Python Bytes 490: Django wins, AI slop kills cURL bounty, AgentsView
Episode 490 of Python Bytes covers four topics worth your attention: a practical Django performance post, a sharp critique of AI slop drowning open source maintainers, a local-first token usage tracker for coding agents, and a dissection of a very specific phishing email targeting a developer by name.
️ Django still has tricks worth knowing
Julia Evans wrote about returning to what she calls “2010-style” web dev: Django, SQL, and server-rendered HTML, after years of Go backends and JS-heavy frontends. The post highlights custom QuerySet classes with chainable filter methods like .approved().future().with_tags(), useful template filters including urlize, linebreaksbr, json_script, and querystring, and 19 auto-generated migrations on her current project.
The performance finding is the most operator-relevant part. CPU profiling via py-spy revealed she had accidentally disabled the cached template loader. Re-enabling it pushed throughput on a $10/mo VM from roughly 2-3 requests per second to roughly 12 requests per second. No database tuning required.
AI slop is breaking open source maintenance
The Financial Times ran a piece (not a dev blog, the actual FT) on AI coding tools overwhelming open source maintainers. The cURL project is the case study: Daniel Stenberg has been the only full-time person on it for years, libcurl has been installed an estimated 20 billion-plus times, and in January the project killed its paid security bug bounty due to what Stenberg called an explosion of AI slop reports that take real time to debunk.
Additional data points from the article:
- tldraw’s Steve Ruiz closed outside contributions entirely, noting that authoring a PR is now nearly free while reviewing one still costs a human.
- Guido van Rossum says projects are holding emergency meetings over the slop flow, and notes LLM patches tend to touch unrelated parts of a file, making review more tedious.
- A paper from Miklós Koren’s group found packages frequently recommended by coding models saw large download jumps with no matching engagement, which breaks the reputation loop that sustains maintainers.
- Stack Overflow went from over 100,000 questions a month before ChatGPT to under 1,500 last month, with the response rate cut roughly in half.
- Josh Comeau’s newest web dev course launched at about a third of prior enrollment.
The podcast notes an interesting omission: the FT piece cited Stenberg’s January post about ending the bounty but skipped his April post, “High-Quality Chaos,” which describes the situation in the opposite direction. The episode argues the reason for the shift is process: killing the bounty removed the cash incentive, and a venue change filtered the remaining reports. That nuance did not make the FT piece.
AgentsView: local token usage tracker for coding agents
AgentsView is a local-first desktop and web app that browses, searches, and analyzes past AI coding agent sessions. It auto-discovers session files on your machine with no config required. Everything is stored locally in SQLite with no cloud account needed. It supports Claude Code, Codex, Copilot, Cursor, Gemini, Aider, and dozens more.
The agentsview usage command is a drop-in replacement for ccusage, and because it reads from a pre-indexed SQLite database, reports run 80 to 220 times faster on large histories. The Activity dashboard shows peak concurrency, active vs. idle time, agent-minutes, and cost, all filterable by project, agent, or machine. Full-text and optional semantic search covers every session, and it imports Claude.ai and ChatGPT chat exports.
Install via pip install agentsview, uvx agentsview, or brew install --cask agentsview. Binaries are also available on GitHub Releases.
A phishing email that knew exactly who it was targeting
The episode closes with a breakdown of a targeted phishing email sent to a listener. The email referenced a specific Bandit issue number (#1350), the B105 hardcoded-password rule, and the exact NextToken false positive the developer had filed publicly on GitHub. It was signed “Patrick, Blacktrace” but sent from a personal Gmail address, and its entire payload was two links to blacktrace.co.
The tells identified in the episode:
- Freemail sender, corporate signoff. Real company outreach comes from the company domain.
- Over-specific targeting. Scraping a GitHub issue and auto-generating tailored bait is exactly what agents make cheap now.
- The whole email is two links. Strip the technical flattery and it’s just “paste here” and “see results here.”
- “30-second paste” likely means paste your source code into a stranger’s tool, which is code exfiltration dressed as convenience.
- Brand-new domain with no reputation.
blacktrace.cohas no track record, and the/krucslug is random noise. - Jargon that sounds precise but isn’t. “Deterministic gate” and “noise-eraser” are empty phrases bolted onto correct real details like the B105 rule and
sk-live-Stripe key prefix to borrow credibility.
The takeaway: agents make personalized phishing cheap at scale. Relative unknowns are now worth targeting. If an unsolicited email knows your exact GitHub history, that specificity is a red flag, not a green one.
Extras
- DjangoCon US 2026 runs August 24-28 in Chicago.
- Ruff v0.16.0 now enables 413 rules by default, up from 59. Details at astral.sh/blog/ruff-v0.16.0.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
