The best software security solutions to your security requirements and challenges are specific to your use case, self-service and don't impede development velocity. This will often include creating custom, safe versions of functionality or not allowing the use of certain library functions which we know are dangerous. However, making sure that this guidance is constantly followed can be problematic.

Whilst standard automated tools such as bandit or pylint may help discover generic vulnerabilities such as insecure use of pickle or security errors/misconfigurations such insecure autoescape configuration, how can we verify that our custom solutions and guidance have been correctly implemented and more importantly, stay that way, without writing complicated custom rules for these tools?

In this talk we will discuss examples of custom solutions like this but more importantly, we will demonstrate how to continuously verify that the code remain in a secure state with these solutions implemented, on an ongoing basis. We will demonstrate using simple rule syntax provided by the free, open-source, Semgrep tool.

Some example scenarios we’ll discuss:

You should leave with ideas for how you can have custom and specific security guidelines that match your situation and how you can use a simple rule syntax to verify them as well as solve other similar code analysis problems.

Ever experience a bug in a python library? What about a library that's downloaded nearly 30 million times a month? This talk focuses on a vulnerability - one that caused data leakage in some services.

Attend this talk this talk, to learn about the vulnerability that brought down the world's largest AI framework. Walk away with the tools to address these bugs in the future, learning how the library was debugged, and how the fix was tested. This talk will cover the technical detail behind how the fix was applied in the open, but also the process of working with security issues. Learn how to work with an Open Source community, while addressing a critical bug and keeping your cool.

Every line of code written is open-source, and in the public record, today.

REM group in Mobileye is tasked with the challenge of creating and maintaining a high definition map at world scale with cm level accuracy of all road geometry and semantic elements to enable fully autonomous driving.

The map is constructed from crowd sourced anonymized data of millions of driving assistance systems running computer vision processes in consumer vehicles.

In this talk we will share stories from the trenches on how we optimized python workloads to run distributed big data processing.

The AST (Abstract Syntax Tree) module in Python can be used to analyze code, alert it, and even generate new code. We can use programming to change the AST representation of python, resulting in code that looks and behaves differently than the original.

In this talk we will explore the AST module capabilities, and its lack of capabilities.

We will see some examples of fun code-manipulations. First, we will show how to automatically add meaningful logs to your code. Second, we will experiment with code reordering and last, we will explore ideas to manipulate code for mutant testing purposes.

Dealing with database migrations for developers can be pretty tricky.

Python has frameworks that combine code and database management such as Django.

This talk will go over the basics:

Did the cat eat your CSV file? Did it eat only every third record?

In this talk, we will talk about the different patterns of missing data and what are the best practices for handling each. In addition, we will show how to visualize missing data as part of our data exploration phase to understand our data better.

As python is the leading programing language for data scientists and data analysts, we will use pandas, missingno, scikit-learn and other tools to demonstrate those ideas and explore the data.

Any complex Django-based app will include many models that use the DateTime field, and the clients use those fields.

Assuming all our clients will always be in the same timezone is wrong for a globally used app.

When designing a flow that handles DateTime fields in server-client data exchange, timezone conversions are the main issue.

Another challenge is what can we assume about the DateTime data that comes from the client when they send a PUT request with a DateTime field? What should the response assume? What if the client sends a GET request without any additional data?

In this talk, we will address those issues by demonstrating a simple “Timed Assignment App” that can be used globally.

What is your first association when you hear “automation”? Is it QA automation? Business Process Automation? Data Analysis? If we explore it deeply, we can reveal many undiscovered layers- many uses of automation in many aspects of life.

Ever since my first position as an EDA Engineer - Electronics Design Automation Engineer – many years passed, I have been to many development positions, and I still find myself using these abilities I acquired, to improve my performance and excel in my tasks, both at work and my personal projects. Have you ever looked for a solution to ease your tasks in your personal or work life? Have you ever tried to think Automation? Can we really use it outside the defined world of automation jobs?

In this entry level lecture we will review together some real cases I dealt with and how I used Automation as a solution and improvement tool - automating repetitive commands, automating manual work, extracting information out of a big data and even writing a script that writes a reusable code. We will analyze the issues, review some code and discover the Power of Python in these tasks, and together we will train “automation thinking”.

Join me on the full fascinating tour of the automation mindset, and come out with a new and improved skill in your “bag of tricks”.

The pyproject.toml file is the new standard for declaring Python projects, and it tells a story. Evidence for its significance is the tomllib built-in module introduced in Python 3.11. Many Python tools and linters adopted it as their primary configuration source. You should also use it - whether you publish a library, build an application or even write scripts/notebooks.

This talk will take us through the story of modern Python build systems and package managers. We'll learn where they come into play in the development life-cycle, their benefits, and their limitations.

We will cover dependency resolution and locking with .lock files and how to utilize them for reproducible environments and CI environment caches, facilitating development across large teams.

We will migrate together a Python project from the legacy setup.py file with many additional files into a single pyproject.toml with Poetry.

https://jond01.github.io/blog/pycon-il-23/