Helping Securing the Python with Mike Fiedler

On this Screaming in the Cloud In this episode of Screaming in the Cloud, Corey Quinn is joined by AWS container hero and security engineer at the Python Software Foundation, Mike Fiedler. They delve into the intricacies of Python's ecosystem, discussing the evolution of PyPI, its significance, and the ongoing battles against security threats like account takeover attacks and typo-squatting. Mike sheds light on his role in maintaining the security and reliability of the Python Package Index, the importance of 2FA, and the collaborative efforts with security researchers. Corey and Mike also explore the challenges and philosophies surrounding legacy systems versus greenfield development, with insights on maintaining critical infrastructure and the often-overlooked aspects of social engineering. Show Highlights (0:00) Introduction (0:47) The Duckbill Group sponsor read (1:21) Breaking down the Python nomenclature and its usability (5:49) Figuring out how Boto3 is one of the most downloaded packages (6:43) Why Mike is the only full-time security and safety engineer at the Python Software Foundation (9:53) How the Python Software Foundation affords to operate (14:17) Mike's stack security work (16:14) The Duckbill Group sponsor read (16:57) Having the "impossible job" of stopping supply chain attacks (21:00) The dangers of social engineering attacks (24:44) Why Mike prefers to work on legacy systems (33:30) Where you can find more from Mike About Mike Fiedler Mike Fiedler is a highly analytical, forward-thinking Information Technology professional. His broad-based background includes systems administration and engineering in global environments. Mike is technically astute and versatile with ability to quickly learn, master, and leverage new technologies to meet business needs and has a track record of success in improving performance, stability, and security for all infrastructure and product initiatives. Mike is also bilingual, speaks English and Hebrew, and he loves solving puzzling problems. LinksMike’s Mastadon: https://hachyderm.io/@mikethemanMike’s Bluesky: https://bsky.app/profile/miketheman.comMike’s Python Software Foundation blog posts: https://blog.pypi.org/The Python Package Index Safety & Security Engineer: First Year in Review: https://blog.pypi.org/posts/2024-08-16-safety-and-security-engineer-year-in-review/ Sponsor The Duckbill Group: duckbillgroup.com