Python Foundation declines substantial grant

Python Foundation declines substantial grant 🔗 **Source:** [Python Foundation declines substantial grant](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/) > [!note]+ Document Notes > tags: [Python, PSF, NSF] > author: Mels Dees > source: Techzine Europe > reference: [https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/] > date created: 2025-10-28 00:00 > > # 🏷️ Title: Python Foundation declines substantial grant >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened: The PSF withdrew its $1.5M NSF grant application after final terms would force it to “not run any programs that promote DEI” across the entire organization and allow clawbacks. - Why it matters: Sacrifices a major open source security investment to uphold community values around inclusivity. - Key stakeholders: PSF (lead: Loren Crary; security dev Seth Larson), NSF, broader Python/open source ecosystem. - Risks and tradeoffs: Loss of funding for proactive PyPI supply-chain tooling vs. avoiding broad, organization-wide restrictions and financial clawback risk. - Bottom line: PSF chose values over money and asks the community to help backfill funding. ## 📖 Main Content - Core arguments: - The NSF terms would apply org-wide and enable clawbacks, which PSF deems too risky and contrary to its mission. - DEI is integral to PSF’s support of a “diverse, international community,” so agreeing would “betray…core values.” - Context/definitions: - NSF program: Safety, Security, and Privacy of Open Source Ecosystems. - PyPI: Python’s package index; target of supply-chain hardening. - Article situates the terms within early-2025 federal rules limiting DEI funding. - Uncertainties: - Exact regulatory text and permanence of conditions. - Whether tailored exemptions or narrower attestations are possible in future cycles. ### 🗒️ Notes - “The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).” - Terms applied to all PSF activities; NSF could reclaim funds upon breach. - Planned work: automated, proactive checks on new PyPI packages for supply-chain attacks; transferable to NPM/Crates.io. - Budget context: PSF ≈ $5M/year; 14 staff; $1.5M over two years would be its largest grant. - Board unanimous to decline; community broadly supportive. - Call to action: memberships, donations, sponsorships. - NSF unable to comment due to government shutdown. ## 📚 References - Techzine coverage of the PSF decision: https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ - Background on supply chain security in open source (context): https://www.openssf.org/ - Python Packaging Index (PyPI): https://pypi.org/ ## 🗣️ Paraphrase - Paragraph A: PSF pulled its NSF bid after final conditions barred DEI-related programs across the organization and enabled fund clawbacks. - Paragraph B: Despite the project’s clear security benefits and unprecedented funding size for PSF, leadership deemed acceptance incompatible with its values. ## 📰 Newsletter - The PSF declined a $1.5M NSF grant due to terms restricting DEI across the org, even with major PyPI security wins on the table. Watch for community-driven funding to keep proactive supply-chain tooling moving. If you run Python infra or publish to PyPI, consider corporate sponsorships or memberships to sustain this critical work. Related reading: OpenSSF’s guidance on securing package ecosystems. ## ✅ Action Items #### DevRel - Publish a technical explainer of the proposed PyPI checks, with demos and roadmap. - Host office hours for package maintainers on proactive supply-chain hygiene. - Create quickstarts for publishers to adopt pre-publish checks. #### OSPO - Document a funding-acceptance policy with values/ethics guardrails. - Establish license and policy compliance training cadence. - Define SBOM strategy for core infra with ownership and SLOs. #### Community - Run contributor onboarding for security tooling modules. - Offer “first issue” rotations for PyPI security checks. - Launch transparent sponsorship tiers with impact reporting. #### WordPress - Core Security: adopt analogous proactive checks in plugin repo. - Playground: labs for reproducible supply-chain test cases. - Training: lessons on package provenance and signatures. #### The WPOCC - Microgrants for ecosystem security tools. - Stipends for maintainers implementing proactive scanning. ### FAIR - Publish funding transparency and anti-capture covenants. - Sign artifact provenance; verify build and release signatures. ## 🧪 Hypotheses - Restrictive DEI clauses reduce open source orgs’ willingness to accept public funds. - Community funding can replace ≥50% of foregone grant value within 12 months. - Proactive PyPI checks reduce malicious package incidents by ≥30% year-over-year. - Cross-ecosystem transferability (NPM/Crates.io) lowers marginal cost of adoption. ### 📊 Methodology - Survey open source orgs on funding acceptance under DEI restrictions. - Interrupted time series on malicious PyPI package detections pre/post proactive checks. - Cost-effectiveness analysis of shared scanning components across ecosystems. ### ❓ Questions - Can narrower attestations avoid org-wide DEI constraints? - What minimal viable proactive checks yield the largest risk reduction? - Which funding mixes best stabilize PSF security work? ### 🔮 Future Research - Standardized, portable policy-as-code for package vetting. - Shared threat intel feeds across registries with privacy-preserving sharing. ### 💡 Implications - Practice: prioritize proactive scanning in package ecosystems. - Policy: align funding terms with open source governance and inclusion. - Security: invest in cross-registry tooling and signatures. - Funding: diversify with memberships and corporate SLAs. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ≈ 11–12. #### 👀 Visual learners - Improve: add data flows and supply-chain diagrams. #### 🔊 Aural learners - Improve: 3–5 minute audio summary of the decision. #### 🗣️ Verbal learners - Present: clear definitions and rationale; add glossary. #### 🧩 Kinesthetic learners - Improve: step-by-step guide to local pre-publish checks. #### 🧠 Logical learners - Improve: decision tree for funding acceptance criteria. #### 🧑‍🤝‍🧑 Social learners - Improve: moderated Q&A forums with maintainers. #### 🧘‍♀️ Solitary learners - Improve: self-check quiz on supply-chain risks. #### 🌿 Naturalistic learners - Improve: lifecycle and ecosystem impact framing. ### 📊 Accessibility Assessment #### Screen reader semantics - Improve: add alt text for any future diagrams. #### Keyboard navigation - Improve: ensure focus states and skip links in related pages. #### Contrast and readability - Present: adequate body text contrast; verify headings. #### Text resizing and reflow - Improve: confirm 200% zoom layouts for long quotes. #### Media and captions - Improve: provide captions for any future video explainers. #### Forms and interactions - Improve: accessible donation/sponsorship flows. #### Standards reference - Map gaps to WCAG 2.2 AA. ### 🌍 DEIB Assessment - Present: explicit commitment to inclusivity in mission. - Improve: multilingual calls for support; plain-language summaries. - Support: consistent structure aids neurodiverse readers. - Representation: include global community examples and quotes. ### ✅ Logical Validity #### Strong reasoning - Causal tradeoff: terms vs. mission (values over funding) is coherent and supported by quotes. #### Fallacies - None apparent; political context presented as context, not proof. #### Tone of voice - Neutral-informative with value-based justification. ### 🛡️ DARVO Analysis - Deny: none; PSF acknowledges costs. - Attack: none toward NSF; contextualizes policy origins. - Reverse victim/offender: none; frames as values decision. ## 🎯 Conclusion - Bottom line: PSF declined a record grant to avoid organization-wide DEI restrictions and clawback risk, prioritizing mission and community values over funding. Next: pursue community and corporate support to advance proactive PyPI security tooling. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: H3. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] PSF declines NSF grant over DEI terms > [!quote] [Python Foundation declines substantial grant](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/) by [[Mels Dees]] via [[Techzine Europe]]. Published 2025-10-28. Accessed 2025-10-28. > “The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).” Decision context for governance and funding ethics in open source. [view highlight](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] Proactive PyPI checks planned to curb attacks > [!quote] [Python Foundation declines substantial grant](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/) > “automated tools that would proactively check new PyPI packages for potential supply chain attacks” Scope security benefits and portability to NPM/Crates.io. [view highlight](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) #### [Z1] Values-aligned funding improves open source legitimacy - Applies when funder terms constrain core mission. - Link: Techzine coverage; PSF decision. - Links: [[Open-Source-Governance]] [[Funding-Ethics]] #### [Z2] Proactive package checks reduce supply-chain risk - Applies to registries with high ingestion rates. - Pointer: PyPI plan described by PSF coverage. - Links: [[Software-Supply-Chain]] [[Registry-Security]] --- ### ✏️ Fleeting Queue (Extract by Selection) - [F1] Draft a one-pager on PyPI proactive scanning — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox - [F2] Outline funding ethics checklist for OSS orgs — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox - [F3] Identify 10 potential corporate sponsors for PSF security work — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox --- # 🏷️ Title: Python Foundation declines substantial grant ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened: The PSF withdrew its $1.5M NSF grant application after final terms would force it to “not run any programs that promote DEI” across the entire organization and allow clawbacks. - Why it matters: Sacrifices a major open source security investment to uphold community values around inclusivity. - Key stakeholders: PSF (lead: Loren Crary; security dev Seth Larson), NSF, broader Python/open source ecosystem. - Risks and tradeoffs: Loss of funding for proactive PyPI supply-chain tooling vs. avoiding broad, organization-wide restrictions and financial clawback risk. - Bottom line: PSF chose values over money and asks the community to help backfill funding. ## 📖 Main Content - Core arguments: - The NSF terms would apply org-wide and enable clawbacks, which PSF deems too risky and contrary to its mission. - DEI is integral to PSF’s support of a “diverse, international community,” so agreeing would “betray…core values.” - Context/definitions: - NSF program: Safety, Security, and Privacy of Open Source Ecosystems. - PyPI: Python’s package index; target of supply-chain hardening. - Article situates the terms within early-2025 federal rules limiting DEI funding. - Uncertainties: - Exact regulatory text and permanence of conditions. - Whether tailored exemptions or narrower attestations are possible in future cycles. ### 🗒️ Notes - “The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).” - Terms applied to all PSF activities; NSF could reclaim funds upon breach. - Planned work: automated, proactive checks on new PyPI packages for supply-chain attacks; transferable to NPM/Crates.io. - Budget context: PSF ≈ $5M/year; 14 staff; $1.5M over two years would be its largest grant. - Board unanimous to decline; community broadly supportive. - Call to action: memberships, donations, sponsorships. - NSF unable to comment due to government shutdown. ## 📚 References - Techzine coverage of the PSF decision: https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ - Background on supply chain security in open source (context): https://www.openssf.org/ - Python Packaging Index (PyPI): https://pypi.org/ ## 🗣️ Paraphrase - Paragraph A: PSF pulled its NSF bid after final conditions barred DEI-related programs across the organization and enabled fund clawbacks. - Paragraph B: Despite the project’s clear security benefits and unprecedented funding size for PSF, leadership deemed acceptance incompatible with its values. ## 📰 Newsletter - The PSF declined a $1.5M NSF grant due to terms restricting DEI across the org, even with major PyPI security wins on the table. Watch for community-driven funding to keep proactive supply-chain tooling moving. If you run Python infra or publish to PyPI, consider corporate sponsorships or memberships to sustain this critical work. Related reading: OpenSSF’s guidance on securing package ecosystems. ## ✅ Action Items #### DevRel - Publish a technical explainer of the proposed PyPI checks, with demos and roadmap. - Host office hours for package maintainers on proactive supply-chain hygiene. - Create quickstarts for publishers to adopt pre-publish checks. #### OSPO - Document a funding-acceptance policy with values/ethics guardrails. - Establish license and policy compliance training cadence. - Define SBOM strategy for core infra with ownership and SLOs. #### Community - Run contributor onboarding for security tooling modules. - Offer “first issue” rotations for PyPI security checks. - Launch transparent sponsorship tiers with impact reporting. #### WordPress - Core Security: adopt analogous proactive checks in plugin repo. - Playground: labs for reproducible supply-chain test cases. - Training: lessons on package provenance and signatures. #### The WPOCC - Microgrants for ecosystem security tools. - Stipends for maintainers implementing proactive scanning. ### FAIR - Publish funding transparency and anti-capture covenants. - Sign artifact provenance; verify build and release signatures. ## 🧪 Hypotheses - Restrictive DEI clauses reduce open source orgs’ willingness to accept public funds. - Community funding can replace ≥50% of foregone grant value within 12 months. - Proactive PyPI checks reduce malicious package incidents by ≥30% year-over-year. - Cross-ecosystem transferability (NPM/Crates.io) lowers marginal cost of adoption. ### 📊 Methodology - Survey open source orgs on funding acceptance under DEI restrictions. - Interrupted time series on malicious PyPI package detections pre/post proactive checks. - Cost-effectiveness analysis of shared scanning components across ecosystems. ### ❓ Questions - Can narrower attestations avoid org-wide DEI constraints? - What minimal viable proactive checks yield the largest risk reduction? - Which funding mixes best stabilize PSF security work? ### 🔮 Future Research - Standardized, portable policy-as-code for package vetting. - Shared threat intel feeds across registries with privacy-preserving sharing. ### 💡 Implications - Practice: prioritize proactive scanning in package ecosystems. - Policy: align funding terms with open source governance and inclusion. - Security: invest in cross-registry tooling and signatures. - Funding: diversify with memberships and corporate SLAs. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ≈ 11–12. #### 👀 Visual learners - Improve: add data flows and supply-chain diagrams. #### 🔊 Aural learners - Improve: 3–5 minute audio summary of the decision. #### 🗣️ Verbal learners - Present: clear definitions and rationale; add glossary. #### 🧩 Kinesthetic learners - Improve: step-by-step guide to local pre-publish checks. #### 🧠 Logical learners - Improve: decision tree for funding acceptance criteria. #### 🧑‍🤝‍🧑 Social learners - Improve: moderated Q&A forums with maintainers. #### 🧘‍♀️ Solitary learners - Improve: self-check quiz on supply-chain risks. #### 🌿 Naturalistic learners - Improve: lifecycle and ecosystem impact framing. ### 📊 Accessibility Assessment #### Screen reader semantics - Improve: add alt text for any future diagrams. #### Keyboard navigation - Improve: ensure focus states and skip links in related pages. #### Contrast and readability - Present: adequate body text contrast; verify headings. #### Text resizing and reflow - Improve: confirm 200% zoom layouts for long quotes. #### Media and captions - Improve: provide captions for any future video explainers. #### Forms and interactions - Improve: accessible donation/sponsorship flows. #### Standards reference - Map gaps to WCAG 2.2 AA. ### 🌍 DEIB Assessment - Present: explicit commitment to inclusivity in mission. - Improve: multilingual calls for support; plain-language summaries. - Support: consistent structure aids neurodiverse readers. - Representation: include global community examples and quotes. ### ✅ Logical Validity #### Strong reasoning - Causal tradeoff: terms vs. mission (values over funding) is coherent and supported by quotes. #### Fallacies - None apparent; political context presented as context, not proof. #### Tone of voice - Neutral-informative with value-based justification. ### 🛡️ DARVO Analysis - Deny: none; PSF acknowledges costs. - Attack: none toward NSF; contextualizes policy origins. - Reverse victim/offender: none; frames as values decision. ## 🎯 Conclusion - Bottom line: PSF declined a record grant to avoid organization-wide DEI restrictions and clawback risk, prioritizing mission and community values over funding. Next: pursue community and corporate support to advance proactive PyPI security tooling. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: H3. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] PSF declines NSF grant over DEI terms > [!quote] [Python Foundation declines substantial grant](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/) by [[Mels Dees]] via [[Techzine Europe]]. Published 2025-10-28. Accessed 2025-10-28. > “The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).” Decision context for governance and funding ethics in open source. [view highlight](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] Proactive PyPI checks planned to curb attacks > [!quote] [Python Foundation declines substantial grant](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/) > “automated tools that would proactively check new PyPI packages for potential supply chain attacks” Scope security benefits and portability to NPM/Crates.io. [view highlight](https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) #### [Z1] Values-aligned funding improves open source legitimacy - Applies when funder terms constrain core mission. - Link: Techzine coverage; PSF decision. - Links: [[Open-Source-Governance]] [[Funding-Ethics]] #### [Z2] Proactive package checks reduce supply-chain risk - Applies to registries with high ingestion rates. - Pointer: PyPI plan described by PSF coverage. - Links: [[Software-Supply-Chain]] [[Registry-Security]] --- ### ✏️ Fleeting Queue (Extract by Selection) - [F1] Draft a one-pager on PyPI proactive scanning — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox - [F2] Outline funding ethics checklist for OSS orgs — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox - [F3] Identify 10 potential corporate sponsors for PSF security work — context/https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ #fleeting #inbox ---