Python Software Foundation Blog

Your cynicism isn't warranted: we've made significant improvements to PyPI over the last 4 years[1][2], and I'm currently working on additional features that will make secure publishing to PyPI easier[3]. We're also working on a codesigning implementation for PyPI, based on Sigstore[4]. Security needs to be evidence and outcome-driven, first and foremost. That takes a while, but improved outcomes make it worth it. [1]: https://pyfound.blogspot.com/2019/06/pypi-now-supports-two-factor-logi… [2]: https://pythoninsider.blogspot.com/2019/07/pypi-now-supports-uploading… [3]: https://github.com/pypi/warehouse/issues/12465 [4]: https://www.sigstore.dev/

Hence the "So it's something that had be delayed.", and not "this is something impossible". Javascript has the benefit of having billions of dollars allocated to it from Google/Microsoft/Apple to hire dozen of amazing engineers full time over decades to work on it. Python has existed since 1994, yet in 2011, the Python Software Fundation budget was less than $40K: https://pyfound.blogspot.com/2012/01/psf-grants-over-37000-to-python.h… We are talking a difference of funding of 6 order of magnitudes. Not to mention one is a language that has to stand on its own, the second has an accidental monopoly on the most popular plateform in the world. So it had to be delayed, unlike for JS.

Ugh. My host is giving me nothing but heartburn. Great. Link to the original RFP: http://pythonorg-redesign.readthedocs.org/en/latest/ PSF Blog post: http://pyfound.blogspot.co.uk/2012/11/pythonorg-is-getting-makeover.ht… Link to the winning bids: http://redesign.python.org/assets/Python-proposal-Sept2012-cleaned.pdf http://redesign.python.org/assets/divio_python_presentation.pdf I'm working on the hosting issue now.

> Making them use a name other than python is hardly any great hardship. It wasn't. (And Tauthon is arguably a really cool name.) But it does indicate that they want Python 2 dead. > Van Rossum argued instead that if the Twisted team wants the ecosystem to evolve, they should stop supporting older Python versions and force users to upgrade. Brown acknowledged this point, but said half of Twisted users are still on Python 2 and it is difficult to abandon them. http://pyfound.blogspot.com/2019/05/amber-brown-batteries-included-but… Like I said, if people were just fading out of Python 2 that wouldn't make me call them arrogant, it's when they insist that other people have to ditch Python 2 that I start to feel like there's some arrogance there. Like I said in a another comment, the only thing you get from switching to Python 3 is Python 3 compatibility. If Python 2 remains viable (which it will) there's much less incentive to use 3. Python 2 isn't broken or bad or anything, it's just not Python 3. We aren't being urged to switch because 2 is (so much) worse than 3 but because it's a viable competitor to it.

"What will happen if I do not upgrade by January 1st, 2020?" "You will lose chances to use good tools because they will only run on Python 3, you will slow down people who depend on you and work with you." The tone in this document is excessive and over-the-top. If the author spent half the document demonstrating (with examples) why Python3 is so great, it might actually be useful and get people upgrading like right now as they're reading it. But instead, it seems the author simply wanted to convey how sick they are of Python 2. The author does not appear to understand their users; that's their real frustration. In life outside of Python... The transition in C/C++ from C++98 to C++11 and then C++20 (and beyond) has been quite clean and professional. There were some glaring issues with C++11 that later got patched up (e.g. rvalues but no optional, no filesystem, make_unique, etc). Most importantly, compiler support and standard distributions improved a lot. There were often clear incentives to upgrade, and it was relatively easy to stick to an old standard where necessary. In contrast, Python has become a bit fractured, with a number of notable well-discussed but unaddressed loose ends in Python3: http://pyfound.blogspot.com/2019/05/amber-brown-batteries-included-but… I think the Python community has failed to present strong enough incentives for upgrading to Python3, and that's why users are sticking to Python2 and 'slowing everybody down'. The jump to C++11…

Please explain how it looks shady, because I don't understand it. If I start a blog - completely independent of PyPy - which promotes PyPy and describes the development efforts, and I want to encourage people to support the PyPy project, then I might link to the PyPy donation page, yes? Yet, because I'm not affiliated with the project, I can't put the blog under pypy.org. Would my blog also be shady? If so, doesn't that mean that no one should promote donating to a project unless that promotion is done under the project's domain? You write "Not many read the blog post, then go to Google, search for pypy and then click the link and then donate." That would be true even if the blog post were hosted under pypy.org. That is, why would anyone donate after reading one blog post? I would think that more people would donate after they download PyPy, try it out, and see that it's worthwhile enough to fund. In that case, they've already found out how to get PyPy, so there's no need to "Google, search for pypy" because they've already done that. Nor is PyPy unusual in this respect. It's hard to find projects which have both a blog and a donate page. Of the 50 so projects I looked at, the following are "shady" according to your definition: - the PSF blog (hosted on blogspot) links to the python.org page for donations, eg, https://pyfound.blogspot.com/search?q=donate . - The Thunderbird blog has a posting like…

Source: https://pyfound.blogspot.com/2025/12/anthropic-invests-in-python.html

Yes, and at least the strings they attached are productive palatable unlike some other organizations: https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html

The Python Software Foundation Security Developer-in-Residence, Seth Larson, published a new white paper with Alpha-Omega titled "Slippery ZIPs and Sticky tar-pits: Security & Archives" about work to remediate 10 vulnerabilities affecting common archive format implementations such as ZIP and tar for critical Python projects. PDF link: https://alpha-omega.dev/wp-content/uploads/sites/22/2025/10/ao_wp_1027… PSF Blog: https://pyfound.blogspot.com/2025/10/slippery-zips-and-sticky-tar-pits… Alpha-Omega.dev: https://alpha-omega.dev/blog/slippery-zips-and-sticky-tar-pits-securit…

The PSF withdrew their application for the grant from the US government after being presented with terms that included "do not, and will not during the term of this financial assistance award, operate any programs that advance or promote DEI, or discriminatory equity ideology in violation of Federal anti-discrimination laws", which conflicts with their mission statement: "The mission of the Python Software Foundation is to promote, protect, and advance the Python programming language, and to support and facilitate the growth of a diverse and international community of Python programmers." [1]: https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html

This was a really stupid move. Isn't the Python Foundation almost exactly $1.5 million over budget? According to their recent post they only have 6 months of runway before going broke. https://pyfound.blogspot.com/2025/10/connecting-the-dots.html

Here's some evidence that he is, again, badmouthing the PSF without a good reason: https://pyfound.blogspot.com/2025/06/the-psfs-2024-annual-impact-repor…

More details on the underlying project that the grant would have funded: https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html And for those who want to fund the security of one of the few remaining independent foundation-led package ecosystems: https://www.python.org/psf/donations/ https://www.python.org/sponsors/application/

The EU certainly proposed something not far off. And it took the python foundation threatening to block all users from the EU to partially shelve it. The compulsion: jump through EU paperwork hoops, perform security work, and fix bugs on demand or face ruinous fines. https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have… Even now, the CRA is very vague -- any commercial activity tenuously related to a piece of software you share can force you to do work for the EU. Of at least try, if you don't tell the EU to shove it. And that commercial activity doesn't even need to be in the EU.

Unless something has drastically changed, PyCon covers itself and earns the PSF quite some money on top. Here are numbers from 2020: https://thefortunate.blog/diversification-is-the-future-for-the-psf.ht… > Out of USD4.5MM of revenue for the PSF in 2019, around 63% of it came from PyCon. USD1.9MM was the costs of having PyCon, which means that for every dollar spent on PyCon, the PSF gets back 1.50 dollars. https://pyfound.blogspot.com/2020/03/psfs-projected-2020-financial-out… Obviously, the revenue has sharply dropped for a time because of COVID, but I'd be surprised if PyCon is run at a loss nowadays. So you can assume none of your sponsorship money goes to running PyCon.

PSF's meeting notes from the time https://pyfound.blogspot.com/2023/10/september-october-board-votes.htm…

It doesn't seem like it was so simple as the open letter puts it? From the boards blog post https://pyfound.blogspot.com/2023/10/september-october-board-votes.htm… The first vote had 6 abstentions and 4 yes votes. The second vote had 10 yes votes and 1 abstention. It seemed there was enough outstanding information/questions for 6 total people to abstain, though perhaps 1 of those 6 was using it nefariously? Hard to say

Who is responsible for complying with it? If a Chinese or American manufacturer of an embedded device that does not have a presence in the EU fails to provide updates what happens? How many of the companies producing this stuff have the skills to fix kernel security bugs? It will end up being tickbox regulatory compliance and will create barriers to competition, especially from FOSS: https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have…

TL;DR The EU is working on the Cyber Resilience Act (CRA) which will be voted on the 19th of July. The current wording makes it look like it will affect open source projects that receice donations; which have contribution from corporate developers; and might break coordinated vulnerability disclousure. If you live in the EC area, there's a link on the blog to contact to MEP. The blog also links to other posts from OSS organisations sharing the same concer. * https://blogs.eclipse.org/post/mike-milinkovich/european-cyber-resilie… * https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have… * https://blog.opensource.org/the-ultimate-list-of-reactions-to-the-cybe…

I was referring to this: https://pyfound.blogspot.com/2023/05/the-python-language-summit-2023-w… Of course nobody even knew so the default response is to hit that bottom arrow :D

This is a good cause. They should help the legislators by coming up with a proposal on how to better phrase it. Not just state what’s wrong. That would make it easier to get the proper provisions in place. Legislators (and their staff) are not usually the experts and rely on such advice. Original PSF statement here: https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have…

I think this summarizes the topic quite well: https://pyfound.blogspot.com/2022/05/the-2022-python-language-summit-p…

> Now let's get a sane concurrency story This is in very active development[1]! And seems like the Core Team is not totally against the idea[2]. [1] https://github.com/colesbury/nogil [2] https://pyfound.blogspot.com/2022/05/the-2022-python-language-summit-p…

Latest update about this project: https://pyfound.blogspot.com/2022/05/the-2022-python-language-summit-p… And the HN discussion: https://news.ycombinator.com/item?id=31348097

> Pretty excited for the 3.12 work, where they plan to introduce JIT compilation I believe? "A JIT, according to Shannon, will probably not arrive until 3.13 at the earliest, given the amount of lower-hanging fruit that is still to be worked on. The first step towards a JIT, he explained, would be to implement a trace interpreter, which would allow for better testing of concepts and lay the groundwork for future changes." https://pyfound.blogspot.com/2022/05/the-2022-python-language-summit_2…

Łukasz Langa now works full time on CPython via the PSF's Developer in Residence program. https://pyfound.blogspot.com/2021/07/ukasz-langa-is-inaugural-cpython.…

Agree with all of this except > 5) I really like official libraries, not SomeBasicFunctionality.jl dependency. I am spoiled by Python. Python's standard library is full of bad code that nobody has time to improve [1]. Over time, Julia packages will surpass the standard library too but we'll still be hauling it around and spending core-dev time on it for for backward-compatibility reasons. We should have a much much smaller standard library. [1] https://pyfound.blogspot.com/2019/05/amber-brown-batteries-included-bu…

This [0] is the announcement from the PSF. The team also includes core developers Eric Snow and Mark Shannon (of the faster-cpython [1] proposal). [0] https://pyfound.blogspot.com/2021/05/the-2021-python-language-summit-m… [1] https://github.com/markshannon/faster-cpython

`str.format` can’t be removed completely - it’s necessary if you want to build format strings at runtime. But otherwise, yes - make f-strings the “one obvious way to do it” and use `format` only when necessary. And get rid of the old %-formatting. Also consider making f-strings the default: https://pyfound.blogspot.com/2020/04/all-strings-become-f-strings-pyth…

Alex Gaynor! I've missed this guy. I remember him back from his work on Django. http://pyfound.blogspot.com/2019/02/the-steady-leader-of-python-commun…