The Curious Engineer

All blogs / Python

Seth Larson

sethmlarson.dev

Python, open source, and the internet

PythonSecurityGaming

’05’10’15’20’25
Posts
199 from 14 Apr 2001 to 29 Oct 2026
Posting
weekly (54 in the last year)
Kind
personal blog
Feed
https://sethmlarson.dev/feed

2026 40

  1. Bowser’s Fury outshines Sunshine, SA2B, and Billy Hatcher
  2. Documenting certificate distribution pain points for the Python ecosystem
  3. Gaming’s all-digital future doesn’t include “Sonic the Hedgehog 3” and “Pikmin 2”
  4. Blogging for the Python Language Summit
  5. Buying GameCube games from other regions
  6. When str.lower() is a security vulnerability in Python
  7. Let’s Play “htmx 4: the game”
  8. Extracting “Ocarina of Time: Master Quest” ROM from the Legend of Zelda: Wind Waker bonus disc
  9. recently purchased from Kraków, Poland
  10. EuroPython 2026: Learning from the “not-so-secret” Python security cabal
  11. Playing the “Second Quest” of Legend of Zelda: Four Swords Adventures
  12. Mario Kart World and “seamless” media
  13. United Nations Open Source Week 2026
  14. TIL “@here” only notifies online users on Discord and Slack
  15. Linting is important for code review: screen included
  16. Are insecure code completions a vulnerability?
  17. Is the Super Smash Bros. Brawl donut from Mister Donut?
  18. How much “Super Mario” per year?
  19. Using Epilogue Retrace app with iPhone 13 Pro and Ubuntu
  20. Library dependency version specifiers aren't for fixing vulnerabilities
  21. The Frog for Whom the Bell Tolls
  22. pip v26.1 adds support for relative dependency cooldowns
  23. More thoughts on Nintendo Switch 2 storage prices
  24. LAN Party Calculator (Mario Kart, Kirby Air Riders, F-Zero)
  25. Delta emulator
  26. Python library “Requests” needs you to test type hints
  27. I’ve added human.json to my website
  28. published a blog post
  29. finished Link’s Awakening
  30. Deprecate confusing APIs like “os.path.commonprefix()”
  31. Respecting maintainer time should be in security policies
  32. Automated public shaming of open source maintainers
  33. Cooler Analytics
  34. Dumping Nintendo e‑Reader Card “ROMs”
  35. Use “\A...\z”, not “^...$” with Python regular expressions
  36. mGBA → Dolphin not working? You need a GBA BIOS
  37. “urllib3 in 2025” available on Illia Volochii’s new blog
  38. hours staring at sprite-sheets
  39. New ROM dumping tool for SNES & Super Famicom from Epilogue
  40. Cutting spritesheets like cookies with Python & Pillow 🍪

2025 56

  1. Nintendo GameCube and Switch “Wrapped” 2025 🎮🎁
  2. Getting started with Playdate on Ubuntu 🟨
  3. SMS BCC tool
  4. PEP 770 Software Bill-of-Materials (SBOM) data from PyPI, Fedora, and Red Hat
  5. Delta emulator adds support for SEGA Genesis games
  6. Nintendo Switch, Switch 2
  7. Deprecations via warnings don’t work for Python libraries
  8. One weird trick for cheaper physical Switch 2 games?
  9. WebKit browsers see telephone numbers everywhere
  10. BrotliCFFI has two new maintainers
  11. Blogrolls are the Best(rolls)
  12. Ice Pikmin and difficulty of Pikmin Bloom event decor sets
  13. GameCube Nintendo Classics and storage size
  14. RSS feed for new Nintendo Classics games
  15. Easily create co-authored commits with GitHub handles
  16. Drawing an ASCII TIE fighter for post-quantum cryptography
  17. Re(blog, tweet, toot, skoot, skeеt, post)
  18. Is the "Nintendo Classics" collection a good value?
  19. Winning a bet about “six”, the Python 2 compatibility shim
  20. GZipped files and streams may contain names
  21. SCREAM CIPHER (“ǠĂȦẶAẦ ĂǍÄẴẶȦ”)
  22. Infinite Precision CVSS Calculator
  23. Extracting NES & N64 ROMs from Zelda Collector's Edition
  24. Draft SMS and iMessage from any computer keyboard
  25. The vulnerability might be in the proof-of-concept
  26. SMS URLs
  27. Extracting genesis and game gear roms from sega gamecube collections
  28. How many RSS subscribers do I have?
  29. What first-party GameCube titles are available on Nintendo Switch Online?
  30. Transferring “UTF8.XYZ”
  31. Extracting nes and famicom roms from animal crossing
  32. $200 USD in July 2025
  33. Email has algorithmic curation, too
  34. Nintendo GameCube
  35. Open Source Security work isn't “Special”
  36. Hand-drawn QR codes
  37. UN Open Source Week 2025: Security for the Long-Haul
  38. Pikmin 2 International Treasure Hoard
  39. Volunteer Responsibility Amnesty Day (Spring 2025)
  40. Animal CrosSCII
  41. Voicemail for notifications
  42. whichprovides: an abstraction of "yum provides"
  43. Better boosting on Mastodon with smart clients
  44. Quick Mastodon toot templates for event hashtags
  45. Everything Security at PyCon US 2025 🐍🛡️
  46. Nintendo Switch 2: DRM, expensive, and GameCube
  47. Don't bring slop to a slop fight
  48. I fear for the unauthenticated web
  49. #FediDonutFriday
  50. Post Malone Oreos
  51. Your GitHub Copilot access has been renewed 🤡
  52. Building software for connection (#2: Consensus)
  53. Building software for connection (#1: Local-First)
  54. Significant whitespace
  55. How to disable Copilot in GitHub?
  56. Quickly visualizing an SBOM document

2024 35

  1. New experimental Debian package for Cosign (Sigstore)
  2. slop vulnerability reports
  3. How do I pay the publisher of a web page?
  4. Visualizing the Python package SBOM data flow
  5. SEGA Genesis & Mega Drive games and ROMs from Steam
  6. Early promising results with SBOMs and Python packages
  7. Writing a blog on the internet
  8. Python and Sigstore
  9. EuroPython 2024 talks about security
  10. PyCon Taiwan 2024 Keynote
  11. 2024 Minnesota State Fair foods
  12. YouTube without YouTube Shorts
  13. Lockdown Mode for Apple devices
  14. CPython vulnerability data infrastructure (CVE and OSV)
  15. PyCon US 2024 as Security Developer-in-Residence
  16. Bringing supply chain security to PyCon US 2024
  17. Backup Game Boy ROMs and saves on Ubuntu
  18. Isolating risk in the CPython release process
  19. Open Source Summit North America 2024
  20. Microsoft supports urllib3 with FOSS Fund 2024
  21. CPython release automation, more Windows SBOMs
  22. Security Developer-in-Residence Weekly Report #32
  23. I blogged about this behavior
  24. Regex character “$” doesn't mean “end-of-string”
  25. Security Developer-in-Residence Weekly Report #31
  26. Windows SBOM work and Alpha-Omega 2023 annual report
  27. Websites without servers or networking
  28. Challenges while building SBOM infrastructure for CPython
  29. CPython 3.12.2 is SBOM-ified!
  30. Security Developer-in-Residence Weekly Report #27
  31. Releases on the Python Package Index are never “done”
  32. Removing maintainers from open source projects
  33. Defending against the PyTorch supply chain attack PoC
  34. urllib3 is fundraising for HTTP/2 support
  35. Security Developer-in-Residence Weekly Report #24

2023 35

  1. 2023 year in review
  2. Security Developer-in-Residence Weekly Report #23
  3. AI and Wonder
  4. Security Developer-in-Residence Weekly Report #22
  5. Mahjong tiles and Unicode variation selectors
  6. Python listed as memory-safe language in latest CISA recommendations
  7. Review of the Security Developer-in-Residence role in 2023
  8. Proposal for Software Bill-of-Materials for CPython
  9. Querying every file in every release on the Python Package Index
  10. OSS Security RFI, Guide to become a CNA, and PEP 639
  11. “For You” is not for me
  12. Patching the libwebp vulnerability across the Python ecosystem
  13. Quarterly report for Q3 2023 on the PSF Blog
  14. Reproducible builds for CPython source tarballs
  15. Python 3.12.0 from a supply chain security perspective
  16. Starting on Software Bill-of-Materials (SBOM) for CPython
  17. CPython vulnerabilities are now published to the Open Source Vulnerability Database
  18. Security Developer in Residence Weekly Report #10
  19. Visualizing the CPython Release Process
  20. Python Security Response Team handling of CVE-2023-40217
  21. Reconciling elegance and secure-by-design in APIs
  22. Security Developer-in-Residence – Weekly Report #7
  23. Security Developer-in-Residence – Weekly Report #6
  24. Quirks of Python package versioning
  25. Security Developer-in-Residence – Weekly Report #5
  26. Security Developer-in-Residence – Weekly Report #4
  27. Security Developer-in-Residence – Weekly Report #3
  28. Security Developer-in-Residence – Weekly Report #2
  29. Security Developer-in-Residence – Weekly Report #1
  30. I am the first PSF Security Developer-in-Residence
  31. urllib3 v2.0.0 is now generally available
  32. Google Assured OSS
  33. Python and SLSA 💃
  34. Testing multiple Python versions with nox and pyenv
  35. urllib3 in 2022

2022 12

  1. Working on urllib3 full-time for one week
  2. Ubuntu 22.10 on Dell XPS 15 9520
  3. Switching git back to GPG signing
  4. Preparing for the wave of open source funding
  5. Help us test system trust stores in Python
  6. Get paid to contribute to urllib3 (Newsletter #7)
  7. People in your software supply chain
  8. Security for package maintainers
  9. Move or recover your Wordle statistics
  10. How does UTF-8 turn “😂” into “F09F9882”?
  11. Strict Python function parameters
  12. Problems with testing Python pre-releases and pip caching

2021 7

  1. urllib3 raised $15,000 in 2021 (Newsletter #6)
  2. Experimental APIs in Python 3.10 and the future of trust stores
  3. Tests aren’t enough: Case study after adding type hints to urllib3
  4. The problem with Flask async views and async globals
  5. Everything to know about Requests v2.26.0
  6. urllib3 Newsletter #5
  7. urllib3 Newsletter #4

2020 8

  1. urllib3 Newsletter #3
  2. urllib3 Newsletter #2
  3. urllib3 Newsletter #1
  4. API Design for Optional Async Context Managed Resources
  5. TIL: Getting HTTP Status Codes from Flask errorhandler
  6. Designing Libraries for Async and Sync I/O
  7. Why URLs are Hard: Path Params & urlparse
  8. urllib3 in 2020

2019 4

  1. Review of 2019 for urllib3
  2. HTTP Header Compression
  3. Designing for Real-World HTTPS
  4. Sponsored Work on urllib3

2001 1

  1. Add Animal Crossing events to your digital calendar

Undated 1

  1. Blogroll