Notices by Jeff Triplett (webology@mastodon.social)

✨ So @justin did everyone a solid and wrote "Any Updates?"

If you are an open-source maintainer and dealing with "Any Updates?" comments on issues, you can now copy and paste the url to Justin's article, and no other reply is needed.

https://justinmayer.com/posts/any-updates/

https://mastodon.social/@justin@ramble.space/114223316349198309

I have hated LastPass for over a decade, but we have entered a new era.

🤔 Storing your passwords as a Google doc that you print into a PDF and share with your entire company is more secure than using LastPass levels of bad.

Do NOT use LastPass.

https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/

🤔 This aged well.

https://micro.webology.dev/2024/07/14/why-i-deleted-firefox-from/

@baconandcoconut What do you mean, "close all the tabs?"

I thought they grew until the browser crashes then you get to start over.

@ehmatthes @kattni I really enjoyed not having to commit to anything outside of inviting people out for pierogies which I did a lack luster job of. 😄

@CodenameTim If you already have Django running, then you have solved most of these.

I think about privacy, too.

Do you trust Google and someone managing share permissions who might accidentally be making the data public over a system you can control?

Google trains on any data that's marked as public, accidentally or not.

🤷 Why do the Django and Python communities use so many Google Forms?

https://micro.webology.dev/2024/12/17/why-do-the.html

🗳️ If you haven't voted yet in the DSF's Steering Council election, and *you can vote* then please do that Monday or Tuesday. By Wednesday, it will be too late.

https://www.djangoproject.com/weblog/2024/dec/10/django-6x-steering-council-candidates/

The secret here is that fundraising is a JOB and not a volunteer function.

Working with these companies is a JOB.

Sadly, even when these companies want to write us a check, we historically haven't made that easy. Even setting up a meeting is a multi-week scheduling pain.

My goal is to hire an Executive Director for the DSF. Then, I want these companies to pay up. https://fosstodon.org/@carlton/113628848430194440

Please publish and share more

https://micro.webology.dev/2024/11/02/please-publish-and.html

This advice applies to #Python tooling, too.

> Tools should be durable, reliable, and safe. They should also work as designed and provide clear instructions on operating them.

https://www.thisoldhouse.com/tools/23438662/tool-buying-guide

@ntnsndr I have never tried Matrix, but I have yet to use a non-proprietary platform whose UX wasn't hot garbage.

I'm not a fan of Discord and Slack, but I have to log into them every day for a few dozen orgs that are firmly there.

I welcome a good, open platform whose UX is not hot garbage. (I am not sure we are there yet.)

🎉 With a ~76% voter turnout and all three bylaws passing for this year's @ThePSF elections.

It was a great turnout and outcome.

There is so much noise on the forum and mailing lists, which continues to be an echo chamber. It's a shame so many people (small numbers are still too many) are still anti and openly hostile towards having an enforceable code of conduct.

💪 That ship sailed years ago and the Python community is better for it.

@MonaApp I can't tell what changed in the last 24 hours, but both my trackpad and mouse stopped working with that app. Clicks do not register and I can't for the life of me tell how to fix it or what's changed.

Have you see this before?

I have used a dozen other apps and I have not seen this at all.

I deleted, restarted, and re-installed a fresh copy from the App Store and I have the same behavior.

Plz help!

🤔 Friends, I hate to say this with fresh layoffs happening, but you are about to see how much "Big Tech ❤️s Open Source" after years of exploiting our work.

>$100 billion in cash reserves and record quarterly profits going back a decade doesn't provide even an ounce of job safety, job security, or even loyalty for the employees and projects who got them there.

If you believe otherwise and work for one of these companies, I hope you are mentally and financially ready for what is to come.

📌 On leaving Pinboard, aka Raindrop, is better 🤷: https://micro.webology.dev/2024/04/11/on-leaving-pinboard.html

@sethmlarson The context matters 💯

Flask runs a `pip install -e . ` to install itself to run tests. This gets a negative mark.

Same for running `pip install -U pip` to always be on the latest pip.

I don't know how someone may reasonably pin those.

They also get tripped up on locked Python dependencies via `pip install -r locked-filename.txt`.

These aren't helpful.

🔥 An update on OpenSSF's XZ fumble: https://micro.webology.dev/2024/04/01/an-update-on.html

@sethmlarson Django was also dinged because of their security details because the file includes a link to the website.

Some points for the filename existing, so GitHub's API can pick up on it.

Negative points for keywords not existing because the file is a URL that appears to be on the external website.

🤷

@sethmlarson I don't believe grepping for "pip install" and then failing is useful or healthy for anyone, which is what those sections appear to be pointing out.

I get that this is a hard problem to know the right context and to differentiate, which is why many of us are pointing out that it's a bad tool.

A bad tool is one we can't trust or that commonly reports false positives, which is where we are at.