William Woodruff (1.3.6.1.4.1.55738)

Wrote a post for the Astral blog astral.sh/blog/tar-codec

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

we’ve released uv 0.13.4 and pip has released 26.2.2 for the eMudra CA incident. Please upgrade ASAP!

Please upgrade certifi in all Python applications to the latest version (2026.10.19) following emSign CA certificate security incident: github.com/certifi/pyth... #security #python #vulnerability

After 10 years, I disabled my lobste.rs account. I think it's clear I am not a culture fit anymore with whatever it is they have going on there. I feel more and more like I don't belong in almost any tech community because I believe LLM agents are real, passkeys are good, and fascism is bad.

I’ll be giving a talk at the NYC OSS security user group meetup on 11/4 about zizmor! (Space will be limited, if you’re in NYC I would recommend signing up now.) luma.com/sazzc937

TIL: Rust's derive often implies inline yossarian.net/til/post/rus...

Introducing vulnbrocards.com https://blog.yossarian.net/2026/08/31/Introducing-vulnbrocards-com #oss #security

Running for the Python Packaging Council https://blog.yossarian.net/2026/08/13/python-packaging-council #oss #python

Last year @yossarian.net wrote a brief post on the surprising complexity of the #Python "splitlines()" method. As a busy Unicode pedant, it took me a while to write up something explaining *why* it's complex, but here it finally is: www.b-list.org/weblog/2026/...

GitHub Actions needs OIDC audience constraints https://blog.yossarian.net/2026/08/10/github-actions-needs-oidc-audience-constraints #oss #security #dear-github

my keynote from EuroPython is online! youtu.be/wMPe_KepOjc

Trusted publishing is good, but it's still just an authn method and doesn't mean the package itself is safe to run. Good breakdown by @yossarian.net about that

“I take the green line to work”

It's not my usual beat, but I wrote a pure-Python ML-DSA verifier. pip install mldsa It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested. Signature verification handles no secrets, so it doesn't need to be constant-time.

Excited for the #EuroPython morning keynote today from @yossarian.net, starting at 9AM in S1: ep2026.europython.eu/session/secu...

README, not https://blog.yossarian.net/2026/07/16/README-not #ai #oss

If you use GitHub Actions to publish to #PyPI, I wrote a blog post outlining what I consider the key things you can do to secure your publishing workflow. snarky.ca/how-to-publi... If you don't use GitHub Actions for publishing, this post will NOT be of interest to you.

You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss

We couldn't be happier to welcome @yossarian.net to the EuroPython 2026 speaker lineup! 🎉 At Astral, William builds secure Python tooling. He also maintains zizmor (GitHub Actions linter), pip-audit, and PyCA! 🛡️ 🎟️ europython.eu/tickets/

I wrote a new post for the Astral blog about how we’re building more vulnerability and malware defenses directly into uv: astral.sh/blog/uv-audit

Registering my dissatisfaction with GitHub https://blog.yossarian.net/2026/04/29/Registering-my-dissatisfaction-with-GitHub #oss

Brocards for vulnerability triage https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerability-triage #security #oss

the last two weeks have been ~exciting~ in terms of open source security! I've put together a post on Astral's blog about how we think about open source security: astral.sh/blog/open-so...

Just cut a new release of `pypi-publish` v1.14.0! It's now verbose by default and prints out hashes. You can opt-out, though. The rest is internal updates, housekeeping, docs. github.com/pypa/gh-acti... / github.com/pypa/gh-acti... #python #Packaging

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

TIL: Rust has safe uninitialized bindings yossarian.net/til/post/rus...

absolut etrog limited edition

Some flexibility with Go’s sumdb https://blog.yossarian.net/2025/12/29/Some-flexibility-with-Go-s-sumdb #security #go #cryptography

At the gpg.fail talk and omg #39c3 You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message. Won’t even blame PGP here. C is unsafe at any speed. gpg has not fixed it yet.

TIL: serde's borrowing can be treacherous yossarian.net/til/post/ser...

so pumped for the ty beta to finally be here, we did so much great work it rules! astral.sh/blog/ty

Dependency cooldowns, redux https://blog.yossarian.net/2025/12/13/cooldowns-redux #security #oss

I've been SHA-1 pinning ever since I started using GitHub Actions, but I didn't think of transitive (compound) actions, which can use unpinned sub-actions. This is fine 🔥🐶☕🔥 Time to setup zizmor.sh by @yossarian.net for automated scanning, I've had it in my "tools to try" list for a bit.

ICYMI, we want your #security talks at #PyConUS 🤩 CFP closes December 19th #python #supplychain #opensource #oss pycon.blogspot.com/2025/11/trai...

I'm a big fan of zizmor.sh by @yossarian.net to provide static analysis of GitHub Actions workflows as I'm working on them. The remediation advice is also top notch, for `pull_request_target` as an example: docs.zizmor.sh/audits/#dang...

There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects. TL,DR: Adopt Trusted Publishing 🔐🚀📦 blog.pypi.org/posts/2025-1...

We should all be using dependency cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns #security #oss

TIL: Safari has built-in WebDriver support yossarian.net/til/post/saf...

All the world's developers are a toddler and X.509 is the neighbor's unfenced pool.

Dear GitHub: no YAML anchors, please https://blog.yossarian.net/2025/09/22/dear-github-no-yaml-anchors #programming #rant

maslow’s hierarchy of needs? yeah, I think I’ve heard of that somewhere before

One year of zizmor https://blog.yossarian.net/2025/09/14/one-year-of-zizmor #devblog #programming #rust #zizmor

finally learned what a "labubu" is from my local bodega. very helpful

Just cut a new release of `pypi-publish` v1.13.0! It's got internal runtime update, housekeeping, also diagnostic messages and security improvements from @yossarian.net! github.com/pypa/gh-acti... / github.com/pypa/gh-acti... #python #Packaging

i went on tom, deirdre, and david's podcast and talked about PGP and encrypted email: securitycryptographywhatever.com/2025/08/22/s...

grape nuts is the only good cereal