Anže

Anže

@anze3db.pecar.me

Writing Python and surfing waves 🏄‍♂️

1.2K followers161 following211 posts

Anže
@anze3db.pecar.me

django-tui 26.1 is out, the first release in two years! 🎉 It's a complete redesign! You can now type a command like in your shell and the form fills in as you go. pip install -U django-tui

Anže
@anze3db.pecar.me

🐍 Python Lisbon Meetup is tomorrow! 🎤 Talk by @mathsppblog ⚡ Lightning talks 🍻 Socializing 📍 IST, Sala Multiusos, Torre Norte (new room, not the Pavilhão de Matemática!) 🕖 Thu, 1 Oct, 19:00 RSVP links below 👇

Anže
@anze3db.pecar.me

PyCon Portugal continues to be my favorite PyCon. This year it was in Aveiro (a better Venice 😉) and we had a blast! I enjoyed giving my talk on lazy imports, but the best part was meeting new people and catching up with friends. Looking forward to it again next year!

Anže
@anze3db.pecar.me

Fun fact, I gave a lightning talk about chess and then got caught solving a chess puzzle during one the workshops 😅

Anže
@anze3db.pecar.me

I had a bit of a heart attack this morning when we noticed that my Grok 4.6 benchmark experiment using Amazon Bedrock would cost $28,044.59 instead of ~$28.00 that I was expecting 😱

Anže
@anze3db.pecar.me

We opened a support ticket, and the AI immediately identified the issue as being on their end. No answer to the ticket yet, but we no longer see the 30k charge in Cost Explorer 😮‍💨 If you are using Grok 4.6 through Bedrock Mantle, double-check how much you are spending!

Anže
@anze3db.pecar.me

One of the many things that I learned at DEF CON a few weeks ago is about Python Class Pollution and how a harmless snippet like the one below can cause a huge issue if an attacker controls it!

Anže
@anze3db.pecar.me

Because I've written a similar snippet many times in the past, the first thing I did when I got home was write an open grep rule so our existing tools could catch it. Blog post on why this can be very bad and how to protect yourself on my company blog: www.fencer.dev/blog/python...

fencer.devPython class pollution: a paste-in Opengrep rulePython class pollution turns getattr and setattr into RCE and auth bypass. Here is an Opengrep rule you can paste into your own ruleset to catch it in CI.
Anže
@anze3db.pecar.me

We benchmarked 15 models for triaging vulnerabilities. * Kimi K3 came out on top but marked a true positive as a false positive ☠️ * Opus 5 refused to give a verdict on 11 vulnerabilities * Sonnet 5 and Luna outperformed Terra and Sol Full post 👇 www.fencer.dev/blog/llm-tr...

fencer.devBenchmarking 15 LLMs on SAST false-positive triageWe benchmarked 15 LLMs on 142 real security findings to triage SAST false positives. Kimi K3 led on accuracy, with one caveat that matters for security.
Anže
@anze3db.pecar.me

I do think it nailed my voice though!

Anže@anze3db.pecar.me

I asked Claude to come up with writing guidelines based on my blog posts: > A few things I deliberately did not encode as guidelines: the frequent typos (characteristic of your fast publishing cadence) 88 blog post in 14 years is not fast publishing cadence 😅

Anže
@anze3db.pecar.me

I asked Claude to come up with writing guidelines based on my blog posts: > A few things I deliberately did not encode as guidelines: the frequent typos (characteristic of your fast publishing cadence) 88 blog post in 14 years is not fast publishing cadence 😅

Anže
@anze3db.pecar.me

We reviewed 4,978 mypy runs in our Django app: • 4,731 green • 246 failed Of the 246 failures: • 173 false positives • 73 real issues • 39 caught only by mypy and no other check! Some noise, but it prevented real bugs from reaching production. 🎉

Anže
@anze3db.pecar.me

It was also very useful to look at the false positives, and we were able to make two changes that reduced them by half: 1. Stop type-checking test files. No true positives were ever caught by this, and dynamic attrs from baker/setUpTestData are a common source of false positives

Anže
@anze3db.pecar.me

2. Turn on the DRF-type stubs we’d already installed but never wired up. It was flagging serializer-field errors, and we never figured it out until now. Yes, mypy is slow, but I think there is value in running it on Django codebases!

Anže
@anze3db.pecar.me

Our Go wrapper rebuilt an expensive index on every call. Python version builds it at package build time. Yes, we could fix the indexing problem, and then Go would be ~16x faster than Python (0.04ms vs 0.63ms), but we’ll happily trade 0.6ms to remove the whole Go-Python bridge.

Anže
@anze3db.pecar.me

After 9 meetups full of talks, lightning talks, and even lightning turtles, it's time for the Python Lisbon Meetup to take it easy. Join us at Linha d'Água on Thursday to relax and enjoy the summer in Lisbon with Python friends 🐢 www.meetup.com/python-lisb...

meetup.com#10 – PyLM Meetup – Social Get-Together, Thu, Jul 2, 2026, 7:00 PM | Meetup🇬🇧 After 9 meetups full of talks, lightning talks, and even lightning turtles, it's time to take it easy. Join us at Linha d'Água — the café by the lake in Parque Eduardo
Anže
@anze3db.pecar.me

One of my servers lost DNS after every single reboot, and it was driving me crazy. ping 8.8.8.8 worked, ping google.com didn't, and the fix never stuck. Turned out to be a config from 2010. I finally debugged it properly with Claude. blog.pecar.me/the-15-year...

blog.pecar.meThe 15-Year-Old iptables Rule That Broke My DNSOne of my servers has a weird problem after every reboot: it can ping IP addresses just fine, but it can’t resolve any DNS names. $ ping 8.8.8.8 # works $ ping google.com # ping: google.com: Temporary failure in name resolution I’ve been working around this for a while now: after every reboot I’d SSH in and overwrite /etc/resolv.conf to point straight at 8.8.8.8 instead of the local 127.0.0.53 stub. That got DNS working again, but it was never a real fix. /etc/resolv.conf is regenerated on boot, so my edit vanished the next time the machine came up and I was back to fixing it by hand. This time I decided to attempt to properly debug it with Claude.
Anže
@anze3db.pecar.me

The Claude usage page is very confusing. Since Sonnet has a separate bar I thought I'd be able to switch to it after I max out Opus, but nope. Of course this all makes sense if you actually read the tooltip/labels but who does that today anyway? 😅

Anže
@anze3db.pecar.me

Speaking about reading the labels. It says that I spent the limit for this month but it's actually a weekly limit, lol.

Anže
@anze3db.pecar.me

Running Claude in a loop to push our test coverage. After 24+ hours and 22,000 new lines of tests, coverage climbed from 92% to 95%. No clue if it’ll get merged, but it's a really fun experiment 👀

Anže
@anze3db.pecar.me

Over the last week, I've been reviewing PyCon Portugal talk and workshop proposals, and I just finished reviewing them all! 😎 Some really good ones in the mix that got me really excited about the conference in September. Make sure to grab your ticket! 2026.pycon.pt

Anže
@anze3db.pecar.me

Fun fact, I was reviewing for 3 hours straight on Saturday while the Raglan surf competition was on. There was A LOT of waiting between sets, so I could focus on proposals for most of it!

Anže
@anze3db.pecar.me

Claude wrote up a Cloudflare-style post mortem: blog.pecar.me/fedidevs-pos...

blog.pecar.meFedidevs PostmortemToday I had almost 9 hours of downtime on fedidevs.com and some of my other sites that I run on a Raspberry Pi at home. The alert came in just as I was heading to bed and I didn’t see it until I woke ...
Anže@anze3db.pecar.me

Fedidevs had quite an outage today. It went offline just as I went to bed and I didn't see it until I woke up this morning 🫣 Still better uptime than GitHub 😅

Anže
@anze3db.pecar.me

Fedidevs had quite an outage today. It went offline just as I went to bed and I didn't see it until I woke up this morning 🫣 Still better uptime than GitHub 😅

Anže
@anze3db.pecar.me

The supply chain attack has now spread to PyPI: mistralai: 2.4.6 guardrails-ai: 0.10.1 Pause your dependency updates or use package cooldowns (--uploaded-prior-to flag in latest pip) Stay safe!

Anže@anze3db.pecar.me

🚨 There was another supply chain attack, this time affecting tanstack npm packages. Make sure you haven't installed the compromised packages either in your CI or locally. I would also hold off on updating any dependency for the next week or so until the dust settles from this.

Anže
@anze3db.pecar.me

🚨 There was another supply chain attack, this time affecting tanstack npm packages. Make sure you haven't installed the compromised packages either in your CI or locally. I would also hold off on updating any dependency for the next week or so until the dust settles from this.

Anže
@anze3db.pecar.me

I told Claude to upgrade my Raspberry Pi from Debian 12 to 13 and went to enjoy my Sunday. It wasn't an easy upgrade. apt kept tripping over Debian's t64 transition, but Claude managed to unstuck it. When I came back, the box rebooted cleanly into Debian 13. 😲

Anže
@anze3db.pecar.me

Claude had to force-remove conflicting packages, reinstall the Trixie versions, and use dpkg -i --force-overwrite where the metadata still disagreed about file ownership. I would have given up and reinstalled. Full write-up in my latest blog post 👇 blog.pecar.me/letting-cla...

blog.pecar.meLetting Claude Upgrade My Raspberry PiI have two Raspberry Pis at home. One hosts my various sites including fedidevs.com and the other supports it by storing backups of all the configs and data. This includes a streaming hot standby of the Postgres database that powers some of my sites. I am not (yet) brave enough to run Claude on my primary Pi, but I decided to let it loose on my secondary. Doing an in-place dist upgrade on a Raspberry Pi is generally not recommended. The official guidance is to do a clean install instead. Since it felt very likely that I’d be doing a clean install in any case to get from Bookworm (Debian 12) to Trixie (Debian 13), I figured this was the perfect opportunity to see if Claude could pull a miracle.
Anže
@anze3db.pecar.me

I wrote a few words about the Agents Day hachaton that I attended last week on Friday. It's always fun to have an excuse to spend a day tinkering with something new. I even managed to be one of the 5 that got to demo their project on stage! 👉 blog.pecar.me/agents-day-...

Anže
@anze3db.pecar.me

We have another Python Lisbon Meetup coming up on Thursday 🐍 This time Yulia will be giving a talk on strong and weak references! See you on May 7 @ 19:00 at IST, Pavilhão de Matemática, room 3.10!

Anže
@anze3db.pecar.me

Finally wrote up my notes from DjangoCon Europe 2026 in Athens 🇬🇷 I climbed the Acropolis, ate great food, hung out with amazing people, gave a lightning talk, and fixed one regression in Django main during the sprints. blog.pecar.me/djangocon-e...

blog.pecar.meDjangoCon Europe 2026Before the conference My partner and I arrived in Athens a few days before the conference. It was a convenient excuse to visit a European capital we hadn’t been to yet, and of course to eat as much delicious food as possible. Django Social One day before the conference I went to the django.social event organized by Jon Gould and Andrew Miller. The bar they initially picked got too crowded, so the group moved to the backup place. I came late to the first bar, found no one there, and was a bit lost until I made it to the right spot. Once I did, I felt immediately at home. I met old friends, made some new ones, and had a very fun evening. So fun, in fact, that I forgot to take any photos, so I have no social proof that I was there 😅
Anže
@anze3db.pecar.me

With all the supply chain attacks going around, we have to be very careful about how we update our dependencies. I've written a full blog post about it, but here is the TLDR: 1. Pin to hashes, not just versions 2. Automate the updates 3. Use dependency cooldowns blog.pecar.me/how-to-safe...

blog.pecar.meHow to Safely Update Your DependenciesWith all the supply chain attacks happening lately (litellm being the most recent example) keeping dependencies up to date without risk has been on my mind. Below is everything I do to keep my personal projects secure, what we do at Fencer to keep our own codebase secure, and what we recommend to the startups we work with. Be hesitant about what you add The best way to reduce the risk of installing a compromised dependency is to avoid relying on it in the first place. Before adding a new dependency, I first make sure that implementing it ourselves would be too much work (or tokens!).
Anže
@anze3db.pecar.me

Another Python Lisbon Meetup in the books! Looking forward to the next one on May 7 👀

Anže@anze3db.pecar.me

I'll be giving a talk about lazy imports at the next Python Lisbon Meetup! See you there? 😀 www.meetup.com/python-lisb...

meetup.com#07 - PyLM Meetup at Técnico 🎓🐍, Thu, Apr 2, 2026, 7:00 PM | Meetup**Agenda:** * 25-minute talk: **Speed Up Your Startup Times with Lazy Imports** by [Anže Pečar](https://pecar.me/) * One or more lightning talks ⚡ * Socializing! **Join t
Anže
@anze3db.pecar.me

With recent Python supply chain attacks (Trivy/LiteLLM), it’s worth mentioning uv’s `exclude-newer = "x days"` config. It forces uv to only installs packages published more than x days ago, reducing risks since problematic packages should be yanked by then. docs.astral.sh/uv/referenc...

Anže
@anze3db.pecar.me

I wrote a post on how we tracked down slow imports in our Django app, fixed them by making imports lazy, and added a lint check to prevent regressions. Now I’m waiting for Python 3.15 to make all of this easier! 🚀 blog.pecar.me/speeding-up...

blog.pecar.meSpeeding Up Django Startup Times with Lazy ImportsAt Fancer we are building the security suite for startups. Startups use a lot of SaaS tools and services which means we are building a lot of integrations. Most of these go through API calls but we also try to leverage SDKs to make our lives a little bit easier. The problem we started noticing was that loading all these 3rd party integrations has made our Django app feel very sluggish. While this was noticeable around deployments and starting scans, it hurt the most during local development. It was taking around 10s to run ./manage.py check which meant that any Django command ended up being slow. Devs felt this the most with development server restarts and when running tests.
Anže
@anze3db.pecar.me

Can't wait for lazy imports in Python 3.15! I spent a bunch of time and tokens over the weekend inlining heavy imports so that they don't get loaded during initial start of a Django app. The `manage.py check` command is now 3.8x faster (9.45s down to 2.48s).

Anže
@anze3db.pecar.me

I wrote a blog post about some of the options for adding type checking to your Django project! Historically, Django projects have been tough to type-check, but the future feels bright, especially if PEP 827 gets accepted! blog.pecar.me/typing-your...

blog.pecar.meTyping your Django project in 2026The first version of Django was released about 10 years before Python standardized its type hints syntax. Because of this it’s not surprising that getting type hints to work in your Django project is not going to be trivial. django-stubs with mypy If you want your Django codebase to be type checked then django-stubs is the go to package to use. It ships both type-stubs for most of Django’s public APIs as well as a mypy plugin that fills in the typing information for all the dynamic black magic that we love Django for. You’ll also want to include the monkeypatch from django-stubs-ext for best results.