Python Multithreading Is Not Fake — But It Depends on the Task

·7 views

A developer noticed significant speed gains after parallelizing a network data-fetching tool with Python threads, despite a colleague's claim that Python multithreading is 'fake' due to the Global Interpreter Lock (GIL). The GIL restricts Python so that only one thread executes bytecode at a time, which led to the misconception. However, the GIL is released during I/O waits, allowing other threads to run while one waits for a network response, which explains the real speedup observed. For CPU-bound tasks like image processing or heavy math, the GIL never releases meaningfully, making multithreading genuinely ineffective. The key distinction is that Python threads deliver real concurrency for I/O-bound work but not for CPU-bound operations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev team cuts Quarkus CI pipeline time from 11 minutes to 5 minutes without paid tools

A development team running a Quarkus monorepo on GitHub Actions free-tier runners reduced their CI pipeline duration from 9–11 minutes down to approximately 5 minutes 20 seconds. The gains were achieved without self-hosted runners, larger GitHub runners, or paid caching services. Investigation revealed the bottleneck was not dependency downloads or Maven compilation, but duplicated Quarkus work such as repeated augmentation, redundant application boots, and unnecessary infrastructure startup. The team deliberately avoided splitting integration tests into per-service matrix jobs, as doing so would have multiplied fixed setup costs across each parallel cell. Instead, optimisations focused on eliminating duplicated work within existing jobs while keeping the overall job count small.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Run a Local LLM on Apple Silicon Using MLX or llama.cpp

Mac users with M1 through M4 chips can run large language models entirely on-device using two leading tools: Apple's MLX framework and the community-built llama.cpp engine. MLX is installable as a Python package and can load a 4-bit quantized 3B model in minutes, requiring no API keys or cloud connectivity. The two tools differ in scope — MLX is optimized for Apple's unified memory architecture, while llama.cpp supports a broader range of hardware including Linux and Windows systems. Both frameworks support quantized model formats and offer OpenAI-compatible server modes for application development. Running models locally eliminates per-token costs and keeps user prompts private, with the setup working fully offline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm Supply Chain Attacks Expose Gap in Artifact-Level Dependency Auditing

When a compromised npm package is reported, teams often check their current dependency tree — but this can miss vulnerable versions that existed only briefly during a past build. The Keyv-related package compromise, disclosed by Aikido on August 4, illustrated how a malicious release can spread and be patched before most teams finish assessing their exposure. The core challenge is that modern CI pipelines, lockfile updates, and Docker caching mean a clean scan today says little about what an artifact built yesterday actually contained. Experts argue the useful unit of analysis is not the current repository state but a specific artifact tied to a specific build and its resolved package set. A proposed approach involves accepting lockfiles, build timestamps, artifact digests, and CI logs to reconstruct past builds and classify exposure as confirmed, possible, or unknown — with human review required before any remediation action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

10 Warning Signs Your Windows PC May Be Compromised and How to Spot Them

Windows users can detect potential security threats by monitoring unusual system activity such as unknown processes in Task Manager, unexpected CPU or RAM spikes, and new startup programs added without user knowledge. Suspicious PowerShell executions, unrecognized USB connections, and sudden changes to Windows Defender settings are also red flags worth investigating. Many legitimate Windows tools like Task Manager and Event Viewer exist for this purpose, but most users do not check them regularly enough to catch threats early. A lightweight monitoring tool called SysPulse has been developed to address this gap by offering real-time process tracking, executable path visibility, and Telegram-based security alerts. The goal is not to replace antivirus software but to give users greater visibility into what is happening on their systems at any given time.

0 comments Read more at DEV Community