Python Bytes #492 Codeberg Puts Head in Sand
12 snips
Aug 18, 2026 Security releases for Python 3.10–3.12 and tarfile hardening make update urgency a hot topic. Codeberg’s new ban on mostly AI-written repositories and its implications for Git hosting are debated. A proposal to record source origins and SBOMs for reproducible PyPI builds is explored. Extras include tooling updates, post-quantum TLS notes, and a playful closing bit.
AI Snips
Chapters
Books
Transcript
Episode notes
Apply Python Source Security Fixes Immediately
- Upgrade Python on older branches because source-only security fixes patch multiple exploitable issues in tarfile extraction and other modules.
- Calvin highlights tarfile path-traversal and symlink escape fixes affecting 3.10/3.11/3.12 that make these updates urgent.
Codeberg's Majority LLM Rule Breaks Measurement
- Codeberg's new terms ban projects judged 'mostly' generated by LLMs, creating an ambiguous enforcement boundary for hosting alternatives to GitHub.
- Michael warns that diffs from AI refactors can overwhelm handwritten code counts and break majority-based rules.
Armin Ronacher's Codeberg Critique
- Armin Ronacher published a critique arguing Codeberg's democratic governance can still make unpredictable, narrow choices that undermine being a GitHub alternative.
- Michael recounts community hopes for a dependable European host and how this policy disappoints those who migrated.
