Jaime Rodríguez-Guerra

Jaime Rodríguez-Guerra

@jaimergp.dev

Another PhD captured by open source. ⇒ Core team at @conda-forge.org. ⇒ Steering council at @conda.org. ⇒ Staff Software Engineer at @quansight.com. ⇒ Blogging at rjai.me. he/him

102 followers174 following43 posts

Jaime Rodríguez-Guerra
@jaimergp.dev

What I want in my GitHub Security Advisories: rjai.me/posts/2026-1... It's been a while I write in my blog or post here, but here's something I've been thinking about for some time. cc @sethmlarson.dev, since we talked about this in NYC some months ago!

rjai.meWhat I want in GitHub Security Advisories - rjai.me - A personal blog about scientific software, music and miscellaneaSecurity Advisories are a GitHub repository feature that allows users to submit vulnerability reports to repository owners in a private manner. Owners can then review the inbox of submissions, and dec...

Jaime Rodríguez-Guerra reposted

Juan Nunez-Iglesias
@jni.codes

Great thread. Dripping with sarcasm, but still manages to heartily celebrate the importance of human contribution and connection in (specifically game development but generally) any creative endeavour.

Freya Holmér@freya.bsky.social

"AI lets you focus on the higher level ideas!!" because we all grew up dreaming of becoming managers and CEOs we all know the real artists at the very highest level are the shareholders, famously full of amazing ideas

Jaime Rodríguez-Guerra reposted

napari
@napari.org

🚀 napari is hiring Remote Developers-in-Residence! Join us to build the future of interactive n-dimensional data visualization in Python. 💻 60% Dev / 20% Maintenance / 20% Community & Outreach ⏱️ Contract, 14–35 hrs/wk 🌍 Global 100% Remote Learn more and apply today: napari.org/island-dispa...

napari.orgWe’re hiring Developers-in-Residence! — napari blog documentationOrganization: napari (a NumFOCUS Sponsored Project) Position Type: Independent contractor agreement. Global, 100% Remote. Duration: One year, possibility to extend. Commitment: 0.4 to 1.0 FTE…

Jaime Rodríguez-Guerra reposted

Anil Madhavapeddy
@anil.recoil.org

I've had to respond to multiple OSS security issues recently and the wild thing is that agents can now generate exploits just on the *rumour* of a bug. This throws security embargoes out the window, as the fix is less important than the knowledge of its existence anil.recoil.org/notes/rumour...

anil.recoil.orgJust a rumour of a bug is enough to find a security exploit these daysThinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
Jaime Rodríguez-Guerra
@jaimergp.dev

This closes the loop on issues created more than 10 years ago (e.g. github.com/conda/conda/..., github.com/conda/conda/...). I'll keep you posted when clients implementations are available!

github.comOptional dependencies for conda packages · Issue #1696 · conda/condaA proposal for optional dependencies in conda packages. Implementation of this would be relatively simple. The proposal consists of adding a new section requirements so that it could look like pack...

Jaime Rodríguez-Guerra reposted

PyPodcats
@pypodcats.live

Meet Juanita Gomez, one of the Hidden Figures of Python. A Ph.D. candidate at UC Santa Cruz, @juanitagomezr.bsky.social researches how to make scientific open source software more secure with the OSPO at UCSC. pypodcats.live/episodes/ep-12/ 🧵👇️

pypodcats.liveEpisode 12 with Juanita GomezLearn about Juanita Gomez, a Ph.D. candidate at UC Santa Cruz researching open source security. From developing the Spyder IDE to leading community efforts for Scientific Python and singing on stage a...

Jaime Rodríguez-Guerra reposted

SciPy Conference 2026
@scipyconf.bsky.social

⚡ Tutorial Spotlight: Reproducible CUDA doesn't have to be complicated! Matthew Feickert, Ruben Arts & Katrina Riehl will show you how to easily create reproducible scientific and AI/ML environments that leverage GPU acceleration across multiple machines and platforms with Pixi. 🚀

Jaime Rodríguez-Guerra reposted

Mike Fiedler
@miketheman.com

This is what collaborative, coordinated, responsible disclosure looks like. It was a pleasure to work with @gitguardian.com on this #PyPI #security investigation to help protect the global #Python #SupplyChain blog.gitguardian.com/hunting-leak...

blog.gitguardian.comHunting Leaked PyPI Tokens: 62 Live, 125 Packages ExposedWe found 62 live PyPI tokens leaking on public sources, enough to push malicious code to 125 packages with 25,000 monthly downloads. We reported them to PyPI, which revoked every one. Here's how we de...
Jaime Rodríguez-Guerra
@jaimergp.dev

Cannot emphasize this enough.

Sovereign Tech Agency@sovereign.tech

building for long-term stewardship, and governance at scale. One thing in particular came up repeatedly: open source maintenance is not a narrow technical task. It is about trust, relationships, incentives, and the capacity to keep essential systems healthy over time.

Jaime Rodríguez-Guerra reposted

Python Software Foundation
@python.org

Watch PSF PyPI Safety & Security Engineer @miketheman.com's talk from Open Source Summit NA 2026: Trusted Publishing uses OIDC to generate short-lived tokens from CI/CD. No passwords. No tokens to rotate. No secrets in repos. www.youtube.com/watch?v=i0BW... #Python #PyPI #OSSummit #Security

youtube.comTrusted Publishing: Eliminating Credentials From Your Release Workflow - Mike FiedlerYouTube video by The Linux Foundation

Jaime Rodríguez-Guerra reposted

Sovereign Tech Agency
@sovereign.tech

The #maintainathon is underway at #UNOpenSourceWeek 2026 in NYC. For the 2nd year, we & the UN Office for Digital and Emerging Technologies are convening #opensource maintainers and institutional actors to work on the challenge of maintaining increasingly complex critical digital systems.

Jaime Rodríguez-Guerra reposted

Quansight
@quansight.com

Excited to see Jaime Rodríguez-Guerra heading to UN Open Source Week as part of the Sovereign Tech Agency's maintainer delegation. It's great to see practitioner voices included in these conversations. Congrats to Jaime and the whole delegation, we can't wait to see the impact of your insights! 🙌

Sovereign Tech Agency@sovereign.tech

For the second year, we are bringing a delegation of #OpenSource maintainers to #UNOpenSourceWeek in NYC. The experts who actually build and maintain critical digital infrastructure are rarely represented in the international conversations about how that infrastructure is sustained and maintained.

Jaime Rodríguez-Guerra reposted

Quansight
@quansight.com

AI is absorbing the "visible friction" that open-source communities used to rely on to welcome newcomers. The result? The "Invisible Newcomer." They get the answer. They miss the community. How do we design invitation when the path is gone? Mara Averick shares her analysis here:

buff.lyWhat We're No Longer Seeing: AI and the Invisible Newcomer in Open SourceHow AI is absorbing the visible friction that open-source communities have always relied on to see—and welcome—newcomers.

Jaime Rodríguez-Guerra reposted

Bernát Gábor
@gjbernat.bsky.social

Just published my notes from this year's Python Packaging Summit at PyCon US. If you've ever been curious what one of these is like from the inside: Wheel 2.0 + Zstandard, PyPI abuse vectors, conda vs pip, nab as a pip-resolver candidate. 🐍📦 bernat.tech/posts/pycon-... #PyConUS

bernat.techPyCon US 2026 Packaging Summit RecapPer-talk notes from the PyCon US 2026 Packaging Summit in Long Beach: Emma Smith on Wheel 2.0 and Zstandard compression, Mike Fiedler on PyPI abuse vectors, Mahe Iram Khan on ecosystems, lightning tal...

Jaime Rodríguez-Guerra reposted

Andras Bacsai
@heyandras.dev

We made a fake repo with fake bounties, and the bots are applying fake PRs, so we know who is fake, and we can ban them from the Coolify repo. IQ over 1000

Jaime Rodríguez-Guerra reposted

daniel:// stenberg://
@bagder.mastodon.social.ap.brid.gy

#Mythos finds a #curl vulnerability yes, as in singular one. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

daniel.haxx.seMythos finds a curl vulnerabilityyes, as in singular _one_. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model _Mythos_ is _dangerously good_ at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead trickle it out to a selected few companies for a while to allow a few good ones(?) to get a head start and fix the most pressing problems first, before the general populace would get their hands on it. The whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure. ## My (non-) access Part of the deal with _project Glasswing _was that Anthropic also offered access to their latest AI model to “Open Source projects” via Linux Foundation. Linux Foundation let their project Alpha Omega handle this part, and I was contacted by their representatives. As lead developer of curl I was offered access to the magic model and I graciously accepted the offer. Sure, I’d like to see what it can find in curl. I signed the contract for getting access, but then nothing happened. Weeks went past and I was told there was a hiccup somewhere and access was delayed. Eventually, I was instead offered that someone else, who has access to the model, could run a scan and analysis on curl for me using Mythos and send me a report. To me, the distinction isn’t that important. It’s not that I would have a lot of time to explore lots of different prompts and doing deep dive adventures anyway. Getting the tool to generate a first proper scan and analysis would be great, whoever did it. I happily accepted this offer. (I am purposely leaving out the identity of the individual(s) involved in getting the curl analysis done as it is not the point of this blog post.) ## AI scans of curl Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean _in addition to_ running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc). Primarily AISLE, Zeropath and OpenAI’s Codex Security have been used to scrutinize the code with AI. These tools and the analyses they have done have triggered somewhere between _two and three hundred_ bugfixes merged in curl through-out the recent 8-10 months or so. A bunch of the findings these AI tools reported were confirmed vulnerabilities and have been published as CVEs. Probably a dozen or more. Nowadays we also use tools like GitHub’s Copilot and Augment code to review pull requests, and their remarks and complaints help us to land better code and avoid merging new bugs. I mean, we still merge bugs of course but the PR review bots regularly highlight issues that we fix: our merges would be worse without them. The AI reviews are used _in addition_ to the human reviews. They help us, they don’t replace us. We also see a high volume of high quality security reports flooding in: security researchers now use AI extensively and effectively. Security is a _top_ _priority_ for us in the curl project. We follow every guideline and we do software engineering properly, to reduce the number of flaws in code. Scanning for flaws is just one of many steps to keep this ship safe. You need to search long and hard to find another software project that makes as much or goes further than curl, for software security. Steps involved in keeping curl secure ## May 6, 2026 It was with great anticipation we received the first source code analysis report generated with Mythos. Another chance for us to find areas to improve and bugs to fix. To make an even better curl. This initial scan was made on curl’s git repository and its master branch of a certain recent commit. It counted 178K lines of code analyzed in the src/ and lib/ subdirectories. The analysis details several different approaches and methods it has performed the search, and how it has focused on trying to find which flaws. A fun note in the top of the report says: > curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely. … and it correctly found no problems in those areas. Completely unscientific poll on Mastodon about people’s expectations for Mythos scanning curl ## The size of curl curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Piece. On average, every single production source code line of curl has been written (and then rewritten) 4.14 times. We have polished on this. Right now, the existing production code in git master that still remains, has been authored by 573 separate individuals. Over time, a total of 1,465 individuals have so far had their proposed changes merged into curl’s git repository. We have published 188 CVEs for curl up until now. curl is installed in over _twenty million instances_. It runs on over _110 operating systems_ and _28 CPU architectures_. It runs in every smart phone, tablet, car, TV, game console and server on earth. ## Five findings became one The report concluded it found **five** “Confirmed security vulnerabilities”. I think using the term _confirmed_ is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take. Five issues felt like nothing as we had expected an extensive list. Once my curl security team fellows and I had poked on the this short list for a number of hours and dug into the details, we had trimmed the list down and were left with _one_ confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”. The single confirmed vulnerability is going to end up a _severity low_ CVE planned to get published in sync with our pending next curl release 8.21.0 in late June. The flaw is not going to make anyone grasp for breath. All details of that vulnerability will of course not get public before then, so you need to hold out for details on that. The Mythos report on curl also contained a number of spotted bugs that it concluded were not vulnerabilities, much like any new code analyzer does when you run it on hundreds of thousands of lines of code. All the bugs in the report are being investigated and one bye one we are fixing those that we agree with. All in all about twenty bugs that are described and explained very nicely. Barely any false positives, so I presume they have had a rather high threshold for certainty. curl is certainly getting better thanks to this report, but counted by the volume of issues found, all the previous AI tools we have used have resulted in larger bugfix amounts. This is only natural of course since the first tools we ran had many more and easier bugs to find. As we have fixed issues along the way, finding new ones are slowly becoming harder. Additionally, a bug can be small or big so it’s not always fair to just compare numbers ## Not particularly “dangerous” My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing. This is just _one_ source code repository and maybe it is much better on other things. I can only tell and comment on what it found here. ## Still very good But allow me to highlight and reiterate what I have said before: AI powered code analyzers are _significantly_ better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real. Any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws, bugs and possible vulnerabilities with this new generation of tools. Mythos will, and so will many of the others. Not using AI code analyzers in your project means that you leave adversaries and attackers time and opportunity to find and exploit the flaws you don’t find. ## How AI analyzers differ * They can spot when the comment says something about the code and then conclude that the code does not work as the comment says. * It can check code for platforms and configurations we otherwise cannot run analyzers for * It “knows” details about 3rd party libraries and their APIs so it can detect abuse or bad assumptions. * It “knows” details about protocols curl implements and can question details in the code that seem to violate or contract protocol specifications * They are typically good at summarizing and explaining the flaw, something which can be rather tedious and difficult with old style analyzers. * They can often generate and offer a patch for its found issue (even if the patch usually is not a 100% fix). ## More details from the report **Zero memory-safety vulnerabilities found.** Methodology note: this review is hand-driven analysis using LLM subagents for parallel file reads, with every candidate finding re-verified by direct source inspection in the main session before being recorded. The CVE to variant-hunt mapping was built from curl’s own vuln.json. No automated SAST tooling was used. This outcome is consistent with curl’s status as one of the most heavily fuzzed and audited C codebases. The defensive infrastructure (capped dynbufs everywhere, `curlx_str_number` with explicit max on every numeric parse, `curlx_memdup0` overflow guard, CURL_PRINTF format-string enforcement, per-protocol response-size caps, pingpong 64KB line cap) systematically closes the bug classes that would normally be productive in a codebase this size. Coverage now includes: all minor protocols, all file parsers, all TLS backends’ verify paths, http/1/2/3, ftp full depth, mprintf, x509asn1, doh, all auth mechanisms, content encoding, connection reuse, session cache, CLI tool, platform-specific code, and CI/build supply chain. ## AI finds existing kinds of errors It should be noted that the AI tools find the usual and established kind of errors we already know about. It just finds new instances of them. We have not seen any AI so far report a vulnerability that would somehow be of a novel kind or something totally new. They do not reinvent the field in that way, but they do dig up more issues than any other tools did before. ## More to find These were absolutely not the last bugs to find or report. Just while I was writing the drafts for this blog post we have received more reports from security researchers about suspected problems. The AI tools will improve further and the researchers can find new and different ways to prompt the existing AIs to make them find more. We have not reached the end of this yet. I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems. ## Credits Thanks to Anthropic and Alpha Omega for providing the model, the tools and doing the scan for us. Thanks also to the individual who did the scan for us. Much appreciated! Top image by Jin Kim from Pixabay Thanks for flying curl. It’s never dull.

Jaime Rodríguez-Guerra reposted

QueerAF
@wearequeeraf.com

Geocities, a gay owned start up, was one of the first to give people tools to make their own web pages - when Yahoo deleted it, queer and Trans+ archives were lost www.wearequeeraf.com/geocities-a-...

wearequeeraf.comGeocities: a cautionary tale of how Trans+ history can be deleted with one clickGeocities, a gay owned start up, was one of the first to give people tools to make their own web pages - when Yahoo deleted it, queer and Trans+ archives were lost
Jaime Rodríguez-Guerra
@jaimergp.dev

Two of the PyConDE sprints will be dedicated to the @conda.org ecosystem! I'll lead the session on conda-smithy, one of the tools behind @conda-forge.org! ・📍 Where: Darmstadt, Germany ・📅 When: Monday, Apr 13th 2026 ・🌐 More info: 2026.pycon.de/sprints/#acc...

2026.pycon.de🏁 Sprint Day at PyConDE & PyData Darmstadt 2026Join PyCon DE & PyData 2026 in Darmstadt (Frankfurt), April 14-17! Germany’s largest Python, data and AI conference with talks, workshops, and the best community. Be part of the action!
PyCon DE & PyData@pyconde.bsky.social

🏁 Sprint Day at PyConDE & PyData Darmstadt 2026 — registration is still open! All 6 projects are confirmed and ready for contributors! Monday, 13 April 2026 · Darmstadt · €5 · Lunch & coffee provided ☕ 👉 2026.pycon.de/sprints/

Jaime Rodríguez-Guerra reposted

Quansight
@quansight.com

46,500 hours. 35+ open source projects. One community-driven mission. 🌟 The Quansight Annual Report 2025 is officially live! This year’s report celebrates our team, community, and partners who make this work possible. 🔗 Explore the report: buff.ly/KRo5vUN

Jaime Rodríguez-Guerra
@jaimergp.dev

This was a lot of work but I'm so happy we could make it happen as a community. Huge thanks to the steering council and everyone that participated in the discussion!

conda@conda.org

The conda steering council recently approved a set of CEPs (conda enhancement proposals) that effectively standardize the conda ecosystem. This is a big milestone worth celebrating! 🎉 Full details at conda.org/blog/2026-03...

conda.orgStandardization of the conda ecosystem | conda.orgHow the conda ecosystem adopted a new set of voted standards and specifications

Jaime Rodríguez-Guerra reposted

Ax=b
@melissawm.pynews.com.br.ap.brid.gy

Hi folks, I'm trying to put together a list of AI generated contribution policies for different open source projects. Do you have any you can link to me here? You can also directly submit a PR to https://github.com/melissawm/open-source-ai-contribution-policies

github.comGitHub - melissawm/open-source-ai-contribution-policies: A list of policies by different open source projects about how to engage with AI-generated contributions.A list of policies by different open source projects about how to engage with AI-generated contributions. - melissawm/open-source-ai-contribution-policies

Jaime Rodríguez-Guerra reposted

Matthew Feickert
@matthewfeickert.com

Question scoped to software in physics: Do you currently use PPC64LE architecture hardware for anything in your scientific workflow and is it important to you to have binary builds of software for that machine? Are there high impact examples that you can think of? Or is everything x64 or aarch64?

Jaime Rodríguez-Guerra reposted

conda
@conda.org

Anaconda.org and conda adopt sharded repodata! 🚀 CEP 16, introduced by @prefix.dev, splits the massive repodata files into per-project shards. This allows clients to only fetch what they need, resulting in significant speedups! Instructions to opt-in and benchmarks at buff.ly/XUSXp9h

Jaime Rodríguez-Guerra reposted

Jacob Tomlinson
@jacobtomlinson.dev

For Python package management I use a mixture of pixi, uv and conda depending on the task I'm doing. I wrote up a long form post about the history of these tools, why each one exists, and why I settled on these choices in my workflow. jacobtomlinson.dev/posts/2025/p...

jacobtomlinson.devPython package managers: uv vs pixi?When I talk to people about Python package management in 2025 I see the following tools in active use; uv, pixi, pip, conda, mamba, micromamba and poetry. There may be others, but I don’t hear much ab...

Jaime Rodríguez-Guerra reposted

conda
@conda.org

Conda ≠ PyPI Conda isn’t just another Python package manager-it’s a multi-language, user-space distribution system. In this 3-part series, we explore the fundamental differences between conda and PyPI. Part 1 is live now 👇 conda.org/blog/conda-i... #conda #packaging #python

conda.orgConda ≠ PyPI: Why Conda Is More Than a Package Manager | conda.orgPart 1 of the 'Conda Is Not PyPI' series—why conda is a multi-language user-space distribution, not just a Python package manager.

Jaime Rodríguez-Guerra reposted

napari
@napari.org

napari 0.6.6 is out! 🚀 This is a bugfix release following up 0.6.5: if something in your napari workflow unexplicably broke, you might want to update ;) Also, with the new bundle you can now "open files with > napari"! Check out the full release notes on the website: napari.org/stable/relea...

napari.orgnapari: a fast, interactive viewer for multi-dimensional images in Pythonview and explore 2D, 3D, and higher-dimensional arrays on a canvas;, overlay derived data such as points, polygons, segmentations, and more;, annotate and edit derived datasets, using standard data st...
Jaime Rodríguez-Guerra
@jaimergp.dev

Part of the submission includes a couple of applications: - pyproject-external: CLI to show and map the PEP 725 [external] tables - external-metadata-mappings: schemas and example mappings for common identifiers. You can browse them in this Streamlit app: external-metadata-mappings.streamlit.app

external-metadata-mappings.streamlit.appPEP 725 registry and mappings browserThis repository prototypes schemas for PEP-725-adjacent PURL-like registry and downstream mapping...