#557: Security of everything at PyCon 2026

Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall. On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe. We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full. **Episode sponsors** Sentry Error Monitoring, Code talkpython26 Talk Python Courses ## Links from the show **Guests** **Juanita Gomez**: linkedin.com **Mike Fiedler**: miketheman.dev **Seth Michael Larson**: sethmlarson.dev **Trailblazing Python Security**: us.pycon.org **Everything Security at PyCon US 2026 (PSF blog)**: pyfound.blogspot.com **Dependency Cooldowns**: cooldowns.dev **Anatomy of a Phishing Campaign (Mike Fiedler) Recording**: www.youtube.com **FedRAMP**: www.gsa.gov **Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon**: www.youtube.com **Rust for CPython project**: blog.python.org **pre-PEP**: discuss.python.org **Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith**: www.youtube.com **SBOMit**: github.com **Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle**: www.youtube.com **Volatility**: volatilityfoundation.org **Post Incident Runtime SBOM Generation from Python Memory - Hala Ali**: www.youtube.com **zizmor**: docs.zizmor.sh **GitHub Actions security in Python packages (Andrew Nesbitt write-up)**: nesbitt.io **andrew/pycon: data & analysis for the GitHub Actions security talk**: github.com **GitHub Actions Security in Python Packages - Andrew Nesbitt**: www.youtube.com **gh-profiler: examine a GitHub user's profile to gauge their contributions**: github.com **PyCon US YouTube channel**: www.youtube.com **SBOMit: adding verification to SBOMs (OpenSSF)**: openssf.org **Ecosystems**: ecosyste.ms **Watch this episode on YouTube**: youtube.com **Episode #557 deep-dive**: talkpython.fm/557 **Episode transcripts**: talkpython.fm **Theme Song: Developer Rap** **🥁 Served in a Flask 🎸**: talkpython.fm/flasksong **---== Don't be a stranger ==---** **YouTube**: youtube.com/@talkpython **Bluesky**: @talkpython.fm **Mastodon**: @talkpython@fosstodon.org **X.com**: @talkpython **Michael on Bluesky**: @mkennedy.codes **Michael on Mastodon**: @mkennedy@fosstodon.org **Michael on X.com**: @mkennedy