environments.
You would think it's a simple thing, but that's probably why everyone has an opinion about it and some of those opinions are "get off my lawn" strong.

2026-05-07 22:21:27 CEST

RE: https://infosec.exchange/@mttaggart/116533391495608629
This coupled with https://www.selc.org/news/xai-built-an-illegal-power-plant-to-power-its-data-center/ makes it extra bad for the environment based on how xAI had unpermitted gas turbines at Colossus 1 initially.
#note1260…k8qh

2026-04-28 01:07:30 CEST

RE: https://mastodon.social/@sethmlarson/116477240088086817
Note the "install from pylock.toml"! It's experimental, but having PEP 751 reaching this point is big!
#note1rtq…z3cv

2026-03-28 20:36:48 CET

- reply

trusted != uptime; it just means PyPI expects that security is at a certain level around identity

2026-03-28 03:38:20 CET

- reply

First, I work at MS; I don't expect you to necessarily agree with the trajectory of the company but it did pay for that blog post, so please keep the insults civil.
Two, you can work with whomever you have hosting your code to become trusted enough to use trusted publishing. Or you can work to make a system where trusted publishing isn't a prerequisite.

2026-03-26 05:05:46 CET

RE: https://fosstodon.org/@jni/116287554201659198
I said digital attestations and `pylock.toml` would have helped with the litellm attack. People asked for more details, so I wrote a blog post explaining why. It also hopefully acts at motivation for people to use:
- Trusted publishing
- Digital attestations
- Lock files, and `pylock.toml` specifically
https://snarky.ca/why-pylock-toml-includes-digital-attestations/
So yes, @npub1ks8…5wm6 , I have a "human-readable intro" because I wrote one for you (and the other folks asking me questions on the subject). 😁
#note1f7f…h4dr

2026-03-24 18:27:23 CET

RE: https://infosec.exchange/@dangoodin/116285175398594132
Notice how the compromised releases were directly uploaded. This is why `pylock.toml` includes attestation data and trusted publishing is important. If the project used trusted publishing then their the lack of attestation data could have been noticed in a diff of the lock file as it would have suddenly disappeared (which is also why `pylock.toml` was designed to be human-readable).
#note19jl…gtsu

2026-01-28 21:57:07 CET

https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-7115 is a petition for the Canadian government to set up secure coding guidelines.

2026-01-25 22:20:42 CET

Something I noticed lately is people having at least separate sections on their website if not a separate site entirely to split blog posts/articles from short thoughts/social media posts. Do people like that for the separate RSS feeds so you can ignore the short stuff? Hate it because now it's 2 feeds to follow if you wants everything from someone? Don't care since it all just funnels into a single place here and you don't use RSS feeds?

2026-01-21 23:51:35 CET

My bet is that safety-critical code will be the last place to pick up AI due to auditing needs.

2026-01-09 01:15:17 CET

I got an external drive for backing up my home directory on my Linux machine. I want to do rolling updates in case I want to go back for a file I deleted or edited, space permitting. Is rsync still the best option for this sort of thing?

2025-12-18 20:33:34 CET

https://doesjitgobrrr.com/ now has a goal line for the Python JIT in 3.15 (at well as 3.16 and a custom line as well), and Arm support crossed the goal for the first time!

2025-11-14 21:35:19 CET

- reply

Is that image available as a wallpaper?

2025-10-11 05:48:10 CEST

In case you prefer text over video, the blog post version of my EuroPython keynote about why it took 4 years to get a lock files specification is now up at https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/ .

2025-09-10 05:18:09 CEST

If you work for a remote-friendly company and have wanted to hire US-based Microsoft employees, now is a good time to try (other countries will probably come up next year).
https://blogs.microsoft.com/blog/2025/09/09/flexible-work-update/

2025-09-05 21:33:17 CEST

PEP 794 (Import Name Metadata) has been accepted!
https://peps.python.org/pep-0794/
https://discuss.python.org/t/pep-794-import-name-metadata/94567/85

2025-08-28 00:11:40 CEST

The Python documentary premieres tomorrow @ 10:00 PT / 19:00 CET!
https://www.youtube.com/watch?v=GfH4QL4VqJ0

2025-08-26 19:14:35 CEST

The Python documentary by cult.repo is going to be debuting live on YouTube on Thursday the 28th at 7pm CET/10am PT! https://www.youtube.com/@cultrepo
I'll share a link the day before to the doc that will have a countdown to the debut. I'm planning to be in the live chat during the debut.
I saw a full length cut a month ago (which was great!), but I am purposefully holding off on watching the final cut with the rest of you so I get to have a little bit of a surprise 😁.

2025-08-12 07:39:10 CEST

Annual reminder for Canadian #Mullvad users that vouchers from Amazon are cheaper than buying from Mullvad directly and keep you anonymous to Mullvad.

2025-07-31 21:53:09 CEST

PSA: do NOT create a virtual environment in the directory you're keeping your code in (or the corollary: don't create a virtual environment and put your code into it). You should NEVER do `python3 -m venv .`.
Brought to you by people who did `python3.13 -m venv .` and discovered their `.gitignore` file got overwritten with venv's `.gitignore` file or that suddenly all of their files were being ignored.
And no, we are not removing the `.gitignore` file from venv.

2025-07-30 05:30:30 CEST

A throwaway line I said while walking with @npub1qph…t7nc @npub1zgm…dan3 @npub1xvu…jmp8 and Nicholas Tollervey to the EuroPython social event in reference to people relaxing about potential breakage in a release and just lean into bumping the version instead.
Credit to Claude for helping me make the image.
https://files.mastodon.social/media_attachments/files/114/940/060/503/271/242/original/684484ea7b514daa.png

2025-07-06 21:42:03 CEST

Does anyone have a recommendation for a travel eSIM?
It will primarily be for EU, UK, and US travel. I prefer better/easier UX over cheapest price. I won't be tethering, so this is for data on my phone while I'm out and about. Bonus if there's some way to have multiple eSIMs on one family account. And while this shouldn't matter, I'm on Android.
(And for anyone curious as to how outrageous Canadian telecoms are, US roaming is CAD$14/day, CAD$16/day everywhere else.)

2025-06-24 21:54:35 CEST

https://www.cbc.ca/news/world/trump-supreme-court-deportations-1.7568872
Does this mean that if I visit the US and they decide to kick me out via deportation (let's say there's a disagreement over whether I'm performing work or not while in the States), they could legally send me to South Sudan instead of Canada?

2025-06-17 22:39:48 CEST

For a PEP discussion, it's been eerily quiet...
I don't want to be more specific since I don't want people to find a reason to say something, but it is a good sign I covered everything in the latest version and people are generally happy with the outcome.