Feeds

An over-the-air (OTA) update capability is an increasingly critical part of any embedded product to close cybersecurity vulnerabilities, allow just-in-time product rollouts, stomp out bugs, and deliver new features. We’ve talked about some of the key structural elements that go into an embedded OTA architecture before. But what about the back end? Let’s address some of those considerations now.

The challenges of embedded connectivity

The ideal of a constant Internet connection is more aspiration than reality for many embedded devices. Sporadic connections, costly cellular or roaming charges, and limited bandwidth are common hurdles. These conditions necessitate smart management of update payloads and robust retry strategies that can withstand interruptions, resuming where they left off without getting locked in a continually restarting update cycle.

There are other ways to manage spotty connections. Consider using less frequent update schedules or empower users to initiate updates. These strategies however have trade-offs, including the potential to miss critical security patches. One way to strike a balance is to implement updates as either optional or mandatory, or flag updates as mandatory only when critical, allowing users to pace out updates when embedded connectivity isn’t reliable.

To USB or not to USB

When network access is very unreliable, or even just plain absent, then USB updates are indispensable for updating device software. These updates can also serve as effective emergency measures or for in-field support. While the process of downloading and preparing a USB update can often be beyond a normal user’s capability, it’s a critical fallback and useful tool for technical personnel.

OTA servers: SaaS or self-hosted

Deciding between software as a service (SaaS) and self-hosted options for your OTA server is a decision that impacts not just the update experience but also compliance with industry and privacy regulations. While SaaS solutions can offer ease and reliability, certain scenarios may necessitate on-premise servers. If you do need to host an OTA server yourself, you’ll need to supply the server hardware and assign a maintenance team to manage it. But you may not have to build it all from scratch – you can still call in the experts with proven experience in setting up self-hosted OTA solutions.

Certificates: The bedrock of OTA security

SSL certificates are non-negotiable for genuine and secure OTA updates. They verify your company as the authentic source of updates. Choosing algorithms with the longest (comparatively equivalent) key lengths will extend the reliable lifespan of these certificates. However, remember that certificates do expire; having a game plan in place to deal with expired certificates will allow you to avoid the panic of an emergency scramble if it should happen unexpectedly.

Accurate timekeeping is also essential for validating SSL certificates. A functioning and accurate real-time clock that is regularly NTP/SNTP synchronized is critical. If timekeeping fails, your certificates won’t be validated properly, causing all sorts of issues. (We recommend reading our OTA best practice guide for advice on what to do proactively and reactively with invalidated or expired certificates.

Payload encryption: Non-negotiable

Encrypted update payloads are imperative as a safeguard against reverse-engineering and content tampering. This is true for OTA updates as well as any USB or offline updates. Leveraging the strongest possible encryption keys that your device can handle will enhance security significantly.

Accommodating the right to repair

The growing ‘right to repair’ movement and associated legislation imply that devices should support updates outside of your organization’s tightly controlled processes. This may mean that you need to provide a manual USB update to meet repair requirements without exposing systems to unauthorized OTA updates. To prevent your support team from struggling with amateur software updates, you’ll want to configure your device to set a flag when unauthorized software has been loaded. This status can be checked by support teams to invalidate support or warranty agreements.

Summary

By carefully navigating the critical aspects of OTA updates, such as choosing the right hosting option and managing SSL certificates and encryption protocols, your embedded systems can remain up-to-date and secure under any operating conditions. While this post introduces the issues involved in embedded-system updates, there is much more to consider for a comprehensive strategy. For a deeper exploration and best practices in managing an embedded product software update strategy, please visit our best practice guide, Updates Outside the App Store.

About KDAB

If you like this article and want to read similar material, consider subscribing via our RSS feed.

Subscribe to KDAB TV for similar informative short video content.

KDAB provides market leading software consulting and development services and training in Qt, C++ and 3D/OpenGL. Contact us.

The post Behind the Scenes of Embedded Updates appeared first on KDAB.

The Drupal Starshot initiative has been making significant progress behind the scenes, and I'm excited to share some updates with the community.

Leadership team formation and product definition

Over the past few months, we've been working diligently on Drupal Starshot. One of our first steps was to appoint a leadership team to guide the project. With the leadership team in place as well as the new Starshot Advisory Council, we shifted our focus to defining the product. We've made substantial progress on this front and will be sharing more details about the product strategy in the coming weeks.

Introducing Drupal Starshot tracks

We already started to break down the initiative into manageable components, and are introducing the concept of "tracks". Tracks are smaller, focused parts of the Drupal Starshot project that allow for targeted development and contributions. We've already published the first set of tracks on the Drupal Starshot issue queue on Drupal.org.

Example tracks include:

1. Creating Drupal Recipes for features like contact forms, advanced search, events, SEO and more.
2. Enhancing the Drupal installer to enable Recipes during installation.
3. Updating Drupal.org for Starshot, including product marketing and a trial experience.

While many tracks are technical and need help from developers, most of the tracks need contribution from designers, UX experts, marketers, testers and site builders.

Recruiting more track leads

Several tracks already have track leads and have made significant progress:

• Matt Glaman is spearheading the development of a trial experience.
• The marketing team, led by Suzanne Dergacheva, is crafting product marketing documentation.
• Martin Anderson-Clutz has been appointed as the track lead for event management.

However, we need many additional track leads to drive our remaining tracks to completion.

We're now accepting applications for track lead positions. Interested individuals and organizations can apply by completing our application form. The application window closes on July 31st, two weeks from today.

Key responsibilities of a track lead

Track leads can be individuals, teams, or organizations, including Drupal Certified Partners. While technical expertise is beneficial, the role primarily focuses on strategic coordination and project management. Key responsibilities include:

• Defining and validating requirements to ensure the track meets the expectations of our target audience.
• Developing and maintaining a prioritized task list, including creating milestones and timelines.
• Overseeing and driving the track's implementation.
• Collaborating with key stakeholders, including the Drupal Starshot leadership team, module maintainers, the marketing team, etc.
• Communicating progress to the community (e.g. blogging).

Track lead selection and announcement

After the application deadline, the Drupal Starshot Leadership Team will review the applications and appoint track leads. We expect to announce the selected track leads in the first week of August.

While the application period is open, we will be available to answer any questions you may have. Feel free to reach out to us through the Drupal.org issue queue, or join us in an upcoming zoom meeting (details to be announced / figured out).

Looking ahead to DrupalCon Barcelona

Our goal is to make significant progress on these tracks by DrupalCon Barcelona, where we plan to showcase the advancements we've made. We're excited about the momentum building around Drupal Starshot and can't wait to see the contributions from the community.

If you're passionate about Drupal and want to play a key role in shaping its future, consider applying for a track lead position.

Stay tuned for more updates on Drupal Starshot, and thank you for your continued support of the Drupal community.

The Rcpp Core Team is once again pleased to announce a new release (now at 1.0.13) of the Rcpp package. It arrived on CRAN earlier today, and has since been uploaded to Debian. Windows and macOS builds should appear at CRAN in the next few days, as will builds in different Linux distribution–and of course r2u should catch up tomorrow too. The release was uploaded last week, but not only does Rcpp always gets flagged because of the grandfathered .Call(symbol) but CRAN also found two packages ‘regressing’ which then required them to take five days to get back to us. One issue was known; another did not reproduce under our tests against over 2800 reverse dependencies leading to the eventual release today. Yay. Checks are good and appreciated, and it does take time by humans to review them.

This release continues with the six-months January-July cycle started with release 1.0.5 in July 2020. As a reminder, we do of course make interim snapshot ‘dev’ or ‘rc’ releases available via the Rcpp drat repo as well as the r-universe page and repo and strongly encourage their use and testing—I run my systems with these versions which tend to work just as well, and are also fully tested against all reverse-dependencies.

Rcpp has long established itself as the most popular way of enhancing R with C or C++ code. Right now, 2867 packages on CRAN depend on Rcpp for making analytical code go faster and further, along with 256 in BioConductor. On CRAN, 13.6% of all packages depend (directly) on Rcpp, and 59.9% of all compiled packages do. From the cloud mirror of CRAN (which is but a subset of all CRAN downloads), Rcpp has been downloaded 86.3 million times. The two published papers (also included in the package as preprint vignettes) have, respectively, 1848 (JSS, 2011) and 324 (TAS, 2018) citations, while the the book (Springer useR!, 2013) has another 641.

This release is incremental as usual, generally preserving existing capabilities faithfully while smoothing our corners and / or extending slightly, sometimes in response to changing and tightened demands from CRAN or R standards. The move towards a more standardized approach for the C API of R leads to a few changes; Kevin did most of the PRs for this. Andrew Johnsom also provided a very nice PR to update internals taking advantage of variadic templates.

The full list below details all changes, their respective PRs and, if applicable, issue tickets. Big thanks from all of us to all contributors!

Changes in Rcpp release version 1.0.13 (2024-07-11)

• Changes in Rcpp API:

  • Set R_NO_REMAP if not already defined (Dirk in #1296)

  • Add variadic templates to be used instead of generated code (Andrew Johnson in #1303)

  • Count variables were switches to size_t to avoid warnings about conversion-narrowing (Dirk in #1307)

  • Rcpp now avoids the usage of the (non-API) DATAPTR function when accessing the contents of Rcpp Vector objects where possible. (Kevin in #1310)

  • Rcpp now emits an R warning on out-of-bounds Vector accesses. This may become an error in a future Rcpp release. (Kevin in #1310)

  • Switch VECTOR_PTR and STRING_PTR to new API-compliant RO variants (Kevin in #1317 fixing #1316)

• Changes in Rcpp Deployment:

  • Small updates to the CI test containers have been made (#1304)

Thanks to my CRANberries, you can also look at a diff to the previous release Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page. Bugs reports are welcome at the GitHub issue tracker as well (where one can also search among open or closed issues).

If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Redirecting all your traffic from HTTP to HTTPS with or without WWW using Drupal can be a complex and frustrating task. Fortunately, there is a relatively simple solution that can help you achieve this in just a few steps.

Resolving merge conflicts is a great advanced part of Composer’s documentation, but we’ve found that it leaves many readers more confused than confident. If there is a composer.lock conflict, all you get is this error message:

Series Overview & ToC | Previous Article | Next Article - coming July 24th --- Our last article explored the syntax and structure of migration files. Today, we are diving deeper into the most important part of a migration: the process pipeline. This determines how source data will be processed and transformed to match the expected destination structure. We will learn how to configure and chain process plugins, how to set subfields and deltas for multi-value fields, and to work with source constants and pseudo-fields. Let’s get started. ## From source to destination The process section in a migration is responsible for transforming data as extracted from the source into a format that the destination expects. The collection of all those data transformations is known as the migration process pipeline. The Migrate API is a generic ETL framework. This means the source data can come from different types of sources like a database table; a CSV, JSON, or XML file; a remote API using JSON:API or GraphQL; or something else. The destination can be as diverse including databases, text files, and remote APIs. Because the series focuses on migrating from Drupal 7 to 10, most of our discussion will revolve...

Read more mauricio Wed, 07/17/2024 - 08:23

In Python, a protocol specifies the methods and attributes that a class must implement to be considered of a given type. Protocols are important in Python’s type hint system, which allows for static type checking through external tools, such as mypy, Pyright, and Pyre.

Before there were protocols, these tools could only check for nominal subtyping based on inheritance. There was no way to check for structural subtyping, which relies on the internal structure of classes. This limitation affected Python’s duck typing system, which allows you to use objects without considering their nominal types. Protocols overcome this limitation, making static duck typing possible.

In this tutorial, you’ll:

• Gain clarity around the use of the term protocol in Python
• Learn how type hints facilitate static type checking
• Learn how protocols allow static duck typing
• Create custom protocols with the Protocol class
• Understand the differences between protocols and abstract base classes

To get the most out of this tutorial, you’ll need to know the basics of object-oriented programming in Python, including concepts such as classes and inheritance. You should also know about type checking and duck typing in Python.

Get Your Code: Click here to download the free sample code that shows you how to leverage structural subtyping with Python protocols

The Meaning of “Protocol” in Python

During Python’s evolution, the term protocol became overloaded with two subtly different meanings. The first meaning refers to internal protocols, such as the iterator, context manager, and descriptor protocols.

These protocols are widely understood in the community and consist of special methods that make up a given protocol. For example, the .__iter__() and .__next__() methods define the iterator protocol.

Python 3.8 introduced a second, slightly different type of protocol. These protocols specify the methods and attributes that a class must implement to be considered of a given type. So, these protocols also have to do with a class’s internal structure.

With this kind of protocol, you can define interchangeable classes as long as they share a common internal structure. This feature allows you to enforce a relationship between types or classes without the burden of inheritance. This relationship is known as structural subtyping or static duck typing.

In this tutorial, you’ll focus on this second meaning of the term protocol. First, you’ll have a look at how Python manages types.

Dynamic and Static Typing in Python

Python is a dynamically typed language, which means that the Python interpreter checks an object’s type when the code runs. It also means that while a variable can only reference one object at a time, the type of that object can change during the variable’s lifetime.

For example, you can have a variable that starts as a string and changes into an integer number:

Python >>> value = "One hundred" >>> value 'One hundred' >>> value = 100 >>> value 100 Copied!

In this example, you have a variable that starts as a string. Later in your code, you change the variable’s value to an integer.

Because of its dynamic nature, Python has embraced a flexible typing system that’s known as duck typing.

Duck Typing

Duck typing is a type system in which an object is considered compatible with a given type if it has all the methods and attributes that the type requires. This typing system supports the ability to use objects of independent and decoupled classes in a specific context as long as they adhere to some common interface.

Note: To dive deeper into duck typing, check out the Duck Typing in Python: Writing Flexible and Decoupled Code tutorial.

As an example of duck typing, you can consider built-in container data types, such as lists, tuples, strings, dictionaries, and sets. All of these data types support iteration:

Python >>> numbers = [1, 2, 3] >>> person = ("Jane", 25, "Python Dev") >>> letters = "abc" >>> ordinals = {"one": "first", "two": "second", "three": "third"} >>> even_digits = {2, 4, 6, 8} >>> containers = [numbers, person, letters, ordinals, even_digits] >>> for container in containers: ... for element in container: ... print(element, end=" ") ... print() ... 1 2 3 Jane 25 Python Dev a b c one two three 8 2 4 6 Copied!

In this code snippet, you define a few variables using different built-in types. Then, you start a for loop over the collections and iterate over each of them to print their elements to the screen. Even though the built-in types are significantly different from one another, they all support iteration.

The duck typing system allows you to create code that can work with different objects, provided that they share a common interface. This system allows you to set relationships between classes that don’t rely on inheritance, which produces flexible and decoupled code.

Read the full article at https://realpython.com/python-protocol/ »

[ Improve Your Python With 🐍 Python Tricks 💌 – Get a short & sweet Python Trick delivered to your inbox every couple of days. >> Click here to learn more and see examples ]

Over the years, when  I am low, I always go to the 2014 Euro Python talk  "Farewell and Welcome Home: Python in Two Genders" by Naomi. It has become the first step of my coping mechanism and the door to my safe house. Though 2024 marked my Euro Python journey in person, I had a long connection and respect for the conference. A conference that believes community matters, human values and feelings matter, and not afraid to walk the talk. And how the conference stood up to my expectations in every bit.

My Talk: Intellectual Property Law 101

I had my talk on Intellectual Property Law, on the first day. After a long time, I was giving a talk on the legal topic. This talk was dedicated to the developers. So, I concentrated on only those issues which concerned the developers. Tried to stitch the concerned topics Patent, Trademarks, and Copyright together. For the smooth flow of the talk, since it becomes easier for the developers to understand and remember for all the practical purposes for future use. I was concerned if I would be able to connect with people. Later, people came to  me with several related questions, starting from

• Why should I be concerned about patents?

• Which license would fit my project?

• Should I be scared about any Trademarks granted to other organizations under some other jurisdiction?

So on and so forth. Though I could not finish the whole talk due to time constraints, I am happy with the overall review.

Panel: Open Source Sustainability

On Day 1 of the main conference, we had the panel on Open Source Sustainability. This topic lies at the core of open-source ecosystem sustainability for the projects and community for the future and stability. The panel had Deb Nicholson, Armin Ronacher Çağıl Uluşahin Sönmez,Deb Nicholson, Samuel Colvin, and me and Artur Czepiel as  the moderator.  I was happy to represent my community&aposs side. It was a good discussion, and hopefully, we could give answers to some questions of the community in general.

Birds of Feather session: Open Source Release Management

This Birds of Feathers (BoF) session is intended to deal with the Release Management of various Open Source projects, irrespective of their size. The discussion includes all projects, from a community-led project to projects maintained/initiated by big enterprises, from a project maintained by one contributor to a project with several hundred contributors.

• What methods do we follow regarding versioning, release cadence, and the process?

• Do most of us follow manual processes or depend on automated ones?

• What works and what does not, and how can we improve our lives?

• What are the significant points that make the difference?

We discussed and covered the following topics: different aspects of release management of Open-Source projects, security, automation, CI usage, and documentation. We followed the Chatham House Rules during the discussion to provide the space for open, frank, and collaborative conversation.

PyLadies Lunch

And then comes my favorite part of the conference: PyLadies Lunch. It was my seventh PyLadies lunch, and I was moderating it for the fifth time. But this time, my wonderful friends [Laís] and Çağıl were by my side, holding me up when I failed. I love every time I am at a PyLadies lunch. This is where I get my strength, energy, and love.

Workshop

I attended two workshops organized by Anezka Muller , Mia Bajić and all amazing PyLadies organizers

• Self-defense workshop where the moderators helped us navigate challenging situations we face in life, safeguard ourselves from them, and overcome them.

• I AM Remarkable workshop, where we learned to tell people about our successes.

Representing Ansible Community

I always take the chance to meet the Ansible community members face-to-face. Euro Python gave me another opportunity to do that. I learned about different user stories that we do not get to hear from our work corners, and I learned about these unique problems and their solutions in Ansible. 
Fun fact : Maarten gave a review after knowing I am Anwesha from the Ansible project. He said, &aposCan you Ansible people slow down in releasing new versions of Ansible? Every time we get used to it, we have a new version.&apos

Acknowledging mental health issues

The proudest moment for me personally was when I acknowledged my mental health issues and later when people came to me saying how they relate to me and how they felt empowered when I mentioned this.

PyLadies network at Red Hat

A network of PyLadies within Red Hat has been my dream since I joined Red Hat. She also agreed when I shared this with Karolina at last year&aposs DevConf. And finally, we initiated on day 2 of the conference. We are so excited for the future to come.

Meeting friends

Conference means friends. It was so great to meet so many friends after such a long time Tylor, Nicholas, Naomi, Honza, Carol, Mike, Artur, Nikita, Valerio and many new ones Jannis Joana,[Chirstian], Martina Tereza , Maria, Alyona, Mia, Naa , Bojanand Jodie. A special note of love to Jodie, you to hold my hand and take me out of the dark.

The best is saved for the last. Euro Python 2024 made 3 of my dreams come true.

• Gender Neutral Washrooms

• Sanitary products in restrooms (I remember carrying sanitary napkins in my bag pack in PyCon India and telling girls if they needed it, it was available in the PyLadies booth).

• Neo-diversity bag (which saved me at the conference; thank you, Karolina, for this)

I cannot wait for the next Euro Python; see you all at Euro Python 2025.

PS: Thanks to Lias, I will always have a small piece of Euro Python 2024 with me. I know I am loved and cared for.

Dear community

I am happy to announce patchset 2.2.1 for MYGNUHealth, the GNU Health Personal Health Record.

This patchset fixes the following issues:

• MyGH crashes when clicking 'Network':  https://codeberg.org/gnuhealth/mygnuhealth/issues/34
• Include icons of type gif on MANIFEST.in : https://codeberg.org/gnuhealth/mygnuhealth/issues/36

You can download MyGNUHealth source code from the official GNU Savannah (https://ftp.gnu.org/gnu/health/mygnuhealth/). You can also install MyGH from the Python Package Index (PyPI) or from your operating system distribution.

Happy hacking
Luis

Lomiri Weather App goes Open Meteo

In Ubuntu Touch / Lomiri, Maciej Sopyło has updated Lomiri's Weather App to operate against a different weather forecast provider (Open Meteo). Additionally, the new implementation is generic and pluggable, so other weather data providers can be added-in later.

Big thanks to Maciej for working on this just in time (the previous implementation's API has recently been EOL'ed and is not available anymore to Ubuntu Touch / Lomiri users).

Lomiri Weather App - new Meteorological Terms part of the App now

While the old weather data provider implementation obtained all the meteorological information as already localized strings from the provider, the new implementation requires all sorts of weather conditions being translated within the Lomiri Weather App itself.

The meteorological terms are probably not easy to translate for the usual software translator, so special help might be required here.

Call for Translations: Lomiri Weather App

So, if you feel entitled to help here, please join the Hosted Weblate service [1] and start working on Lomiri Weather App.

Thanks a lot!

light+love
Mike Gabriel (aka sunweaver)

[1] https://hosted.weblate.org/
[2] https://hosted.weblate.org/projects/lomiri/lomiri-weather-app/

Wouldn't it be cool if we could get around our LocalGov Drupal websites by using keyboard shortcuts?

The Akademy 2024 Program is now available.

This year's Akademy will take place in Würzburg, a beautiful city where you can enjoy interesting and fascinating talks, panels and keynotes. And for those who prefer to participate remotely, Akademy will also be available online.

Akademy officially kicks off with a welcome event on Friday 6 September, followed by a series of talks on Saturday 7 September and Sunday 8 September. From Monday 9 to Thursday 12 September, there will be BoFs (Birds of a Feather), workshops, meetings, daytrip and training sessions.

The talks will cover KDE's goals, how we're doing with implementing other languages to code for KDE (Rust anyone?), what's new in the latest wave of desktop and mobile applications, how KDE Eco is saving the environment, backends, frontends, KDE for work, life and fun.

For example, Nicolas Fella will tell us what a software maintainer does and why they are crucial to a project's survival, Aleix Pol Gonzalez will demystify embedded Linux, and Kevin Ottens will take us deep into the core of KDE Neon. You will also learn more about Plasma Mobile, funding your dream project and cool new KWin effects.

You can expect much, much more from a schedule packed with exciting talks and eye-opening presentations. Just take a look at the full program to discover everything that will be happening.

And that is not all! Stay tuned for the announcement of our two keynote speakers, coming soon here on Planet.

During the week KDE community members will attend BoFs and meet with colleagues with similar interests to work on their projects. They will also attend workshops, meetings, training sessions and daytrip until the event closes on 12 September.

<strong>Topics covered in this episode:</strong><br> <ul> <li><a href="https://pyfound.blogspot.com/2024/07/announcing-2024-psf-board-election.html"><strong>2024 PSF Board Election &amp; Proposed Bylaw Change Results</strong></a></li> <li><strong><a href="https://satyrn.app">SATYRN: A modern Jupyter client for Mac</a></strong></li> <li><a href="https://blog.pypi.org/posts/2024-07-08-incident-report-leaked-admin-personal-access-token/"><strong>Incident Report: Leaked GitHub Personal Access Token</strong></a></li> <li><strong>Extra extra extra</strong></li> <li><strong>Extras</strong></li> <li><strong>Joke</strong></li> </ul><a href='https://www.youtube.com/watch?v=GpZI_HqzCTc' style='font-weight: bold;'data-umami-event="Livestream-Past" data-umami-event-episode="392">Watch on YouTube</a><br> <p><strong>About the show</strong></p> <p>Sponsored by <strong>Code Comments</strong>, an original podcast from RedHat: <a href="https://pythonbytes.fm/code-comments">pythonbytes.fm/code-comments</a></p> <p><strong>Connect with the hosts</strong></p> <ul> <li>Michael: <a href="https://fosstodon.org/@mkennedy"><strong>@mkennedy@fosstodon.org</strong></a></li> <li>Brian: <a href="https://fosstodon.org/@brianokken"><strong>@brianokken@fosstodon.org</strong></a></li> <li>Show: <a href="https://fosstodon.org/@pythonbytes"><strong>@pythonbytes@fosstodon.org</strong></a></li> </ul> <p>Join us on YouTube at <a href="https://pythonbytes.fm/stream/live"><strong>pythonbytes.fm/live</strong></a> to be part of the audience. Usually Tuesdays at 10am PT. Older video versions available there too.</p> <p>Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to <a href="https://pythonbytes.fm/friends-of-the-show">our friends of the show list</a>, we'll never share it. </p> <p><strong>Brian #1:</strong> <a href="https://pyfound.blogspot.com/2024/07/announcing-2024-psf-board-election.html"><strong>2024 PSF Board Election &amp; Proposed Bylaw Change Results</strong></a></p> <ul> <li>New board members <ul> <li>Tania Allard</li> <li>KwonHan Bae</li> <li>Cristián Maureira-Fredes</li> </ul></li> <li>Congrats to new board members</li> <li>If you want to consider becoming a board member, there are 4 seats up for vote next year.</li> <li>All 3 bylaw changes passed, <a href="https://opavote.com/results/5004101476679680/1">by a wide margin</a>. <ul> <li><a href="https://pyfound.blogspot.com/2024/06/for-your-consideration-proposed-bylaws.html">Details of changes</a></li> <li>Change 1: Merging Contributing and Managing member classes</li> <li>Change 2: Simplifying the voter affirmation process by treating past voting activity as intent to continue voting</li> <li>Change 3: Allow for removal of Fellows by a Board vote in response to Code of Conduct violations, removing the need for a vote of the membership</li> </ul></li> </ul> <p><strong>Michael #2:</strong> <a href="https://satyrn.app">SATYRN: A modern Jupyter client for Mac</a></p> <ul> <li>A Jupyter client app for macOS</li> <li>Comes with a command palette</li> <li>LLM assistance (local or cloud?)</li> <li>Built in Black formatter</li> <li>Currently in alpha</li> <li>Business model unknown</li> </ul> <p><strong>Brian #3:</strong> <a href="https://blog.pypi.org/posts/2024-07-08-incident-report-leaked-admin-personal-access-token/"><strong>Incident Report: Leaked GitHub Personal Access Token</strong></a></p> <ul> <li>Suggested by Galen Swint</li> <li>See also JFrog blog: <a href="https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/">Binary secret scanning helped us prevent</a><a href="https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/"> </a><a href="https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/">(what</a><a href="https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-binary-preventing-suppy-chain-attack/"> might have been) the worst supply chain attack you can imagine</a></li> <li>A GitHub access token found it’s way into a .pyc file, then into a docker image.</li> <li>JFrog found it through some regular scans.</li> <li>JFrog notified PYPI security.</li> <li>Token was destroyed within 17 minutes. (nice turnaround)</li> <li>Followup scan revealed that no harm was done.</li> <li>Takaways (from Ee Durbin): <ul> <li>Set aggressive expiration dates for API tokens (If you need them at all)</li> <li>Treat .pyc files as if they were source code</li> <li>Perform builds on automated systems from clean source only.</li> </ul></li> </ul> <p><strong>Michael #4:</strong> <strong>Extra extra extra</strong></p> <ul> <li><a href="https://blog.python.org/2024/06/python-3130-beta-3-released.html">Python 3.13.0 beta 3 released</a></li> <li><a href="https://github.com/jordanbaird/Ice/releases">Ice got a lot better</a></li> <li><a href="https://www.youtube.com/watch?v=k0XuoK132z4">I Will Piledrive You If You Say AI Again | Prime Reacts Video</a></li> <li><a href="https://fosstodon.org/@mkennedy/112797279807472603">Follow up actions for polyfill supply chain attack</a></li> <li><a href="https://surveys.jetbrains.com/s3/p-developer-ecosystem-survey-2024?utm_source=pythonbytes">Developer Ecosystem Survey 2024</a></li> <li><a href="https://talkpython.fm/castle">Code in a Castle still has seats open</a></li> </ul> <p><strong>Extras</strong> </p> <p>Brian: </p> <ul> <li>A new pytest course in the works <ul> <li>Quick course focusing on <ul> <li>core pytest features + some strategy and Design for Testability concepts</li> </ul></li> <li>Idea <ul> <li>everyone on the team (including managers) can take the new course.</li> <li>1-2 people on a team take “The Complete pytest Course” to become the teams local pytest experts.</li> </ul></li> </ul></li> <li>Python People is on an indefinite hold </li> <li>Python Test → back to Test &amp; Code (probably) <ul> <li>I’m planning a series (maybe a season) on TDD which will be language agnostic.</li> <li>Plus I still have tons of Test &amp; Code stickers and no Python Test stickers.</li> <li>New episodes planned for August</li> </ul></li> </ul> <p><strong>Joke:</strong> <a href="https://devhumor.com/media/i-need-my-intellisense">I need my intellisense</a><a href="https://devhumor.com/media/i-need-my-intellisense"> </a><a href="https://devhumor.com/media/i-need-my-intellisense">(autocomplete)</a></p>

After the VoLTE saga [1] and the problems with battery life on the PinePhonePro [2] (which lasted 4 hours while idle with the screen off in my last test a few weeks ago) I’m running a Galaxy Note 9 [3] with the default Samsung OS as my daily driver.

I don’t think that many people will be rushing out to buy a 2018 phone regardless of my review. For someone who wants a phone of such age (which has decent hardware and a low price) then good options are the Pixel phones which are all supported by LineageOS.

I recommend not buying this phone due to the fact that it doesn’t have support for VoLTE with LineageOS (and presumably any other non-Samsung Android build) and doesn’t have support from any other OS. The One Plus 6/6T has Mobian support [4] as well as LineageOS support and is worth considering.

The Note 9 still has capable hardware by today’s standards. A 6.4″ display is about as big as most people want in their pocket and 2960×1440 resolution in that size (516dpi) is probably as high as most people can see without a magnifying glass. The model I’m using has 8G of RAM which is as much as the laptop I was using at the start of this year. I don’t think that many people will have things that they actually want to do on a phone which needs more hardware than this. The only hardware feature in new phones which beats this is the large folding screen in some recent phones, but $2500+ (the price of such phones in Australia) is too much IMHO and the second hand market for folding phones is poor due to the apparently high incidence of screens breaking.

The Note 9 has the “Dex” environment for running as a laptop if you connect it to a USB-C dock. It can run nicely with a 4K monitor with USB keyboard and mouse. The UI is very similar to that of older versions of Windows.

The Samsung version of Android seems mostly less useful than the stock Google version or the LineageOS version. The Samsung keyboard flags words such as “gay” as spelling errors and it can’t be uninstalled even when you install a better keyboard app. There is a “Bixby” button on the side of the phone to launch the Bixby voice recognition app which can’t be mapped to any useful purpose, The Google keyboard has a voice dictation option which I will try out some time but that’s all I desire in terms of voice recognition. There are alerts about Samsung special deals and configuration options including something about signing in to some service and having it donate money to charity, I doubt that any users want such features. Apart from Dex the Samsung Android build is a good advert for LineageOS.

The screen has curved sides for no good reason. This makes it more difficult to make a protective phone case as a case can’t extend beyond the screen at the sides and therefore if it’s dropped and hits an edge (step, table, etc) then the glass can make direct contact with something. Also the curved sides reflect sunlight in all directions, this means that the user has to go to more effort to avoid reflecting the sun into their eyes and that a passenger can more easily reflect sunlight into the eyes of a car driver. It’s an impressive engineering feat to make a curved touch-screen but it doesn’t do any good for users.

The stylus is good as always and the screen is AMOLED so it doesn’t waste much power when in dark mode. There is a configuration option to display a clock all the time when the screen is locked because that apparently doesn’t use much power. I haven’t felt inclined to enable the always on screen but it’s a nice feature for those who like such things.

The VoLTE implementation is apparently a bit unusual so it’s not supported by LineageOS and didn’t work on Droidian for the small amount of time that Droidian supported it.

Generally this phone is quite nice hardware it’s just a pity that it demonstrates all of the downsides to buying a non-Pixel phone.

• [1] https://etbe.coker.com.au/2024/07/01/volte-australia/
• [2] https://etbe.coker.com.au/2023/10/11/pinephone-status/
• [3] https://en.wikipedia.org/wiki/Samsung_Galaxy_Note_9
• [4] https://wiki.debian.org/InstallingDebianOn/OnePlus/OnePlus6

Related posts:

1. Samsung Galaxy Note 2 A few weeks ago I bought a new Samsung Galaxy...
2. Samsung Galaxy Note 3 In June last year I bought a Samsung Galaxy Note...
3. Samsung Galaxy Note 10.1 2014 In May 2014 I bought a Samsung Galaxy Note 10.1...

Drupal Starshot seeks track leads to drive key project components. Apply by July 31st and help bring Drupal Starshot to life!

The Drupal Starshot initiative has been making significant progress behind the scenes, and I'm excited to share some updates with the community.

Leadership team formation and product definition

Over the past few months, we've been working diligently on Drupal Starshot. One of our first steps was to appoint a leadership team to guide the project. With the leadership team in place as well as the new Starshot Advisory Council, we shifted our focus to defining the product. We've made substantial progress on this front and will be sharing more details about the product strategy in the coming weeks.

Introducing Drupal Starshot tracks

We already started to break down the initiative into manageable components, and are introducing the concept of "tracks". Tracks are smaller, focused parts of the Drupal Starshot project that allow for targeted development and contributions. We've already published the first set of tracks on the Drupal Starshot issue queue on Drupal.org.

Example tracks include:

1. Creating Drupal Recipes for features like contact forms, advanced search, events, SEO and more.
2. Enhancing the Drupal installer to enable Recipes during installation.
3. Updating Drupal.org for Starshot, including product marketing and a trial experience.

While many tracks are technical and need help from developers, most of the tracks need contribution from designers, UX experts, marketers, testers and site builders.

Recruiting more track leads

Several tracks already have track leads and have made significant progress:

• Matt Glaman is spearheading the development of a trial experience.
• The marketing team, led by Suzanne Dergacheva, is crafting product marketing documentation.
• Martin Anderson-Clutz has been appointed as the track lead for event management.

However, we need many additional track leads to drive our remaining tracks to completion.

We're now accepting applications for track lead positions. Interested individuals and organizations can apply by completing our application form. The application window closes on July 31st, two weeks from today.

Key responsibilities of a track lead

Track leads can be individuals, teams, or organizations, including Drupal Certified Partners. While technical expertise is beneficial, the role primarily focuses on strategic coordination and project management. Key responsibilities include:

• Defining and validating requirements to ensure the track meets the expectations of our target audience.
• Developing and maintaining a prioritized task list, including creating milestones and timelines.
• Overseeing and driving the track's implementation.
• Collaborating with key stakeholders, including the Drupal Starshot leadership team, module maintainers, the marketing team, etc.
• Communicating progress to the community (e.g. blogging).

Track lead selection and announcement

After the application deadline, the Drupal Starshot Leadership Team will review the applications and appoint track leads. We expect to announce the selected track leads in the first week of August.

While the application period is open, we will be available to answer any questions you may have. Feel free to reach out to us through the Drupal.org issue queue, or join us in an upcoming zoom meeting (details to be announced / figured out).

Looking ahead to DrupalCon Barcelona

Our goal is to make significant progress on these tracks by DrupalCon Barcelona, where we plan to showcase the advancements we've made. We're excited about the momentum building around Drupal Starshot and can't wait to see the contributions from the community.

If you're passionate about Drupal and want to play a key role in shaping its future, consider applying for a track lead position.

Stay tuned for more updates on Drupal Starshot, and thank you for your continued support of the Drupal community.

— Dries Buytaert

Join us THURSDAY, July 18 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.) We'll be taking August off, so this is the last chat of the summer.

We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits.  Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google doc: https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone. 

• Join the call: https://us02web.zoom.us/j/81817469653

  • Meeting ID: 818 1746 9653
    Passcode: 551681

  • One tap mobile:
    +16699006833,,81817469653# US (San Jose)
    +13462487799,,81817469653# US (Houston)

  • Dial by your location:
    +1 669 900 6833 US (San Jose)
    +1 346 248 7799 US (Houston)
    +1 253 215 8782 US (Tacoma)
    +1 929 205 6099 US (New York)
    +1 301 715 8592 US (Washington DC)
    +1 312 626 6799 US (Chicago)

  • Find your local number: https://us02web.zoom.us/u/kpV1o65N

• Follow along on Google Docs: https://nten.org/drupal/notes

View notes of previous months' calls.

#638 – JULY 16, 2024
View in Browser »

Customize VS Code Settings

In this course, Philipp helps you customize your Visual Studio Code settings to switch from a basic cluttered look to a clean presentable look. This is not just pleasant on the eyes, but also gives you a nice user interface if you want to share on a Zoom call or screen recording.
REAL PYTHON course

Incident Report: Leaked GitHub Personal Access Token

A PyPI admin accidentally leaked credentials into a Docker container. It has since been fixed and the credentials revoked. This is the report by that same admin outlining what happened and how to help prevent similar mistakes in the future.
EE DURBIN

GPU Accelerate Your Data Science Workflows End-to-End

Discover how to create, accelerate, and deploy data pipelines with RAPIDS for GPU-accelerated data science workflows. Take one of our Data Science courses for free when you join the NVIDIA Developer Program →
NVIDIA sponsor

Free-Threaded CPython Is Ready to Experiment With!

An overview of the ongoing efforts to improve and roll out support for free-threaded CPython throughout the Python open source ecosystem. Associated Hacker News discussion.
RALF GOMMERS

PSF Announces Infrastructure Engineer

PYTHON SOFTWARE FOUNDATION

DjangoCon US 2024 Announces Talks

DJANGOCON

Django Security Releases Issued: 5.0.7 and 4.2.14

DJANGO SOFTWARE FOUNDATION

Register for Kiwi PyCon, Aug 23-25

KIWIPYCON.NZ • Shared by Kiwi PyCon

Quiz: Split Datasets With scikit-learn.train_test_split()

REAL PYTHON

Python Jobs Python Tutorial Writer (Anywhere)

Real Python

Python Video Course Instructor (Anywhere)

Real Python

More Python Jobs >>>

Articles & Tutorials Free, Unbelievably Stupid Wi-Fi on Long-Haul Flights

Deep in a need to procrastinate on a flight between London and San Francisco, Robert discovered that changing his name on an airline’s frequent flyer account was free over the plane’s WiFi. What’s a developer to do? Work on their tickets? No, create an entire TCP/IP protocol using this loophole. The result is the PySkyWiFi package.
ROBERT HEATON

Digging Into Graph Theory in Python With David Amos

Have you wondered about graph theory and how to start exploring it in Python? What resources and Python libraries can you use to experiment and learn more? This week on the show, former co-host David Amos returns to talk about what he’s been up to and share his knowledge about graph theory in Python.
REAL PYTHON

My Programming Beliefs as of July 2024

This collection of thoughts outlines how Evan approaches coding, with the understanding that this might change in the future. His beliefs include using spikes, the difference between simple and easy, a preference for enums over booleans, and more.
EVAN HAHN

Breaking Out of Nested Loops With Generators

Have you ever had the situation where you’ve got a nested loop and need to break out of the outer one? One way of dealing with this problem is refactoring the loop to use a generator. This post shows you how.
RODRIGO GIRÃO SERRÃO

“Extracting Wisdom” From Conference Videos

There are so many conferences and so many videos, you can’t possibly watch them all. This post shows you how to extract information to summarize a talk so you can quickly decide what you want to watch.
GONÇALO VALÉRIO

Creating a Simple Pastebin Service in Python and Flask

Learn how to build a functional pastebin service using Python and Flask. This tutorial covers web development basics, file handling, and syntax highlighting.
MUHAMMAD RAZA

How a Decorator Crashed My Flask App

This blog post shows how failing to use functools.wraps can cause issues with FlaskAPI. Learn why you should always use wraps and what went wrong.
SUYOG DAHAL

Python Has Too Many Package Managers

Overview of Python’s Package management ecosystem in 2024 and associated Hacker News Discussion
LARRY DU

Creating Images in Your Terminal With Python and Rich Pixels

Rich Pixels, a package from one of the folks at Textual, allows you to create images in your terminal and display them.
MIKE DRISCOLL

How Do You Choose Python Function Names?

This tutorial discusses the rules and conventions for choosing Python function names and why they’re important.
REAL PYTHON

Using HTMX With FastAPI

This tutorial looks at how use HTMX with FastAPI by creating a simple todo web app and deploying it on Render.
PAUL ESCH-LAURENT • Shared by Michael Herman

Projects & Code ViperIDE: MicroPython IDE for Web and Mobile

GITHUB.COM/VSHYMANSKYY

ML System Design: 450 Case Studies to Learn From

EVIDENTLYAI.COM • Shared by Daria Maliugina

reladiff: High-Perf Diffing of Large Datasets Across Databases

GITHUB.COM/EREZSH

Yen: The Last Python Environment Manager You’ll Ever Need

GITHUB.COM/TUSHARSADHWANI • Shared by Tushar Sadhwani

Events Weekly Real Python Office Hours Q&A (Virtual)

July 17, 2024
REALPYTHON.COM

PyData Bristol Meetup

July 18, 2024
MEETUP.COM

PyLadies Dublin

July 18, 2024
PYLADIES.COM

Chattanooga Python User Group

July 19 to July 20, 2024
MEETUP.COM

PyKla Monthly Meetup

July 24, 2024
MEETUP.COM

PyLadies Amsterdam

July 24, 2024
MEETUP.COM

PyOhio 2024

July 27 to July 28, 2024
PYOHIO.ORG

Happy Pythoning!
This was PyCoder’s Weekly Issue #638.
View in Browser »

[ Subscribe to 🐍 PyCoder’s Weekly 💌 – Get the best Python news, articles, and tutorials delivered to your inbox once a week >> Click here to learn more ]

On the occasion of the Point Zero Forum's Innovation Tour, Evgeny Grin has interviewed Özgur Kesim who designed and implemented an age restricition mechanism inside the GNU Taler coins.