9 ms·

I'm not collaborating with Kenneth Reitz

269 points by f311a 7y ago

Waterluvian 7y ago
Not related to the core point of the article but why does Requests need async support? Why can't it just be good at what it is and if you want to do asyncio you use aiohttp or something else? Or put differently, why does the author think that "everyone knows it's silly" to have different libraries doing the same thing in different ways?
- ris 7y ago
  "Hey guys, I think we'd get a lot of benefit switching our large application to be async" "But that would require us to port to a different http library - do you have any idea how many places we do intricate things with requests all over the place?" vs. "Ok, let's test it out switching requests to its async mode..."
  - Waterluvian 7y ago
    You really should always abstract IO interfaces but yeah I see your point. I'm not convinced it's going to help a whole lot though. Async is a whole different paradigm. You can't just "turn it on" in a library without significantly affecting how one interfaces with it.
    - ris 7y ago
      > You really should always abstract IO interfaces I'd be very careful with the word always there. I've worked in projects where almost every external library we used someone felt they had to build a "wrapper" class or two around. When you're doing that you realize the reality of the situation is that most developers are totally shit at designing APIs, and instead of using the library's probably-quite-well-thought-out & flexible API (after all, that's likely why it became popular enough to come to your attention), you've got to spend your life using this - for lack of a better term - gimped up abortion of an interface. Which typically doesn't even succeed in the purported task of giving you library independence so long as it doesn't sanitize all of its possible return values and catch & re-throw custom exceptions. Be wary of this hole. But yes, I did try and specifically mention intricate use of requests to try and leapfrog that conclusion.
- zedpm 7y ago
  Agreed, I’ve found aiohttp works wonderfully as both client and server.
- passive 7y ago
  Because Requests makes HTTP much easier to work with, which has dramatically expanded the pool of developers who are comfortable doing that kind of work. When we've had to add some level of concurrency to an HTTP tool, we have serious discussions over whether to swap out Requests, or to just run multiple instances of the tool, especially if it's a tool that only requires concurrency sometimes. This is nothing against aiohttp or others, but Requests is de facto standard library.
  - LyndsySimon 7y ago
    > Requests is de facto standard library. I think a valuable discussion that could come from this is to seek to understand why it’s “de facto” standard library instead of “de jure” standard library. I’ve heard it said that “the standard library is where popular packages go to die”, and I think that’s very true. I’m very happy that Requests isn’t part of the standard library, because that means that updates - including updates that are extremely important to maintaining the health of the library over time - are possible without an entirely separate release of cPython itself.
kevmo 7y ago
Out of fairness, I urge everyone to give Kenneth a chance to respond before judging him. Separately: Humans do their best work when they are collaborating with one another. I have worked in many different organizational formats, but I have never worked in an organization where an excessively negative person did so much good work that it was worth team destruction. When everyone else is doing less work because of one person, you have to remove that person or you raise risk of mission failure.
- throwaway7613 7y ago
  (Throwaway account) This is not an isolated mistake. There is a consistent pattern of exploitation and toxicity from Kenneth that has been ongoing for many years. Many people in the community have known about this and worse. This post is courageous for finally calling it out. It's difficult to call out a person in a position of power like himself, especially one who obsessively engages in abusive tactics yet has an army of people who worship him and make excuses for him.
  - neilv 7y ago
    Presumably you have good intentions, but I think it's dangerous for us to have criticisms of one person's name come from other people who won't stand behind it with their own names. Perhaps there is a whistleblower exception, such as when the person being criticized is powerful, and the whistleblower is vulnerable, but I'm not aware that's the situation here, and whistleblowing involves an investigation (by officials, journalists).
    - throwaway7613 7y ago
      You're comparing a hypothetical danger of society gone amok with the practical already-experienced danger of pissing off a systemic abuser with tens of thousands of followers. Even this very HN thread is full of people blindly defending him. If there is a functioning body of authority that is accepting confidential complaints, then I will happily use my real name. I am not eager to invite abuse just to help the HN community gain some awareness of what has been going on for years.
prepend 7y ago
A trigger warning for gaslighting is something that makes me assume low quality posts. I know it’s unwise to judge a book by its cover, but I’m comfortable with discounting an API from its interface.
tyingq 7y ago
Personally, I'd have stuck with facts. There's quite a lot of unattributed quotes and conjecture in this, which makes it read more like retaliation. It does sound like the author has a legit complaint, but the embellishments don't help.
- dragonwriter 7y ago
  > Personally, I'd have stuck with facts. There's quite a lot of unattributed quotes and conjecture in this Unattributed quotes are facts, even if they aren't easily verifiable by third parties. But then, most facts someone observes and reports aren't easily verifiable by uninvolved parties. And there is very little conjecture where the factual basis isn't presented so that one can judge whether the conjecture is warranted given the stated basis (of course, generally one must also deicde whether or not to trust the description of facts.) > which makes it read more like retaliation. It doesn't read like retaliation to me at all, nor is there any apparent thing to be retaliated for unless you accept the account itself, in which case it's just an account of the facts and not retaliation.
  - tyingq 7y ago
    Anonymous quotes like "he is such a fucking narcissist power broker" are over the line for me. If you can't stand behind that, it's better left unsaid.
    - LyndsySimon 7y ago
      I completely agree. I feel like this quote in particular is intended as a personal attack, and that its inclusion dilutes the actual potentially valuable criticism and suggestions to the point that they’re basically irrelevant. That’s a shame, because I also believe that all projects like this have room for improvement.
      - 0815test 7y ago
        > I feel like this quote in particular is intended as a personal attack In context, it's clearly meant to hint at a purported pattern of problematic behavior, the specific instances of which the author is unwilling to get into, for whatever reason. While gossip is always unsavory to some extent - anonymous gossip all the more so - I think we should be respectful of the author's choice here and not take what they wrote as being by definition a violation of civility norms (as a personal attack would be).
ris 7y ago
My spidey sense has been acting all funny around requests since I realized it has its own vendored certificate bundle...
- mercer 7y ago
  could you elaborate?
  - ris 7y ago
    Maintaining a certificate bundle is not something to be taken lightly - it's a central root of trust, and is something that should generally be deferred to the system or user and easily configurable globally. As a system administrator if there is an advisory over a certain set of root certificates, I want to be able to address that and remove that from one or maybe two places on a system. Not wonder about every last package that thought to award itself that authority. Especially the way a lot of python packages are used - as deeply nested and possibly pinned dependencies that maybe never get updated.
- lozenge 7y ago
  "Requests uses certificates from the package certifi. This allows for users to update their trusted certificates without changing the version of Requests. Before version 2.16, Requests bundled a set of root CAs that it trusted, sourced from the Mozilla trust store. The certificates were only updated once for each Requests version. When certifi was not installed, this led to extremely out-of-date certificate bundles when using significantly older versions of Requests. For the sake of security we recommend upgrading certifi frequently!" It isn't completely clear but it sounds like they (used to) copy the Mozilla Trust Store wholesale, which isn't a particularly controversial policy. They might be one of the more open stores.
lexpar 7y ago
Reitz really does not come off looking very good here. I was always a little suspicious of the set of libraries he maintains - the documentation pages are so slick that I begin to wonder if this is a software package or a lifestyle upgrade. Anecdotally, I was at one point in an informal business relationship with someone who has bipolar disorder and I had a very similar experience when I attempted to formalize our procedures for collecting and recording income. This was in a band (garage bands seemingly not that different from OSS) - so we're talking a few hundred dollars a month going in to one person's checking account. I thought we'd all feel better if we knew exactly how much money we were making and how it was being spent. Had a similar set of objections from my colleague to this kind of openness.
- 0815test 7y ago
  > I was always a little suspicious of the set of libraries he maintains - the documentation pages are so slick that I begin to wonder if this is a software package or a lifestyle upgrade. Does that mean bad documentation is a good thing? Not sure if serious... That said, there are so many red flags in this whole story that I can't tell why the whole thing is only being revealed today. It seems that, as the person who was actually working on a crowdfunded feature, OP should have disclosed the potential issues to the community as soon as he became conclusively aware of them. Much of the damage would've been repaired a lot more smoothly, had he done so.
  - dictum 7y ago
    I wish I could upvote the half of this comment that questions the wisdom of seeing good docs as a bad signal, and not upvote the part about not disclosing these issues earlier. This same question comes up when people reveal abuse (of any kind) or other traumatic experiences. People need time to process some events, and when you're going through some interpersonal trouble, you may think this (is your fault|will go away|is not a big problem|has been solved).
  - Nicksil 7y ago
    >OP should have disclosed the potential issues to the community as soon as he became conclusively aware of them. Sure, but that's ideal. In practice, humans frequently delay or completely forgo sounding the alarm when there's a problem. Having not raised concerns immediately isn't out of the ordinary; for myriad of reasons, it occurs everyday. So instead of rebuking the author, consider _why_ it wasn't immediately brought to the community's attention (or maybe it was, but not to the degree we see here)
antt 7y ago
I don't understand the penny pinching in this post. My shitty laptop costs pretty close to 3k with all the mods I have on it. My work laptop came it at over 5k. A descent desktop for a developer can cost around $10k. My fancy dream machine is over $20k. $30k is peanuts. That's one month's wages for a senior dev. I've seen project that cost 50 times as much and the only delivery was a button of a different color. I have no idea if anything else said there is true or not and I have no interest in looking at more drama.
- sudhirj 7y ago
  The point of the article is the lack of transparency and borderline exploitation. If KR had put up a fundraising page saying “buy me beer” or “support my work” this wouldn’t be an issue. The author is pointing out that the funds were raised for a team effort and the other members on the team were being dealt with in a shady way.
  - antt 7y ago
    Like I said, I have no interest in the drama. I'm just pointing out that the sums they are talking about here are laughable. Anyone who thinks that 30k can pay anything to a team should have a look at getting a real job. Him getting paid for the bother of working as the project coordinator sounds about fair for two months part time. The rest of the contributors should have been doing the work out of interest when they have free time with nothing better to do. I have a hell of a time explaining to people that I'm happy to contribute 1 hour 8 times to their projects for free, but if they expect 8 hours once it will cost them.
  - tyingq 7y ago
    "The author is pointing out that the funds were raised for a team effort and the other members on the team were being dealt with in a shady way" It doesn't appear, though, that the author was part of that team, or promised any of the money. The author says this: "If he'd found another way to use the money on Requests, then I would have been totally happy. I didn't have any claim on the money" Other parts of the post do seem to indicate something isn't right. But it's not exactly as straightforward as you're saying.
Lazare 7y ago
It wasn't really mentioned in the linked article, but at the start of the year there was a lot of very heated discussion about Python, packaging, Pipenv, what was (and wasn't) an "official" packaging tool, etc. See, for example, this earlier discussion: https://news.ycombinator.com/item?id=18612590 https://news.ycombinator.com/item?id=18612590 Obviously there are multiple sides to that debate, but I personally came to the conclusion that Reitz had behaved quite poorly there. It's interesting to see his name come up again, here.
- smnrchrds 7y ago
  Interestingly, Pipenv is no longer in the list of projects on his website: https://www.kennethreitz.org/projects https://www.kennethreitz.org/projects What that means, I don't know.
  - loulouxiv 7y ago
    The hype around pipenv is gone now that more people actually tried to use it in real life project and foubd out that it was not the storytelled solution to all your problems
    - smnrchrds 7y ago
      Sure, but I still don't get why it is missing from the project list. The list is not that curated. It includes Autoenv for example, a project whose Github README [0] says, "Note: you should probably use direnv instead. Simply put, it is higher quality software. But, autoenv is still great, too. Maybe try both? :)" [0] https://github.com/kennethreitz/autoenv https://github.com/kennethreitz/autoenv
sdwa 7y ago
Whoever he is, despite knowing nothing about him except his unusable pipenv, in the time I have been using python I've somehow become aware through osmosis that this person is not very pleasant. I can only assume that there's no smoke without fire.
- jzl 7y ago
  Curious about the "unusable pipenv" comment. I don't know much about it, but been meaning to try it out due to the publicity it's been getting. Care to elaborate?
  - pseudalopex 7y ago
    https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-lot-delivers-very-little/ https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-l...
- LyndsySimon 7y ago
  I would argue that says more about the people speaking out in “opposition” than it does about who he really is.
asveikau 7y ago
Reading the link to Reitz's description of his bipolar diagnosis it's very hard not to see what is being described as manipulation, toxicity, narcissism, gaslighting ... as all being rooted in that. I understand it's tough to feel like a target of somebody's symptoms. I have been there too. But compassion is also needed.
- floatingatoll 7y ago
  Compassion is given. It lays out his actions, how they are perceived by others, and why the author feels they cannot work with him. It does not name him evil, and in fact seems disinterested in his private personal motivations. Shunning someone is a compassionate response to bipolar disorder. Keeping the reasons for shunning someone private harms others, such that “compassionate” becomes “complicit”. The community’s replies indicate that many chances have been given, well ahead of when this post was published. What further compassion would you suggest is appropriate here? ps. It is suggested he has bipolar disorder, but replacing that with “for personal reasons” in no way alters the content of the post.
  - asveikau 7y ago
    Sorry, my experience says shunning is a very shitty thing to do, as it re-enforces their bad feedback loop. I am being vague because I don't know what the right answer is. But it is surely a compassionate one, and not one that rushes to judgement. The author is making an attempt at this, sure.
    - floatingatoll 7y ago
      Anything will reinforce the feedback loop. That’s inherent in the disorder. Either they voluntarily seek help, they are involuntarily committed, or they do not seek help. You can’t pressure them. They will rationalize their decision without any regard for the reality you perceive. Eventually, you can only choose either to enable them or to shun them.
      - asveikau 7y ago
bhouston 7y ago
This whole thing seems like focusing on small things and pretending they are big. I think the guys running Requests is eccentric and weird for sure. Weird eccentric guys will do weird and eccentric things. You have to expect that. The amount of money is ridiculously small. It isn't worth the time to focus on it. It is too bad the popular library doesn't have a competent maintainer. But at least he hasn't screwed it up. Maybe someone should just write a replacement with better features and then we can all move on? Sounds like the best solution to me. Probably easier to do than dealing with him or even fighting him. I guess I wouldn't focus on attacking this guy, it just isn't worth it. Life is short, the stakes are small, and it just isn't worth it.
- lexpar 7y ago
  > The amount of money is ridiculously small. It isn't worth the time to focus on it. Well, it's donated money... Do you think the people who donated share this view?
  - bhouston 7y ago
    It is a ridiculously small amount of money though. You are probably right it is being wasted and misused, but that is half of kickstarters. It is par for the course when donating to a non-charity, it is trust and this guy is eccentric and weird. I think people have unrealistic expectations in this situation.
    - lexpar 7y ago
      Maybe you're right that it's a bit naive to throw money at internet eccentrics who don't have a plan and trust that they will manage things well. I just don't think we should be excusing things because it's (what some people think) is a small amount of money (note - about the average yearly income for a Canadian).
      - antt 7y ago
        >Maybe you're right that it's a bit naive to throw money at internet eccentrics who don't have a plan and trust that they will manage things well. I don't expect him to manage it well. I'd have been happy if half of the promised work got delivered and the money was spend on hookers and blow. I know most of the fees for my portfolio are funding that type of thing already.
yeukhon 7y ago
Bipolar can often comorbid with another mental illness. If he has a narcissistic trait, he could have a personality disorder. But I urge the community to stop guessing what he has or doesn’t have. Even professionals have hard times diagnosing their own patients. The point, as the author says, is not to circle around mental illness. Let’s skip this part of the discussion...
- jdorfman 7y ago
  He has been pretty transparent with his bipolar disorder. Speaking from experience mania drastically changes your personality. https://www.kennethreitz.org/essays/mentalhealtherror-an-exception-occurred https://www.kennethreitz.org/essays/mentalhealtherror-an-exc...
teddyh 7y ago
If all this is to be taken at face value, Kenneth Reitz should be publicly removed from any and all projects. The reported activity (of having secret groups to “work around” the troublesome person) is untenable. Projects should not be afraid to exclude people who are more trouble than they are worth; feeling that one cannot ever exclude people is also known as “Geek social fallacy #1”: http://www.plausiblydeniable.com/opinion/gsf.html http://www.plausiblydeniable.com/opinion/gsf.html
zzzeek 7y ago
SQLAlchemy author / maintainer here. If Kenneth has been acting in bad faith within the community, that should be brought to light and called out. That said, I can't help but think this blog post swings that hammer way too hard, and then even gets into rumors about other unethical things he has allegedly done without any attribution. The author goes on long enough in this manner so much so that they have to remind the reader "please don't abuse or harass Kenneth!" That's a sign you've swung too hard. I know Kenneth personally, as the blog post mentions, he has mental health issues and while the article rightly points out this is no excuse, it's not the authors place to judge how effectively or not a mental health sufferer is capable of managing their illness. Again i agree the incidents in question should be called out and I am glad this author has spoken out. But as someone who also suffers from mental illness I am concerned for the extended nature of the post.
- wilfredinni 7y ago
  This is from the post: Many people manage their conditions without causing this kind of harm, and when they mess up, they make amends, just like the rest of us. If someone can't do that, then as a community, we can have compassion but shouldn't give them power and influence.
  - zzzeek 7y ago
    I agree totally but at the same time this post goes well beyond the realm of calling out the behavior and into deep rumor and character assasination territory. All of which may also be true but there is simply no need.
    - Nicksil 7y ago
      >All of which may also be true but there is simply no need. I don't understand this logic. If all may be true, then there is absolutely a need to alert the community of a prominent member who may be damaging that very community.
      - zzzeek 7y ago
craigsmansion 7y ago
> [Mental] Illness does not erase [..] their responsibility for their actions. Except for when it does, and linking to a lifestyle article on medium as a source to back you up doesn't really hold water. There might be something wrong, but that's no reason for what ultimately is a very subjective public character assassination piece, no matter how cautious and caring the author claims to be.
deleted 7y ago
[deleted]
devnonymous 7y ago
Just a tip (since there sometimes seem to be a pattern here to tl;dr but still comment), please read the whole thing. My thoughts on this: I consider myself an avid pythonista and have built my career programming in python. Though I've only been watching the community at the sidelines for personal reasons. I think this post took courage to call out someone who while great at code and docs and community interaction, is a flawed human. Kenneth seems to be more about the glam and less about the code these days. Case in point - His attempt to influence the adoption of then half baked pipenv as the officially endorsed tool for pkg management.
jdorfman 7y ago
> His collaborators also consistently cited his bipolar disorder as an excuse for whatever he did. I think this is deeply unfair to Reitz, and to everyone struggling with mental health issues. He's right it's completely unfair to others with bipolar disorder (can't speak for other mental illnesses). If you take you take your medication, go to therapy, practice CBT, and stay sober you can live a normal life. Don't get me wrong, it's hard work and expensive. I have no idea what Kenneth's situation is and I'm not excusing any of the alleged behavior, I'm just asking that others not to assume automatically all others successfully treating bipolar disorder (1 or 2) are up to no good.
theon144 7y ago
Why was this flagged?
- RA_Fisher 7y ago
  We have to be neutral. /sarcasm The heavy-handed opinion of HN mods drove me away from this community. It's not about protecting folks or creating a strong community. Creating those requires cultivated judgement not neutrality.
wyldfire 7y ago
Reitz has responded (and subsequently removed his response). Please un-flag this article so that HN can discuss the controversy/debate surrounding Reitz and his accuser.

269 points by f311a 7y ago

Not related to the core point of the article but why does Requests need async support? Why can't it just be good at what it is and if you want to do asyncio you use aiohttp or something else? Or put differently, why does the author think that "everyone knows it's silly" to have different libraries doing the same thing in different ways?

ris 7y ago
"Hey guys, I think we'd get a lot of benefit switching our large application to be async" "But that would require us to port to a different http library - do you have any idea how many places we do intricate things with requests all over the place?" vs. "Ok, let's test it out switching requests to its async mode..."
- Waterluvian 7y ago
  You really should always abstract IO interfaces but yeah I see your point. I'm not convinced it's going to help a whole lot though. Async is a whole different paradigm. You can't just "turn it on" in a library without significantly affecting how one interfaces with it.
  - ris 7y ago
    > You really should always abstract IO interfaces I'd be very careful with the word always there. I've worked in projects where almost every external library we used someone felt they had to build a "wrapper" class or two around. When you're doing that you realize the reality of the situation is that most developers are totally shit at designing APIs, and instead of using the library's probably-quite-well-thought-out & flexible API (after all, that's likely why it became popular enough to come to your attention), you've got to spend your life using this - for lack of a better term - gimped up abortion of an interface. Which typically doesn't even succeed in the purported task of giving you library independence so long as it doesn't sanitize all of its possible return values and catch & re-throw custom exceptions. Be wary of this hole. But yes, I did try and specifically mention intricate use of requests to try and leapfrog that conclusion.
zedpm 7y ago
Agreed, I’ve found aiohttp works wonderfully as both client and server.
passive 7y ago
Because Requests makes HTTP much easier to work with, which has dramatically expanded the pool of developers who are comfortable doing that kind of work. When we've had to add some level of concurrency to an HTTP tool, we have serious discussions over whether to swap out Requests, or to just run multiple instances of the tool, especially if it's a tool that only requires concurrency sometimes. This is nothing against aiohttp or others, but Requests is de facto standard library.
- LyndsySimon 7y ago
  > Requests is de facto standard library. I think a valuable discussion that could come from this is to seek to understand why it’s “de facto” standard library instead of “de jure” standard library. I’ve heard it said that “the standard library is where popular packages go to die”, and I think that’s very true. I’m very happy that Requests isn’t part of the standard library, because that means that updates - including updates that are extremely important to maintaining the health of the library over time - are possible without an entirely separate release of cPython itself.

kevmo 7y ago

Out of fairness, I urge everyone to give Kenneth a chance to respond before judging him. Separately: Humans do their best work when they are collaborating with one another. I have worked in many different organizational formats, but I have never worked in an organization where an excessively negative person did so much good work that it was worth team destruction. When everyone else is doing less work because of one person, you have to remove that person or you raise risk of mission failure.

throwaway7613 7y ago
(Throwaway account) This is not an isolated mistake. There is a consistent pattern of exploitation and toxicity from Kenneth that has been ongoing for many years. Many people in the community have known about this and worse. This post is courageous for finally calling it out. It's difficult to call out a person in a position of power like himself, especially one who obsessively engages in abusive tactics yet has an army of people who worship him and make excuses for him.
- neilv 7y ago
  Presumably you have good intentions, but I think it's dangerous for us to have criticisms of one person's name come from other people who won't stand behind it with their own names. Perhaps there is a whistleblower exception, such as when the person being criticized is powerful, and the whistleblower is vulnerable, but I'm not aware that's the situation here, and whistleblowing involves an investigation (by officials, journalists).
  - throwaway7613 7y ago
    You're comparing a hypothetical danger of society gone amok with the practical already-experienced danger of pissing off a systemic abuser with tens of thousands of followers. Even this very HN thread is full of people blindly defending him. If there is a functioning body of authority that is accepting confidential complaints, then I will happily use my real name. I am not eager to invite abuse just to help the HN community gain some awareness of what has been going on for years.

prepend 7y ago

A trigger warning for gaslighting is something that makes me assume low quality posts. I know it’s unwise to judge a book by its cover, but I’m comfortable with discounting an API from its interface.

tyingq 7y ago

Personally, I'd have stuck with facts. There's quite a lot of unattributed quotes and conjecture in this, which makes it read more like retaliation. It does sound like the author has a legit complaint, but the embellishments don't help.

dragonwriter 7y ago
> Personally, I'd have stuck with facts. There's quite a lot of unattributed quotes and conjecture in this Unattributed quotes are facts, even if they aren't easily verifiable by third parties. But then, most facts someone observes and reports aren't easily verifiable by uninvolved parties. And there is very little conjecture where the factual basis isn't presented so that one can judge whether the conjecture is warranted given the stated basis (of course, generally one must also deicde whether or not to trust the description of facts.) > which makes it read more like retaliation. It doesn't read like retaliation to me at all, nor is there any apparent thing to be retaliated for unless you accept the account itself, in which case it's just an account of the facts and not retaliation.
- tyingq 7y ago
  Anonymous quotes like "he is such a fucking narcissist power broker" are over the line for me. If you can't stand behind that, it's better left unsaid.
  - LyndsySimon 7y ago
    I completely agree. I feel like this quote in particular is intended as a personal attack, and that its inclusion dilutes the actual potentially valuable criticism and suggestions to the point that they’re basically irrelevant. That’s a shame, because I also believe that all projects like this have room for improvement.
    - 0815test 7y ago
      > I feel like this quote in particular is intended as a personal attack In context, it's clearly meant to hint at a purported pattern of problematic behavior, the specific instances of which the author is unwilling to get into, for whatever reason. While gossip is always unsavory to some extent - anonymous gossip all the more so - I think we should be respectful of the author's choice here and not take what they wrote as being by definition a violation of civility norms (as a personal attack would be).

ris 7y ago

My spidey sense has been acting all funny around requests since I realized it has its own vendored certificate bundle...

mercer 7y ago
could you elaborate?
- ris 7y ago
  Maintaining a certificate bundle is not something to be taken lightly - it's a central root of trust, and is something that should generally be deferred to the system or user and easily configurable globally. As a system administrator if there is an advisory over a certain set of root certificates, I want to be able to address that and remove that from one or maybe two places on a system. Not wonder about every last package that thought to award itself that authority. Especially the way a lot of python packages are used - as deeply nested and possibly pinned dependencies that maybe never get updated.
lozenge 7y ago
"Requests uses certificates from the package certifi. This allows for users to update their trusted certificates without changing the version of Requests. Before version 2.16, Requests bundled a set of root CAs that it trusted, sourced from the Mozilla trust store. The certificates were only updated once for each Requests version. When certifi was not installed, this led to extremely out-of-date certificate bundles when using significantly older versions of Requests. For the sake of security we recommend upgrading certifi frequently!" It isn't completely clear but it sounds like they (used to) copy the Mozilla Trust Store wholesale, which isn't a particularly controversial policy. They might be one of the more open stores.

lexpar 7y ago

Reitz really does not come off looking very good here. I was always a little suspicious of the set of libraries he maintains - the documentation pages are so slick that I begin to wonder if this is a software package or a lifestyle upgrade. Anecdotally, I was at one point in an informal business relationship with someone who has bipolar disorder and I had a very similar experience when I attempted to formalize our procedures for collecting and recording income. This was in a band (garage bands seemingly not that different from OSS) - so we're talking a few hundred dollars a month going in to one person's checking account. I thought we'd all feel better if we knew exactly how much money we were making and how it was being spent. Had a similar set of objections from my colleague to this kind of openness.

0815test 7y ago
> I was always a little suspicious of the set of libraries he maintains - the documentation pages are so slick that I begin to wonder if this is a software package or a lifestyle upgrade. Does that mean bad documentation is a good thing? Not sure if serious... That said, there are so many red flags in this whole story that I can't tell why the whole thing is only being revealed today. It seems that, as the person who was actually working on a crowdfunded feature, OP should have disclosed the potential issues to the community as soon as he became conclusively aware of them. Much of the damage would've been repaired a lot more smoothly, had he done so.
- dictum 7y ago
  I wish I could upvote the half of this comment that questions the wisdom of seeing good docs as a bad signal, and not upvote the part about not disclosing these issues earlier. This same question comes up when people reveal abuse (of any kind) or other traumatic experiences. People need time to process some events, and when you're going through some interpersonal trouble, you may think this (is your fault|will go away|is not a big problem|has been solved).
- Nicksil 7y ago
  >OP should have disclosed the potential issues to the community as soon as he became conclusively aware of them. Sure, but that's ideal. In practice, humans frequently delay or completely forgo sounding the alarm when there's a problem. Having not raised concerns immediately isn't out of the ordinary; for myriad of reasons, it occurs everyday. So instead of rebuking the author, consider _why_ it wasn't immediately brought to the community's attention (or maybe it was, but not to the degree we see here)

antt 7y ago

I don't understand the penny pinching in this post. My shitty laptop costs pretty close to 3k with all the mods I have on it. My work laptop came it at over 5k. A descent desktop for a developer can cost around $10k. My fancy dream machine is over $20k. $30k is peanuts. That's one month's wages for a senior dev. I've seen project that cost 50 times as much and the only delivery was a button of a different color. I have no idea if anything else said there is true or not and I have no interest in looking at more drama.

sudhirj 7y ago
The point of the article is the lack of transparency and borderline exploitation. If KR had put up a fundraising page saying “buy me beer” or “support my work” this wouldn’t be an issue. The author is pointing out that the funds were raised for a team effort and the other members on the team were being dealt with in a shady way.
- antt 7y ago
  Like I said, I have no interest in the drama. I'm just pointing out that the sums they are talking about here are laughable. Anyone who thinks that 30k can pay anything to a team should have a look at getting a real job. Him getting paid for the bother of working as the project coordinator sounds about fair for two months part time. The rest of the contributors should have been doing the work out of interest when they have free time with nothing better to do. I have a hell of a time explaining to people that I'm happy to contribute 1 hour 8 times to their projects for free, but if they expect 8 hours once it will cost them.
- tyingq 7y ago
  "The author is pointing out that the funds were raised for a team effort and the other members on the team were being dealt with in a shady way" It doesn't appear, though, that the author was part of that team, or promised any of the money. The author says this: "If he'd found another way to use the money on Requests, then I would have been totally happy. I didn't have any claim on the money" Other parts of the post do seem to indicate something isn't right. But it's not exactly as straightforward as you're saying.

Lazare 7y ago

It wasn't really mentioned in the linked article, but at the start of the year there was a lot of very heated discussion about Python, packaging, Pipenv, what was (and wasn't) an "official" packaging tool, etc. See, for example, this earlier discussion: https://news.ycombinator.com/item?id=18612590 https://news.ycombinator.com/item?id=18612590 Obviously there are multiple sides to that debate, but I personally came to the conclusion that Reitz had behaved quite poorly there. It's interesting to see his name come up again, here.

smnrchrds 7y ago
Interestingly, Pipenv is no longer in the list of projects on his website: https://www.kennethreitz.org/projects https://www.kennethreitz.org/projects What that means, I don't know.
- loulouxiv 7y ago
  The hype around pipenv is gone now that more people actually tried to use it in real life project and foubd out that it was not the storytelled solution to all your problems
  - smnrchrds 7y ago
    Sure, but I still don't get why it is missing from the project list. The list is not that curated. It includes Autoenv for example, a project whose Github README [0] says, "Note: you should probably use direnv instead. Simply put, it is higher quality software. But, autoenv is still great, too. Maybe try both? :)" [0] https://github.com/kennethreitz/autoenv https://github.com/kennethreitz/autoenv

sdwa 7y ago

Whoever he is, despite knowing nothing about him except his unusable pipenv, in the time I have been using python I've somehow become aware through osmosis that this person is not very pleasant. I can only assume that there's no smoke without fire.

jzl 7y ago
Curious about the "unusable pipenv" comment. I don't know much about it, but been meaning to try it out due to the publicity it's been getting. Care to elaborate?
- pseudalopex 7y ago
  https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-lot-delivers-very-little/ https://chriswarrick.com/blog/2018/07/17/pipenv-promises-a-l...
LyndsySimon 7y ago
I would argue that says more about the people speaking out in “opposition” than it does about who he really is.

asveikau 7y ago

Reading the link to Reitz's description of his bipolar diagnosis it's very hard not to see what is being described as manipulation, toxicity, narcissism, gaslighting ... as all being rooted in that. I understand it's tough to feel like a target of somebody's symptoms. I have been there too. But compassion is also needed.

floatingatoll 7y ago
Compassion is given. It lays out his actions, how they are perceived by others, and why the author feels they cannot work with him. It does not name him evil, and in fact seems disinterested in his private personal motivations. Shunning someone is a compassionate response to bipolar disorder. Keeping the reasons for shunning someone private harms others, such that “compassionate” becomes “complicit”. The community’s replies indicate that many chances have been given, well ahead of when this post was published. What further compassion would you suggest is appropriate here? ps. It is suggested he has bipolar disorder, but replacing that with “for personal reasons” in no way alters the content of the post.
- asveikau 7y ago
  Sorry, my experience says shunning is a very shitty thing to do, as it re-enforces their bad feedback loop. I am being vague because I don't know what the right answer is. But it is surely a compassionate one, and not one that rushes to judgement. The author is making an attempt at this, sure.
  - floatingatoll 7y ago
    Anything will reinforce the feedback loop. That’s inherent in the disorder. Either they voluntarily seek help, they are involuntarily committed, or they do not seek help. You can’t pressure them. They will rationalize their decision without any regard for the reality you perceive. Eventually, you can only choose either to enable them or to shun them.
    - asveikau 7y ago

bhouston 7y ago

This whole thing seems like focusing on small things and pretending they are big. I think the guys running Requests is eccentric and weird for sure. Weird eccentric guys will do weird and eccentric things. You have to expect that. The amount of money is ridiculously small. It isn't worth the time to focus on it. It is too bad the popular library doesn't have a competent maintainer. But at least he hasn't screwed it up. Maybe someone should just write a replacement with better features and then we can all move on? Sounds like the best solution to me. Probably easier to do than dealing with him or even fighting him. I guess I wouldn't focus on attacking this guy, it just isn't worth it. Life is short, the stakes are small, and it just isn't worth it.

lexpar 7y ago
> The amount of money is ridiculously small. It isn't worth the time to focus on it. Well, it's donated money... Do you think the people who donated share this view?
- bhouston 7y ago
  It is a ridiculously small amount of money though. You are probably right it is being wasted and misused, but that is half of kickstarters. It is par for the course when donating to a non-charity, it is trust and this guy is eccentric and weird. I think people have unrealistic expectations in this situation.
  - lexpar 7y ago
    Maybe you're right that it's a bit naive to throw money at internet eccentrics who don't have a plan and trust that they will manage things well. I just don't think we should be excusing things because it's (what some people think) is a small amount of money (note - about the average yearly income for a Canadian).
    - antt 7y ago
      >Maybe you're right that it's a bit naive to throw money at internet eccentrics who don't have a plan and trust that they will manage things well. I don't expect him to manage it well. I'd have been happy if half of the promised work got delivered and the money was spend on hookers and blow. I know most of the fees for my portfolio are funding that type of thing already.

yeukhon 7y ago

Bipolar can often comorbid with another mental illness. If he has a narcissistic trait, he could have a personality disorder. But I urge the community to stop guessing what he has or doesn’t have. Even professionals have hard times diagnosing their own patients. The point, as the author says, is not to circle around mental illness. Let’s skip this part of the discussion...

jdorfman 7y ago
He has been pretty transparent with his bipolar disorder. Speaking from experience mania drastically changes your personality. https://www.kennethreitz.org/essays/mentalhealtherror-an-exception-occurred https://www.kennethreitz.org/essays/mentalhealtherror-an-exc...

teddyh 7y ago

If all this is to be taken at face value, Kenneth Reitz should be publicly removed from any and all projects. The reported activity (of having secret groups to “work around” the troublesome person) is untenable. Projects should not be afraid to exclude people who are more trouble than they are worth; feeling that one cannot ever exclude people is also known as “Geek social fallacy #1”: http://www.plausiblydeniable.com/opinion/gsf.html http://www.plausiblydeniable.com/opinion/gsf.html

zzzeek 7y ago

SQLAlchemy author / maintainer here. If Kenneth has been acting in bad faith within the community, that should be brought to light and called out. That said, I can't help but think this blog post swings that hammer way too hard, and then even gets into rumors about other unethical things he has allegedly done without any attribution. The author goes on long enough in this manner so much so that they have to remind the reader "please don't abuse or harass Kenneth!" That's a sign you've swung too hard. I know Kenneth personally, as the blog post mentions, he has mental health issues and while the article rightly points out this is no excuse, it's not the authors place to judge how effectively or not a mental health sufferer is capable of managing their illness. Again i agree the incidents in question should be called out and I am glad this author has spoken out. But as someone who also suffers from mental illness I am concerned for the extended nature of the post.

wilfredinni 7y ago
This is from the post: Many people manage their conditions without causing this kind of harm, and when they mess up, they make amends, just like the rest of us. If someone can't do that, then as a community, we can have compassion but shouldn't give them power and influence.
- zzzeek 7y ago
  I agree totally but at the same time this post goes well beyond the realm of calling out the behavior and into deep rumor and character assasination territory. All of which may also be true but there is simply no need.
  - Nicksil 7y ago
    >All of which may also be true but there is simply no need. I don't understand this logic. If all may be true, then there is absolutely a need to alert the community of a prominent member who may be damaging that very community.
    - zzzeek 7y ago

craigsmansion 7y ago

> [Mental] Illness does not erase [..] their responsibility for their actions. Except for when it does, and linking to a lifestyle article on medium as a source to back you up doesn't really hold water. There might be something wrong, but that's no reason for what ultimately is a very subjective public character assassination piece, no matter how cautious and caring the author claims to be.

deleted 7y ago

[deleted]

devnonymous 7y ago

Just a tip (since there sometimes seem to be a pattern here to tl;dr but still comment), please read the whole thing. My thoughts on this: I consider myself an avid pythonista and have built my career programming in python. Though I've only been watching the community at the sidelines for personal reasons. I think this post took courage to call out someone who while great at code and docs and community interaction, is a flawed human. Kenneth seems to be more about the glam and less about the code these days. Case in point - His attempt to influence the adoption of then half baked pipenv as the officially endorsed tool for pkg management.

jdorfman 7y ago

> His collaborators also consistently cited his bipolar disorder as an excuse for whatever he did. I think this is deeply unfair to Reitz, and to everyone struggling with mental health issues. He's right it's completely unfair to others with bipolar disorder (can't speak for other mental illnesses). If you take you take your medication, go to therapy, practice CBT, and stay sober you can live a normal life. Don't get me wrong, it's hard work and expensive. I have no idea what Kenneth's situation is and I'm not excusing any of the alleged behavior, I'm just asking that others not to assume automatically all others successfully treating bipolar disorder (1 or 2) are up to no good.

theon144 7y ago

Why was this flagged?

RA_Fisher 7y ago
We have to be neutral. /sarcasm The heavy-handed opinion of HN mods drove me away from this community. It's not about protecting folks or creating a strong community. Creating those requires cultivated judgement not neutrality.

wyldfire 7y ago

Reitz has responded (and subsequently removed his response). Please un-flag this article so that HN can discuss the controversy/debate surrounding Reitz and his accuser.