2026-07-16 –, Memorial Hall
Supply chain attacks on Python, including recent compromises of popular packages and CI workflows, have exposed structural weaknesses in the scientific Python ecosystem. This BoF will bring together library maintainers, downstream users, and security practitioners to discuss practical strategies for securing scientific Python stacks, from core packages (NumPy/SciPy) to domain libraries and analysis workflows. We will share current efforts (e.g., SPEC 8, Trusted Publishing, SBOM generation, GitHub Actions hardening), identify pain points and gaps, and brainstorm actionable steps the community can take over the next year to make scientific Python releases more trustworthy by default. Join us to share your experiences, challenges, and ideas on fortifying our open-source projects against potential threats and ensuring the integrity of scientific research.
Jarrod Millman is the Executive Director for Berkeley's Open Source Program Office (OSPO). With a background in computer science, mathematics, and statistics, and degrees from Cornell and Berkeley, Millman is a founding member of the scientific Python ecosystem. His primary focus is on developing and sustaining open-source, community-owned scientific software tools. Millman serves on the steering council of NetworkX, is a core developer of scikit-image, and was an early contributor to NumPy, SciPy, and scikit-learn. He has co-founded several influential initiatives to advance open and reproducible research, including the Scientific Python project, the nonprofit NumFOCUS, and the Neuroimaging in Python project.
Matthew is a research scientist in experimental high energy physics and data science at the University of Wisconsin-Madison Data Science Institute (a “data physicist”). He works as a member of the ATLAS collaboration on searches for physics beyond the standard model with experiments performed at CERN's Large Hadron Collider (LHC) in Geneva, Switzerland. He also serves on the executive board of the Institute for Research and Innovation in Software for High Energy Physics (IRIS-HEP) where he is a researcher and the Analysis Systems Area lead. He is also a topical editor for physics and data science for the Journal of Open Source Software. He previously did his Ph.D. (2019) research at Southern Methodist University, also on the ATLAS experiment, and was a postdoc at the University of Illinois at Urbana-Champaign, and the University of Wisconsin-Madison.