My Blog

Packaging in Python has been notoriously confusing for newcomers. How should I structure the directories? What is the difference between setup.py and setup.cfg? How do they relate to a requirements.txt? Why do I need a MANIFEST.in file? Do I need tox or nox, and what are they for? Why is flake8 ignoring my pyproject.toml file? What’s the deal with virtual environments?

Luckily, this has been simplified a lot in recent years, in substantial part thanks to uv. I finally (and hopefully permanently) converged on what I call a canonical Python project template. If you are new to Python or generally confused about Python packaging, this blog article is for you. Find the copier template at the end.

Someone shared this cool site on Hacker News: https://knock-knock.net/.

It’s a honey pot with the purpose of identifying malicious actors on the internet and then publicly sharing the list of their IP addresses.

Since I’m hosting my own site, I’ve seen how many bots are hitting my poor server. Number one on the list of 404 errors is a request to /wp-admin/install.php?step=1 – 10 times as many hits as the next entry. It’s clearly an attempt to pwn web servers whose careless admins left an uninitialized WordPress instance exposed to the internet.

In episode 5.18 of the TV show “House, M.D.” (fantastic show, by the way), they show a patient who presents with vertigo. They fix it within moments by applying the so called Epley maneuver. This trope is every patient’s dream: just do this one weird trick and you’re cured!

I still cannot believe that not only did I experience something similar, but the most shocking part of it was that it was Claude, the LLM by Anthropic, who told me about it, despite having seen a specialist.

This really needs to be said:

If you are generating passwords, do not include special characters.

That’s right, I said it. Passwords without special characters.

I know, countless password policies and recommendations from all kinds of places mandate the use of at least one special character in a password. But guess what, adding an exclamation mark at the end doesn’t mean you now have a good password.

This rule is a rule of thumb that is given to users who are generally non-technical to help them choose a better password. The idea is that if adversaries are trying to find a password from its hashed form using brute force, they must work harder the larger the alphabet that makes up the password. And that’s true. Except brute force rarely plays a role.

A few weeks ago, I saw two interesting talks on Tübix. One was about self-hosting an e-mail server with Stalwart, and another was about digital sovereignty in Europe – or at least the first half of it, then it turned into a bit of a rant about the state of the usability of FOSS.

The message in both talks matched the sentiment that can be felt in many circles these days: digital sovereignty is becoming more important than ever. Dependence on (usually US American) hyperscalers should be avoided. This resonates with me.