Talk Python To Me

How many cores does your machine have, 10, 18? Your async Python code uses just one of them. That isn't a bug in asyncio. That's the design, and optimizing event loops to be faster by 20% doesn't change it. So Giovanni Barillari started over. Joe is the creator of Granian, the Rust-based server that powers Talk Python. His new project is TonIO, an async runtime written from scratch for free-threaded Python. Real threads, a handful of primitives instead of asyncio's pile of them, and it flat out refuses to start if the GIL is on.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

Guest

Giovanni Barillari: github.com

Granian: github.com

Hyper: github.com

Free threaded Python: docs.python.org

Sort of: labs.quansight.org

did a whole course: training.talkpython.fm

uvloop: github.com

rloop: github.com

TonIO: github.com

your EuroPython 2026 talk: www.youtube.com

Michael's Cutting Python Web App Memory Over 31% Article: mkennedy.codes

Watch this episode on YouTube: youtube.com

Episode #561 deep-dive: talkpython.fm/561

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy

In 2020, a gastroenterologist in Glasgow did the math on his new research study and came up with 30,000 samples, arriving over two years from three cities and a dozen hospitals. He asked around about how researchers keep track of that. The answer was Microsoft Excel. Shaun Chuah had written some HTML by hand in Notepad back in high school and that was about the whole of his programming experience, so he opened the Django tutorial and started reading. Six years later that app is Foundry120, holding 10 terabytes of clinical and genomics data with an agentic AI running on top of it.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Talk Python Courses

Links from the show

Guest

Shaun Chuah: github.com

Up and Running with Rust Course: talkpython.fm

Foundry120: www.foundry120.com

Designing Data Intensive Applications: www.oreilly.com

Microsoft Foundry: ai.azure.com

ChatIBD: www.chatibd.com

Blog: shaunchuah.github.io

@drshaunchuah: x.com

github.com/shaunchuah: github.com

Watch this episode on YouTube: youtube.com

Episode #560 deep-dive: talkpython.fm/560

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy

Your site is down. It's 3am. Is it a bug, a bill, or a breach? You can't tell yet, and everyone is watching you find out. Matt Lea has spent fifteen years being the person companies call when an outage is costing them real money per hour, and his whole argument is that everything you'd want in that moment gets decided months earlier, on ordinary afternoons, when someone chose the convenient thing. We walk his top twelve dos and don'ts in AWS - infrastructure as code, IAM roles instead of access keys, private subnets, no wildcards, no public buckets - and I push on which of them actually matter if you're one person on a small VPS. Then we get to Cloud War Games, where Matt breaks things on purpose so your team's first real incident isn't their first incident. Let's get into it.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Talk Python Courses

Links from the show

Guest

Matt Lea: linkedin.com

Talk Python Certificates: training.talkpython.fm/certificates

Schematical: schematical.com

CloudWarGames.com: cloudwargames.com

Zero to Hero on AWS Security: www.oreilly.com

Repo: github.com

Custom Wheel Offset: customwheeloffset.com

2012 TechCrunch Disrupt Hackathon: techcrunch.com

tech comics: schematical.com

shhgit: github.com

Zero Trust in 200ms: Implementing Identity-Per-Transaction: us.pycon.org

Coolify: coolify.io

returned to full GA Nov 2025: aws.amazon.com

Signed URLs/cookies: docs.aws.amazon.com

Cloudflare: www.cloudflare.com

Bunny Shield: bunny.net

Cloud War Games One: www.youtube.com

Cloud War Games Two: www.youtube.com

LinkedIn: linkedin.com

YouTube: youtube.com

KnocKnoc: knocknoc.io

Watch this episode on YouTube: youtube.com

Episode #559 deep-dive: talkpython.fm/559

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy

Every company has one. The little internal tool that Jane built back in 2021, and then Jane left. Nobody understands it, nobody will touch it. There are two unwritten rules around it: don't change it, it's working. And if you break it, you bought it. That's dark-matter enterprise software.



For every app you can actually see, there are ten of these sitting in the shadows, frozen. Michael Booth thinks that just changed. He read my article on hyper-personal software and ran with it, writing about hyper-team software: small teams inside big companies finally building the tools that were never going to get built.



We cover where this works, where it quietly goes wrong, and the guardrails that keep it from turning into a mess. Let's get into it.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Python in Production

Talk Python Courses

Links from the show

Guest

Michael Booth: github.com

Talk Python AI Integrations: talkpython.fm/blog

From Hyper-Personal to Hyper-Team Software: Small Team-Built, AI-Assisted Tools Inside the Enterprise: www.databooth.com.au

What hyper-personal software looks like (MK's article): mkennedy.codes

Databooth Site: www.databooth.com.au

Wall Street just lost $285 billion because of 13 markdown files: martinalderson.com

SaaSpocalypse is real but everyone is panicking about the wrong thing: www.reddit.com

Warp Terminal: www.warp.dev

Watch this episode on YouTube: youtube.com

Episode #558 deep-dive: talkpython.fm/558

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy

Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall.



On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe.



We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.

Episode sponsors

Sentry Error Monitoring, Code talkpython26

Talk Python Courses

Links from the show

Guests

Juanita Gomez: linkedin.com

Mike Fiedler: miketheman.dev

Seth Michael Larson: sethmlarson.dev

Trailblazing Python Security: us.pycon.org

Everything Security at PyCon US 2026 (PSF blog): pyfound.blogspot.com

Dependency Cooldowns: cooldowns.dev

Anatomy of a Phishing Campaign (Mike Fiedler) Recording: www.youtube.com

FedRAMP: www.gsa.gov

Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python & Serverless-Tristan McKinnon: www.youtube.com

Rust for CPython project: blog.python.org

pre-PEP: discuss.python.org

Rust for CPython: Making Python Safer and More Robust for Everyone - Emma Smith: www.youtube.com

SBOMit: github.com

Asleep at the Wheel: Getting your SBOMs to pay attention... - Sanchit Sahay, Abhishek Reddypalle: www.youtube.com

Volatility: volatilityfoundation.org

Post Incident Runtime SBOM Generation from Python Memory - Hala Ali: www.youtube.com

zizmor: docs.zizmor.sh

GitHub Actions security in Python packages (Andrew Nesbitt write-up): nesbitt.io

andrew/pycon: data & analysis for the GitHub Actions security talk: github.com

GitHub Actions Security in Python Packages - Andrew Nesbitt: www.youtube.com

gh-profiler: examine a GitHub user's profile to gauge their contributions: github.com

PyCon US YouTube channel: www.youtube.com

SBOMit: adding verification to SBOMs (OpenSSF): openssf.org

Ecosystems: ecosyste.ms

Watch this episode on YouTube: youtube.com

Episode #557 deep-dive: talkpython.fm/557

Episode transcripts: talkpython.fm

Theme Song: Developer Rap

🥁 Served in a Flask 🎸: talkpython.fm/flasksong

---== Don't be a stranger ==---

YouTube: youtube.com/@talkpython

Bluesky: @talkpython.fm

Mastodon: @talkpython@fosstodon.org

X.com: @talkpython

Michael on Bluesky: @mkennedy.codes

Michael on Mastodon: @mkennedy@fosstodon.org

Michael on X.com: @mkennedy