bitprophet.org

Updates for 2026

Jeff Forcier — Sat, 09 May 2026 15:02:50 -0400

New “time since last post” high score! At this rate I’ll end up blogging once a decade 😰 Some quick updates today, including a moderately sized Paramiko announcement.

Paramiko 5, now with fewer features!

Getting this out of the way early: Paramiko 5.0 is out now! - but most of the updates are actually removals instead of additions. Specifically, removing a lot of old, insecure algorithms and related functionality, and areas of the codebase that were significant support burdens with low upsides.

No more SHA1 anywhere; no more use of MD5 anywhere; no more GSSAPI (until somebody contributes a SHA256-compatible rework, anyways); no more demos/; and more besides.

Naturally, there are still some non-removal improvements, including but not limited to: ability to select OpenSSH vs PEM format when writing out new private key files; the newish PKey.from_type_string() meta-constructor now forwards the password kwarg for encrypted private keys; inconsistencies in other key constructors’ kwargs were fixed; an Ed25519Key introspection bug was fixed; etc!

OK, but why?!

I’m burying the lede a bit - we got audited! 🎉 No, not the tax kind, the security kind. The fine folks at OSTIF brought me (and to a degree, my compatriots over at Cryptography.io) and security firm Quarkslab together to have the codebase (and CI, and tooling, and everything else) audited for security issues.

Their findings included some long-standing issues (we’ve always been quite slow at dropping old algorithms…), as well as quite a few unknown problems. In addition to reporting the findings, they recommended fixes and helped workshop my commits as I went.

We remediated all the high priority findings and many of the lower priority ones, resulting in Paramiko 5.0! Working with both groups was a pleasure and I’m super grateful for their input and expertise (and their patience).

You can find OSTIF’s blog post here: https://ostif.org/paramiko-audit-complete/ and Quarkslab’s here: https://blog.quarkslab.com/paramiko-security-audit.html

And I’ll repeat our own changelog link, for good measure: https://www.paramiko.org/changelog.html#5.0.0 - as always, I tried to include rationales for removals, and clearly marked backwards incompatibilities. Those of you who weren’t relying on these outdated algorithms will likely notice very few required changes on your end.

You said “updates”, plural - what else?

Nothing quite as exciting, just some life updates:

Title change

I’m now a fulltime devops engineer again, and without switching companies! I missed hacking on systems/tooling related things all day instead of only once in a while. (I didn’t miss the increased level of interrupts, but, that comes with the territory - and I now have two other dedicated teammates to share the load.)

We’re still hiring non-devops product engineers (as well as looking for a good devops manager/leader): https://www.reach.security/careers - tell ’em I sent you. (Make sure to include my last name, so you don’t confuse our recruiter, whose name is also Jeff!)

PyCon US 2026

I will be attending PyCon US 2026 in Long Beach, CA from May 13-19. Drop me a line if you want to say hi! This will be my first time visiting SoCal (unless you count driving the long way around during my move to the Bay Area in 2011…) so it’ll be interesting.

It’s also my first time flying since the COVID pandemic started 😬 hoping the currently low transmission levels and my trusty N95s keep me safe! Also very excited that SoCal being SoCal means lots of outdoor dining opportunities…

Why do I always feel compelled to stick an outro on these things?

Great question! Please tell me if you figure it out. As always, thanks for reading! Exclamation point!

Departures and arrivals

Jeff Forcier — Tue, 14 May 2024 11:43:13 -0400

Hello! Apologies for the radio silence. It’s been a strange, uh (sweats, checks date of previous blog post) 14 months! I have updates regarding my employment status and OSS releases. Plus! Extremely mediocre section-title wordplay.

People? In rooms together?! In THIS pandemic?!?!

Quick note: I’ll be attending PyCon US in Pittsburgh, my first time doing anything in large non-family-related groups since 2019. Shoot me a Mastodon DM or an email if you’d like to say a masked hello.

Jumping-off point

As seen on my resumé and in the last blog post I wrote on this topic, I spent the tail end of last decade and first third of this one, working for an international fintech firm, Jump Trading. In addition to being oncall and various devops wrangling, I was generously given a day a week to support internal/external use of my OSS projects.

This led to a number of important upgrades and experimental APIs for my bigger codebases, and helped keep the lights on despite problems with burnout.

Unfortunately, as you already know, ~~computers~~ the economic underpinnings of the last decade shifted recently – resulting in previously-generous financial arrangements (and pandemic-era remote work affordances) evaporating due to becoming “ZIRPs”¹. My position at Jump turned out to be one of these, and I became unemployed in September 2023.

A generous severance meant I didn’t have to worry about job hunting immediately, and the nature of the split did not improve my already-poor mental health – so I took the opportunity to disengage and refill the ol’ HP meter a little.

Can you be an absentee landlord if almost nobody pays rent?

Said disengagement included my open source, for which, I apologize. A little, anyways; many words have been spilled about how us maintainers don’t actually owe the users anything, and there is truth to that. My activity also wasn’t zero - eg I spent a while updating Paramiko to address a recent CVE you may have heard of.

But I ought to have made my status clearer than random self-pitying subtoots on Mastodon. Hopefully there’s no repeat of this particular situation, but if there is, I’ll try to do better.

I did, also, intend to re-engage with the OSS eventually, starting around now and lasting through fall: the severance kept me in groceries and mortgage for a ~year, so my plan for the middle half of 2024 was a combo of job hunting and OSS hacking.

But then! Stuff happened!

Reach for the stars security

Specifically, I was alerted a few months ago to an Employment Opportunity™ from a Python community buddy who had joined a small security startup – they’d just raised a Series A and were looking to hire. The company had need for a Pythonista who could improve their infrastructure and development pipeline alongside regular feature work.

Even better? They’re distributed (no RTO!) and I’d coincidentally spent the previous few years virtually hanging with a bunch of wonderful security-adjacent nerds on a private Slack – giving me a(n even) greater appreciation of the importance of cybersecurity work.

This seemed too good to pass up, so when Reach Security made an offer, I accepted!

Never heard of them, what do they do?

I get a little “sus” when folks get chatty about their employer, so I’ll limit this to the basics: the elevator pitch for Reach is that instead of being Yet Another Security Tool, their raison d’être is extracting the full value of the security tools your company is already paying for.

The average IT/infosec team is typically not positioned to make the most out of their current firewall, spam filter, endpoint protection, identity/auth system, and so forth. Growing such teams with the headcount and experience required to configure those systems well, is increasingly costly – especially as attackers aren’t standing still.

Reach’s bet is that, for less than that hypothetical staffing increase, they can apply (or suggest, in a read-only mode) a smart and constantly updating set of configuration updates, tailored to their customers’ environments.

Makes sense to me; and it’s a nice perk to care about your employer’s product for a change. (Also, we’re still hiring, so get in touch!)

So what about the OSS?

This part is less rosy. “A day a week for your OSS” was, in hindsight, its own ZIRP; I was incredibly lucky to have it at the last couple of jobs. There’s no such agreement this time around.

What does exist is the possibility of applying my projects where relevant. At the start, this is Invoke, bringing a consistent and centralized CLI experience to a formerly seed-stage-startup level of repo organization. I’m already bumping into multiple long-term bugs/missing features that will need work!

Whether this later involves Fabric/Paramiko depends on how the company’s infrastructure grows. As came up in early chats with another company/friend, shoehorning tools where they don’t belong, purely because I have a need to keep the projects relevant in my dayjob is…not a good thing. I don’t want to become “that guy” any more than I already am.

And these days, “SSH via Python” is not the correct default tool in many situations – it’s harder to justify in a world full of serverless computing, containers, and IaC than it was in the late 2000s.

That said: I still use all 3 projects for personal tech, and there is absolutely a “long tail” of groups for whom Pythonic SSHing is a valid tool in the box; long tails being something those of us near the bleeding edge love to forget about.

So Fabric/Paramiko have a future - the question is just how much time I can make for them in the short/medium term, and whether I can successfully grow the maintainership.

Watch this space for more, and in the meantime, I’m hoping to generally re-engage with my projects in whatever time I can make for them. The staycation is over!

Zero-Interest-Rate Phenomenon ↩︎

Dice, dice, baby

Jeff Forcier — Tue, 07 Mar 2023 19:14:50 -0500

Bought some fancy dice on a whim recently, and wanted to share the photos / descriptions. Figured this would work marginally better as a blog post instead of Mastodon posts.

Dice? Like for craps?

No, like for nerdy tabletop roleplaying games. Your d20s and d12s and d4s and so forth.

So you play TTRPGs?

Well…I used to¹, and never lost my love for the genre and its trappings. I’d probably give it another try these days if not for the whole pandemic thing (hint: it is still on, as much as you’d rather it weren’t.)

Then what’s with “bought some dice”?

The catalyst for this episode: earlier this year, I nostalgia-raided my late-childhood-through-college bedroom and carted home a pile of questionably preserved rulebooks, collectible card games, assorted paraphernalia…and my old dice!

I don’t remember where I got them, they feel cheap as fuck, and they’re not even in colors I like very much – but they sure smell like nostalgia. Or is that incense? Whatever.

You can tell most of these kinda go together; when I care enough I’ll probably skim the Dice Maniac’s Club identification guides (link goes to part 1 of N) to see what they are but I assume they’re Chessex since most of today’s dice makers weren’t operating back in the early 1990s.

The small reddish d6 is probably from an unrelated board game or something?

The big green fella might be a little esoteric to some of you – it’s a 30-sider! I have no clue what it was for exactly, it’s probably a donor like the rest. The joys of getting most of your stuff as hand-me-downs from the other local roleplayer who was years older…

Notably missing compared to contemporary sets is a “d%”, which is a d10 marked with 00-90 instead of 1-(1)0, to be rolled alongside a regular d10 to fake rolling a d100. I never really needed this (if they even had such incredible, advanced technology back then) in part because aforementioned friend had a real actual d100!

Anyway. So that’s the spark. “Oh yea! Dice are fun to hold, and to look at, and even – gasp! – to roll!” I knew that the last ~10-20 years' gaming/TTRPG/nostalgia renaissance had lead to lots of fancy dice being made/sold, but I’d never really mucked with them. Figured hey! Retail therapy. Why not.

Show us the goods already!

Sure, sure. So, these all came from Misty Mountain Gaming - I looked at a bunch of vendors (and even then it was clearly only scratching the surface!) and they had the overall most aesthetically pleasing selection for my needs, which was “kinda want one of each major new classification, just to see what’s what.”

I’ll do an effortpost later perhaps, with all my research, but for now suffice to say I got 3 sets of dice:

Kinda-sorta like my old pair, some plastic dice - but modern! Specifically, resin, with attractive colors/objects inside, and sharp-edged instead of tumbled.
The new hotness: metal dice! I don’t love the looks of the simpler metal dice, but some of them do a lot of neat stuff with multiple colors/textures and/or fancier engraving. These sound like they’re everyone’s favorite for actual use due to the heft.
Extra fancy: (gem)stone dice - it sounds like these are almost more for collecting/displaying, as they are liable to get damaged when used unless you make sure to only ever roll them in a padded box AND only one at a time. But goodness, are they gorgeous! Name a mineral or stone that holds up to mild stress, and you can get dice made from it.

Here we go.

Resin love

First, the resin set, specifically how it was packaged:

Very nice, individually wrapped “candies”, and a free display/storage case. Unwrapped:

These are just gorgeous. I especially love how the font ‘pops’ despite how complex the insides are. The color work is also fantastic - the blue and the shells go together perfectly.

In the hand, they are very light, and of course a bit sharp. Especially the d4, which will absolutely work as a caltrop in a pinch.

I’m not sure why MMG gave me a free case that clearly doesn’t fit the resin dice. Maybe I’m supposed to manually cut out bigger holes in the foam? I’m not very smart.

Heavy metal

The metal dice, a two-tone set:

As expected, these have great heft to them, and are very pleasing to roll.

On the downside, they are way smaller than I expected. Reckon it makes sense due to being solid metal, but I’ll def be looking to see if this is normal or if these are unusually small.

These fit perfectly in the accompanying storage box, making me wonder if I was accidentally given two “metal sized” boxes or if this is just their standard.

Stone cold

Finally, the Labradorite/moonstone dice. Very very pretty. They came in their own display/storage box:

Which of course has appropriately-sized foam holes:

Good heft, much more than resin or acrylic, but not as much as the metal. Pretty obvious when you think about it.

Guess I’ll have to be careful about using these. I’ll definitely think about getting one of those padded rolling trays, these want to roll a bit farther than the resin (which aren’t tumbled) and the metal (which are just that heavy) though they’re obviously not as fleet of foot as the old tumbled-acrylic dice.

Hope you had a dice time!

A parting size comparison shot for you, and a thanks for reading!

AD&D 2nd edition, “regular” D&D, RIFTS, Shadowrun, Werewolf, a tiny bit of Vampire and other White Wolf properties too, and probably a few I’ve forgotten. ↩︎

Saying goodbye is difficult

Jeff Forcier — Fri, 27 Jan 2023 19:34:28 -0500

Don’t let the title scare you; I’m not going anywhere in particular. But the last ~year has seen a couple of big changes that I wanted to briefly share.

A personal note

My mother, with whom I was very close, passed away somewhat suddenly last July (also my birthday month, now ruined forever). She’d been diagnosed with surprise lung cancer the preceding December – despite a lifetime of exactly zero risk factors for lung cancer – and had been managing it during the spring with some new anti-cancer meds.

Unfortunately, since the cancer had already metastasized by the time it was detected, she was on both borrowed time and blood thinners; the blood thinners had to be switched around a few times to support a relapse-related biopsy; and something about that switching (or perhaps simple bad luck) triggered a significant stroke which put her in the hospital. She was gone a few days later.

As you may imagine, this experience has added to an already near-terminal pile of stress and sadness from the ongoing Situations™ that we all live under lately, and has rather lessened my desire to have Internet randos pissing & moaning on my open-source issue trackers.

So if I’m shorter than usual (notice to some of you: that’s your one freebie for the day) or you find a pointless complaint Github comment unceremoniously deleted…this is one reason why.

If you’ve got a mom and are on good terms with her: please give her a call/hug. You never know when she’ll be taken away from you.

A Python note

Nearly two years ago, I announced my intention to drop Python 2 support across all my projects. As of a week ago, this effort is complete!

Really?!

Yes! The last to get updated were my “big three” – Invoke, Paramiko, and Fabric – which got major revision bumps to denote their removal of Python 2 and Python <3.6 support (along with other changes) over the last couple weeks.

Considering my employer’s Python environments are also generally Python 3-only (minus a few holdouts which I am not personally responsible for) this means I am now privileged to assume support for things like f-strings. It feels good!

If I’d held out another 10-11 months, I could have claimed to be writing Python 2 for a full 20 years – thankfully, I resisted the urge. But yes: goodbye, Python 2; so long, and thanks for all the fish!

Python 3.6 is EOL, Jeff!

I appreciate you looking out for my well-being, but I am in fact capable of reading!

Less snarkily / more usefully: 3.6 was a useful cutoff today for a number of factors, but I’m not planning to repeat my mistakes to a high degree. I’d guess that I will end up trailing the official Python EOL dates by a couple of years or so, at most.

Factors pressuring me to drop Python versions:

Requiring custom code to handle old versions. Now that everything <3.6 is out the window, this is nonexistent or very minimal.
Dependencies which I or my users really want newer versions of for feature/security reasons, whose newer versions break on older Pythons. So far, there aren’t any of these on my radar besides a few which emit deprecation warnings on 3.6. Easily muted by those who care to.
Irritatingly large CI test matrixes. Already, 3.6-3.11 is 6 cells minimum, though thankfully CircleCI makes it pretty easy to avoid running a full dot-product in situations where I have additional matrix dimensions. (E.g. if I care to do things like test the oldest and newest versions of a crucial dependency, I might only do that on the oldest and newest Python versions too.)
Ridicule from other OSS maintainers. Thankfully, most such offenders are unreasonably tall and thus their ridicule just flies right over my head!

Factors pressuring me to keep Python versions around: eh, there’s clearly still a LOT of folks on operating systems whose python3 -V spits out 3.6.*. No, they can’t all build their own Python, use pyenv, use containers, or etc.

Anyway - where from here?

See my roadmap as usual, but tl;dr – features! at long last! I’m unreasonably excited to write a much less naive/creaky authentication flow for Paramiko, for example, and to add wholly new functionality to Fabric/Invoke.

Also: presumably shorter time periods between major revisions. Not short periods, and I plan to experiment more with “maybe serve a new API or implementation alongside the old one for a while???”. But also not being too afraid of it when it makes sense. Smaller backwards incompatible versions are much easier for users to swallow than the really big ones.

Overall, my earnest hope is that dropping the Python 2 albatross from my neck will invigorate me a bit more going forwards – at least when the still-frequent thoughts of my mom, and the preexisting condition of my burnout, aren’t getting in the way.

Thanks for reading!

Polestar 2: Test drive to order in one day

Jeff Forcier — Mon, 14 Feb 2022 22:31:00 -0500

I’ve been looking to upgrade my old, boring internal-combustion car to a fancy, shiny battery-electric vehicle for about a year. The other day, I finally got to test drive one - a Polestar 2. It was great! And I ended up putting a deposit down the very next day.

Cars are evil!

You’re not wrong; car culture is responsible for the modern world’s awful urban planning. I bought a house walkable to necessities so I wouldn’t need a car – but they’re still convenient – especially these days, when stranger air is danger air.

Driving to my parents’, running “big” errands, getting places not served by train, and (maybe again someday?) road trips – it’s all good.

So you already have one?

Yes! I own the cutest car ever: a happy green Mazda 2:

We got it in California; it’s served us well for 11 years & a cross-country drive. It transports 2 size ‘small’ adults (and occasionally cats).

No kids, no dogs, no lumber, no garbage cans, ~~no corpses~~ ~~nobody can prove anything~~ ~~stop reading this paragraph please~~

Tiny hatchbacks fit us great, but this one is a manual transmission, which is relevant because…

Why are you replacing such a cute car, what’s wrong with you?!

…I messed up my left ankle a few years ago. Not bad enough to qualify for a blue placard, but it still hurts if I use it too much, such as constantly riding the clutch ~~when some asshat in a BMW causes a pileup on the Merritt~~ in Northeastern US interstate traffic.

No, seriously, what is wrong with you?

God, where to start?

You know what, never mind. Let’s stick to cars.

Why electric?

It’s better for the climate, provided the car and batteries are used long enough. Yes, even if the electricity is fossil-fuel based. I’m not gonna regurgitate the literature here.
Less smelly, can run it in an enclosed garage without dying (always a plus), doing 99% of your refueling at home, etc.
I’m blessed with a 2-car garage, so I can keep my Mazda around as insurance.
Have you driven an electric car? They fly!
As of 2021, the non-Tesla market and charging network has finally reached an early critical threshold of “good enough”.

DID YOU SAY NON-TESLA?! RARGH!

This used to have a Twitter embed, but Twitter is functionally dead now, and hilariously, it’s for the exact reason my tweet had been about: Elon is an absolute shithead. (Also, his cars aren’t very good, as it turns out. Even the range turned out to be inflated!)

So what did you consider?

If you’re interested in a messy database, I used Airtable during my search, embedded below. You may want to click ‘View larger version’ in the bottom right to dig in:

For the last few months, it’s been down to 4 of those cars:

Chevy Bolt
Hyundai Ioniq 5
Kia EV6
Polestar 2

They share a good to great battery capacity & charging rate, don’t look like a standard SUV/crossover, seem reasonably well liked, and are (or are shortly being) sold in the US.

Sadly, none of the true hatchbacks I could get here meet the “good to great battery/charging” criteria. More modern units exist overseas, but that doesn’t help me. So I knew we’d end up with a sedan or crossover.

How’d you end up on Polestar?

The competition

The Mach-E is hard to get due to supply chain issues, I’m not entirely sold on its look & feel, Ford corporate did shady crap around the launch of the vehicle (embargo’ing a known underwhelming trim until post-delivery) and on top of all that, I’d have to deal with Ford software and dealers.

The Ioniq 5 is neat looking, but WAY bigger than it looks in photographs. It’s seriously huge. I also wasn’t a fan of its cockpit when I got to sit inside, but mostly - it’s just too big!

Kia’s EV6 is shorter vertically than the Ioniq, and curves where the Ioniq uses straight lines; but it shares the same platform - so it’s still too big around. Plus most of the Kia dealers I spoke with did nothing to dispel their awful reputation.

Polestar itself

Polestar 2s look like this:

In terms of its comparison to the others:

Sedan shape and size is more our style than the crossovers.
Had the most consistently positive reviews (and most “cons” were things that didn’t bother me or which I knew could be patched in software).
Can test drive, purchase, deliver, and service almost entirely online, including free pickup/dropoff/loaner.
- My interactions with Short Hills Polestar (both sales & test drive folks) have been nothing short of great. Intelligent, responsive, accommodating, and well informed - the polar opposite of my interactions w/ (most) local mainstream dealers.
They partner with Volvo dealerships for service, and the one in my area is super duper well liked.
Priced competitively, and NO dealer markup BS, which is currently rampant with the other models, especially the Hyundai/Kia (which are going for $10+K over MSRP right now!)

By the time I’d emerged from my research, the Polestar was clearly calling my name…

The test drive

Note: I’m skipping some points that are repeated frequently in the reviews you can easily find on auto blogs and YouTube; if you are considering this car at all, absolutely look that stuff up. Ars Technica has a good article or two, Throttle House has a couple videos, there’s a ton out there.

The car I test drove was:

a dual-motor / AWD model
with the Plus pack (sunroof, leather seat option [installed], heated steering wheel, better speakers, etc)
but not Pilot (adaptive cruise, extra cameras/sensors/safety features, 360 park cam) or Performance (I don’t drive that fast)
in the Moon paint.

Here it is being fit tested in my garage:

I love those headlights.

The good

An online refrain is that these cars look better in person than in photos – it’s true! Something about its physical presence really sells the design. I really like it.
It has real door handles, not style-over-substance flush nonsense.
The Plus pack has a pleasing interior design with wood accents and other attractive materials. Both the WeaveTech and (recycled) leather seating options were comfy.
The build quality is extremely good, as I’d expect from a Volvo spinoff. Pleasingly solid door feel, minimal road noise on the highway, etc.
Touch screen was responsive and easy to use, even on the go (altering drive settings and climate).
- Do I love Android styling? No, but it’s inoffensive, and Android Automotive was clearly designed for its environment.
- The Google Assistant-based voice control also worked pretty well, comparable to my (limited) experience with Siri.
Gauge cluster extremely crisp and well presented; plus having a map there is great. No glancing over at phone or tablet.
I absolutely loved how it drove:
- The accelerator felt well tuned at all speeds.
- Tons of power, both when rabbiting across a busy intersection & passing at speed.
- Cornering and changing lanes was super smooth (really, the whole ride was.)
- One-pedal driving is fantastic & if anything made me feel even more “in tune” with the car’s movement than in a manual.
Plenty of room in the trunk, so at least we’re benefiting from the larger vehicle size.
- The Plus pack adds conveniences here such as a flip-up divider and a bunch of hooks/nets.

The less good

The cabin’s a bit cramped coming from my Mazda, at least vertically. Many medium/large-sized reviewers point this out and I can see why - when I notice my on-top-of-head sunglasses smacking the roof, that’s not a great sign for the rest of y’all.
- The center console apparently gets in the way of people who have actual legs. Thankfully, for me it’s no worse than the similarly placed console hosting my Mazda’s shifter, and has more storage compartments too.
The acceleration/torque from the electric motors was literally intimidating/scary in spots. It would be very easy to get into a bad situation with this power, very quickly. I’m terrified to think what the roads will be like when everybody has an EV!
The keyfob. It’s huge (a common complaint) and the car “turns on” simply by having it in range and a butt in the driver’s seat. My inner Pythonista would prefer something more explicit.

The bad (but overlook-able)

Visibility towards the rear is dire, with thick (Volvo safety!) B pillars and wide C pillars / tiny rear window.
- A big change from my Mazda 2; I’ll have to train myself to rely more on the mirrors & safety cameras.
I said I wouldn’t revisit constant refrains, but…the cupholder situation is also dire - actually worse for me than larger folks (you slide the armrest back to access the first cupholder, and open it for the second).
- When in use, though, the first cupholder isn’t in my way…and the Mazda had no armrest anyways!

Result: dear reader, I paid a deposit

After a final visit to Polestar’s “Space” at my local mall to check exterior & interior colors/fabrics, and a night of thinking, I reserved a dual motor “Snow” (white w/ black trim) 2022 model with the Plus and Pilot packs & WeaveTech seats (we don’t like light-colored leather).

I’m reserving the option to switch that reservation to a single-motor once they’re available for test driving - if it’s still enough power for me, I’ll gain some range in exchange. Either way, I’m excited!

I leave you with a photo of my automobile past and future (with a “Midnight” P2 in between) and a thanks for reading! Reach out via email or Twitter if you have burning questions about my experience not listed here.

Security update

Jeff Forcier — Tue, 28 Sep 2021 14:44:31 -0400

After many years of procrastination, I finally got off my duff and set up Let’s Encrypt for my domain – with my OSS domains soon to follow (though those already had SSL for all but the apex domain bounces, courtesy of Read the Docs).

You should now be seeing https URLs for all pages on this site, and be redirected to https if you access the http versions.

From cloud to ocean

I’ve also migrated hosts from Rackspace Cloud to Digital Ocean, which so far has been exceedingly pleasant. RSC wasn’t “bad” per se but Rackspace-the-company has diverged quite a ways from its early/mid 2010s OSS-supporting days, and I’ve continued to hear nothing but good things about DO. The latter supports just about everything I needed at the former & more besides, with a much more pleasant control panel experience to boot.

For now, I simply recreated a manual VPS to largely match the old one (albeit much newer versions of OS and packages) but I’ll probably try out their app platform or managed k8s someday.

Github Sponsors

Jeff Forcier — Sun, 26 Sep 2021 11:10:14 -0400

I finally got my bank, Stripe, and Github to play nice together, so I’m now on Github Sponsors. Added it to the relevant section of my projects page too.

No tiers or goals or anything like that - I’m sure the more entrepreneurial users appreciate those features but I’m #blessed with a well-paying job that gives me some OSS time, so sponsorship/etc is largely about beer money or one-time “you fix my bug, I give you cold hard cash” agreements.

Disabling comments

Jeff Forcier — Sat, 25 Sep 2021 11:30:14 -0400

I’ve turned off Disqus comments on this site. There’s not usually enough feedback to be worth the extra page/cognitive load. My inbox is always open!

New: OSS project roadmap

Jeff Forcier — Fri, 24 Sep 2021 15:54:21 -0400

Just a quick note that there is now a roadmap section on my projects page. I’ll be linking to this from the project websites ASAP.

My hope is that this goes a small way towards addressing the thing where my reduced cadence makes it look like projects are “dead” when they’re actually just sleeping (cue Monty Python parrot reference here).

/quit freenode

Jeff Forcier — Thu, 27 May 2021 11:38:08 -0400

If you haven’t heard by now, the Freenode IRC network is under new, bad, management. I’m locking my channels there and will be registering my project names over on Libera.Chat.

The drama

Ars Technica offers somewhat neutral coverage of the ongoings; there’s a gist which is somewhat biased on the side of the now-former Freenode staff; and it’s all over Pythonista tech Twitter, which unsurprisingly supports the latter.

The most recent article I’ve seen is a post on Linux Weekly News; it’s a free link to what is normally a subscriber-only post, though if you’re even remotely Linux-sysadmin-adjacent, I strongly recommend you consider subscribing - their content is typically top notch.

On top of what’s in those links, more keeps coming out: the new staff sound like your classic socially regressive “bad tech nerd” types, who just don’t understand all this “horrible SJW nonsense” like banning hate speech in the network use policy. But even if you’re a free speech zealot, the new staff has a treat for you too: they’re taking over and deleting/editing any channel mentioning Libera.Chat in its /topic. I believe there’s a Star Wars quote about this somewhere…systems…fingers?

Immediate action

Rather than support a now-toxic community, I’ll be setting +m (you can join but not post anything) on my Freenode channels, and replacing their topics with a link to this post (to avoid the auto-topic-edit mentioned above).

I’ll also register the relevant namespaces on https://libera.chat - but I may not open them for business immediately, instead removing the mention of IRC from my contact pages. Read on for why.

Good memories

I feel like I was using Freenode before the below date and didn’t bother registering my nick until then, but the stats for bitprophet (or bitprophet_ because shenanigans) just now when I signed in for the last time:

-NickServ- Registered : Sep 15 15:07:53 2006 (14y 36w 5d ago)

My earliest recollection of consistent/regular IRC use (vs telnet-based stuff like MUDs and talkers, which I used as far back as the early 1990s) are chatting in #django on Freenode in 2005-2006 when both the framework and my career were largely brand new. The contacts and friendships I made during that time (up until the late 00s or early 10s, when I stopped using Django as much) have informed much of my career and tech-social life.

Goodbye, IRC?

So it’s with no small amount of sadness that I contemplate hanging up my IRC hat for good. Why? I’ve already mostly cut it out of my life for various reasons:

I used it very frequently the later half of the 2000s (including opening channels for my OSS projects), and if you’ve ever chatted with me in realtime anywhere, you know I am VERY CHATTY.
The first half of the 2010s I was very on-again-off-again, because…I realized that propensity to chat nonstop was having impacts on my ability to focus. So I treated it more mindfully and only connected when I had a specific reason to chat, or was on an OSS-focus day.
By the mid 2010s, I was really starting to feel burnt out, and the thought of my users inadvertently nerd-sniping me with realtime support requests (which I’m terrible about dropping everything for) meant I…just stayed logged off most of the time.
It also feels like the Internet has changed; fewer and fewer newbies seem to stumble across IRC and instead prefer to contact folks via email, Twitter or just the issue tracker. (Newer projects set up things like Discord, etc).

Today, I’m still in that “almost always logged off” mode – my poor bouncer loyally slurping up everything folks say, for me to wearily ignore the invariably-incredibly-stale mentions of my nick (OSS, social or otherwise) if I do log in.

Almost but not quite

Given the above, the Freenode news feels like a great opportunity to tie things off. I’m going to shut down my personal bouncer for sure, and as noted, I’m putting my Freenode channels on ice.

However, I hope eventually things will change, and even if they don’t, I don’t want to close off communications avenues for anyone who might pick up my projects if I put them down.

Thus the registrations on Libera.Chat. Same channels as on Freenode (#fabric, #paramiko, #invoke). But they’ll be locked (/mode +si - invite-only and not listed) for now, to avoid user questions being asked with no reasonable chance of an answer. (This isn’t to say that sometimes answers can’t be supplied by other users - but most of the time the questions are requests for authority, which, hi, is usually not present.)

For my friends in the couple social channels I was on, I may return someday, probably in a more “realistic” fashion (no bouncer - just a local client). Clearly me pretending to be “always-on” does nobody any serious favors.

Farewell, Python 2

Jeff Forcier — Thu, 25 Feb 2021 12:01:31 -0500

Long story short: I’m finally starting to drop Python 2 (and a few slightly older Python 3s) from my projects, in a phased manner. Background and details follow.

A brief timeline

Writing this out made me feel #old.

2004: I’m introduced to Python (2.2/2.3) at the end of my time serving a CS degree.
2008: My OSS career kicks into gear as I take over Fabric. Python 2.4 and 2.5 were stable, 2.6 comes out in the fall, and 3.0 in winter.
- 3.x has been around the entire time I’ve maintained Fabric!
2010: Python 2.7 is released. That’s 11 years ago!
2012: Python 3.3, considered the first “really usable” version (especially for 2+3 codebases), comes out.
2013-2014: Invoke and Fabric 2 start development, with Python 3 support right out the gate; Paramiko gains Python 3 support.
2016: Python 3.6 is is born, with f-strings and ordered dicts.
2018-2019: Every widespread Linux distribution switches to Python 3, if they hadn’t already.
- The exception is RHEL/CentOS, which switches in 2020.
- Python 3.4 reaches EOL (End of Life) in mid 2019.
- Around this time (if not sooner) many Python 3-only packages declare Python 3.6 as their baseline supported version.
2020:
- Python 2, in its entirety, is EOL’d in January. This is an ex-interpreter!
- Python 3.5 reaches EOL.
- I admit burnout.
Early 2021: Pip drops support for Python 2, as does Cryptography (a Paramiko dependency which is unsafe to pin for long).

And here we are.

But why???

The timeline is a bit implicit; let’s be explicit. Why am I doing this now?

It’s past time. I’m quite conservative on the maintainer spectrum, but by now – with the interpreter, package installer, many/most packages, and most/all Linux distributions all leaving Python 2 behind – I’m in good company.
It’s decreasingly likely that my software is the first thing pushing you to upgrade. If you’re still on Python 2 in 2021, you’re already committed to a lack of updates from all of the above sources. I’m just one more.
The iron triangle has shifted. An old post is still relevant; ease of maintenance (because burnout) and speed (the current release cadence is unacceptable) are tipping the scales against stability (in the “things don’t change” sense).
Most downloads have been Python 3 for years. Going by PyPIStats, even the most conservative userbase I answer to (surprisingly Fabric, not Paramiko) is only 33% Python 2.
- I don’t have a useful breakdown, but I’d also guess that 33% is heavily slated towards Fabric 1 users, who are already largely unsupported.
- Paramiko is down to <=20% Python 2.
- Invoke (and by extension, most users of Fabric 2) has always been <=10%
- Alabaster is at 10%; etc.
Combining the above two: I’d prefer to think of this as improving quality and release cadence for a majority of users, instead of worrying about its impacts on a recalcitrant minority.
Finally: nothing’s getting deleted. Same as any backwards incompatible release: existing Python 2-supporting releases remain on PyPI.

How, exactly?

I am planning a phased removal of support for Pythons 2.7, 3.4 and 3.5, as follows:

The first step will be to remove CI support for old Pythons.
- This will happen as I migrate to CircleCI from the now-defunct Travis-CI over the next few weeks/months.
- Doing it this way saves me from reproducing a lot of frustrating busywork in my scripting, and also slims the test matrix – which is important now that CI providers track how much CPU time we burn!
- But it means that there’s still a short grace period for users (see below), as my local env will still be doing basic Python 2 test runs.
The next step, which may happen at the same time, is to update development dependencies to assume Python 3.6+.
There will likely be 1-2 more release cycles which include Python 2 artifacts.
- This works because I still generate those artifacts locally and not from CI (yet).
- Included in this is Fabric 1’s still-planned Python 3 support merge, for a final release of that line. This provides users an upgrade path: Python 3, then later Fabric 2+.
Finally, the last trio of changes will happen around the same time:
Project tooling will drop old Python support, including build/publish tasks and packaging metadata.
Python 2-related syntax will be removed from the code itself.
Versions of most packages will bump their major qualifier to signify the change (though it’s unlikely any other backwards incompatible changes will occur):
- Invoke will go to 2.0
- Paramiko will go to 3.0
- Fabric will remain on 2.x because it’s got a more complicated history here
  - thus, this will probably be Fabric 2.8 or 2.9, with 2.7 or 2.8 being the last Python 2-supporting release.

Project Updates, 2020.09

Jeff Forcier — Fri, 18 Sep 2020 16:26:37 -0400

A quick followup to my previous missive.

Triage

I’ve lined up a handful of other Github users for each of my major repos, granted them the triage bit in most cases, and am easing into a weekly review cadence.

In one case, I gave a couple folks more privileges as I’ve already collaborated with them for a while - though until more of the below is taken care of, it’s largely symbolic.
Since the folks involved all have their own lives to live, the speed at which things are moving differs between projects - but the approach is already paying off in at least one area so it’s a good sign.
Trying to figure out (ideally limited) behind the scenes discussion is a challenge - I’m using Github’s newish org/team-level discussions feature for now, but it’s basically just a repositioned version of their Issues framework, which isn’t superb.
- Naturally, other tools have their own issues - either they’re proprietary (Slack), require manual hosting labor (most OSS solutions), or are too easy to lose track of / very difficult to backfill (email).

Feature release planning

As part of the above, I’ve got a small list of low-difficulty high-impact Paramiko PRs lined up to review for its next feature release.

However! I want to give Fabric and Invoke some more love first, as they haven’t had any releases yet this year. Fabric 2 especially needs some features added so it’s not quite so sad looking - heck, in replying to a mailing list email earlier today, I was reminded of multiple missing features (large AND small) that are just crying out to be hacked on.

(A whole ’nother blog post: the uncomfortable tension between “I should hack on $thing” and “but what if somebody has already filed a PR for $thing and it’s not quite what I had in mind?”. It makes “just getting stuff done” on OSS that much more painful for us maintainer types…)

Admin changes

I’m in the middle of trying out a pile of administrative changes on a smaller project (Lexicon) which should give me a useful checklist to roll through for the bigger ones:

As noted in the last post, I am trying out Circle-CI, both because Travis fired all their senior staff a few years ago, and because Circle has some legit neat tech that Travis doesn’t (or didn’t last I looked - they do seem to have changed their .yml some lately).
- E.g. using orbs to refactor my various CI YAML files seems like it could be a decent win, as is the option to use custom Docker containers.
I’m likely moving from setup.py to Poetry-driven pyproject.toml after some success using it at the dayjob.
- It has a lot of rough edges still (yes, like I should talk) but so far none that can’t be worked around, and the core benefits of smarter dependency management and streamlined environment use are something I immediately missed when coming back to OSS from work projects.
- There’s a chance some of my more complex setup.py files will not be amenable to this change, but I’ll find out. The overall packaging world is moving away from executable packaging code either way, so…
- I’m anticipating this throwing a wrench in the works of some/all OS package maintainers.
  - My relationship to such folks has not been as concrete as I’d prefer anyhow; if this describes you, please email me to say hi! I need to build a contact list.
Also as noted prior, renaming master to main.

Eyes on the collaboration prize

Building on the above, I want to make it clear that the NEXT batch of admin changes will be aimed at streamlining collaboration with both privileged and unprivileged contributors:

More rigorous CI: automate as much as possible so there’s less “please add docs here” type busywork for triagers, myself or others, and less frustrating ticket tennis for PR submitters (or at least, they get to play tennis with an immediately responsive CI result or bot instead of every-few-days maintainer chat).
Ticket bots. If only so the numbers of open things don’t look so heinous. I don’t love the sweep-it-under-the-carpet feelings here, but it helps nobody to have tickets moulder forever in an open state if they’ll never rise to the top of the priority stack.
Automated releasing: I’ve already got Invoke task collections for this that make releasing mostly turnkey. However I need to remove that “mostly” qualifier, so that releasing is even easier for me and eventually others. I also need to tie releases into other APIs such as Tidelift.

HELP WANTED

Jeff Forcier — Thu, 02 Jul 2020 13:30:00 -0400

The first step

is admitting you have a problem; so with that in mind:

Hi. My name’s Jeff, I maintain several OSS projects you may be familiar with¹, and I’m burned out.

I lie awake at night, unable to sleep, crippled by guilt. During the day, it’s anxiety and fear that cripple instead, making the thought of facing the issue tracker unbearable.

Development on my projects has slowed far more than I ever intended, and while I have excuses², push has clearly come to shove. Something must change.

Until now, I’ve been a solo maintainer for various reasons, primarily a combination of extreme pickiness (re: code quality, formatting, defensive coding, etc) and trust issues (I have difficulty trusting others to exhibit that same pickiness).

With the burnout I’m feeling, it’s sometimes tempting to give up and walk away. But even that would require trusting others with the future of my projects! Surely I can act less drastically first – extending trust in ways that will get me back to productivity.

Walking before running

My biggest issue? Issues! There’s too much feedback to handle alone and get meaningful work done. The most valuable help I can get is ticket triage (and to a lesser degree, PR code review) so that I can focus on development and direction.

At a minimum, I need scouts, people who can alert me to significant events: serious new bug reports, flurries of interest in an open ticket, or well crafted PRs that are ready to merge. I’ll continue to keep my eyes off the notification queue and trust that these new collaborators will keep me informed.

Beyond that, I’d love to utilize Github’s triage role: having others labeling issues, closing duplicate or noise tickets, and asking submitters for details or PR alterations. I may continue doing this sort of thing myself, but typically only on tickets that otherwise cross my desk.

You

It’s easiest to start with those I recognize from existing engagement, and I’ll be reaching out today to folks who expressed prior interest. If you think you’re in that group and didn’t hear from me, please let me know (and accept my apologies for the oversight)!

For everyone else: if you can show you know your way around Python, the problem domains involved, and the projects themselves – feel free to introduce yourself, briefly explain how you believe you can help (or just point to existing contributions!), and let me know which project(s) you’re interested in supporting.

Me

The best way to get ahold of me is email to jeff (at) bitprophet [dot] org; please put something like “Re: triage blog post” in the subject. Or use this handy mailto: link.

I usually respond within a few days (more quickly on Fridays, which are my OSS time).

Us

I don’t have a clear picture yet of exactly how collaboration will occur (outside of Github-level features such as assignment and milestones). At the start I’m likely to try leveraging per-project email groups, or chat like IRC or Slack.

I’m open to other suggestions too, though unless something has changed recently, this (semiprivate group discussions) is still a poorly solved area for OSS projects.

Where to go next

Ideally, once I’ve learned to trust others with triage and review, I can take further steps until ending up with full-on co-maintainers. Time will tell.

I’ll leave off with some quick roadmaps.

Short term

Get folks set up with the triage role…
With their help, identify and tackle any new-to-me serious issues that have appeared in the last 6-9mo, whether that’s bugs, broken dependencies, Python 3.8 compat, or whatever.
Explore migrating to Circle-CI from Travis-CI, for various reasons (such as lack of confidence in the latter’s future after firing most of their senior talent post-acquisition).
- Possibly Github Actions, but I’d rather not make myself even more dependent on that platform.
Rename master to main – something I’d intended to do sooner, but there is absolutely no time like the present!
Oversee merging of ‘Fabric3’ into Fabric’s v1 line; this is my olive branch to folks struggling with Python 3 but who are frustrated with the pace of Fabric 2 dev the last couple years.
- This doesn’t mean that Fabric 1 is going to see more feature work; it’s just housekeeping.

Medium term

Get back to Fabric 2 feature work; I still want users to migrate off of v1 eventually!
Execute long-planned architectural improvements for Paramiko, eg improved authentication flow.
Ditto Invoke, again features that have been in the wings for years, such as task dependencies and intertask communication.

The ‘big three’ being Fabric, Paramiko, and Invoke. ↩︎
Even before the current double troubles of COVID-19 and “ah yes, my country really IS descending further into a police state”, I was:
- still reeling from last year’s disruptive cross country move
- trying to get used to a new job in a new sector
- attempting to buy, fix up and furnish my first ever house
- grappling with moderate depression
↩︎

Longest. Onboarding. Ever!

Jeff Forcier — Sun, 03 Feb 2019 12:05:42 -0800

Some quick updates on my personal status and whereabouts for Q1 2019!

Today marks my return to air travel after landing a new job – I’m heading eastwards (blessedly, after the recent polar vortex has subsided…) and will be spending a lot of time away from home and family. The later half of my itinerary isn’t yet set in stone, but it looks like this:

Flying to Chicago today (Sunday, February 3rd) to spend a work-week onboarding at my new job, whose headquarters is in the River North district of downtown.
- This is only my second ever visit to Chicago, and I’m hoping to see slightly more of it than my last overnight visit – though I’m sure most of my energy will be consumed by the stresses of starting the new gig, being jet lagged, and being cold.
I then fly to NYC on Saturday (the 9th) to spend another week getting to know my soon-to-be-local satellite office, based at the top end of Madison Square Park (that’s the Park, not the Garden).
- My housing is in a corporate apartment in Jersey City’s Newport neighborhood. It’s an area I’m relatively familiar with, and makes a good apartment hunting base – see below.
The following weekend and partial work week, I’ll get to see my wife again, as she’s flying out to join me in seeking an apartment. (We’ll be looking in New Jersey, because that’s how we roll.)
After she returns to California, I spend another week and a half ramping up at work, still living in Jersey City and posted at the NYC office.
Most likely, I’ll then fly back to Chicago for the first two weeks of March to catch my company’s periodic “here’s how this place works” firm-wide series of meetings.
- A side option is to stay in NY, start setting up my anticipated new apartment, and videoconference to the Chicago folks – but I’m not the handiest person when it comes to installing furniture, and it’d be nice to get more face-time with the bulk of my new team.
Finally, I expect to return to California for the last half of March, working remotely and finalizing our move – capping it off with a week+ drive east to get my car, cats and valuables to New Jersey.

If you’re an old friend who lives in Chicago or New York, or live there and want to become a new friend, hit me up – just in case I have some energy left over for you. (No promises!)

New Year, New Job, Old Haunts

Jeff Forcier — Tue, 18 Dec 2018 17:10:12 -0800

Leaving one opportunity…

The last couple months, I’ve been on the job market; my previous employer, mLab, was acquired by MongoDB and there wasn’t a good role for a full-time Pythonista with my particular open source baggage on the other side of that transition.

mLab was a great place to work and (per my 2016 post) a staunch supporter of my OSS, both re: time on the clock and real-world use cases. Fabric 2 might not have seen the light of day otherwise!

I’ve been absolutely #blessed with a deluge of job leads big and small, far and wide; the process has been exhausting, but also invaluable both for connections and gauging the state of the industry. (Actually industries, plural – not just tech, but finance, healthcare, rocketry and more!)

…and joining another

As of today, I’ve accepted an offer to join a high-frequency trading company called Jump Trading, out of their New York City office. I’ll start in early February.

This has a lot of ramifications!

I’m moving back to the NYC metro area. Going to miss the heck out of Northern California, though I think that’s a topic for its own post. But it’ll be nice to be closer to family, and I won’t miss the background fretting about the West Coast’s particular flavors of natural disasters.
Chicago and London friends may see more of me. The company has offices in these cities as well as New York (plus others even farther afield), and I expect to travel to them occasionally. Excited to learn new places!
My open source will continue receiving support. One of the biggest reasons I took this job is that I’m being given explicit time to work on my Python tooling, and there are internal users to provide insight and feedback as well.
- This should help Fabric 2 get to feature parity with v1; allow some big Paramiko feature additions; and perhaps more!
I’ll be broadening my horizons. One thing that attracted me to Jump is the opportunity to work not just on typical tech company systems/operations toolsets (CI/CD pipelines, deployment tools, Kubernetes and Golang, etc) but to also learn about areas of computing I don’t normally travel in (nontrivial networking, high performance/supercomputing, kernel development, to list only a few).
- Even if I don’t end up working in those subfields directly, learning from folks who do should help me get better at my overall job.
Level up my understanding of the world. If you know me, this is not an area I’ve expressed interest in before. I’m not expecting this role to change my anti-corporate/capitalist leanings much – and I wouldn’t have taken this job if I thought they were close to any of the outright predatory aspects of the field – but I’m looking forward to learning more about the sector. It is fascinating stuff from a purely mathematical and sociological perspective.
- I’m also looking forward to breaking out of my tech bubble a little bit. It’s not really a coincidence that one of my other strong offers was from another not-directly-tech field – healthcare.
2019 will, at long last, be the Year of the Linux Desktop. Jump’s IT department doesn’t currently support macOS, so I’ll be at least partially returning to the land of window managers, unpolished UX, ugly fonts, and non-homogenous keyboard shortcuts.
- I’m going to miss unlocking my workstation with my new Apple Watch, and apologies in advance for all the #waahmbulance tweets.
- On the other hand, I’d be lying if I said I hadn’t been gently considering such a return for years now, so it’ll be an interesting trial run if nothing else. My personal system will of course remain a MacBook Air for the time being.

Onwards to a new year

We’re still working out all the details, but I expect to be moving my family to the NYC area (by which I mean New Jersey) sometime in February and/or March. For my Bay Area friends, please reach out and let’s find some time to say goodbye. For my New York friends, past and present, hi! Let’s get reacquainted after I move.

To the users of my projects, apologies for the slower release cadence the last few months – as you can see, it’s been for a good cause! I’ll probably do some releasing in January, and things should get back to some value of normal once I’m settled in at the new gig.

May you all have a good winter holiday and a great 2019!