Transcript: The Future of Python - Deb Nicholson

I'm Carlton Gibson, joined as ever by Will Vincent.

Hello, Will.

Hello, Will.

Deb, thank you for coming on and joining us.

I it I I I thought that we had you on already, but that I think that's just because I've met you, I met you at DjangoCon US this year, and you were very helpful talking to um to me and Anna on the Django Software Foundation board, or maybe it was Haim, one of us.

You've been very helpful with the Django community, and so um it's great to have you on and uh and talk about your work and how Python and Django interact.

Because on our end, sometimes people think that we are just a we Django is just a subset of the PSF.

Oh.

Um if there is one, uh it is being hidden from me.

Um but I'll I'll keep looking.

Uh we do get uh we to get a lot of um people who probably think we're in charge of other things.

I I hit this sometimes with numfocus.

Like I'll get notes and they'll be like, hey, can you hook me up with a pie data ticket?

And I'm like, um, no.

Um not because I don't want to, but because it's not our conference.

Um, but luckily I know whose conference it is, so I can be like, oh, you should speak with Leah, she's great, um, and can talk to you about Pi Data.

Um not so much on Django, maybe because the name is a little different.

I guess um, like all the numfocus projects have like almost all of them have pie in the name, so that probably makes it a little more confusing.

Um, but uh, but I think for Django, like people it has a different enough name.

Uh, maybe from further out, but I've mostly been talking to people inside the community, so I haven't hit too much of that confusion.

There might be a couple people out there that think like you're a fiscal sponsoree of ours.

I don't know.

Um okay,

We need someone to do your job because basically we're all like this, juggling so many balls in the air, and like we can't do it, and lots doesn't happen.

And but what on earth is an executive director?

Like so we were

So uh so like many years ago, I was before I came to like open source nonprofits, I was working in a small place with like three people, and we hired someone who thought like she was gonna sit around like madmen and dictate letters and people would bring her fizzy water and stuff, and it was like, Oh, um, there's only three people here, and you're one of them.

I don't know, like, I don't know who you think is gonna take a letter.

Um, so for a small organization, and before this I was at the open source initiative as like the general manager, which is sort of like the executive director but without the title.

Um, and now they have an executive director, but uh it's uh the the smaller the org is the more hats you wear, basically.

Um PSF now has uh so we have an events team, uh we have uh like folks that work with the community, like all different parts of the community, and we have uh infrastructure and particularly uh with a focus on security, which is sort of a a thing that we have all decided that we're gonna finally pay attention to in open source.

Great.

Um so uh so that so there's about 12 of us.

So it's a little um no one brings me water, but um, you know, there are a few things that uh like I, you know, I can delegate to other people.

Um so my job like with that size of organization means I am paying attention to a lot of the staffing, uh, making sure that uh, you know, kind of the like places where the different work meets uh, you know, isn't isn't shifting and and and stuff in a way that's like confusing uh or not fair or too much for somebody to do in a regular healthy work week.

Um so there's that.

And then also I kind of like take on everyone has their like stack of things that they do, and then if something comes in from left field, like then I I take a look at it.

Um if it's high profile, I'll take it.

If it's like uh something that we should be doing, I kind of figure out where it would go in the organization uh or how to respond.

Uh so I get like all the weird out-of-band stuff.

And it's like, no, like maybe one person, but not all 12 of us, because that's not very good use of time.

Oh yeah.

Yeah, and but but their role is very much like to look after the the code side and to do the ticket um triage and the ticket report request review and really do the releases and security things, but quite often there'll be these kind of other jobs which oh well let's ask the fellows, or let's and it's and they pick it up, but it's not the role, and so that's kind of and they don't have capacity to take on very much more, so right.

And actually, I mean, you know, you when you when you spoke with us, Deb, um you know, it was just this like, oh my god, that's exactly exactly what we need, because all the things you listed are all the things that I think any uh tech nonprofit of a certain size, which the DSF is and PSF is needs.

And I mean a big one that um the DSF, the current board has been working on is having working groups because historically on the DSF board, the members did the work.

And if they didn't do it, it didn't get done.

Whereas I know the PSF has been a little bit better about basically agreeing on what should be done and then delegating, and maybe one person's involved, but it's more of a, I believe, overarching role rather than like, oh, and you're actually gonna do it all in your uh you know, volunteer time.

And so um having that staff person that sort of like makes sure it's like, oh, I set up this month's meeting, even if it's only like two-thirds of the committee, like we're gonna meet and report out on progress, and if somebody's stuck or something, or like you know, people didn't want to like spend their own personal money to set up some account or whatever, uh, and it should be the or you know, like all these weird little things that it's like uh like volunteers are either don't want to do or don't know if they're all

owed to do.

Um, if you have a staff person that is meeting with them occasionally, it's like, oh no, no, we're allowed to, you know, pay ten dollars a month for that thing that would make the work better, and and stuff like that.

So it's but also helps keep it, make sure like the meeting happens, and so we're sort of looking at how to add that to like a lot of the working groups and and get that support in there.

And so um the other thing I think about with nonprofits is uh like I don't know if it's like Tai Chi where you go where the energy is, right?

So you know

you can talk about an analogy.

That's actually I still I still got pinged.

I can say this.

I still got pinged for like finding an old one for this current year's one.

So it's when Catherine, yeah.

Almost nobody has like, I've always been curious about filing 990s on their personal roadmap unless you're an accountant.

Oh, yeah.

I'm an odd duck because I have an MBA and our um the the board's assistant, Katherine Holmes, actually has an accounting degree.

But yes, most people, most people are like, yeah, I want to like community and code, and it's like, oh, no, be a manager.

And and by the way, don't don't mess these things up.

Like um, I don't know how many skeletons in the closet I want to talk about publicly, but you know, it doesn't always happen the way it should.

And then you have to uh there's a whole process for if you miss, you know, not under my watch, but if you miss uh filing a 990, there's a whole you know, but you Oh, yeah.

And um at some point, like we had the person who was doing the accounting for us, like we just were not grateful enough.

And so she was finally one year it was like there's a bag in my closet.

You can come by when I'm not home to pick it up.

And it was like Oh wow.

Uh or really what's in the bag.

Yeah, what's in the bag?

Um, and so uh yeah, so like, and that was like someone who was like, I want to make art, and we're like, you get to do the accounting.

Oh, that's so weird.

Is it sort of like a performance art accounting?

No, no, it's real just regular accounting.

You know, you go from manageable to not manageable with these things.

I mean, like, I'll give you one example, and I'm sure there's a PSF equivalent where the DSF has um had a sitting cash budget or you know, reserves of around, I think it was around $200,000.

And um, Pete Bumgartner, who was the new took over as treasurer for me, though he's now off the board, um, was like, hey, this is just sitting here, interest rates are high, why don't we put it in a high yield account and get five percent?

Um so he did.

So that's ten thousand dollars a year that the DSF is getting that they weren't before, but it's nice, you know, he just happens to know that because he runs a consulting business.

And that you know, that's kind of why I was like, Yeah, Pete Pete, I really want you to have this role.

So there's yeah, there's so many things like that, right, that are separate from community and code, but are vital to running the thing, keeping it sustainable, and um yeah, so uh it's it's a kind of a miracle the DSF is still as functioning as it is given all these uh concerns.

Yeah.

And people are like, what?

And I'm and you know, I don't like I have done customer service, and so I'm like, yeah, no, people expect to be thanked a couple more times than maybe you think is strictly necessary.

Um because they're not involved in your work and they're just writing a big check.

Like that's you know, um, and so uh so that one I've seen um like smaller projects without staff kind of choke on and they're like, Why all the paperwork?

Like they're renting you like a hundred thousand dollar check, like there's gonna be some paperwork.

Get over it.

And B, you know, yeah, they have there's a whole well-established process for asking for grants, maintaining those grants, thanking them for the grants.

And, you know, when it's just board members uh, you know, who are software developers, we definitely drop the ball on that.

Um, so that's a that's a scaling issue for sure.

Well, and that's again, it's probably something that um you want to have staff doing.

Again, like most people don't have like, oh, I would like to have a lot of high-stakes meetings about money with strangers on their personal growth roadmap unless fundraising is a skill they want to develop.

Right.

Right.

Yeah, and it is a separate skill, that's the thing.

Yeah it's not

And um, so that means we just like fundraise all the time.

So I grew up like I'm sure the neighbors were like, oh god, it's that Nicholson girl again.

Um, oh today we're selling wrapping paper for the elementary school.

Hi, today it's cookies for Girl Scouts, like tomorrow I'll be back for like with you know, candy bars for the band, like everything.

We just like were constantly like, You're you're giving so much.

Like, I'll show you get this chalky candy bar.

Actually, I'm the webmaster, yay.

Um, but um well, I'm gonna resist going down political and angle on that one.

But yes, it is a it's a whole thing in many places.

But maybe um yeah, Carlton, we're just gonna jump all around.

Carlton mentioned the fellows.

The PSF has some new fellows, right?

I believe could you talk about

So uh so Wukash, like, um, I guess like before I got here, it was like, oh, we should eventually have three people doing that.

And then the pandemic came and it was like, Whew, wow, what's going on with our finances?

And it's like, well, we're not hiring two more people, that's what's going on for the first year or two.

Um, and then we're kind of finally back around again where it's like, oh, I think we could do this.

So he he wrote a blog post a little while ago and um was like, I could really use a second person.

And so we had someone respond almost immediately at Bloomberg was like, we would like to hire that second uh C Python developer person, and that's Peter.

And then uh we also it was like someone we got an anonymous donation, like, hey, how much would it cost to just complete the set that we talked about a while ago?

And uh so then we were able to also offer position to Sir Hay.

Uh both of them have a long history with the C Python community, like lots of people are familiar with their work, so it wasn't like surprise, where'd these folks come from?

Uh, but it was just like, oh finally, they can just like full-on work for us and instead of uh, you know, do a lot of unpaid work for us that's a little less directed.

So it hasn't changed so much.

They both are sort of coordinating with Wukash, and uh so the work is more directed, but also they're both able to work for us full-time, which is fantastic.

So Django's 18 this, you know, last year it's gonna be 19 this year, 20 next year.

We'll buy it a beer in a couple of years' time.

But there's no way it would have got there through that 10 to 15 year age group without the the fellowship program coming on because you know it was in trouble and then the fellowship program started, and then all of a sudden, actually Django's as strong now as it ever has been.

Nice, and that's just because of the I guess the limits of volunteer effort.

And I is the do you know that is the feeling the same there in Python?

Actually, that the the bourbon residence is is about the sustainability, secures the sustainability of Python.

Like yesterday Wukash was working on build bots, which he's like, there's no way volunteers would want to do this.

Um it's yeah, yeah, he's he was just like, I can't, yeah, I'm like gonna be on this all day.

I'm like, okay, great.

Um, but like I and I'm so glad you're doing it because there are a lot of things like that in C Python.

So it's it's just like there's also, you know, we have the pep process, and um a lot of times the pep comes in and it's like, whoa, we still have a lot of questions about this one.

Um uh it seems like like maybe the writer had the like has the answers but didn't share them or didn't know that we would want them or how to share them or whatever.

And so like Wukosh does a lot of work with people um who are proposing peps and like hey, so like just so you know, like when when the steering council looks at this, they're gonna want to know how it interacts with this and this and this.

Um so if you include that, your PEB is gonna have a much better chance of being taken seriously and considered uh on its merits as opposed to like wow, I don't know what that would do.

Well, I I I always joke that it's hard to get a feature into Django, but I watched the odd peps go through and I think, wow, it's really hard to get something into Python.

Absolutely.

Um and uh which is good.

Like I want, you know, it I actually wish people would tell us more, you know, politely, but like, you know, more about like how they're feeling about different peps, because then we could foresee more of the places that it touches.

Um so that one's always a little frustrating when it's like, oh, okay, like on the on the forum or something, it feels like we talked about this for like a year, and then someone's like, hey, it broke my thing, and it's like, oh, we were we've been talking about like how we're gonna make this change like forever, and like there was like a lengthy I uh I guess you didn't get your invite, or I don't know why.

Well you're invited.

And in case anyone's listening to this and been like, How do you get that invite?

You're already invited.

Like, yeah, just turn on it.

Well, or the classic thing with open source, which is like, oh, we have been um like re-implementing a bug that you fixed like five years ago internally because our stuff rests on it, and we just didn't want to mention that because it's like our trade secret or whatever.

Uh and then it's like, oh, we changed the we changed it so you can't even just re-implement the bug anymore, and then they're like kind of upset.

And I'm like, how how are we supposed to know that you've been secretly re-implementing a bug internally, like um for like five years?

Like that's I just just open, it's and then we can help you.

Yeah.

But I think

How do we get one?

Um and I think the easiest, and we've had, and I'll just say we've had discussions of these at the most recent DjangoCon, DjangoCon US, DjangoCon Europe, smaller groups.

So I'll just share it around how would how would we do it if we were gonna have an executive director?

And I think the easiest way is to get the fellows program funded by Bloomberg, pick a place and say, you know, for two, three years, do you wanna be, you know, sponsor the fellows?

Because for the DSF, our budget is two-thirds or more fellows.

So if we got a company that said, yeah, for three years, I'll sponsor the fellows program, which is less than the it's just like the cost of a single developer for a West Coast firm.

Um, and then they can get whatever marketing they want.

That would change.

Then they would get then we would then we could have an executive director for three years and you know, see all these things that that would happen.

So I think that's to the extent there's a magic bullet, I think, but you know, then it requires uh someone within the DSF community who has the knowledge to go through that process with with these big companies, right?

And and to the customer service angle.

Personally, no.

I think in some ways it might be better if it's not, actually.

Uh so I mean, the first thing I would do if I was to hire an executive director for an organization that hasn't had one before is make a list of things that the board is doing and doesn't want to do or is doing and is often feeling like they're too late.

Like, oh no, I really need to be doing this every day and I can't, I only can do it once a week.

Like, so list off those things and then list off what you think um the organization needs to get to the next place where you don't have to worry about so you get like a certain amount of funding, and then so I'm guessing fundraising is gonna be on that list.

Um, that person is gonna have to be doing a lot of fundraising uh and be really good at creating new connections and and bringing in money.

I mean, one thing we we should say, I think not maybe not everyone in Django knows that you know, during COVID, we DSF was actually in a fairly strong position because you know the PSF is was conference-based largely, right?

So no conferences kind of blows up the budget.

Whereas the DSF, we do have conferences, but that are they are not big fundraisers.

So um we were in a you know, it was less of an issue for us, but I know that was I guess you came in midway through that, right?

That was a little bit existential for the PSF when you say we have seven figure costs and then our main fundraiser goes virtual.

Um you know, was it was that right?

What was the timing of when you Yeah,

I came in um right before uh like just a couple weeks before PyCon in 2022.

So I showed up and no one had met me or knew who I was, and so it was amazing because like uh like I had all these great conversations.

I actually remember this young woman who uh I sat with at lunch and she was like, Can you believe it?

I've only been doing Python for six months, and the people who run this conference paid for my travel to come here.

And I was like, Wow, that's great.

Which I was like, I I love that.

I'm so glad that we're supporting you so early in your journey, but I don't think she knew she was talking to the executive director.

Like when people are just they give it to you right now.

I know.

But yeah, I did I joined during the pandemic and I and like just like came on like three weeks before the first conference back in person.

So yeah, that was always something that was like, you know, uh on the DSF board, we like, well, at least at least our funding isn't all wrapped up in this one thing that COVID blew up because Yeah, that

Um and like, you know, working on more programmatic sources for uh income, you know, like all of the like folks that fund um people that to work on CPython or to work on security at the PSF, amazing, like uh Meta and Bloomberg, uh AWS and uh OpenSSF, like all of those uh are program funding, not PyCon funding.

I'm I'll but jump in when I've you know go.

Um I I was in the audience for your talk at DjangoCon this year, which we'll put a link to, which I love that talk.

I love I guess the softer talks.

Um could you could you could you um like briefly describe that yeah because I it was a really I love I love those kind of talks.

I I should say actually I met Carlton and I connected because he gave a similarly um non-code heavy talk about growing old Gracely as a developer, and I wasn't there in person but saw it online and reached out to him and then that started this whole thing.

So yes, so your your talk, your talk, what was

So like my um so I used to be the co-organizer for the Boston Python meetup, like many, many years ago before I ever thought of coming to work here as the executive director.

Um and I I love the meetups.

I think uh it's it's so interesting to uh be able to like kind of have each community customize locally to like what people are interested in learning, what people are interested in doing, like what kinds of activities they want to engage in together.

Um, and doing that, and then like what I want to do is kind of strengthen the connection between uh those sorts of edges or uh like you know, all our little front doors all over the place to the community, back up to the main to the PSF.

Um, so we do already like uh fiscally sponsor a couple of the large meetups, including the Boston Python meetup.

Um and we run a big mega meetup account, which like a lot of the Django meetups and Python meetups are on.

So like we pay one fee and then we get unlimited meetups.

Well, not unlimited, but we haven't hit the limit yet.

Um and then uh we, you know, are always like kind of looking at what other ways could we help uh meetups do their work.

Um, and so that's a sort of uh on my on my list of things that I want to do as, you know, is are there other resources or things that we could provide besides the like the meetup account or for meetups that wanna uh be a fiscal sponsoree, uh, you know, a PEX card, which is like a debit card, so they don't have to buy pizza with their own money.

Um so

Um and I believe I'm gonna be speaking at one of the the first ones.

And actually they were like, Who else should we invite?

And I was like, Well, do you know Deb?

Um, so I don't know if they've reached out yet, but if not, I'll I'll coordinate that because that's another um and actually I don't know if they're aware of the the meetup thing that maybe they could get under that umbrella.

Um I'll reach out to them.

But but yeah, you you're completely right.

I mean, especially in a city, you know, Boston's not a huge city, but it's big enough.

There's the Python one, there's there was the Django one, there's all these different ones, and there's yeah, it's like it's the cross-pollination too, is really great.

If you like I I for a while I was going to a whole bunch of React ones.

And just to like the Boston

It's uh like 10,000 people are on that mailing list.

I mean, and there's multiple ones, right?

Because there's like the come to come together and like get help with your project.

There's sometimes people give a talk.

Um, but it's uh yeah, like before, like when I was there, we were doing um we were doing talk nights, uh hack nights with like one beginner table and then eventually two beginner tables because we had so many people coming in as beginners, and then puzzle night, which was like two or three people would go and do the same puzzle and then talk through their solution so that people could see like different ways to attack the same problem.

Um, and then like once or twice we had like someone, some author let us know, like, hey, I'm gonna be in town, and we're like, all right, we'll just have like an author meet the author night.

Yeah, so um now I can't remember their names, so I'm sorry.

There's a few of them.

The the thing is is that Boston for a smaller city, I mean smaller than New York and Los Angeles, I guess, but um is uh a huge Python town because we have so much biotech, like people are working to like to cure cancer or and like uh like build solar energy and like all these, like all this different science stuff because we've got MIT.

Um so like everybody is in Cambridge, like when I took the job at the PSF, everyone's like, oh, Python.

I use Python.

Everyone told me they use Python.

Like everyone I met for like a whole year was like, oh yeah, that's great.

I totally use Python for this.

And they would tell me what they use Python for.

Um seems funny because it's just on the street from MIT, but it does.

Um and uh Boston University, Boston College,

Uh so it's it's so for the size of town we are, it's an extremely big Python town.

You don't always get college grad studate students, but there's so many people who are interested in this.

Yeah, so

And I just someone just told me the other day that they thought the Boston Pie Ladies meetup was maybe getting revived again.

Like a just a lot of meetups took a big hit during the pandemic.

It was like, you know, it it uh part of it was really meeting in person.

It's still there.

It's like the the the the the big conferences, it's like, yeah, you really want to go, but also there's a can then we do a smaller like meetup locally that might be safer or easier and it might be more environmentally sort of sustainable.

It's like, oh, maybe, you know, I mean, like, I don't know if you went to a lot of conferences in the before times, but you know, I would get like a cold or a flu or something

Just like, oh, I guess that's just my job.

I go and I uh like kind of sample germs from like 50 different countries like every other month and uh and then see what I brought home.

So it's like being a pre preschool teacher.

I personally I think I think it's a good choice, but I know it's a difficult one for organizers.

You know, and then we get uh the other end, which like sometimes goes from like a pretty sincere, like I do find it really hard to socialize when I can't pee see all of people's faces.

And I'm like, I get that.

And we are like looking at like can there be outside spaces or like you know, that people can hang out in because we're a little later in the year this year.

Uh, but then other people it's just like oh, you SJWs with your face diapers, and I'm like, uh, okay, okay.

I know when I click over to the rest of your profile on X, I'm not gonna be sad that you aren't attending our event.

Thank you next.

So it's yeah, it's just it's like um, yeah, and I and I get it.

It's like I I'm looking we are looking for like ways that we could uh hold a safer event.

So like this is our first year in Pittsburgh.

So we'll be looking at some of the airflow stuff and um seeing if like maybe we could just have the talk rooms or put like uh more airflow into the talk rooms and make it like more of an optional thing, but still uh have like a good, you know, like not uh not a crowded telephone booth with five people all breathing in each other's mouths kind of situation.

I and I I g it's harder for the hallway, like so.

That's like one of the other things.

Like I know I've seen other conferences that were like, oh, you mask in the talk rooms and then the hallway, which is huge and spacious, although I don't know how huge and spacious our hallways will be this year.

So if they are great, then maybe we'll do that next year.

I wonder if you could speak to that and why is the PSF getting involved?

That makes it sound like that.

Okay.

And it's like, oh, uh, that's like not a nice feeling for European consumers.

And so legislature legislators were interested in doing something about that.

I get it.

And so they were like, anyone giving the software out like should be on the hook for making sure that it's liable for any product it shows up in.

And it was like, whoa, whoa, whoa.

So that's why I I wrote on our website, it was like, you know, uh, so we provide all the code on our site, like both the C Python side and the packaging index side, uh, free for anyone to use for any purpose, whatever.

Nobody tells us when they're downloading it.

We don't create a contractual relationship.

We just have like a little license on it.

It's like, good luck, please don't bother us about it if you you put it in something dumb.

And um, you know, it's like, okay, um cool.

So you would now change this so we would be on the hook for any product any of that code shows up in.

And they're like, Well, aren't you, you know, I think I think European legislators saw some of the business models in open source and were like, I mean, you're providing that code because like you're gonna sell support for it, right?

Or like you're selling the hardware and then like the code is free, so you want a a free pass on the code that's absolutely part of your product.

And we're like, we actually don't have a product here at all.

Like, and so I wrote, like, you know, are people making money with Python?

Absolutely.

Is the PSF making money selling Python?

Absolutely not.

So we are completely the wrong place for this sort of uh, you know, like for the liability to sit.

Uh, so that was why I wrote just like I think um some of the some of the larger players in open source that do have a product were pretty well represented because they've, you know, like 16 lawyers on staff or whatever, and someone who can pay attention to policy.

Um, and some uh but the community-driven projects like Python were not at the table and weren't we weren't really being heard by the uh by European legislators because they were like, it I mean, I've I've seen this a bunch of times like in open source where like you tell someone like, oh, we're making a lot of code, which is a very valuable thing, and then we are giving it away to anyone at all for free.

And they're like, okay, and then what?

And I'm like, no, that's the whole thing.

But like, there's gotta be you're gonna be coming back on the on the on the side, and I'm like, no, no, we're it's a nonprofit organization that just does this.

And they're like, okay.

Is there like a company next to it?

No, there's not a company next to it.

So like, so it it was a little it, you know, it took some education and and talking um with a lot of different legislators about like, yeah, some of those business models you've seen are happening, some of them, uh, but not all open source is getting uh created there.

And in fact, a lot of the things that are offered for free are sitting in like enterprise level stuff, are running like all kinds of applications that you've heard of uh are critically important to the like ecosystem and the way that we uh you know we all understand computing.

So uh so there was you know, it took some education.

Is there a yeah?

So they have like a commercial entity, there's consumers, and then they created a a third new kind of entity called an open source steward.

So an open source steward, and it's really about the activity of providing code for free without a contractual obligation or financial transaction.

So if you're doing that, you're an open source steward.

Uh and that's absolutely what uh Python and uh PyPI are doing.

Uh and you and that does not incur product liability.

Okay.

So we I think the community as a whole is gonna want to see more like software-built materials, like reproducibility, um, you know, that kind

But you can contribute back to the security developing residence who needs to build a.

Um so we may try to synthesize uh folks' requests and ideas into like a single strategy and vision.

I mean Django has a security team and we have a security process, and I think um next week there'll be a security release, and we've got you know, it's a good we do a good job, but it's all volunteer-based.

And it would be lovely if some of the companies that are building products around Django would felt, you know what, we're actually liable for this, and it would be nice to just contribute back so that we could say that our liability was covered.

That would that would be a wonderful state of a lot of people.

A something or other numbering authority.

I forgot the

Um yeah, but basically it's uh like you register and then anyone who's like, oh, I found a vulnerability, like it it comes back into you, but you're registered so that it's not you don't have to like know a person over here to do it.

And that's that number is a uh goes into a database of all exploits that are known, and you know you can search that and it's registered, and patches can be attached.

This is reference that CVE.

So you can look up for it.

And maybe the the thing is we sometimes have people who try and report uh an issue, and people are very good, they go through Django and but um curl, for instance, has people registering CVEs against curl that are just bogus, totally bogus, and then the curl maintainers need to um handle that.

So the the question is could if Django were to become its own one, could we would be able to say no?

Because we would be the only people who would be able to issue CVEs for Django, um, and no one and we can dispute them if that were to happen.

But the how much of a pain is that?

What I'd really kind of like, but I haven't spoken to Seth about it, was if we could perhaps come under the auspices of the Python's um authority, CNA there, because there's a bit of bureaucracy there, which Django perhaps doesn't have the capacity for, but it would be a known and a trusted thing.

And I don't know if that's on Python's roadmap at all, but it's something that has crossed our mind is well, you know, now Python has that authority, maybe we could be under that umbrella because it would save us, it would give us a little bit more confidence in some of the worst cases.

Okay.

Um but that was also half idea.

That's literally just a half idea in the back of my head.

But it it's it's like that was the point of documenting everything that he's doing is so that other projects could be like, hi, I wonder what's the deal with that.

And it's like, oh, you could actually just like see how it worked out for us, and um and instead of doing all that research or try it yourself and find out like wow, that was a lot of work and not so great for us.

Like, um, I don't think that'll be the outcome, but yeah.

You have to the hardest bit is finding the what right web form to do it because there's a there's a a website and there's all sorts of links and it's quite hard to find.

But once you've found it, it's not too hard to actually and Python would, you know, Python did offer that to others things, they'd have the same form.

You just you just you'd have a back channel to a human being you know to to talk to that would be the only real

So you're basically putting out this big like security suggestion box, and if nobody's looking in the box, then it's there's no point.

It's because

So it's you know anyway, it that's just me mind dumping.

There's been um, I know E and their team have done a lot about um two-factor auth, which from my end went incredibly well, but I know that was hard to see that there was some negative pushback from people maybe who weren't really understanding what was why why the reasons for that.

And um, and then what we realized is people just needed a lot more notice and a lot more like, hey, this is why we're doing this.

So, uh, so Mike Fiedler, who works on PyPI as our security engineer over there, uh, you know, he probably wrote like uh like a dozen blog posts and things like getting re getting people ready, like, hey, it's coming.

If you have questions, this is why we're doing it.

Like the whole thing.

He's been really great about communicating.

And I think it went a lot better uh when we did the wider rollout, just like giving people a lot more notice, a lot more time, a lot more like why we're doing it, um, and which makes sense.

It's community, like uh some, you know, and and the other thing that we've found out, like as Mike has been here, is that like there are a few people that have a package on PyPI that maybe forgot they had something over there.

Like, which is fine, like it's been around for a long, long time.

And so and people move on.

It's like you you put something like you you gave your thing to the world and then you moved on.

Okay, fine, but um that's another kind of piece of Mike's work is looking at like what is on the package index, because there's definitely some stuff that's deprecated and that like you know, like it'd be fun to look at for educational purposes, but maybe don't put into like a working live modern project or whatever, but uh but stuff isn't really labeled that way over there right now.

But that's that's like kind of on the roadmap is to uh make the package index a little bit more like verbose as far as like what tells people they're downloading and like warns people off of deprecated stuff.

The traffic is insane, like and and still I think still just kind of up and to the right.

Um same with uh Python gets down downloaded like 300 million times a day.

Uh a bunch of those are probably automated, I hope.

Good lord.

But um, yeah, it's it's um so when I say like infrastructure, and you mentioned E and they do amazing work.

Uh like I just E is amazing.

Uh but the infrastructure, yeah, it has been like a hockey stick.

And um it's it's a huge, it's a huge thing.

Even even with like a massive well-meaning, polite users, there's still like just the like little questions and things that flicker down, it's like still a lot.

Um and uh, you know, and then we also have like a lot of uh corporate users that are uh like oh this is my my work and it needs to be like everyone else in my uh in my work sphere responds like within five minutes on chat, you know, and uh and then the package index is like we'll get to you.

Um so you know, we're trying to match that up a little bit better with what people want.

Is that what you're saying?

Um, but we are looking to be more responsive.

We understand that people are um, you know, like it is part of their their work.

And that was part of what uh you rolled out the um organizations, which is still coming.

It turned out the legal accounting and technical, like tying those up in a knot, uh, was a little bit more to untie.

But um, but that's where uh some of our corporate users would be able to have a little bit more control over their area.

Um so because when we built PyPI, it was just sort of like everyone is the same.

Like we don't care if you're a team of 80 people at some mega company or like one person that's gonna drive by PyPI for two hours on a bunch of Red Bull once in like you know, 2002 and never return.

You're you're all equal to us, and it's so that's how the infrastructure is, but um, that doesn't quite meet the needs of the community today.

Uh I've often thought of open source as three buckets where you have nonprofits, which is rare.

So like Django is now a nonprofit, um, Python is, you have corporate sponsored, um sponsorship is a loaded term, but like so let's say React or Angular, and then you have more solo developer projects, so like Laravel or Vue.js, where there's kind of one person in charge who generally also gets their funding through that way.

Does that does that track or am I like how do you think about open source, right?

Because we toss it around, but it it encompasses so many different things and really I think so many different business models is really what it comes down to.

Uh it's just a little bit different.

Um, I mean, uh if everyone works as the same company, they sort of have the same goal and idea about like the direction of the software.

And so is that maybe more targeted?

Like, yeah, sure, but does that make it like less of like a Swiss Army knife, uh, which is kind of how Python operates?

Yeah, that too.

So, like making it so that the community can kind of build their own extensions and add their own functionality means that you know, Python has become the the glue language we hear sometimes.

It's also uh, like I said, it's a great language for people who don't consider themselves programmers, like uh biologists and uh and people working on the space program.

They're like, oh, like I use Python every day, but I'm not a Python programmer.

And it's like, oh, okay, well, I'm glad it's easy enough to help you get us to space and help you cure cancer, because those are really important as well.

Um, and you can just call yourself whatever you want.

That's great work.

Uh so yeah, like, but could you do that?

Could like all these academics and scientists use a project that lived inside of a corporate silo?

Unless that corporation decided that scientists were their customer base, their main customer base, probably not.

So, you know, and then it's like the other thing with work where where people's work is always evolving, or uh, you know, maybe there's just one person doing like some kind of new thing, like uh some sort of digital humanities, like specializing on letters from kings in the 1600s.

And it's like, do you think there are enough people for a large mega corporation to write some scripts for those people?

I don't.

Um, I probably both of them uh are writing their own scripts to parse the materials from those letters, right?

Like you you kind of have to be a side Python developer just to you know get through grad school, let alone be a professor, because it's it's this tool that is used.

I mean, I was literally just talking to someone who was saying how he wanted to, he was thinking about getting a PhD in physics, but he was like, I don't really want to be a programmer, I want to be a physicist, and like you can't really do that.

Uh yeah, the the the time frame where you could just be a guy that drops stuff off of the leaning tower of Pisa and called yourself a physicist is probably past.

Yeah.

Especially in the nonprofit world.

Like it'd be great if there was some corporate overlord who just like paid for everything.

But I've heard uh publicly, like the re you know, the React team has said, you know, they had to fight Facebook meta just to open source it.

Like often it's not some like thing where you know Mark Zuckerberg's like, yeah, let's open source things.

It's like, you know, because that'll help with recruiting, which I would think it would.

It's like no, it's like the team has to really fight to do it in the first place, and then continually, you know, the needs of the for-profit company come first.

So many of these um corporate sponsored projects are you know, kind of in spite of their corporate overlords, actually, it which makes me um feel humanize the engineers behind it, right?

Instead of being like, Oh, it'd be nice to get paid Facebook money and do open source, it's like, no, they're they're you know, try really trying and fighting to keep it open source when these big companies, you know, don't really want that, or they don't see that they're not gonna prioritize it, I guess, is the thing to say.

And you're always like, uh, I mean, that's the thing is that like a corporation like is obligated to make money for its shareholders.

And so you you can, as long as they align, make the world a better place, empower people, teach people, uh, have a nice event, like all these different things, as long as they also serve that goal of making money for your shareholders.

The minute those two uh unravel um all of the other things go out the window, it's gonna be making money for shareholders.

And that's not like it like you said, it's it's not anything about like the people working inside those companies or that are participating in those systems.

It's how that system is set up.

Like if you if you were gonna create a new thing from scratch now and you were like, oh, what I don't want is for us to uh have to do like ethically gross things or whatever, then setting it up as a for-profit company is gonna be it's you're eventually gonna have to pay that bill.

So if you wanna if you wanna build software to make the world a better place and empower people and that's your focus, then you either need to be doing it as a 501c3 charitable organization, uh, you might consider like doing a cooperative where uh you're the all all of you have signed like a contract saying that you're going to like keep community needs first and not take certain kinds of clients that you find ethically objectionable, or uh you could set up a B cor

poration.

So there's a couple of companies like that in the US too, which is like a social benefit corporation.

So you are allowed to sort of split the difference between your ethical goals and your financial goals uh without always raising the financial goal to the detriment of uh any ethical goals that you have added.

How does how is the PSF thinking of communication?

And I'll give you on the Django side, like we, for example, don't have an email list of users, like we don't track anything.

So, you know, yeah, there's the people on the board, there's people at conferences, there's a couple hundred people on the forum.

Um, but you know, we struggle with reaching the millions of people using it.

Um, and so I'm curious if the PSF has found a solution to that.

Um, it's there are like so many people using Python.

I don't know how we would ever get a hold of all of them.

Um, but uh we have a couple of different channels.

So like for people that are interested in kind of like how the PSF is doing, we have a newsletter.

Um, for people that just want to stay up to date on PyCon, there's a mailing list for that, and you can stay up to date on Python.

Um, there is a forum for like general users, there's one in English and there's one in Spanish, um, where people can go and ask questions or talk about like things going on in their community uh or like announce stuff that they're interested in or thinking about or talking about.

Uh there is also like a place where uh you can go and discuss the technical direction of CPython.

And so that is it's is another forum uh that we have that is separate.

So like it's it's not one conversation, it's at least six, uh, but probably more.

And then there's there's other stuff like um I know Reddit has a Python sub.

Uh we're not in charge of it.

If you go there, you probably will be able to tell.

Um it's uh it's definitely like is

Yeah.

Um, but yeah, so we we maintain relationships over there.

The the discuss forum that uh is the steering council we do run.

So that one's

Oh, but with volunteer moderators, so you know it's like run, but with volunteers, so yeah.

Like uh I know um what's it?

Ned is always answering questions from newbies over on IRC.

I'm like, that's amazing.

I don't know how newbies are finding IRC, but that's great.

I mean, I think about this because I'm like, I like email, like I don't want you know, I don't want to be on Slack or Discord if I don't have to, but you know, young people are and they're used to it in work, and we've had some on the show talk about who are doing work to help Django in that area because they say, Yeah, it feels impersonal to people who are just used to communicating that way.

And I totally get it.

And also I'm getting old, so you know it's good to have

I mean, yeah, yeah.

It's I don't know.

We we've shifted a bunch of different times.

Like when I started at the Free Software Foundation, it was like Freenode IRC.

Um, you know, and uh what were we using?

I think Pigeon or Jabber or something, like interoffice.

Um, and then it it just keeps changing.

And we use Slack at the PSF, um, which is like, oh, everyone's like, oh, it's just IRC with more like emojis and like a GUI.

I'm like, yeah, it kinda is.

Okay.

Yeah.

I mean, because that's a thing, you know, new well, yeah, separate thing on you know, newsletters, right?

With with Substack, there's been talk, but like it's it's wild.

Which is into it now, yeah.

Yeah.

Yeah.

We can't go further down there.

Yeah, yeah, yeah.

Well I mean

So I guess to you, Magic Wand for Python, are there some things you're like, ooh, if I could just change them, I would.

And that can be code, community, legislative, whatever.

It's it's like uh because Python's like different things for different people, and so uh, and we largely sort of like l leave each other alone.

So like even if there was something where I'm like, oh, I don't know if we need that, like someone needs it.

So like I don't think I would change it.

Um Well, what about the the you know, where do you see the PSF in five years, right?

So where I see the PSF in five years, I want us to really kind of fully embrace the mantle of being like everybody's beginner language, um, and do more to support that.

You know, like if you haven't downloaded Python yet, I don't want it to be because you didn't know.

Like we're gonna come find you.

Uh and and like, you know, uh make sure that you know you could have access to a programming language.

Um, but that means like scaffolding a little bit more of like the way that we handle newcomers.

I mean, we do a a really good job with newcomers who like come to us, but um I want I want it to be a little bit more self-served so that if you came to our website and were like, huh, maybe I want to start using this Python thing and and uh and and you could get pretty far on your own, like maybe on our website.

That's kind of what I'm picturing.

Um maybe we're maybe we're teaching Python in elementary school.

Like, I don't know.

It's I I I want I want it to just be available to everybody and uh and if you aren't using Python, it's not because you didn't know.

It's it's because you are now using like six other programming languages um after being introduced to programming via Python.

I think one thing I I don't think it's solved yet is that um during COVID, all the kids in my school got Chromebooks.

And Chromebooks, it's possible but still difficult to play with Python on the computer itself.

You can do it through through the web, but you had to kind of go through a Linux thing.

And um I imagine there's work being done there, but you know, it's I think I'm often thinking, oh, everyone has a MacBook Pro when you know no, like a lot of people are on Windows or Linux or or these um Chromebooks.

And certainly for elementary school kids, something that you know work, you know, so Docker is gonna be a problem for for kids to dive into in fourth grade, right?

But maybe maybe Python would be a little bit easier once there's smooth Chromebook integration or you know, and things like that.

Yeah.

They got enough going on.

I'll I'm happy to do it for free.

Yeah.

Um so if anyone what can people do who are listening who say, I want to get involved in the PSF more than I am.

Um is there any action items?

Um you should come hang out with us in Pittsburgh at PyCon this year, which is in May.

Um, and tickets are on sale now.

Uh and if you don't want to do either of those things, then go find your local Python meetup and get involved over there.

Thank you so much for taking the time.

It's it's all every time I talk with you.

I've like, yes, like there there is a you know happy place that uh Django and open source can be.

And you know, I think it involves having some paid people who know what they're doing.

But um yeah.

Don't make accountants file.

I mean, don't make uh volunteers be accountants.

So there's um behind the scenes, um, you and the PSF over the years have been very, very helpful to the DSF.

So thank you for that.

Yeah.

Let me know when you want to hire an executive director.

I'll I'll share your percentage.

But yeah, I think I do think there's something's happening there, and and thank you for the offer.

I I hope that you'll be able to be taken up by it.

Um so thank you everyone for listening.

We are at DjangoChat.com.

We'll have links to everything in the show notes, and we'll see everyone next time.

Bye bye.

Bye bye.