Talk Python To Me

Do you know what's actually slow in your Python app? Or are you guessing? Until now, profiling Python meant a tracing profiler that made your code 2 to 3 times slower. Or a third-party tool that broke with every new release. Python 3.15 fixes that. It ships Tachyon, a sampling profiler built into the standard library. It attaches to live production apps with almost zero overhead. My guests are Pablo Galindo Salgado, CPython core developer and Steering Council member, and László Kiss Kollár from Bloomberg's Python infrastructure team. Their first prototype ran at two samples a second. Now it does over a million hz. And it lands in Python 3.15 this October.

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

László Kiss Kollár: linkedin.com

3.11: talkpython.fm

Memray: talkpython.fm

PyStack: talkpython.fm

profile and cProfile: docs.python.org

py-spy: github.com

Austin: github.com

PEP 799: peps.python.org

PEP 768: peps.python.org

PyCon US 2026 talk: us.pycon.org

The docs: docs.python.org

Backport to 3.14: github.com

Watch this episode on YouTube: youtube.com

Episode #565 deep-dive: talkpython.fm/565

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

Every ship in EVE Online eventually undocks and leaves the station. This time, it's the whole game. EVE has run on Python 2 since it launched in 2003, all 2.4 million lines of it, on a custom Stackless interpreter that stopped at 3.8 and was archived last year. Destination: Python 3.12. The route runs through 6,500 lines of division that decide who wins a fight, and 100 gigabytes of pickled Python objects that have to survive the jump intact. Kristinn Sigurbergsson was on this show ten years ago. He's back, with Jamie Bannister, who is flying the EVE Online migration right now, and Thomas Dähling, who took EVE Frontier through first. In EVE, a destroyed ship is gone for good. There are no do-overs, and the universe has to stay online the whole way.

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Links from the show

Jamie Bannister: linkedin.com

Thomas Dähling: linkedin.com

Kristinn Sigurbergsson: linkedin.com

EVE Online: www.eveonline.com

EVE Frontier: evefrontier.com

2.4 million lines of Python: www.eveonline.com

Example of graphics, ships walk-through: www.youtube.com

Stackless: www.stackless.com

futurize: python-future.org

blue: github.com

Dev blog on the Frontier upgrade: evefrontier.com

Upgrading CARBON to Python 3: www.youtube.com

carbon-scheduler: github.com

Scheduling in Carbon: Leaving Stackless Python Behind: www.youtube.com

All of Carbon is on GitHub now: github.com

did a whole course: training.talkpython.fm

Trade Wars BBS (Wikipedia): en.wikipedia.org

TW 3002 - TradeWars 2002, reimagined as a modern browser game: www.reddit.com

Watch this episode on YouTube: youtube.com

Episode #564 deep-dive: talkpython.fm/564

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

Lint the entire CPython code base from scratch. It takes 0.3 seconds. Three blinks of an eye.

That is ruff, and it is written in Rust. So are Pydantic, Polars, uv, and Granian. Rust shows up in Python three ways: tools that happen to be Rust, libraries Python imports, and servers that run Python inside Rust. This is Rust for Python developers, not Rust experts.

Christopher Trudeau is back on Talk Python to discuss Rust and his latest course Up and Running with Rust. The core rule is that only one thing can own a value at a time. Pass it around freely in Python and the garbage collector cleans up. Do that in Rust and it will not compile.

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

Up and Running with Rust course: training.talkpython.fm

Rust: rust-lang.org

pydantic: pydantic.dev

ruff: docs.astral.sh

granian: github.com

By example: doc.rust-lang.org

rust-lang.org: rust-lang.org

rustup.rs: rustup.rs

crates.io: crates.io

main.rs: main.rs

PyO3: github.com

https://github.com/ritwiktiwari/awesome-python-rs: github.com

ty: docs.astral.sh

pyrefly: pyrefly.org

uv: github.com

polars: pola.rs

Watch this episode on YouTube: youtube.com

Episode #563 deep-dive: talkpython.fm/563

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

How many files does your query read before it reads any data? On some data lakes, you go through JSON and metadata files first, just to learn which Parquet files matter. DuckLake asks one SQL question instead. The metadata lives in a real database. The data stays in plain Parquet. That's the entire format.

Pedro Holanda joined DuckDB in 2018, when it was still a research prototype at CWI. He's the lead DuckLake developer. Guillermo Sanchez Dionis works on DuckLake and the new Quack protocol.

With Quack as the catalog, DuckLake handles 200 transactions a second under heavy contention. No other open table format comes close.

Six Feet Up

Talk Python Courses

Links from the show

Pedro Holanda: pedroholanda.org

Guillermo Sanchez: linkedin.com

PhD on progressive indexes: ir.cwi.nl

SQLite: www.sqlite.org

Litestream: litestream.io

boring hardware: talkpython.fm

DuckDB: duckdb.org

episode 491: talkpython.fm

Iceberg: iceberg.apache.org

manifesto: ducklake.select

DuckLake: ducklake.select

spec: ducklake.select

this diagram: blobs.talkpython.fm

Data inlining: ducklake.select

ducklake-dataframe: github.com

Polars course: training.talkpython.fm

CSV parser: duckdb.org

Zero-copy Arrow: duckdb.org

ART index: duckdb.org

async I/O: duckdb.org

v1.0: ducklake.select

Git-like branching: ducklake.select

Watch this episode on YouTube: youtube.com

Episode #562 deep-dive: talkpython.fm/562

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

How many cores does your machine have, 10, 18? Your async Python code uses just one of them. That isn't a bug in asyncio. That's the design, and optimizing event loops to be faster by 20% doesn't change it. So Giovanni Barillari started over. Joe is the creator of Granian, the Rust-based server that powers Talk Python. His new project is TonIO, an async runtime written from scratch for free-threaded Python. Real threads, a handful of primitives instead of asyncio's pile of them, and it flat out refuses to start if the GIL is on.

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

Giovanni Barillari: github.com

Granian: github.com

Hyper: github.com

Free threaded Python: docs.python.org

Sort of: labs.quansight.org

did a whole course: training.talkpython.fm

uvloop: github.com

rloop: github.com

TonIO: github.com

your EuroPython 2026 talk: www.youtube.com

Michael's Cutting Python Web App Memory Over 31% Article: mkennedy.codes

Watch this episode on YouTube: youtube.com

Episode #561 deep-dive: talkpython.fm/561

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

In 2020, a gastroenterologist in Glasgow did the math on his new research study and came up with 30,000 samples, arriving over two years from three cities and a dozen hospitals. He asked around about how researchers keep track of that. The answer was Microsoft Excel. Shaun Chuah had written some HTML by hand in Notepad back in high school and that was about the whole of his programming experience, so he opened the Django tutorial and started reading. Six years later that app is Foundry120, holding 10 terabytes of clinical and genomics data with an agentic AI running on top of it.

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Talk Python Courses

Links from the show

Shaun Chuah: github.com

Up and Running with Rust Course: talkpython.fm

Foundry120: www.foundry120.com

Designing Data Intensive Applications: www.oreilly.com

Microsoft Foundry: ai.azure.com

ChatIBD: www.chatibd.com

Blog: shaunchuah.github.io

@drshaunchuah: x.com

github.com/shaunchuah: github.com

Watch this episode on YouTube: youtube.com

Episode #560 deep-dive: talkpython.fm/560

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

Your site is down. It's 3am. Is it a bug, a bill, or a breach? You can't tell yet, and everyone is watching you find out. Matt Lea has spent fifteen years being the person companies call when an outage is costing them real money per hour, and his whole argument is that everything you'd want in that moment gets decided months earlier, on ordinary afternoons, when someone chose the convenient thing. We walk his top twelve dos and don'ts in AWS - infrastructure as code, IAM roles instead of access keys, private subnets, no wildcards, no public buckets - and I push on which of them actually matter if you're one person on a small VPS. Then we get to Cloud War Games, where Matt breaks things on purpose so your team's first real incident isn't their first incident. Let's get into it.

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Talk Python Courses

Links from the show

Matt Lea: linkedin.com

Talk Python Certificates: training.talkpython.fm/certificates

Schematical: schematical.com

CloudWarGames.com: cloudwargames.com

Zero to Hero on AWS Security: www.oreilly.com

Repo: github.com

Custom Wheel Offset: customwheeloffset.com

2012 TechCrunch Disrupt Hackathon: techcrunch.com

tech comics: schematical.com

shhgit: github.com

Zero Trust in 200ms: Implementing Identity-Per-Transaction: us.pycon.org

Coolify: coolify.io

returned to full GA Nov 2025: aws.amazon.com

Signed URLs/cookies: docs.aws.amazon.com

Cloudflare: www.cloudflare.com

Bunny Shield: bunny.net

Cloud War Games One: www.youtube.com

Cloud War Games Two: www.youtube.com

LinkedIn: linkedin.com

YouTube: youtube.com

KnocKnoc: knocknoc.io

Watch this episode on YouTube: youtube.com

Episode #559 deep-dive: talkpython.fm/559

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

Every company has one. The little internal tool that Jane built back in 2021, and then Jane left. Nobody understands it, nobody will touch it. There are two unwritten rules around it: don't change it, it's working. And if you break it, you bought it. That's dark-matter enterprise software.

For every app you can actually see, there are ten of these sitting in the shadows, frozen. Michael Booth thinks that just changed. He read my article on hyper-personal software and ran with it, writing about hyper-team software: small teams inside big companies finally building the tools that were never going to get built.

We cover where this works, where it quietly goes wrong, and the guardrails that keep it from turning into a mess. Let's get into it.

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

Michael Booth: github.com

Talk Python AI Integrations: talkpython.fm/blog

From Hyper-Personal to Hyper-Team Software: Small Team-Built, AI-Assisted Tools Inside the Enterprise: www.databooth.com.au

What hyper-personal software looks like (MK's article): mkennedy.codes

Databooth Site: www.databooth.com.au

Wall Street just lost $285 billion because of 13 markdown files: martinalderson.com

SaaSpocalypse is real but everyone is panicking about the wrong thing: www.reddit.com

Warp Terminal: www.warp.dev

Watch this episode on YouTube: youtube.com

Episode #558 deep-dive: talkpython.fm/558

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.

On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.

We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Links from the show

Juanita Gomez: linkedin.com

Mike Fiedler: miketheman.dev

Seth Michael Larson: sethmlarson.dev

Trailblazing Python Security: us.pycon.org

Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com

Dependency Cooldowns: cooldowns.dev

Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com

FedRAMP: www.gsa.gov

Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com

Rust for CPython project: blog.python.org

pre-PEP: discuss.python.org

Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com

SBOMit: github.com

Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com

Volatility: volatilityfoundation.org

Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com

zizmor: docs.zizmor.sh

GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io

andrew/pycon: data & analysis for the GitHub Actions security talk: github.com

GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com

gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com

PyCon US YouTube channel: www.youtube.com

SBOMit: adding verification to SBOMs (OpenSSF): openssf.org

Ecosystems: ecosyste.ms

Watch this episode on YouTube: youtube.com

Episode #557 deep-dive: talkpython.fm/557

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy

For years, "Django and async" came with an asterisk. The docs themselves warned you off it. Scary performance notes, a story that felt half-finished. Well, that story just got rewritten, literally, and the person who rewrote it is here to tell you why the old framing was wrong.

Carlton Gibson is a former Django Fellow, sat on the security team for eight years, and he's on the steering council. On this episode we get into the async topic doc rewrite, what actually remains versus what was just fear, the new Tasks framework in 6.0, DB-level cascades and fetch modes landing in 6.1, and why free-threading is the bet that's about to pay off big for Django. If you've been told Django's async story isn't ready, this is the episode that puts that myth to bed.

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

DjangoCon Europe: djangocon.eu

PyCon Italia: pycon.it

Django on the Med: djangomed.eu

Django Mantle: noumenal.es

PyPI: pypi.org

release notes: docs.djangoproject.com

on_delete: docs.djangoproject.com

Fetch modes: docs.djangoproject.com

HttpRequest.multipart_parser_class: docs.djangoproject.com

async topic doc: docs.djangoproject.com

docs: docs.djangoproject.com

DEP 14: github.com

django-tasks: github.com

django-tasks-local: github.com

Celery: docs.celeryq.dev

PEP 703: peps.python.org

free-threading HOWTO: docs.python.org

PEP 779: peps.python.org

ASGI: docs.djangoproject.com

PGBouncer: www.pgbouncer.org

Channels: channels.readthedocs.io

sync_to_async / async_to_sync: docs.djangoproject.com

noumenal.es: noumenal.es

Django Chat: djangochat.com

@[email protected]: fosstodon.org

Article: Cutting Python Web App Memory Over 31%: mkennedy.codes

Watch this episode on YouTube: youtube.com

Episode #556 deep-dive: talkpython.fm/556

Episode transcripts: talkpython.fm

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @[email protected]

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @[email protected]

Michael on X.com: @mkennedy