Top all-time · #1464
Seth Larson
Personal blog · sethmlarson.dev · on HN as SethMLarsonprogrammingsecurity
Seth Larson's personal blog at sethmlarson.dev covers programming and security. Since 2019, 48 different Hacker News readers have linked it 129 times, most often “Deprecations via warnings don't work for Python libraries”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link Seth Larson's posts on AI-generated security reports, deprecation warnings, Python typing, and urllib3. Commenters cite them as support for points on open source maintenance and Python.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Python, open source, and the internet
Most-linked posts?
- Deprecations via warnings don't work for Python libraries4 people · 4 mentions · first linked 2025-12-08
- New era of slop security reports for open source4 people · 4 mentions · first linked 2024-12-03
- Help us test system trust stores in Python3 people · 3 mentions · first linked 2022-07-26
- Urllib3 is fundraising for HTTP/2 support3 people · 3 mentions · first linked 2024-01-16
- People in your software supply chain3 people · 3 mentions · first linked 2022-05-31
- Hand-Drawn QR Codes3 people · 3 mentions · first linked 2025-07-01
- Urllib3 v2.0.0 is now generally available3 people · 3 mentions · first linked 2023-04-26
- Add Animal Crossing events to your digital calendar3 people · 3 mentions · first linked 2026-04-14
- Open source package urllib3 raised $15,000 in 20213 people · 3 mentions · first linked 2021-12-29
- Security for package maintainers3 people · 3 mentions · first linked 2022-03-01
What Hacker News says?
You can disable YouTube Shorts (kinda) by disabling history: https://sethmlarson.dev/youtube-without-youtube-shorts
Comment linking /youtube-without-youtube-shorts
on “Show HN: I built an app to block Shorts and Reels”Submitted Regex character "$" doesn't mean "end-of-string" as a story · 437 points
HN discussionNo, changing this breaks the world. A huge fraction of PyPI becomes completely invalid overnight, and the rest fails the expected version checks. Not to mention that the language is fundamentally designed around the expectation that modules are singleton. I've written about this at length before but I can't easily find it right now (I have way too many bookmarks and not nearly enough idea how to organize them). Yes,…
Comment linking /winning-a-bet-about-six-the-python-2-compatibility-shim
on “PEP 810 – Explicit lazy imports”Submitted How UTF-8 Works as a story · 359 points
HN discussionOpen source maintainers have been complaining about this for a while. https://sethmlarson.dev/slop-security-reports . I'm assuming the proliferation of AI will have some significant changes on/already has had for open source projects.
Comment linking /slop-security-reports
on “XBOW, an autonomous penetration tester, has reached the top spot on HackerOne”Submitted Scream cipher as a story · 300 points
HN discussionHehe, just participating in POSSE :) Funnily enough the story you're linking to quotes me with pictures of a story I wrote ( https://sethmlarson.dev/slop-security-reports ) about LLM-generated reports to open source projects.
Comment linking /slop-security-reports
on “I fear for the unauthenticated web”Submitted Tests aren’t enough: Case study after adding type hints to urllib3 as a story · 205 points
HN discussionPotential solution? Works for me but some folks like history: https://sethmlarson.dev/youtube-without-youtube-shorts
Comment linking /youtube-without-youtube-shorts
on “The Fediverse is getting its own TikTok competitor called Loops”Submitted When str.lower() is a security vulnerability in Python as a story · 178 points
HN discussionThis a a great example of good work getting 'upstreamed.' The go-to solution for using requests and urllib3 in the browser had been Koen Vossen's 'pyodide-http' package, which you'd install in PyScript/Pyodide and then call 'pyodide_http.patch_all()`. It monkey-patched requests and urllib3 to use the browser API's. [1] Then 'pyodide-http' got adopted into the Pyodide-included packages[2], so you didn't have to speci…
Comment linking /urllib3-is-fundraising-for-http2-support
on “Python HTTP library 'urllib3' now works in the browser”Submitted Strict Python function parameters as a story · 132 points
HN discussionI found the referenced article linked at the top interesting: https://sethmlarson.dev/deprecations-via-warnings-dont-work-... The underlying complaint seems to be about libraries, rather than user behavior.
Comment linking /deprecations-via-warnings-dont-work-for-python-libraries
on “Deprecate like you mean it”Submitted I fear for the unauthenticated web as a story · 117 points
HN discussion> What if we intentionally made deprecated functions return the wrong result … sometimes? Every time it intentionally returns the wrong result, it logs the deprecation warning.1 What if we found that a highway overpass construction material was suboptimal, and we want people to use superior materials, so, every now and then, we send a chunk of concrete plummeting down to the ground, to kill a motorist? Thanks to dep…
Comment linking /deprecations-via-warnings-dont-work-for-python-libraries
on “Deprecate like you mean it”Submitted Get Paid to Contribute to Urllib3 as a story · 102 points
HN discussion> "I suspect this report is (AI-generated|incorrect|spam). Please respond with more justification for this report. See: https://sethmlarson.dev/slop-security-reports " could an AI bot be trained to recognize low-quality security reports and automatically respond as such? at the risk of escalating the inevitable arms race, of course.
Comment linking /slop-security-reports
on “New era of slop security reports for open source”Submitted How do I pay the publisher of a web page? as a story · 85 points
HN discussionI'm a bit surprised at the vitriol here for even just type hints, much less even static typing. I'll admit that static typing is probably more pain than most python devs are willing to pay, but I will die on the hill of type hints being an essential contribution to the language that vastly improves its capabilities. But don't take it from me, take it from the people who wrote urllib3 [1], who insist that typing is e…
Comment linking /blog/tests-arent-enough-case-study-after-adding-types-to-urllib3
on “Please, stop pushing for static typing in Python”Submitted Deprecations via warnings don't work for Python libraries as a story · 63 points
HN discussionWebAuthN: https://en.wikipedia.org/wiki/WebAuthn FIDO2: https://en.wikipedia.org/wiki/FIDO2_Project Arch/WebAuthN: https://wiki.archlinux.org/title/WebAuthn U2F/FIDO2: https://wiki.archlinux.org/title/Universal_2nd_Factor TPM: https://wiki.archlinux.org/title/Trusted_Platform_Module#Oth... Seahorse: https://en.wikipedia.org/wiki/Seahorse_(software) GNOME Keyring: https://en.wikipedia.org/wiki/GNOME_Keyring tpmfido:…
Comment linking /blog/help-test-system-trust-stores-in-python
on “Bringing Modern Authentication APIs (FIDO2 WebAuthn, Passkeys) to Linux Desktop”Submitted Security for package maintainers as a story · 44 points
HN discussionSubmitted Fediverse Donut Club as a story · 39 points
HN discussionSubmitted New era of slop security reports for open source as a story · 34 points
HN discussionSubmitted Draft SMS and iMessage from any computer keyboard as a story · 23 points
HN discussionSubmitted Open source package urllib3 raised $15,000 in 2021 as a story · 18 points
HN discussionSubmitted People in your software supply chain as a story · 12 points
HN discussionSubmitted Don't bring slop to a slop fight as a story · 10 points
HN discussionSubmitted Winning a bet about "six", the Python 2 compatibility shim as a story · 9 points
HN discussionSubmitted Deprecations via warnings don't work for Python libraries as a story · 8 points
HN discussion
