Jarrod Millman
Jarrod Millman is the Executive Director for Berkeley's Open Source Program Office (OSPO). With a background in computer science, mathematics, and statistics, and degrees from Cornell and Berkeley, Millman is a founding member of the scientific Python ecosystem. His primary focus is on developing and sustaining open-source, community-owned scientific software tools. Millman serves on the steering council of NetworkX, is a core developer of scikit-image, and was an early contributor to NumPy, SciPy, and scikit-learn. He has co-founded several influential initiatives to advance open and reproducible research, including the Scientific Python project, the nonprofit NumFOCUS, and the Neuroimaging in Python project.
Sessions
In 2004, Matthew Brett asked me a provocative question born of frustration with existing fMRI tools: "Why don't we rewrite them in Python?" That question led to a 2005 meeting that brought together a small group of core Scientific Python tool builders from astronomy, neuroscience, physics, and statistics, and then to a series of follow-up meetings alternating between Berkeley, Enthought's offices, and other locations. This talk traces how that ground-up, cross-disciplinary collaboration helped turn SciPy from a workshop curiosity into the backbone of today's ecosystem, and how the same people and patterns later shaped the Scientific Python project.
Supply chain attacks on Python, including recent compromises of popular packages and CI workflows, have exposed structural weaknesses in the scientific Python ecosystem. This BoF will bring together library maintainers, downstream users, and security practitioners to discuss practical strategies for securing scientific Python stacks, from core packages (NumPy/SciPy) to domain libraries and analysis workflows. We will share current efforts (e.g., SPEC 8, Trusted Publishing, SBOM generation, GitHub Actions hardening), identify pain points and gaps, and brainstorm actionable steps the community can take over the next year to make scientific Python releases more trustworthy by default. Join us to share your experiences, challenges, and ideas on fortifying our open-source projects against potential threats and ensuring the integrity of scientific research.