diff --git a/.travis.yml b/.travis.yml
index fbceabb..59faea6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ matrix:
             addons:
               apt:
                 sources:
-                  - sourceline: 'deb http://ppa.launchpad.net/deadsnakes/ppa/ubuntu xenial main'
+                  - sourceline: 'ppa:deadsnakes/ppa'
                 packages:
                   - python3.7-dev
 install: pip install tox
diff --git a/README.md b/README.md
index a0bd2d4..ad209c4 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,7 @@
-# Blessclient
+# Blessclient -- DEPRECATED
+
+**NOTE**: We have deprecated python-blessclient and it is no longer actively maintained. A recommended alternative is [blessclient in Go](https://github.com/chanzuckerberg/blessclient).
+
 A client for interacting with [BLESS](https://github.com/lyft/bless) services from users' laptops. Blessclient optimizes to ensure that users can always use ssh as they normally would with a fixed key, with minimal delay.
 
 [Netflix's BLESS](https://github.com/netflix/bless) was designed to issue short-lived certificates to users after they logged into a bastion service, that would be used to authenticate the user to other hosts within the cluster. Lyft wanted to use ephemeral ssh certificates for our users too, but wanted to issue these certificates directly to users' laptops, instead of on the bastion. We were able to accomplish this by making a few modifications to Netflix's BLESS and deploying this project, blessclient, to our users' laptops. Doing this allowed Lyft to improve security by extending the existing multi-factor authentication (MFA) setup that we had with AWS to SSH, as well as simplifying our provisioning and deprovisioning process.
diff --git a/blessclient.cfg.sample b/blessclient.cfg.sample
index 682acc2..43669ad 100644
--- a/blessclient.cfg.sample
+++ b/blessclient.cfg.sample
@@ -63,9 +63,9 @@ update_script: update_blessclient.sh
 # is 3600 seconds (1 hour). The value must be in the range 900-3600.
 
 # update_sshagent: Specifies whether the identity key should be automatically added to the
-running ssh-agent. If this option is set to 'true', the key and the ssh certificate retrieved
-from lambda are added to the agent. If this option is set to 'false', the key is not added
-to the agent. The default is 'true'.
+# running ssh-agent. If this option is set to 'true', the key and the ssh certificate retrieved
+# from lambda are added to the agent. If this option is set to 'false', the key is not added
+# to the agent. The default is 'true'.
 
 [LAMBDA]
 # user_role: IAM Role that the user will assume, in order to run the BLESS Lambda. This
diff --git a/blessclient/client.py b/blessclient/client.py
index 27b826f..e8b2439 100755
--- a/blessclient/client.py
+++ b/blessclient/client.py
@@ -199,7 +199,7 @@ def get_mfa_token_cli():
 
 def get_mfa_token_gui(message):
     sys.stderr.write(
-        "Enter your AWS MFA token in the gui dialog. Alternatively, run mfa.sh first.\n")
+        "Enter your AWS MFA token in the gui dialog.\n")
     tig = tokengui.TokenInputGUI()
     if message == 'BLESS':
         message = None
diff --git a/blessclient/tokengui.py b/blessclient/tokengui.py
index caaa83f..5728986 100644
--- a/blessclient/tokengui.py
+++ b/blessclient/tokengui.py
@@ -1,6 +1,7 @@
 from __future__ import absolute_import
 import platform
 import os
+import subprocess
 from six.moves.tkinter import Tk, Label, Entry, Button, ACTIVE, W, mainloop
 
 
@@ -35,7 +36,10 @@ def doGUI(self, hostname=None):
 
         if platform.system() == 'Darwin':
             # Hack to get the GUI dialog focused in OSX
-            os.system('/usr/bin/osascript -e \'tell app "Finder" to set frontmost of process "python" to true\'')
+            # https://stackoverflow.com/questions/1892339/how-to-make-a-tkinter-window-jump-to-the-front/37235492#37235492
+            tmpl = 'tell application "System Events" to set frontmost of every process whose unix id is {} to true'
+            script = tmpl.format(os.getpid())
+            subprocess.check_call(['/usr/bin/osascript', '-e', script])
 
         mainloop()
 
diff --git a/setup.cfg b/setup.cfg
index e299fa9..31f59ba 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -20,4 +20,4 @@ format=pylint
 max-complexity = 25
 max-line-length = 126
 exclude = .git,__pycache__,venv,tests/
-ignore = E402, E124, W503
+ignore = E402, E124, W503, W504