Making Python safer than ever
summary
PSF funds PSF Security Developer-in-Residence and PyPI Safety & Security Engineer roles (backed by OpenSSF’s Alpha-Omega and AWS) and is now a CVE CNA for faster vulnerability numbering. PyPI enforces 2FA, the inbound-report pipeline shrinks average response time from about eight hours to roughly sixty minutes, CPython releases are cryptographically signed, and Warehouse undergoes an external security audit — concrete changes with measurable effects on supply‑chain risk.
AI-written summary · about
chapters (14)
- 0:00Python security efforts
- 3:19Security in Python today
- 7:35Python’s unique vulnerabilities
- 10:04Top 10 open source risks
- 14:21PSF security initiatives
- 15:50Verifying Python downloads
- 18:41Python as CVE authority
- 20:29Two-factor auth on PyPI
- 21:36Malware reporting on PyPI
- 23:24Security audits for PyPI
- 24:30Handling vulnerability reports
- 25:57Maintainers improving security
- 27:03Users securing Python
- 28:26Call to action
related talks
10mPyPI Supply Chain Security
19mThe Power of Dedicated Security Engineers vs. Volunteers
10mUpdate from our Security Engineers
25m"Security considerations in Python Packaging"
26mSecure Software Supply Chains for Python
55mReviewing another year of security partnership between the PSF & Alpha-Omega
27mCommunity Service Awards & Python Software Foundation Update
34mSecure Python Development: Tips, Tricks, and Tools