Python Foundation Declines Substantial Grant  ## Metadata - Author: [[Mels Dees]] - Full Title: Python Foundation Declines Substantial Grant - Category: #articles - Document Note: --- tags: [Python, PSF, NSF] author: Mels Dees source: Techzine Europe reference: [https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/] date created: 2025-10-28 00:00 --- # 🏷️ Title: Python Foundation declines substantial grant ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened: The PSF withdrew its $1.5M NSF grant application after final terms would force it to “not run any programs that promote DEI” across the entire organization and allow clawbacks. - Why it matters: Sacrifices a major open source security investment to uphold community values around inclusivity. - Key stakeholders: PSF (lead: Loren Crary; security dev Seth Larson), NSF, broader Python/open source ecosystem. - Risks and tradeoffs: Loss of funding for proactive PyPI supply-chain tooling vs. avoiding broad, organization-wide restrictions and financial clawback risk. - Bottom line: PSF chose values over money and asks the community to help backfill funding. ## 📖 Main Content - Core arguments: - The NSF terms would apply org-wide and enable clawbacks, which PSF deems too risky and contrary to its mission. - DEI is integral to PSF’s support of a “diverse, international community,” so agreeing would “betray…core values.” - Context/definitions: - NSF program: Safety, Security, and Privacy of Open Source Ecosystems. - PyPI: Python’s package index; target of supply-chain hardening. - Article situates the terms within early-2025 federal rules limiting DEI funding. - Uncertainties: - Exact regulatory text and permanence of conditions. - Whether tailored exemptions or narrower attestations are possible in future cycles. ### 🗒️ Notes - “The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).” - Terms applied to all PSF activities; NSF could reclaim funds upon breach. - Planned work: automated, proactive checks on new PyPI packages for supply-chain attacks; transferable to NPM/Crates.io. - Budget context: PSF ≈ $5M/year; 14 staff; $1.5M over two years would be its largest grant. - Board unanimous to decline; community broadly supportive. - Call to action: memberships, donations, sponsorships. - NSF unable to comment due to government shutdown. ## 📚 References - Techzine coverage of the PSF decision: https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/ - Background on supply chain security in open source (context): https://www.openssf.org/ - Python Packaging Index (PyPI): https://pypi.org/ ## 🗣️ Paraphrase - Paragraph A: PSF pulled its NSF bid after final conditions barred DEI-related programs across the organization and enabled fund clawbacks. - Paragraph B: Despite the project’s clear security benefits and unprecedented funding size for PSF, leadership deemed acceptance incompatible with its values. ## 📰 Newsletter - The PSF declined a $1.5M NSF grant due to terms restricting DEI across the org, even with major PyPI security wins on the table. Watch for community-driven funding to keep proactive supply-chain tooling moving. If you run Python infra or publish to PyPI, consider corporate sponsorships or memberships to sustain this critical work. Related reading: OpenSSF’s guidance on securing package ecosystems. ## ✅ Action Items #### DevRel - Publish a technical explainer of the proposed PyPI checks, with demos and roadmap. - Host office hours for package maintainers on proactive supply-chain hygiene. - Create quickstarts for publishers to adopt pre-publish checks. #### OSPO - Document a funding-acceptance policy with values/ethics guardrails. - Establish license and policy compliance training cadence. - Define SBOM strategy for core infra with ownership and SLOs. #### Community - Run contributor onboarding for security tooling modules. - Offer “first issue” rotations for PyPI security checks. - Launch transparent sponsorship tiers with impact reporting. #### WordPress - Core Security: adopt analogous proactive checks in plugin repo. - Playground: labs for reproducible supply-chain test cases. - Training: lessons on package provenance and signatures. #### The WPCC - Microgrants for ecosystem security tools. - Stipends for maintainers implementing proactive scanning. ### FAIR - Publish funding transparency and anti-capture covenants. - Sign artifact provenance; verify build and release signatures. ## 🧪 Hypotheses - Restrictive DEI clauses reduce open source orgs’ willingness to accept public funds. - Community funding can replace ≥50% of foregone grant value within 12 months. - Proactive PyPI checks reduce malicious package incidents by ≥30% year-over-year. - Cross-ecosystem transferability (NPM/Crates.io) lowers marginal cost of adoption. ### 📊 Methodology - Survey open source orgs on funding acceptance under DEI restrictions. - Interrupted time series on malicious PyPI package detections pre/post proactive checks. - Cost-effectiveness analysis of shared scanning components across ecosystems. ### ❓ Questions - Can narrower attestations avoid org-wide DEI constraints? - What minimal viable proactive checks yield the largest risk reduction? - Which funding mixes best stabilize PSF security work? ### 🔮 Future Research - Standardized, portable policy-as-code for package vetting. - Shared threat intel feeds across registries with privacy-preserving sharing. ### 💡 Implications - Practice: prioritize proactive scanning in package ecosystems. - Policy: align funding terms with open source governance and inclusion. - Security: invest in cross-registry tooling and signatures. - Funding: diversify with memberships and corporate SLAs. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ≈ 11–12. #### 👀 Visual learners - Improve: add data flows and supply-chain diagrams. #### 🔊 Aural learners - Improve: 3–5 minute audio summary of the decision. #### 🗣️ Verbal learners - Present: clear definitions and rationale; add glossary. #### 🧩 Kinesthetic learners - Improve: step-by-step guide to local pre-publish checks. #### 🧠 Logical learners - Improve: decision tree for funding acceptance criteria. #### 🧑‍🤝‍🧑 Social learners - Improve: moderated Q&A forums with maintainers. #### 🧘‍♀️ Solitary learners - Improve: self-check quiz on supply-chain risks. #### 🌿 Naturalistic learners - Improve: lifecycle and ecosystem impact framing. ### 📊 Accessibility Assessment #### Screen reader semantics - Improve: add alt text for any future diagrams. #### Keyboard navigation - Improve: ensure focus states and skip links in related pages. #### Contrast and readability - Present: adequate body text contrast; verify headings. #### Text resizing and reflow - Improve: confirm 200% zoom layouts for long quotes. #### Media and captions - Improve: provide captions for any future video explainers. #### Forms and interactions - Improve: accessible donation/sponsorship flows. #### Standards reference - Map gaps to WCAG 2.2 AA. ### 🌍 DEIB Assessment - Present: explicit commitment to inclusivity in mission. - Improve: multilingual calls for support; plain-language summaries. - Support: consistent structure aids neurodiverse readers. - Representation: include global community examples and quotes. ### ✅ Logical Validity #### Strong reasoning - Causal tradeoff: terms vs. mission (values over funding) is coherent and supported by quotes. #### Fallacies - None apparent; political co - Summary: The Python Software Foundation (PSF) is withdrawing its application for a $1.5 million (€1.3 million) grant from the US National Science Foundation (NSF). - URL: https://www.techzine.eu/news/privacy-compliance/135801/python-foundation-declines-substantial-grant/  **The Python Software Foundation (PSF) is withdrawing [its application for](https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html) a $1.5 million (€1.3 million) grant from the US National Science Foundation (NSF). The organization refuses to agree to new grant conditions that explicitly prohibit programs related to diversity, equity, and inclusion (DEI).** In January 2025, the PSF submitted a proposal to the Safety, Security, and Privacy of Open Source Ecosystems program. The project was intended to help address structural vulnerabilities in the Python programming language and its associated package platform PyPI. It was the first time the foundation had applied for government funding. The application process, led by security developer Seth Larson and deputy director Loren Crary, took months of intensive work and thorough evaluation. After a lengthy review process, the proposal was ultimately recommended for funding. This is an exceptional achievement for a first-time application. However, when the PSF saw the final grant conditions, concerns arose. The foundation would have to declare that it does not and will not run any programs that promote DEI. #### Trump administration fights against woke programs That provision would apply not only to the specific security project, but to all of the organization’s activities. In addition, the NSF reserved the right to reclaim previously disbursed funds if the foundation violated this condition. According to the PSF, this would pose a significant financial risk. [The Register](https://www.theregister.com/2025/10/27/python_foundation_abandons_15m_nsf/) places the measure in the context of the [Trump administration’s](https://www.techzine.eu/news/privacy-compliance/130490/trump-takes-revenge-on-sentinelone-exec/) federal policy, which restricts the use of public funds for diversity and inclusion programs. The new grant conditions are the result of federal guidelines that have been in effect since early 2025 and that restrict the use of government funds for diversity, equity, and inclusion initiatives. These regulations are part of broader political measures by the US government under President Trump to reduce the influence of so-called woke programs. Diversity, equality, and inclusion are integral to the PSF’s mission, which focuses on promoting and protecting the Python programming language and supporting a diverse, international community of developers. The organization sought clarification from the NSF and investigated how other parties had dealt with similar situations. One such example was The Carpentries, a non-profit organization for software and data training, which had withdrawn its application earlier this year for the same reason. #### Betrayal of PSF’s core values Ultimately, the PSF concluded that it could not agree to a statement that excludes DEI-related activities. The deputy executive director of the programming non-profit, Loren Crary, stated that accepting such conditions would amount to a betrayal of the foundation’s core values and its community. She indicated that it was a difficult decision, as the proposed project would have had significant benefits for the security of the open source community. The plan included the development of automated tools that would proactively check new PyPI packages for potential supply chain attacks, rather than just a reactive assessment, as is currently the case. The techniques used would also be transferable to other open source package managers, such as NPM and Crates.io. In addition to the security benefits, the grant would have been a major financial boost. The PSF has an annual budget of approximately $5 million and employs 14 people. The $1.5 million over two years would have been the largest grant in the foundation’s history. Nevertheless, the board unanimously decided that the organization’s values outweigh the monetary amount. According to Crary, the Python community broadly supported the decision, which she believes confirms that the foundation did the right thing. The PSF acknowledges that foregoing the grant poses a financial challenge, especially amid inflation, declining sponsorship, and economic pressure in the technology sector. The organization is therefore calling on the community to continue supporting its work, for example, through membership, donations, or corporate sponsorship. According to the foundation, support from individual members and companies is essential to ensure the continued existence of Python as an open-source project and to preserve its values of inclusivity. The National Science Foundation was unable to comment at this time because parts of the US government are closed due to an ongoing shutdown., Python Foundation Declines Substantial Grant, Mels Dees, 01k8nn74w6m1cf3bq9rtvmw638.