How well do you know your software supply chain? When you PIP install a package, what steps can you take to minimize the risk of installing something malicious? This week on the show, we have Dustin Ingram, a director of the Python Software Foundation (PSF) and a maintainer of the Python Package Index (PyPI).
We talk about Dustin’s PyCon 2021 talk titled “Secure Software Supply Chains for Python”. Dustin shares the types of attacks you should be aware of and how you can make your supply chain more trustworthy. We cover tools, techniques, and best practices.
Dustin also discusses what it takes to keep the Python Package Index running and the players working to keep it going into the future.
Course Spotlight: A Beginner’s Guide to Pip
This course is a great introduction to pip for those who are getting started Python, and for those who want to understand more about what is happening when you install new packages into your environment. It’s a worthy investment of your time to understand the fundamentals of pip.
00:00:00 – Introduction00:01:51 – Developer Advocate at Google00:04:34 – A director of the PSF00:06:27 – A maintainer of PyPI00:12:29 – Secure Software Supply Chains for Python - PyCon 202100:15:53 – Do I need to be a security expert as a Python developer?00:17:23 – Typo-squatting of package names00:19:46 – Sponsor: Scout APM00:20:52 – Dependency confusion and private repos00:26:00 – What are some best practices?00:31:55 – How to lessen the scale of “I don’t know what I don’t know”?00:36:33 – Tools and techniques that can help 00:44:11 – Video Course Spotlight00:45:30 – Namespaces on PyPI00:53:03 – What does it take to power the Python Package Index?01:01:57 – What are you excited about in the world of Python?01:03:55 – What do you want to learn next?01:05:52 – What is something you thought you knew about Python, but were wrong about it?01:08:46 – Shout outs and social information01:10:16 – Thanks and goodbyeDustin Ingram: Personal WebsitePython on Google CloudCloud Run: Develop and deploy highly scalable containerized applications on a fully managed serverless platformPython Software FoundationPSF Membership FAQPyPI: The Python Package IndexSecure Software Supply Chains for Python: PyCon 2021 - YouTubepip Documentation: Requirements Filespip Documentation: Hash-Checking ModePEP-0440: Direct references for pippip-tools: pip-tools keeps your pinned dependencies freshPyPA: Python Packaging User GuideThe Update Framework (TUF)tuf: A secure updater framework for Pythonpipx: Install and Run Python Applications in Isolated EnvironmentsHow to Publish an Open-Source Python Package to PyPI - Real Python ArticlePoetry: Python packaging and dependency management made easyPyUp: Python Dependency SecurityDependabot: Automated dependency updatesWhy Package Signing is not the Holy Grail: Donald StufftDependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other CompaniesWhat Is Pip? A Guide for New Pythonistas - Real Python ArticleA ‘Worst Nightmare’ Cyberattack: The Untold Story Of The SolarWinds HackSecurity scanners for Python and Docker: from code to dependenciesWhat does it take to power the Python Package Index?Level up your Python skills with our expert-led courses:
A Beginner's Guide to pipHow to Publish Your Own Python Package to PyPIPython Modules and Packages: An Introduction Support the podcast & join our community of Pythonistas