We've spoken previously about security and software supply chains and we are back at it this episode. We're diving in again with Charles Coggins. Charles works at a software supply chain company and is on to give us the insiders and defender's perspective on how to keep our Python apps and infrastructure safe. 
 
Episode sponsors 
 
<a href='https://talkpython.fm/sentry'>Sentry Error Monitoring, Code TALKPYTHON</a>
<a href='https://talkpython.fm/mailtrap'>Mailtrap</a>
<a href='https://talkpython.fm/training'>Talk Python Courses</a> 
 
Links from the show 
 
<div>Pick a Python Lockfile and Improve Security: <a href="https://blog.phylum.io/pick-a-python-lockfile-and-improve-security/" target="_blank" rel="noopener">blog.phylum.io</a> 
Bad Beat Poetry: <a href="https://blog.phylum.io/bad-beat-poetry/" target="_blank" rel="noopener">blog.phylum.io</a> 
PEP 665 – A file format to list Python dependencies for reproducibility of an application: <a href="https://peps.python.org/pep-0665/" target="_blank" rel="noopener">peps.python.org</a> 
PEP 517 – A build-system independent format for source trees: <a href="https://peps.python.org/pep-0517/" target="_blank" rel="noopener">peps.python.org</a> 
PEP 518 – Specifying Minimum Build System Requirements for Python Projects: <a href="https://peps.python.org/pep-0518/" target="_blank" rel="noopener">peps.python.org</a> 
Lockfiles should be committed on all projects: <a href="https://classic.yarnpkg.com/blog/2016/11/24/lockfiles-for-all/" target="_blank" rel="noopener">classic.yarnpkg.com</a> 
An Overview of Software Supply Chain Security: <a href="https://tldrsec.com/p/supply-chain-security-overview" target="_blank" rel="noopener">tldrsec.com</a> 
Typosquatting: <a href="https://docs.phylum.io/analytics/typosquatting" target="_blank" rel="noopener">docs.phylum.io</a> 
Common Attack Pattern Enumeration and Classification: <a href="https://capec.mitre.org/data/definitions/693.html" target="_blank" rel="noopener">capec.mitre.org</a> 
Dependency Confusion: <a href="https://docs.phylum.io/analytics/dependency_confusion" target="_blank" rel="noopener">docs.phylum.io</a> 
Expired Author Domains: <a href="https://docs.phylum.io/analytics/expired_author_domains" target="_blank" rel="noopener">docs.phylum.io</a> 
Unverifiable Dependency: <a href="https://docs.phylum.io/analytics/odd_dependency" target="_blank" rel="noopener">docs.phylum.io</a> 
Repo Jacking: Hidden Danger in Broken Links: <a href="https://blog.phylum.io/repojacking-software-supply-chain-vulnerability/" target="_blank" rel="noopener">blog.phylum.io</a> 
Software Libraries Are Terrifying: <a href="https://medium.com/@dmrickert/software-libraries-are-terrifying-4875b6a74be6" target="_blank" rel="noopener">medium.com</a> 
phylum 0.43.0: <a href="https://pypi.org/project/phylum/" target="_blank" rel="noopener">pypi.org</a> 
linguist: <a href="https://github.com/github-linguist/linguist" target="_blank" rel="noopener">github.com</a> 
rich-codex ⚡️📖⚡️: <a href="https://ewels.github.io/rich-codex/" target="_blank" rel="noopener">ewels.github.io</a> 
Phylum Community Discord: <a href="https://discord.gg/Fe6pr5eW6p" target="_blank" rel="noopener">discord.gg</a> 
The dream is dead?: <a href="https://mastodon.social/@tveskov/111289358585305218" target="_blank" rel="noopener">mastodon.social</a> 
When "Everything" Becomes Too Much: The npm Package Chaos of 2024: <a href="https://socket.dev/blog/when-everything-becomes-too-much?utm_source=tldrnewsletter" target="_blank" rel="noopener">socket.dev</a> 
pip-tools: <a href="https://github.com/jazzband/pip-tools" target="_blank" rel="noopener">github.com</a> 
Watch this episode on YouTube: <a href="https://www.youtube.com/watch?v=uB-2nMphYBI" target="_blank" rel="noopener">youtube.com</a> 
Episode transcripts: <a href="https://talkpython.fm/episodes/transcript/457/software-supply-chain-security-with-phylum" target="_blank" rel="noopener">talkpython.fm</a> 
 
--- Stay in touch with us --- 
Subscribe to us on YouTube: <a href="https://talkpython.fm/youtube" target="_blank" rel="noopener">youtube.com</a> 
Follow Talk Python on Mastodon: <a href="https://fosstodon.org/web/@talkpython" target="_blank" rel="noopener">talkpython</a> 
Follow Michael on Mastodon: <a href="https://fosstodon.org/web/@mkennedy" target="_blank" rel="noopener">mkennedy</a> </div>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

#457: Software Supply Chain Security with Phylum

Talk Python To Me