Security of everything at PyCon 2026 - Talk Python to Me Ep. 557
Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall. On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe. We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full. ▬▬▬▬ About the podcast ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ This video is the uncut, live recording of the Talk Python To Me podcast ( https://talkpython.fm ). We cover Python-focused topics every week and publish the edited and polished version in audio form. Subscribe in your podcast player of choice (100% free) at https://talkpython.fm/subscribe. ▬▬▬▬ Guests ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Juanita Gomez Seth Michael Larson Mike Fiedler ▬▬▬▬ Links and resources from the show ▬▬▬▬▬▬▬▬▬▬▬▬ Trailblazing Python Security: https://us.pycon.org/2026/tracks/security/ Everything Security at PyCon US 2026 (PSF blog): https://pyfound.blogspot.com/2026/06/everything-security-at-pycon-us-2026.html Dependency Cooldowns: https://cooldowns.dev/ Anatomy of a Phishing Campaign (Mike Fiedler) Recording: https://www.youtube.com/watch?v=uXW1qeUS6Yw FedRAMP: https://www.gsa.gov/technology/government-it-initiatives/fedramp Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: https://www.youtube.com/watch?v=WOOlzsJx9cg Rust for CPython project: https://blog.python.org/2026/04/rust-for-cpython-2026-04/ pre-PEP: https://discuss.python.org/t/pre-pep-rust-for-cpython/104906 Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: https://www.youtube.com/watch?v=42kibVnUHYE SBOMit: https://github.com/in-toto/sbomit Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: https://www.youtube.com/watch?v=VYY3HnRtV6U Volatility: https://volatilityfoundation.org/ Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: https://www.youtube.com/watch?v=mgY7zuDYrag zizmor: https://docs.zizmor.sh/ GitHub Actions security in Python packages (Andrew Nesbitt write-up): https://nesbitt.io/2026/05/25/github-actions-security-in-python-packages.html andrew/pycon: data & analysis for the GitHub Actions security talk: https://github.com/andrew/pycon GitHub Actions Security in Python Packages - Andrew Nesbitt: https://www.youtube.com/watch?v=vn3YIqdseWI gh-profiler: examine a GitHub user's profile to gauge their contributions: https://github.com/ehmatthes/gh-profiler PyCon US YouTube channel: https://www.youtube.com/@PyConUS SBOMit: adding verification to SBOMs (OpenSSF): https://openssf.org/blog/2023/12/13/introducing-sbomit-adding-verification-to-sboms/ Ecosystems: https://ecosyste.ms ▬▬▬▬ Dive deeper ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Listen to the Talk Python To Me podcast at https://talkpython.fm and explore over 275 hours of Python courses at https://training.talkpython.fm/courses. ▬▬▬▬ Follow us on Social ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ Mastodon: Michael - https://fosstodon.org/@mkennedy & Talk Python - https://fosstodon.org/@talkpython Bluesky: Michael - https://bsky.app/profile/mkennedy.codes & Talk Python - https://bsky.app/profile/talkpython.fm X: Michael - https://x.com/mkennedy & Talk Python - https://x.com/talkpython