Topics covered in this episode: justpath xz back door LPython dramatic Extras Joke Watch on YouTube About the show Sponsored by ScoutAPM: pythonbytes.fm/scout Connect with the hosts Michael: @mkennedy@fosstodon.org Brian: @brianokken@fosstodon.org Show: @pythonbytes@fosstodon.org Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesdays at 11am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Michael #1: justpath Inspect and refine PATH environment variable on both Windows and Linux. Raw, count, duplicates, invalids, corrections, excellent stuff. Check out the video Brian #2: xz back door In case you kinda heard about this, but not really. Very short version: A Microsoft engineer noticed a performance problem with ssh and tracked it to a particular version update of xz. Further investigations found a multi-year installation of a fairly complex back door into the xz by a new-ish contributor. But still contributing over several years. First commit in early 2022. The problem is caught. But if it had succeeded, it would have been bad. Part of the issue of how this happened is due to having one primary maintainer on a very widely used tool included in tons-o-Linux distributions. Some useful articles Everything I Know About the XZ Backdoor - Evan Boehs - recommended read Don’t think your affected? Think again if you use homebrew, for example: Update and upgrade Homebrew and xz versions Notes Open source maintenance burnout is real Lots of open source projects are maintained by unpaid individuals for long periods of time. Multi-year sneakiness and social bullying is pretty hard to defend against. Handing off projects to another primary maintainer has to be doable. But now I think we need better tools to vet contributors. Maybe? Or would that just suppress contributions? One option to help with burnout: JGMM, Just Give Maintainers Money: