This makes sense given how much of the current AI ecosystem is built on top of Python. I hope this helps the foundation improve security for everyone who relies on these libraries.
NPM is the other major source of issues (congrats for now, `cargo`!), and TIL that NPM is A) a for-profit startup (??) and B) acquired by Microsoft (????). In that light, this gift seems even more important, as it may help ensure that relative funding differences going forward don’t make PyPi an outsized target!
(Also makes me wonder if they still have a Microsoft employee running the PSF… always thought that was odd.)
AFAIU the actual PSF development team is pretty small and focused on CPython (aka language internals), so I’m curious how $750,000/year changes that in the short term…
EDIT: there’s a link below with a ton more info. This gift augments existing gifts from Amazon, Google, Microsoft, and Citi, and they soft-commit to a cause:
Planned projects include creating new tools for automated proactive review of all packages uploaded to PyPI, improving on the current process of reactive-only review. We intend to create a new dataset of known malware that will allow us to design these novel tools, relying on capability analysis.You might be confusing the Python Steering Council - responsible for leadership of Python language development - with the PSF non-profit there.
The PSF is lead by a full-time executive director who has no other affiliation, plus an elected board of unpaid volunteer directors (I'm one of them).
Microsoft employees occasionally get voted into the board, but there is a rule to make sure a single company doesn't have more than 2 representatives on the board at any one time,
The board also elects a chair/president - previously that was Dawn Wages who worked at Microsoft for part of that time (until March 2025 - Dawn was chair up to October), today it's Jannis Leidel from Anaconda.
Meanwhile the Python steering council is entirely separate from the PSF leadership, with their own election mechanism voted on by Python core contributors. They have five members, none of whom currently work for Microsoft (but there have been Microsoft employees in the past.)
Yes, I was talking about Wages -- the day-to-day is surely complex, but I'm sure you'd agree that the president of the board is ultimately "above" the chief executive if push ever came to shove, at least on paper. I will grant that I used "running", which is quite unclear in hindsight! "Responsible for" or "leading" seems more accurate.
She seemed great as policymaker and person, but when I last checked her job was literally to be Microsoft's Python community liason, and that just struck me as... dangerous? On the nose? Giving the reigns to someone from a for-profit, $1.5B corporation whose entire business depends directly upon the PSF's work also seems like an odd choice. Again, I'm sure they're great as an individual, and during normal operations there's no competing interests so it's fine. It's just...
I guess I just have a vision for the non-profit org guiding the world's most popular programming language that doesn't really mesh with the reality of open source funding as it exists today, at the end of the day; the "no 2 representatives from the same company" rule seems like a comforting sign that they(/y'all!) share that general philosophy despite the circumstances.
That is not true of the PSF, nor of many (most?) other US nonprofits. Not on paper, and not practically speaking. The director reports to the board, but officers have little to no unitary power. You can go read the PSF’s bylaws if you like, and if you do you’ll see that officers, including the president, can do very little without a board vote. And because of aforementioned policy, that’s a max of two votes from people employed by a single company.
Also, like, do you know anything about Dawn? She’s been serving the Python community waaaay longer than she’s worked for Microsoft. Questioning her ethics based on absolutely nothing is unfounded and, honestly, pretty fucked up.
There’s this pernicious lie that Microsoft is somehow controlling the PSF. It’s based on about as much evidence as there is for Flat Earth, yet here it is again. At best, repeating this lie reflects profound ignorance about how the PSF actually functions; at worst it seems like some kind of weird disinfo campaign against one of the most important nonprofits in open source.
> Section 5.15. Limits on Co-affiliation of Board Members. No more than one quarter (1/4) of the members of the Board of Directors may share a common affiliation as defined in Section 5.14.
The PSF allows three board members to share an affiliation, 13 seats * 0.25 ~= 3.25.
BTH, that's one too many, and I helped write/recommend the original language. When I was on the board, three felt like too many, even though everyone was wonderful, and it was Google, not Microsoft, that hit the limit.
The DSF (Django Software Foundation) recently adopted a two-person limit, which I recommend more boards consider.
B) Hacker news is crazy -- I didn't expect to spawn a thread that would get responses from actual board members, ex- or otherwise! I'd like to take a brief moment deep down into this thread to echo what I said to Simon above: thanks for giving your valuable time to help grow the best programming language & community to ever exist :)
I assume you have more experience than me in corporate governance, but this is such a fundamental truth that I've just gotta stick to my guns. The executives serve at the pleasure of the board. That's what the board is.
Also, like, do you know anything about Dawn? She’s been serving the Python community waaaay longer than she’s worked for Microsoft. Questioning her ethics based on absolutely nothing is unfounded and, honestly, pretty fucked up.
There’s this pernicious lie that Microsoft is somehow controlling the PSF. It’s based on about as much evidence as there is for Flat Earth, yet here it is again.
The fact of the matter is that the senior-most member of an important non-profit was/is employed in a lucrative, full-time, relatively open-ended role by a firm whose profits depend directly on the work of that non-profit. There's no accusations in that statement, and thus no room for it to be written off as a conspiracy theory.
In terms of why it matters: wouldn't it at least deserve a raised eyebrow if, say...
- The chair of the WHO was employed by J&J?
- The chair of the ACLU was employed by a political party?
- The chair of Make-A-Wish was employed by a Hollywood agency?
The position doesn't have much additional power at all - the chair spends a little more time with the executive director and gets to set the agenda for the board meetings, but board actions still require a vote from the board.
If we felt like an employee of a specific company was abusing their position on the PSF board we would take steps to address that. Thankfully I've seen no evidence of that from anyone during my time on the board.
If anything it's the opposite: board members are very good about abstaining from votes that their employer might have an interest in.