Uploaded September 2025 | Updated September 2026, 3 hours ago
(Nicky Ringland, Tim Zhang) Number 5 will shock you!
Forget what you think you know about robust dependency graphs, the security gains of living at Head, and those supposedly solid requirements.txt. We'll get down to the nitty-gritty of open source security, giving you real-world large-scale insights to understanding common misconceptions across programming ecosystems.
While it’s true that there is only one dependency graph* (*for you) (*right now) it’s not always understood what impact this can have at an ecosystem level.
We’ve got ecosystem level stats on just how many PURLs map to multiple different packages, dependency graph shifts that happen faster than you can type git commit, and some surprises with Git (im)mutability!
We will talk about vulnerabilities in your transitive dependencies, understanding what even ARE your dependencies, and trying to identify what that one (*for certain values of one) CVE you were supposedly affected by actually is. (Not to mention what, if anything, you can do about it.)
You’ll leave this talk with a better understanding of open source edge cases and just how common they are. You’ll be shocked, amazed, horrified, and hopefully a little optimistic about the state of open source security and your place within it.
pretalx.com/pycon-au-2025/talk/GVEQKY
python, pycon, australia, programming, conference, technical, developers, panel, sessions, libraries, frameworks, community, sysadmins, students, education, data, science
Videos licensed as CC-BY-NC-SA 4.0
PyCon AU is the national conference for the Python programming community, bringing together professional, student and enthusiast developers, sysadmins and operations folk, students, educators, scientists, statisticians, and many others besides, all with a love for working with Python.
Licensed as CC BY-NC-SA - creativecommons.org/licenses/by-nc-sa/4.0
Produced by Next Day Video Australia: https://nextdayvideo.com.au
Sun Sep 14 14:00:00 2025 at Ballroom 2
(Nicky Ringland, Tim Zhang) Number 5 will shock you!
Forget what you think you know about robust dependency graphs, the security gains of living at Head, and those supposedly solid requirements.txt. We'll get down to the nitty-gritty of open source security, giving you real-world large-scale insights to understanding common misconceptions across programming ecosystems.
While it’s true that there is only one dependency graph* (*for you) (*right now) it’s not always understood what impact this can have at an ecosystem level.
We’ve got ecosystem level stats on just how many PURLs map to multiple different packages, dependency graph shifts that happen faster than you can type git commit, and some surprises with Git (im)mutability!
We will talk about vulnerabilities in your transitive dependencies, understanding what even ARE your dependencies, and trying to identify what that one (*for certain values of one) CVE you were supposedly affected by actually is. (Not to mention what, if anything, you can do about it.)
You’ll leave this talk with a better understanding of open source edge cases and just how common they are. You’ll be shocked, amazed, horrified, and hopefully a little optimistic about the state of open source security and your place within it.
pretalx.com/pycon-au-2025/talk/GVEQKY
python, pycon, australia, programming, conference, technical, developers, panel, sessions, libraries, frameworks, community, sysadmins, students, education, data, science
Videos licensed as CC-BY-NC-SA 4.0
PyCon AU is the national conference for the Python programming community, bringing together professional, student and enthusiast developers, sysadmins and operations folk, students, educators, scientists, statisticians, and many others besides, all with a love for working with Python.
Licensed as CC BY-NC-SA - creativecommons.org/licenses/by-nc-sa/4.0
Produced by Next Day Video Australia: https://nextdayvideo.com.au
Sun Sep 14 14:00:00 2025 at Ballroom 2
