Hello from a new Security Developer

Core Development
1

Hi folks! You might’ve seen the blog post but I’m happy to introduce myself here. I’m Brett Smith and I just joined the PSF staff as a Security Developer. I’m going to be working with Seth and Mike to investigate and coordinate responses to security issues in Python and malware on PyPI.

My career has had a mix of software development, Linux administration, and project collaboration. In the past I worked at Software Freedom Conservancy, supporting its member projects like Git, Outreachy, and Homebrew, including writing new financial reports to give them more information about their funding. I also did system administration at the World Wide Web Consortium (W3C) building infrastructure to help the Team and Working Groups collaborate better.

I’m a big believer that good security should empower people, not just put up roadblocks as they work. By improving the baseline security of our systems, we can prevent situations where someone who’s rushed, tired, or just having a bad day makes one small mistake with outsize consequences. While I was interviewing for this position, it was clear that everyone involved in PSF tech has human factors front of mind, so I’m really happy to join this team.

I’ve been using Python basically as long as I’ve been using Linux. I learned version 1.5 in high school, used it for some of my undergraduate courses, and basically never stopped. It’s the language I’ll reach for first for most tasks and my reference point when I’m learning a new language.

I’m looking forward to meeting more of you as I get more involved!

34 Likes
2

Thank you and welcome!

…we can prevent situations where someone who’s rushed, tired, or just having a bad day makes one small mistake with outsize consequences.

I really appreciate hearing this viewpoint. “There’s no such thing as a type of person who is susceptible to scams. There is a set of circumstances and frame of mind that makes us susceptible to scams. You are one tired evening away from clicking the email link.”

12 Likes
3

For sure. I know it because I’ve lived it. I’m a victim of identity theft, and people have tried some pretty wild scams on me. The worst was one night when “my bank” called in the middle of dinner to verify some recent charges. Once I said those were unauthorized, they triggered SMS 2FA and asked for the code. When I wouldn’t share it, they tried to reassure me they were legit by reading me back my own social security number.

I’m still haunted by how targeted and sophisticated that call was. If I hadn’t summoned all of my security skills at a moment’s notice, I could’ve been completely wiped out. We shouldn’t have to go through our entire lives that vigilant. I don’t want to live my entire life that vigilant. I want to work towards making sure people don’t have to.

4 Likes
4

Nice to see you on board and I’m sure you’ll have a planty of interesting work! :wink:

1 Like