Python Daily
2.57K subscribers
1.48K photos
53 videos
2 files
38.9K links
Daily Python News
Question, Tips and Tricks, Best Practices on Python Programming Language
Find more reddit channels over at @r_channels
Download Telegram
Django security best practices for software engineers.

Hi all,

I'm Ahmad, founder of Corgea. We've built a scanner that can find vulnerabilities in Django applications, so we decided to write a guide for software engineers on Django security best practices: https://corgea.com/Learn/django-security-best-practices-a-comprehensive-guid-for-software-engineers

We wanted to cover Django's security features, things we've seen developers do that they shouldn't, and all-around best practices. While we can't go into every detail, we've tried to cover a wide range of topics and gotcha's that are typically missed.

I'd love to get feedback from the community. Is there something else you'd include in the article? What's best practice that you've followed?

Thanks!

PS: we're using Django too for some of our services ❤️

/r/django
https://redd.it/1ic9c1w
etl4py - Beautiful, whiteboard-style, typesafe dataflows for Python

https://github.com/mattlianje/etl4py

What my project does

etl4py is a simple DSL for pretty, whiteboard-style, typesafe dataflows that run anywhere - from laptop, to massive PySpark clusters to CUDA cores.

Target audience

Anyone who finds themselves writing dataflows or sequencing tasks - may it be for local scripts or multi-node big data workflows. Like it? Star it ... but issues help more 🙇‍♂️

Comparison

As far as I know, there aren't any libraries offering this type of DSL (but lmk!) ... although I think overloading >> is not uncommon.

Quickstart:

from etl4py import

# Define your building blocks
five_extract: Extract[None, int] = Extract(lambda _:5)
double: Transform[int, int] = Transform(lambda x: x
2)
add10: Transform[int, int] = Extract(lambda x: x + 10)

attempts = 0
def risky
transform(x: int) -> int:
global attempts; attempts += 1
if attempts <= 2: raise

/r/Python
https://redd.it/1ic9b2m
PyPI security funding in limbo as Trump executive order pauses NSF grant reviews

Seth Larson, PSF Security-Developer-in-Residence, posts on LinkedIn:

> The threat of Trump EOs has caused the National Science Foundation to pause grant review panels. Critically for Python and PyPI security I spent most of December authoring and submitting a proposal to the "Safety, Security, and Privacy of Open Source Ecosystems" program. What happens now is uncertain to me.

> Shuttering R&D only leaves open source software users more vulnerable, this is nonsensical in my mind given America's dependence on software manufacturing.

> https://www.npr.org/sections/shots-health-news/2025/01/27/nx-s1-5276342/nsf-freezes-grant-review-trump-executive-orders-dei-science

This doesn't have immediate effects on PyPI, but the NSF grant money was going to help secure the Python ecosystem and supply chain.

/r/Python
https://redd.it/1iccu2q
Wednesday Daily Thread: Beginner questions

# Weekly Thread: Beginner Questions 🐍

Welcome to our Beginner Questions thread! Whether you're new to Python or just looking to clarify some basics, this is the thread for you.

## How it Works:

1. Ask Anything: Feel free to ask any Python-related question. There are no bad questions here!
2. Community Support: Get answers and advice from the community.
3. Resource Sharing: Discover tutorials, articles, and beginner-friendly resources.

## Guidelines:

This thread is specifically for beginner questions. For more advanced queries, check out our [Advanced Questions Thread](#advanced-questions-thread-link).

## Recommended Resources:

If you don't receive a response, consider exploring r/LearnPython or join the Python Discord Server for quicker assistance.

## Example Questions:

1. What is the difference between a list and a tuple?
2. How do I read a CSV file in Python?
3. What are Python decorators and how do I use them?
4. How do I install a Python package using pip?
5. What is a virtual environment and why should I use one?

Let's help each other learn Python! 🌟

/r/Python
https://redd.it/1icge4n
Problem with env variables

I'm trying to set up an email sending system. The problem is that if I set MAIL_SERVER and MAIL_PORT their values ​​always remain None. How can I solve it?

/r/flask
https://redd.it/1ic7n1s
Alternatives to session and global variables in flask

I currently am making an app that will query weather data from an AWS bucket and display it on a map. Right now I am using global variables to store progress data (small dictionary that records amount of files read, if program is running, etc) and the names of files that match certain criteria. However, I understand this is bad pratice for a web app. When trying to look for alternatives, I discovered flask's session, but my "results" variable will need to store anywhere from 50-100 filenames, with the possibility of having up to 2700. From my understanding this list of files seems like way too much data for a session variable. When I tested the code, 5 filenames was 120 bytes, so I think that its pretty impossible to stay under 4kb. Does anyone have any ideas instead? Once a user closes the tab, the data is not important (there are download functions for maps and files). I would perfer not to use a db, but will if that is outright the best option.



/r/flask
https://redd.it/1icknxu
The scale vs. intelligence trade-off in retrieval augmented generation Discussion

Retrieval Augmented Generation (RAG) has been huge in the past year or two as a way to supplement LLMs with knowledge of a particular set of documents or the world in general. I've personally worked with most flavors of RAG quite extensively and there are some fundamental limitations with the two fundamental algorithms (long-context, and embedding) which almost all flavors of RAG are built on. I am planning on writing a longer and more comprehensive piece on this, but I wanted to put some of my thoughts here first to get some feedback and see if there are any perspectives I might be missing.

Long-context models (e.g. Gemini), designed to process extensive amounts of text within a single context window, face a critical bottleneck in the form of training data scarcity. As context lengths increase, the availability of high-quality training data diminishes rapidly. This is important because of the neural scaling laws, which have been remarkably robust for LLMs so far. There is a great video explaining them here. One important implication is that if you run out of human-generated training data, the reasoning capabilities of your model are bottle-necked no matter how many other resources or tricks you throw at

/r/MachineLearning
https://redd.it/1ick63j
Guidance for junior backend developer

I am pursuing BCA ( Bachelor of Computer Application ) from IGNOU ( Indira Gandhi National Open University ) . I am in last semester. And now I have completed internship as a backend developer and after that gained experience as a junior django backend developer. But at that time I acknowledge that I didn't learn enough much or confidence that I am able to work on any project.. I can not quit job and also not one will give me job . What should I do now 🫠

/r/django
https://redd.it/1icm5ww
DeepSeek Infinite Context Window

What my project does?

Input arbitrary length of text into LLM model. With models being so cheap and strong I came up with an idea to make a simple "Agent" that will refine the infinite context size to something manageable for LLM to answer from instead of using RAG. For very large contexts you could still use RAG + "infinite context" to keep the price at pay.

How it works?


1. We take a long text and split it into chunks (like with any RAG solution)
2. Until we have reduced text to model's context we repeat
1. We classify each chunk as either relevant or irrelevant with the model
2. We take only relevant chunks
3. We feed the high-quality context to the final model for answering (like with any RAG solution)

Target audience

For anyone needing high-quality answers, speed and price are not priorities.

Comparison

Usually context reduction is done via RAG - embeddings, but with the rise of reasoning models, we can perform a lot better and more detailed search by directly using models capabilities.

Full code Github link: Click

/r/Python
https://redd.it/1icpk3z
How to implement protected routes with allauth dj-rest?

I have been stuck for days with oauth. I managed to login with oauth using allauth then I was looking for a way to token based authentication for my drf restapi endpoint. That is why I implemented dj-rest auth.

http://localhost:8000/accounts/github/login/callback/



  repath('dj-rest-auth/', include('djrestauth.urls')),
    re
path('dj-rest-auth/github/', GitHubLogin.asview(), name='githublogin'),

Then I have a social provider with client id and client secret.

When I add this url Git Hub Login – Django REST framework to my url it shows me drf page where I need to add access token and code and token id to make a request. I have missed something here. Can someone help me?



/r/django
https://redd.it/1icqlfw
Any good Flask study resource or playlist?

All youtube videos I can search are already old. Which resource do you recommend?

/r/flask
https://redd.it/1icv06w
deployed my flask app, the apis donot work, help

index.html works well while the apis return 404 error in vercel, can anyone help me

/r/flask
https://redd.it/1ictqry
This media is not supported in your browser
VIEW IN TELEGRAM
I recreated the django admin "green plus popup form" in the frontend with HTMX

/r/django
https://redd.it/1icxl9e
Host your Python app for $1.28 a month

Hey 👋

I wanted to share my technique ( and python code) for cheaply hosting Python apps on AWS.

**https://www.pulumi.com/blog/serverless-api/**

40,000 requests a month comes out to $1.28/month! I'm always building side projects, apps, and backends, but hosting them was always a problem until I figured out that AWS lambda is super cheap and can host a standard container.

💰 The Cost:

Only $0.28/month for Lambda (40k requests)
About $1.00 for API Gateway/egress
Literally $0 when idle!
Perfect for side projects and low traffic internal tools

🔥 What makes it awesome:

1. Write a standard Flask app
2. Package it in a container
3. Deploy to Lambda
4. Add API Gateway
5. Done!

The beauty is in the simplicity - you just write your Flask app normally, containerize it, and let AWS handle the rest. Yes, there are cold starts, but it's worth it for low-traffic apps, or hosting some side projects. You are sort of free-riding off the AWS ecosystem.

Originally, I would do this with manual setup in AWS, and some details were tricky ( example service and manual setup ) . But now that I'm at Pulumi, I decided to convert this all to some Python Pulumi code and get it out on the blog.

How are you currently

/r/Python
https://redd.it/1ics9vi
Planning to shift career From Golang Developer to Python (Django) Developer

Currently working as a Golang Developer In a startup for the past 2 years, Now I have an opportunity from another startup for python fullstack developer role. I'm Fine with Golang but I only know the basics of Python. What are all the things to do to learn Django with htmx..?
I'm on notice period having 30 days to join the other company
Can anybody share the roadmap/ suggestions for this.

/r/django
https://redd.it/1iczarc
Performance Benchmarks for ASGI Frameworks

# Performance Benchmark Report: MicroPie vs. FastAPI vs. Starlette vs. Quart vs. LiteStar

# 1. Introduction

This report presents a detailed performance comparison between four Python ASGI frameworks: MicroPie, FastAPI, LiteStar, Starlette, and Quart. The benchmarks were conducted to evaluate their ability to handle high concurrency under different workloads. Full disclosure I am the author of MicroPie, I tried not to show any bias for these tests and encourage you to run them yourself!

Tested Frameworks:

[MicroPie](https://patx.github.io/micropie) \- "an ultra-micro ASGI Python web framework that gets out of your way"
FastAPI \- "a modern, fast (high-performance), web framework for building APIs"
[Starlette](https://www.starlette.io/) \- "a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python"
Quart \- "an asyncio reimplementation of the popular Flask microframework API"
[LiteStar](https://litestar.dev/) \- "Effortlessly build performant APIs"

Tested Scenarios:

/ (Basic JSON Response) Measures baseline request handling performance.
`/compute` (CPU-heavy Workload): Simulates computational load.
/delayed (I/O-bound Workload): Simulates async tasks with an artificial delay.

Test Environment:

CPU: Star Labs StarLite Mk IV
Server: Uvicorn (4 workers)
Benchmark Tool: `wrk`
Test Duration: 30 seconds per endpoint
Connections: 1000 concurrent connections
Threads: 4

# 2. Benchmark Results

# Overall Performance Summary

|Framework|/ Requests/sec|Latency (ms)|Transfer/sec|/compute Requests/sec|Latency (ms)|Transfer/sec|/delayed Requests/sec|Latency (ms)|Transfer/sec|
|:-|:-|:-|:-|:-|:-|:-|:-|:-|:-|
|Quart|1,790.77|550.98ms|824.01 KB|1,087.58|900.84ms|157.35 KB|1,745.00|563.26ms|262.82 KB|
|FastAPI|2,398.27|411.76ms|1.08 MB|1,125.05|872.02ms|162.76 KB|2,017.15|488.75ms|303.78

/r/Python
https://redd.it/1id4vt7
Thursday Daily Thread: Python Careers, Courses, and Furthering Education!

# Weekly Thread: Professional Use, Jobs, and Education 🏢

Welcome to this week's discussion on Python in the professional world! This is your spot to talk about job hunting, career growth, and educational resources in Python. Please note, this thread is not for recruitment.

---

## How it Works:

1. Career Talk: Discuss using Python in your job, or the job market for Python roles.
2. Education Q&A: Ask or answer questions about Python courses, certifications, and educational resources.
3. Workplace Chat: Share your experiences, challenges, or success stories about using Python professionally.

---

## Guidelines:

- This thread is not for recruitment. For job postings, please see r/PythonJobs or the recruitment thread in the sidebar.
- Keep discussions relevant to Python in the professional and educational context.

---

## Example Topics:

1. Career Paths: What kinds of roles are out there for Python developers?
2. Certifications: Are Python certifications worth it?
3. Course Recommendations: Any good advanced Python courses to recommend?
4. Workplace Tools: What Python libraries are indispensable in your professional work?
5. Interview Tips: What types of Python questions are commonly asked in interviews?

---

Let's help each other grow in our careers and education. Happy discussing! 🌟

/r/Python
https://redd.it/1id8oap
D Why is most mechanistic interpretability research only published as preprints or blog articles ?

The more I dive into this topic, the more I see that the common practice is to publish your work on forums as blog articles instead of in peer-reviewed publications.

This makes work less trust-worthy and credible. I see that Anthropic does not publish on conferences as you can't reproduce their work. However, there is still a large amount of work "only" available as blog articles.

/r/MachineLearning
https://redd.it/1icw2pi
Object oriented programming with python

Hello,

I have a bit of hard time understanding OOP in python such as class, instance, method, class variable, instance variable, instantiation, and etc. Are there good video clips where I can conceptualize this logic visually and explain well? I feel like I kinda understand but then I am not 100% sure if I get the concept correctly. It's a bit confusing for me to understand clearly on these topics. I was wondering if there is a resource which explains these concepts very well with line by line interpretation of what they are and what they do in python coding. Thanks in advance!

/r/Python
https://redd.it/1id8t6d