James Bennett

"AI can draft an essay for you, especially if you give it a high quality prompt." Really? This is what MIT thinks high schoolers should learn? MIT's "Day of AI" dayofai.org provides materials for K-12 teachers and claims to have reached over 5,000,000 students to date. 1/2

"Anyway, remember prompt engineering?" is a savage line. fishbowl.pastiche.org/2026/10/26/a...

I feel like the people naming RCEs are getting lazy about naming. Someone cleverly pointed out that maybe we should name the pattern. So, here it is: 2shell2furio.us

The first genuinely honest ad for generative AI I've ever seen, from Microsoft / CoPilot A mediocre white guy sees his non-white colleague getting praised for good work, he asks AI to *literally copy it*, and then he gets all the praise instead: www.ispot.tv/ad/SoDi/micr...

NOT NOW NODEJS

Due to timezone handling bugs, we regret to inform you that it is always Patch Tuesday somewhere.

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

There are days when I can’t help but reflect on mistakes I’ve made throughout my career. Days when, even decades in with professional accolades and fancy titles, I still feel like I’m not good enough. Then there are days when I find out a CA trusted by basically everything used a private key of… 4.

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation. I’ve written a rebuttal: scotthelme.co.uk/passkeys-are...

"The credit for coming up with the research is now shared across the entire field because the machines exploit all of our ideas at once." huh that's gonna live free in my vocabulary

As the release manager for 3.16, it's also my duty to inform you that 3.16 alpha 1 is slated for this coming Tuesday!!!

Python 3.15 is OUT 🐍🚀 Lazy imports, Tachyon in the stdlib, frame pointers on by default, frozendict, better error messages... this one is LOADED 🔥🔥🔥 Go upgrade 🤘 discuss.python.org/t/python-3-1...

Would people be interested in a blog post or perhaps a series of posts walking through the process of making some contributions to #Python? I have some free time (i.e., unemployed), and a couple things I’d like to do, mostly in documentation, and I figured if there’s interest I can write it up.

I've just published 10 blog posts detailing the #Python Language Summit 2026. The Language Summit was held in Kraków, Poland and included discussions about free-threading, #Rust, garbage collectors, and type annotations. Please enjoy and thank you for your patience: blog.python.org/2026/09/lang...

It really doesn't make sense to attribute those job losses to AI-the-technology, because if that were the case we'd be observing AI outputs displacing conventional entertainment products, and they're clearly not. Rather, the impact of AI is that AI-the-business is crowding out other investment.

More on this later, but it feels like a community putting a lot of effort into creating a cognitive callus against the threat of work that undermines a chunk of their world-view: bsky.app/profile/emil... >>

The whole internet loves Jev, a cheap model that classifies in milliseconds! *5 days later* We regret to inform you the Jev is racist

Voiceover: “Each grape is milled from a single billet of aluminium…”

93. When someone says "I want a programming language in which I need only say what I wish done," give him a lollipop. www.cs.yale.edu/homes/perlis...

"Bayesian" means "from the Bay Area".

It’s kind of interesting that this thread, of all things, is the one making some big pro-LLM folks I know suddenly stop and actually read other people’s experiences outside the bubble and have a “wait, really, that’s what it’s been like?” moment. lobste.rs/s/7tpc5q/sur...

Unfortunately I did not understand in time that the Packaging Council election requires a *separate* voter-enrolling affirmation from other PSF-run elections, so I did not receive a ballot. But if I had, I would have voted Brett at the top of it. He's done incredible work improving Python packaging.

Tired: “we were hacked and our password database was exfiltrated and is now being used for credential stuffing” Wired: “Our credential agent broke containment and is now autonomously attacking other services”

Four years ago I published a post on how to manage #Python dependencies in as “boring” a manner as I could manage. Today I’ve published a revised version catching up on developments in the ecosystem since then: www.b-list.org/weblog/2022/...

re: omarchy trying to create parallel infra to subvert the linux community and kick trans/female/black people out i know some people think that sounds crazy but DHH literally is doing a podcast tour saying that is exactly what he's doing lol

It's even worse. He's been pretty open about the fact that the reason Omarchy exists is the Linux community has too many trans/marginalized folks. It's not *just* funding something run by a rotten man. It's funding something with a rotten intent behind it.

Hey @1password.bsky.social, time to change course.

A neat security vulnerability in Python caused by str.lower(). Also includes lots of RFCs so I’m having a good time :) sethmlarson.dev/when-str-low... #security #python #idna

Ah yes, the three genders.

I self-nominated myself for the Python packaging council today. I have posted my nomination statement as a blog post. snarky.ca/my-nominatio...

Last year @yossarian.net wrote a brief post on the surprising complexity of the #Python "splitlines()" method. As a busy Unicode pedant, it took me a while to write up something explaining *why* it's complex, but here it finally is: www.b-list.org/weblog/2026/...

Tech press seem to have noticed this now. www.theregister.com/ai-and-ml/20...

Happy to announce v3.0.0 of my build-and-inspect-python-package GitHub Action that does what the name says. If u maintain a Python pkg u should really give it a look! Much, much fewer broken pkgs have been pushed to PyPI & who doesn't love automatic trove classifier → GHA test matrix conversion‽

I just learned that Oracle, which is shoveling unbelievable amounts of cash into getting everybody to use LLMs, also has a policy forbidding contributors to OpenJDK from using LLMs to generate code, citing code quality, security, and legal concerns: openjdk.org/legal/ai

Damn, all that scheming water!

Any news report that starts “OpenAI says…” or claims “an AI” (sic) has “broken containment” or “gone rogue” is no longer doing journalism, but PR for the #AI industry. #OpenAI used their product to hack a third-party and failed to implement adequate safeguards. That’s it. That’s the story. #AIHype

Oh, your AI hacked Hugging Face? Well, my uncle's AI hacked Nintendo, and it says you CAN find Mew under the truck!

old and busted: delete failing tests new and hotness: delete CI configuration this is FOSS DoS; I have no other term for it github.com/python-attrs...

step 1: do an experimental JIT step 2: do a website called www.doesjitgobrrr.com to track performance step 3: write a PEP called "JIT Go Brrr" step 4: non-experimental JIT gone brrr? step 5: CPython gone brr? step 6: brrrrrr? peps.python.org/pep-0836/ #Python #CPython #JIT #PEP #PEP836 #JIT #GoBrrr

Frog put Claude in a harness. "There," he said, "now Claude can no longer delete files." "But Claude can edit the files" said Toad. "That is true," said Frog.

Join Seth Michael Larson (@sethmlarson.dev) at EuroPython for "Learning from the not-so-secret Python security "cabal"" talk: ep2026.europython.eu/9JALSN

They wanted her to make a second effort with reluctant adopters, extol the virtues, etc. She was clearly uncomfortable with this and didn’t do it. But there they all are, bolted to the ceiling, and were just supposed to trust that they aren’t recording, that nothing is being “trained” 3/

A quick shadow drop of sorts: who hasn't implemented a cache on top of Postgres? I know, everyone has. And yet, here's another contender that's based on psycopg and can use existing SQLAlchemy engines (or whatever you implement): ⚡️psycache ⚡️ 1/2

This was one of my favorite talks at PyCon US, so if you’re going to EuroPython I’d highly recommend.