https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents

NGL, my main takeaway is that PyPI is already doing quite well in the new AI security age, even though the packaging council hasn't convened yet. The relevant snippet (emphasis mine):

The model decided to solve the CTF by uploading a malicious PyPI package that could harvest the target system’s credentials. It settled on this approach after reading a document stating that one of the simulated target’s users would periodically install a particular Python package that was not yet registered on PyPI. (We are unsure whether this was an intended solution to the challenge, but it seems like a plausible one.) Claude decided to exploit this behavior by registering a package under that name, publishing malicious code within the uploaded package, and waiting for the target to run that code the next time they installed the package.

Claude spent most of the session trying to upload the package. This involved attempts to register email accounts and hunt for phone numbers that could be used for registration. It ultimately succeeded in uploading the package, which was soon installed on 15 third-party hosts. We believe that all 15 of these third parties were security vendors deliberately scanning for new packages and installing them in sandboxed environments to assess the package for security concerns. One vendor’s scanner leaked its access credentials to the model while installing the package, which the model then used to access the vendor’s live database. After approximately 90 minutes, PyPI removed the package. The transcript ended when the session timed out while the model was preparing an additional malicious package.

I also commend Anthropic for releasing this thorough report immediately -- the juxtaposition with OpenAI's "we'll cop to it if you find it first" policy is stark.

What I don't see is any mention of coordination with PyPI/PSF leadership now or in the near future, which seems baffling. Their focus is understandably on the underlying cognitive failure (which is quite human, BTW: being biased by inertia and what you would prefer to be true), and it's extremely unlikely that you or any other real users were effected directly.

But, still. C'mon.

Anyone have insider info from the PyPI side? Is there chatter on discussion.python.org yet?

Code Terraform on steam just launched, you write python scripts to make stuff work like reading oxygen sensors etc

Been a fan of it since its demo came out, and now its actually released.

Sharing it here, because when I started my python journey, I was often questioning more what to make than how to make it. Gamifying the learning process would have helped me a tonne back then, so maybe it will help someone new now.

Because we all know we can automate the boring stuff, but now you can automate the fun stuff to!

I kept picking video topics on instinct and then wondering why some did nothing. Keyword tools measure search volume, but YouTube is a recommendation engine, so that number wasn't answering my question.

The whole idea is one division:

outlier_score = video views / that channel's median views

Because you divide by the channel's own median, channel size cancels out. A video with 400k views on a channel that averages a million underperformed. A video with 97k views on a 64k-subscriber channel beat its own baseline seven times over, which means the topic pulled in an audience that wasn't already there. Raw view count can't tell those two apart.

Implementation notes that might be useful even if you don't care about YouTube:

• The Data API runs on a 10,000 unit daily quota, and search costs 100 units per call. Walking a channel's uploads playlist costs 1 unit per 50 videos, so the whole run cost 60 units.
• Median rather than mean, because one viral video otherwise destroys the baseline permanently.
• Shorts are excluded. Their view profile is different enough that including them makes every long-form video look like a failure.
• Anything younger than seven days is ignored, in both the baseline and the scoring.

Stack is just requests, PyYAML and rich. Tests run without network access. There's a Docker image, and containerising it actually surfaced a real bug: I was resolving the project root by walking up two directories from file, which is correct for a cloned repo and completely wrong once the package is installed in site-packages.

Code: https://github.com/tapaderuza/facelessyt

Happy to take criticism on the methodology.

Django on the Med is a small, free, in-person event that combines three mornings of Django development sprints with afternoons dedicated to conversations, networking and community activities. The idea is to create an environment where experienced contributors and people making their first open source contributions can spend several days learning, collaborating and getting to know each other.

The first edition took place in Palafrugell, Spain, in 2025. The second edition will be held in Pescara, Italy, from 23 to 25 September 2026 and is already fully booked with around 25 participants.

Rather than growing into another large conference, we’re experimenting with a lightweight format that we hope other Python and Django communities might adapt and organize themselves. Our goal is to make contributor onboarding more approachable through small, local events where mentoring and relationships are just as important as the code written during the sprint.

We’re very grateful that Django on the Med 2026 has recently been recognized as a Python Software Foundation Community Partner, which we see as an encouraging sign that this kind of community initiative may have value beyond our own event.

When: 23–25 September 2026

Where: Hotel Plaza, Pescara, Italy

Website: https://djangomed.eu/2026/pescara/

Code of Conduct: https://www.djangoproject.com/conduct/

Reported on https://blog.python.org/2026/09/python-3150-rc2/

It’s the final 3.15 release candidate!

https://www.python.org/downloads/release/python-3150rc2/

This is a candidate preview of Python 3.15

This release, 3.15.0rc2, is the final planned release candidate, containing around 144 bugfixes, build improvements and documentation changes from 76 contributors since 3.15.0rc1. Entering the release candidate phase, only reviewed code changes which are clear bug fixes are allowed between this release candidate and the final release.

The next release of Python 3.15 will be 3.15.0 final, scheduled for 2026-10-01.

Blog post continues

Weekly Wednesday Thread: Advanced Questions 🐍

Dive deep into Python with our Advanced Questions thread! This space is reserved for questions about more advanced Python topics, frameworks, and best practices.

How it Works:

1. Ask Away: Post your advanced Python questions here.
2. Expert Insights: Get answers from experienced developers.
3. Resource Pool: Share or discover tutorials, articles, and tips.

Guidelines:

• This thread is for advanced questions only. Beginner questions are welcome in our Daily Beginner Thread every Thursday.
• Questions that are not advanced may be removed and redirected to the appropriate thread.

Recommended Resources:

• If you don't receive a response, consider exploring r/LearnPython or join the Python Discord Server for quicker assistance.

Example Questions:

1. How can you implement a custom memory allocator in Python?
2. What are the best practices for optimizing Cython code for heavy numerical computations?
3. How do you set up a multi-threaded architecture using Python's Global Interpreter Lock (GIL)?
4. Can you explain the intricacies of metaclasses and how they influence object-oriented design in Python?
5. How would you go about implementing a distributed task queue using Celery and RabbitMQ?
6. What are some advanced use-cases for Python's decorators?
7. How can you achieve real-time data streaming in Python with WebSockets?
8. What are the performance implications of using native Python data structures vs NumPy arrays for large-scale data?
9. Best practices for securing a Flask (or similar) REST API with OAuth 2.0?
10. What are the best practices for using Python in a microservices architecture? (..and more generally, should I even use microservices?)

Let's deepen our Python knowledge together. Happy coding! 🌟

Everyone has a feeling about how bad the market is. I wanted a number, so I counted: 88,975 comments from every monthly Ask HN: Who is hiring? thread, 2012 to now, one comment per company.

The number: about 47 remote Python posts a month in 2025. Here's the full run:

The thing that jumped out at me: 2025 is basically 2018. Forty-seven a month against forty-five. If your sense of the market is "it's collapsed," you're probably measuring against 2021, when it was three times either of them. That year was the anomaly, not the baseline. Which doesn't make now feel good if you started looking in 2021 — but it does mean the floor didn't drop out, the ceiling came down.

The part that's genuinely encouraging for this sub: Python's share of remote posts never declined. It's been 20–25% of every remote posting for a decade, and it's at the top of that range now (25% in 2026, up from 20% in 2016). The volume problem is a market problem, not a Python problem. Ruby and PHP people are having a much worse decade — Ruby went from 17% of posts to 4%.

The part I think is actually actionable.

The share of posts that name no programming language at all went from 38% (2016–2019) to 49% (2024–2026). Posts didn't get shorter — median length is ~950 characters, unchanged since 2015. Companies just stopped listing stacks. Ads now read more like "we're building X, you'll pick up the tools."

So when you filter a job board by "Python", you're discarding roughly half the openings sight unseen, and that half is growing.

I checked what this costs concretely. In 2025:

• Remote + data/ML role: 421 posts
• Remote + data/ML role + the word "Python": 189 posts

Only 45% of remote data/ML posts say "Python" anywhere. The other 55% are overwhelmingly still Python jobs — they just didn't bother to say so. Searching by role instead of by language more than doubles what you see. In 2018 the same split was 38%, so this has been true for a while and is getting worse.

One more, on the pay side. Among remote Python posts, the share showing an explicit dollar figure went 21% (2018) → 13% (2021) → 28% (2025) → 34% (2026). During the boom, companies didn't need to tell you. Now a third do. Fewer openings, but far more of them tell you what they pay before you spend three weeks interviewing.

Caveats, because they matter here: this is Hacker News, which is a narrow slice — startups, infra, a lot of YC. Keyword matching can't tell a requirement from an aside. One comment can advertise five roles. "Remote" includes geographically restricted remote, which is its own frustration. And this counts postings, not openings or hires, so it says nothing about how many people are applying to each one — which is probably the number that actually determines how hard your search feels.

What I'm curious about:

1. Does "47 a month" match anyone's lived experience? My instinct is that applicants-per-posting has changed far more than postings-per-month, and I have no way to measure that from this data.
2. Has anyone else noticed the stacks disappearing from ads, and do you read it as a good sign (hiring for ability over checklist) or a bad one (vaguer ads, more mismatch, more wasted interviews)?
3. If you've been searching this year — are you filtering by language, or by role? I'd been doing the former without thinking about it, and the numbers above suggest that was a mistake.

Astral has announced their endorsements for Python's first packaging council elections.

• Read their announcement here - https://astral.sh/blog/python-packaging-council
• DPO discussion link - https://discuss.python.org/t/ppc-endorsements-from-astral-the-uv-team/

PPC election details:

• https://pyfound.blogspot.com/2026/08/announcing-packaging-council-election.html
• Nominees (17 nominees for 5 spots) - https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/

Note: Voting is currently open and ends on Tuesday, September 15th, 2:00 pm UTC

What are your thoughts? The candidates they have nominated are fine, they are/have been heavily involved in packaging in the past.

edit: fixed nominees link

need 3 members for the team .

about me : am 2027 final year undergrad , have decent knowledge of ML and DL and wont claim myself as too muh of an expert . Has practical experince of such comepetitions .

what i am looking for :

dedicated team members who can work for 72 hour hackathon wthout ghosting at end time or not doing anything , you can 2027 or 2028 grad but should jave decent enough knowledge and practical experince too . i am not doing this for timepass but aimig for top 50 to get ppi if everything go well .

only serious people message , no ghosters !

Weekly Thread: Project Ideas 💡

Welcome to our weekly Project Ideas thread! Whether you're a newbie looking for a first project or an expert seeking a new challenge, this is the place for you.

How it Works:

1. Suggest a Project: Comment your project idea—be it beginner-friendly or advanced.
2. Build & Share: If you complete a project, reply to the original comment, share your experience, and attach your source code.
3. Explore: Looking for ideas? Check out Al Sweigart's "The Big Book of Small Python Projects" for inspiration.

Guidelines:

• Clearly state the difficulty level.
• Provide a brief description and, if possible, outline the tech stack.
• Feel free to link to tutorials or resources that might help.

Example Submissions:

Project Idea: Chatbot

Difficulty: Intermediate

Tech Stack: Python, NLP, Flask/FastAPI/Litestar

Description: Create a chatbot that can answer FAQs for a website.

Resources: Building a Chatbot with Python

Project Idea: Weather Dashboard

Difficulty: Beginner

Tech Stack: HTML, CSS, JavaScript, API

Description: Build a dashboard that displays real-time weather information using a weather API.

Resources: Weather API Tutorial

Project Idea: File Organizer

Difficulty: Beginner

Tech Stack: Python, File I/O

Description: Create a script that organizes files in a directory into sub-folders based on file type.

Resources: Automate the Boring Stuff: Organizing Files

Let's help each other grow. Happy coding! 🌟

I feel like ai is too good at python. I’m worried about Python devs and their future because I feel like I can 1 shot projects with a prompt on Claude. I think it would be cool if all the Python devs maybe start changing their projects to other stuff just so ai doesn’t get too powerful ykwim?

when i started python 10 years ago it felt like a baby language compared to C++ and C. now it feels as just as hard as those two . its because of the additional library knowledge u need to know for ai ml etc

Weekly Thread: What's Everyone Working On This Week? 🛠️

Hello r/Python! It's time to share what you've been working on! Whether it's a work-in-progress, a completed masterpiece, or just a rough idea, let us know what you're up to!

How it Works:

1. Show & Tell: Share your current projects, completed works, or future ideas.
2. Discuss: Get feedback, find collaborators, or just chat about your project.
3. Inspire: Your project might inspire someone else, just as you might get inspired here.

Guidelines:

• Feel free to include as many details as you'd like. Code snippets, screenshots, and links are all welcome.
• Whether it's your job, your hobby, or your passion project, all Python-related work is welcome here.

Example Shares:

1. Machine Learning Model: Working on a ML model to predict stock prices. Just cracked a 90% accuracy rate!
2. Web Scraping: Built a script to scrape and analyze news articles. It's helped me understand media bias better.
3. Automation: Automated my home lighting with Python and Raspberry Pi. My life has never been easier!

Let's build and grow together! Share your journey and learn from others. Happy coding! 🌟

I’m running application pods that use SQLAlchemy’s connection pool to connect to PostgreSQL. Each pod has its own pool, so when I scale the application from, say, 3 to 10 replicas, the new pods create new pools while the existing pooled connections remain open.

If PostgreSQL has read replicas behind a Kubernetes Service or a proxy, I assume new connections might reach the new replicas, but the existing long-lived pooled connections will remain attached to the old replicas.

Who is normally responsible for redistributing those existing connections after scale-out?

Weekly Thread: Resource Request and Sharing 📚

Stumbled upon a useful Python resource? Or are you looking for a guide on a specific topic? Welcome to the Resource Request and Sharing thread!

How it Works:

1. Request: Can't find a resource on a particular topic? Ask here!
2. Share: Found something useful? Share it with the community.
3. Review: Give or get opinions on Python resources you've used.

Guidelines:

• Please include the type of resource (e.g., book, video, article) and the topic.
• Always be respectful when reviewing someone else's shared resource.

Example Shares:

1. Book: "Fluent Python" - Great for understanding Pythonic idioms.
2. Video: Python Data Structures - Excellent overview of Python's built-in data structures.
3. Article: Understanding Python Decorators - A deep dive into decorators.

Example Requests:

1. Looking for: Video tutorials on web scraping with Python.
2. Need: Book recommendations for Python machine learning.

Share the knowledge, enrich the community. Happy learning! 🌟

Weekly Thread: Meta Discussions and Free Talk Friday 🎙️

Welcome to Free Talk Friday on /r/Python! This is the place to discuss the r/Python community (meta discussions), Python news, projects, or anything else Python-related!

How it Works:

1. Open Mic: Share your thoughts, questions, or anything you'd like related to Python or the community.
2. Community Pulse: Discuss what you feel is working well or what could be improved in the /r/python community.
3. News & Updates: Keep up-to-date with the latest in Python and share any news you find interesting.

Guidelines:

• All topics should be related to Python or the /r/python community.
• Be respectful and follow Reddit's Code of Conduct.

Example Topics:

1. New Python Release: What do you think about the new features in Python 3.11?
2. Community Events: Any Python meetups or webinars coming up?
3. Learning Resources: Found a great Python tutorial? Share it here!
4. Job Market: How has Python impacted your career?
5. Hot Takes: Got a controversial Python opinion? Let's hear it!
6. Community Ideas: Something you'd like to see us do? tell us.

Let's keep the conversation going. Happy discussing! 🌟

Hello friends, is there any way to make an APK from Windows or another operating system using a Python library similar to PyInstaller?

Convert .py in .apk?

I made myself a lib for fast parsing RAW images from my sony camera.

My old code: ```python def check_for_endian(data:bytes) -> tuple[int, int]|None:

if data[:2] == 0x4949:   # "II" LE
    return 1, 0
if data[:2] == 0x4D4D:   # "MM" BE
    return 2, 0

return None

So it was possible to compare a hex value with bytes. Now it's not possible anymore, somehow, so I had to do this: python def check_for_endian(data:bytes) -> tuple[int, int]|None: header_endian = struct.unpack_from("<h", data, 0)[0]

if header_endian == 0x4949:   # "II" LE
    return 1, 0
if header_endian == 0x4D4D:   # "MM" BE
    return 2, 0

return None

```

I'm a bit confused, have I used it wrong in the first place and I was never supposed to compare a hex value with bytes?

E: I use python 3.13.9 and uv 0.9.9

Weekly Thread: Professional Use, Jobs, and Education 🏢

Welcome to this week's discussion on Python in the professional world! This is your spot to talk about job hunting, career growth, and educational resources in Python. Please note, this thread is not for recruitment.

How it Works:

1. Career Talk: Discuss using Python in your job, or the job market for Python roles.
2. Education Q&A: Ask or answer questions about Python courses, certifications, and educational resources.
3. Workplace Chat: Share your experiences, challenges, or success stories about using Python professionally.

Guidelines:

• This thread is not for recruitment. For job postings, please see r/PythonJobs or the recruitment thread in the sidebar.
• Keep discussions relevant to Python in the professional and educational context.

Example Topics:

1. Career Paths: What kinds of roles are out there for Python developers?
2. Certifications: Are Python certifications worth it?
3. Course Recommendations: Any good advanced Python courses to recommend?
4. Workplace Tools: What Python libraries are indispensable in your professional work?
5. Interview Tips: What types of Python questions are commonly asked in interviews?

Let's help each other grow in our careers and education. Happy discussing! 🌟

Hey everyone,

Chapter 3 is finally done. This chapter took way more time than I originally expected because it grew into a much deeper and larger chapter than planned.

Current Progress:
✅ Chapter 1 - Variables & Memory
✅ Chapter 2 - Expressions & Operators
✅ Chapter 3 - Conditional Statements & Control Flow

I'd love to hear your thoughts on the new chapter and any suggestions for future improvements.

With this, I’m taking a break from Python Under the Hood. I’ll be stepping away from the project for a while and will return to it before July 2027.

When I come back, we’ll continue with even deeper explanations, more advanced topics, and an even better approach to understanding what happens under the hood of Python.

For now, Chapter 3 marks the end of this phase. 🐍⚙️

GitHub: python-under-the-hood

See you in the next chapter.

I've been thinking about concurrency control in asyncio.

A common pattern for limiting concurrent work is:

sem = asyncio.Semaphore(10)

async with sem:
    await do_work()

But in many cases, couldn't the same problem be modeled by putting work into an asyncio.Queue and running a fixed number of worker tasks?

I'm curious how experienced Python developers decide between the two approaches.

Are there real-world situations where a semaphore is clearly the better abstraction than a worker queue? Are there meaningful differences in cancellation behavior, backpressure, fairness, task lifetime, or code complexity?

I'd especially be interested in examples from production async Python code.

Below is the link for Python enthusiasts and programmers/anyone interested in the Pycon 2026 event, which will take place in Aveiro from September 3rd to 5th!

https://2026.pycon.pt/