11 ms·

Things I've learned serving on the board of the Python Software Foundation

170 points by rednafi 2y ago

zahlman 2y ago
I enjoyed reading this perspective, but I think it left out some crucial information. My thesis here is that the PSF - already woefully underfunded, with PyPI kept afloat by a massive in-kind donation that gets to stay off the books - grossly misallocates the funding it does receive. Further, there are obvious and serious gaps in the consideration they pay to the moral values they profess to hold most dear. > The PSF currently employs 12 full-time staff members. Members of the board do not directly manage the activities of the staff—in fact board members telling staff what to do is highly inappropriate. Instead, the board is responsible for hiring an Executive Director—currently Deb Nicholson... Ms. Nicholson is listed as both a board member and a staff member, and also an officer. Another staff member, Olivia Sauls, is also listed as an officer. Between officers, the board and staff, I count 25 unique individuals, who are presumably all paid. > Many PSF activities are carried out by these volunteers, in particular via Work Groups. The membership of these Work Groups also has heavy overlap. For example, four members of the Code of Conduct Work Group are on the Board as well - including Ms. Nicholson. It's also worth noting that members of Work Groups are not necessarily elected. For example, the cited charter for the new "User Success" Work Group doesn't provide for the addition or removal of members at all, even though it's intended to operate perpetually. The Code of Conduct Work Group appoints its members, who may apply by private contact. > You can see how that money has been spent in the 2023 Annual Impact Report.... The most significant categories of expenditure in 2023 were PyCon US ($1,800,000), our Grants program ($677,000), Infrastructure (including PyPI) ($286,000) and our Fiscal Sponsorees ($204,000)—I’ll describe these in more detail below. I can't readily find these numbers in the report, but I can find that staffing for 2023 cost a total of about 1.3 million. (The report for this year is, for some reason, only available in PDF format. Others pointed out that this was not great for accessibility - supposedly a core value of the PSF and several Work Groups - and this was agreed about, and then as far as I can tell nothing was done.) > More recently, the PSF has started employing Developers in Residence to directly support the work of both the core Python team and initiatives such as the Python Package Index. To my understanding, there are currently three of these: Łukasz Langa - the individual who implemented my ban from the Python Discourse forum - since 2021, and Petr Viktorin and Serhiy Storchaka since January. That makes 28 likely people on the payroll by my count. Other core developers - dozens of them - operate purely on a volunteer basis. (In talks at PyCon, Raymond Hettinger used to joke about Guido van Rossum offering to double his $0 salary.) > PyPI’s numbers are staggering. Today there are 570,000 projects consisting of 12,035,133 files, serving 1.9 billion downloads a day (that number from PyPI Stats). Bandwidth for these downloads is donated by Fastly, a PSF Visionary Sponsor who recently signed a five year agreement to continue this service. Per the report, this amounts to over 600 petabytes of network traffic from PyPI per year. This would cost about 12 million dollars a year - nearly triple the operating budget - at market rates (https://aws.amazon.com/cloudfront/pricing/ https://aws.amazon.com/cloudfront/pricing/). My experiments suggest that about a quarter of this could be eliminated simply by enabling and then mandating the use of LZMA (XZ) compression for sdists and wheels (which currently must both use ordinary Gzip compression). There is support for LZMA in the Python standard library. (The one-time cost of recompressing existing archives should be minuscule in comparison - granted that LZMA is computationally expensive, but currently the daily download volume is on the order of dozens of times the entire repository size.) > The annual US Python Conference—PyCon US—is a big part of the PSF’s annual activities and operations. With over 3,000 attendees each year (and a $1.8m budget for 2023) running that conference represents a full-time job for several PSF staff members.... the importance of PyCon US to the Python community is such that the PSF is happy to lose money running the event if necessary. For a sense of scale, this is 200 times the grant that made DjangoCon Africa possible - though it ran into serious issues due to underfunding (https://pythonafrica.blogspot.com/2023/12/an-open-letter-to-python-software_5.html https://pythonafrica.blogspot.com/2023/12/an-open-letter-to-...). Also for a sense of scale: the PyCon US Youtube channel (https://www.youtube.com/@PyConUS https://www.youtube.com/@PyConUS) has about 29k subscribers and a total of 1.35 million views across all videos. For comparison, that's not many more people than those taking the JetBrains Python developer survey each year (e.g. https://lp.jetbrains.com/python-developers-survey-2023/ https://lp.jetbrains.com/python-developers-survey-2023/ claims 25k), and less than a sixth as many views as for the question "How do I list all files of a directory [in Python]?" on Stack Overflow (https://stackoverflow.com/questions/3207219/ https://stackoverflow.com/questions/3207219/). But perhaps "the Python community" (with inclusivity as a core value) is meant to represent a much smaller group than Python developers in general.
- maroonblazer 2y ago
  >To my understanding, there are currently three of these: Łukasz Langa - the individual who implemented my ban from the Python Discourse forum Go on...
  - zahlman 2y ago
    Oh, I should have included the links that time I guess, I just don't want to appear overly self-promotional. https://zahlman.github.io/politics/the-psf/2024/07/31/an-open-letter-to-the-psf-coc-wg.html https://zahlman.github.io/politics/the-psf/2024/07/31/an-ope... https://zahlman.github.io/dpo_archive/ https://zahlman.github.io/dpo_archive/
  - blueflow 2y ago
    What is this intended to say? "Oh, you got banned there, so there surely is a justified reason for that"? Because the lack of justified reason for bans was a big thing in the Python Forum some weeks ago.
    - tempfile 2y ago
      I think it is just asking for the gossip around the ban. It doesn't read as "the ban was justified" or not.
- unsnap_biceps 2y ago
  It's not unusual for board members to also be officers and staff and it's generally understood that being on the board by itself does not denote a authority over staff, however, a staff member on the board would still be able to fulfill their staff responsibilities. That said, it would be best to clarify if the board/officers are getting paid. > My experiments suggest that about a quarter of this could be eliminated simply by enabling and then mandating the use of LZMA (XZ) compression for sdists and wheels (which currently must both use ordinary Gzip compression) At this point, I wonder if jumping to zstd would be a much larger savings and require about the same amount of organizational effort, even if the technical work would be larger.
- 2y ago
sashank_1509 2y ago
Interesting, I always wondered how pip was funded. It works too quickly and seamlessly for a free service, interesting to see a company just sort of bankrolls it. I suppose if Fastly will stop bankrolling it then some of the big tech like Microsoft or Amazon should. It is the world’s most popular language now after all, and a lot of ML codebases are exclusively in Python.
- oswalk 2y ago
  > It works too quickly and seamlessly for a free service In what sense? Linux distribution package managers work just as well, if not better.
  - zahlman 2y ago
    The Linux foundation is one of the few open-source organizations that actually has significant money behind it (Mozilla is the only other one I can think of). PyPI moves hundreds of petabytes of data per year and a lot of orgs are simply not prepared to scale to that size. Without Fastly's support, the PSF wouldn't be prepared, either. So it's more than a little annoying to see that resource wasted. Setuptools is one of the most downloaded packages, largely due to issues with the design of Pip. Numpy by my estimate accounts for over 10% of download volume by itself (it's both very popular and very large), and ships basically an entire development environment (including multiple test suites and patches for Setuptools) for both C and FORTRAN extensions, along with many megabytes of advanced math libraries, to clients who mostly don't need any of that. Most packages could be considerably smaller if the standards supported LZMA compression (which is already in the Python standard library). The metadata formats are awkward, both wasting space and failing to prevent downloads of package versions doomed to fail installation.
lrhag 2y ago
It is sad that open source is all about foundations and positions now, not about software development. Periodically you see "I am awesome and served on the Steering Council" posts on Stack Overflow. Some of it from people who have never been on the bug tracker, who don't know or ignore the significant social and abuse of power issues in Python. The PSF marketing completely ignores reality: Free developers have been crowded out, chased away, humiliated and libeled and replaced by a clique of true believers. I would not advise anyone to spend significant resources to donate free work to Python. I'd also warn Microsoft employees who are potentially lured in to work on a JIT that they are up against ruthless politicians and should probably better work on C# and F# for their careers.
- weinzierl 2y ago
  "I would not advise anyone to spend significant resources to donate free work to Python." The Python Software Foundation (PSF) is a 501(c)(3) which means it is for the benefit of the community as a whole. What better form of organization would you suggest? This is already much better than most other open source organizations[1], which are 501(c)(6) and are explicitly for the benefit of their members only, which are usually comprised of the silicon valley behemoths.
  - blueflow 2y ago
    I think the issue is less their legal form, but their behavior and the resulting drama. If they are driving away the good developers, some kind of collapse might be imminent. You shouldn't invest anything in that.
    - ensignavenger 2y ago
      An alternative approach is to get involved and drive out the bullies, or better, drive out the bullying practices.
      - glaucon 2y ago
        That is the ideal but the above comment "...are up against ruthless politicians ..." applies. It's my observation that there are people involved who are : very interested in promoting a point of view; only secondarily interested in Python. They have time and motivation to protect their bridgehead. Many others who look at what's going on and hold their nose have other things they would rather be doing ... like developing software.
thenerdhead 2y ago
Foundations seem critical for the health and longevity of ecosystems. It is interesting to compare the various foundations in other ecosystems, their tax/entity status, and who comprises the board. Many boards are structured to purely benefit the company “sponsoring” and this is wrong. I’ve always looked at PSF as a means of doing it right in all regards. I wonder how much other ecosystems can grow if they gave up the control and allowed their communities to drive progress. One of the greatest parts of python and rust is the ability to still innovate the needs of the community and not just corporate interests
- rhkal 2y ago
  Free-threading goes in because Facebook wants it. Microsoft wants more control, too. The current PSF is doing nothing right. Up to 2014 it was a somewhat reasonable organization that marketed Python to academics, which is part of Python's success. Now it rests on its laurels, gives money to administrators and friends, stifles free speech and locks down the infrastructure. No innovation has ever come from the PSF. It takes the credit for the blood, sweat and tears of individual contributors.
mjburgess 2y ago
The elephant in the room here is the ideological capture of the PSF via its CoC working group. It seems, at best, the power of an unaccountable body to arbitrarily enforce membership conditions (and the like), has not been properly thought through (though, of course, attempts were made). The absence of due process and accountability to the community means the members of this group have arbitrary power to shape the PSF+community however they wish. They have thus far, explicitly equivocated community criticism of the PSF with "attacking" it; equivocated mentioning the difficulties some communities face with defending these difficulties; and equivocated mentioning the identities of victims of this enforcement with the converse bigotry that people of other identities ought be harmed. Thus at this point there is no open question about whether the CoC group is enforcing the CoC or using abusing their juridical power to humiliate, defame and exclude members of the community which are critical of the PSF. This is so repulsive to any reasonable person, the behaviour here is so public and so clearly abusive. Left to their own devices, a PSF operating under this capture will alienate significant numbers of the invested members of the python community -- who are aware-of, and concerned-by, such actions. I think those of us merely observing this, with some stake in python as a language and community, ought make our repulsion clear. Since this is having, and will have, a serious deleterious impact on those most inclined to participate and invest time in projects of this kind.
- linsomniac 2y ago
  I was surprised that there was no mention of the latest drama in "the kinds of things the board talks about" section. I would have assumed it was something that was a topic at the board retreat. But, maybe Simon was deliberately trying to avoid mentioning specifics to today and make this a more general post? I would like to see an independent investigation into the recent events of the CoC WG, because it really appears to be indefensible.
  - mjburgess 2y ago
    If I were Tim, or any others who've been bullied-out, I'd sue for defamation. Members of the WG have issued briefs, on behalf of the PSF, which list the supposed infractions that read as the worst sort of libellous yellow journalism. Eg., To equivocate discussing the past difficulties faced by victims of sexual harassment in corps with defending sexual harassment is sickening. Perhaps this group of people have grown up in twitter space where the game is obnoxiously strawmanning and rephrasing another person in order to farm outrage against them (eg., "oh so when you mentioned sexism, that means you're a sexist!"). However this conduct is now on behalf of an organisation formed in law, with legal duties and responsibilities, and now has liability for this conduct that is practically absent on twitter. This is a very serious problem for the PSF. You cannot have a working group releasing a dozen accusations of the worst kinds of bigotry, entirely false and unevidenced (etc.), on your behalf. Punishing your members, and the like. The legal liability here is incredible.
pm90 2y ago
> This auditability is an interesting aspect of how 501(c)(3) organizations work, because it means you can donate funds to them and know that the IRS will ostensibly be ensuring that the money is spent in a way that supports their stated mission. Come on. IRS is woefully understaffed. This might be a good talking point but short of some sort of egregious financial crime (like actual fraud) it seems unlikely the IRS gives a shit about how PSF spends its money.
- simonw 2y ago
  That’s what I was trying to hint at with the word “ostensibly”.
BrannonKing 2y ago
So who manages Pypi? This document seemed vague on that. Maybe that's the problem with Pypi's progress in life. Most packages on Pypi are complete crap. It's also heavily burdened with domain-specific applications and one-off student projects. They have no standards for what makes a useful package, and no ranking system aside from the number-of-downloads. I think package maintainers should be required to push an update every other year or have their package get dropped. I think frameworks should be separate from applications. I think packages without a lot of downloads should utilize endorsements and code-cleanliness metrics.
- Numerlor 2y ago
  Should there be an expectation of a package being particularly useful to be in a package repository? You see the same in other places like npm or docker repositories and it is not a problem. Manually checking things is very much out of scope for a service for open source like this. Limiting it by arbitrary metrics like code cleanliness would also just give a false sense of quality. One thing that'd make sense to me would just be asking for confirmation that the upload is not more suited to test pypi instead of the main one. Not sure whether the tools aren't already doing that or not. The major problem that's being somewhat worked on now is typo squatting, names taken up by old packages, and other security considerations around pypi. Random packages being useless (or malware) doesn't fall under that in my mind as you just won't or shouldn't be downloading completely random things. Admittedly there isn't as much man power dedicated to it as I think there should be, more so after I saw how much admin there is in PSF with the recent coc debacle.
- simonw 2y ago
  PyPI’s policies are here: https://policies.python.org/pypi.org/Acceptable-Use-Policy/ https://policies.python.org/pypi.org/Acceptable-Use-Policy/ Outside of abuse, PyPI does not impose editorial standards on packages. That would take an incredible amount of additional work, and it’s not clear to me that it would be “better”. How much does it really matter if there’s a university student project on there with virtually no downloads? “I think package maintainers should be required to push an update every other year or have their package get dropped.” Sometimes libraries really are “finished” - if you go through your dependency stack you may find a surprising number of packages with no new releases in the past 12 months, because they didn’t need a release. I tried that myself just now, here are some of the packages I found that haven't had a release in a few years: decorator 2022-01-07 rfc3986 2022-01-10 aiosignal 2022-11-08 colorama 2022-10-25 h11 2022-09-25 jmespath 2022-06-17 mdurl 2022-08-14 rsa 2022-07-20 mergedeep 2021-02-05 dictdiffer 2021-07-22 janus 2021-12-17 conda-content-trust 2021-05-12 six 2021-05-05 uritemplate 2021-10-13 pytest-clarity 2021-06-11 ptyprocess 2020-12-28 backcall 2020-06-09 text-unidecode 2019-08-30 PySocks 2019-09-20 sphinxcontrib-jsmath 2019-01-21 pprintpp 2018-07-01 homebrew-pypi-poet 2018-02-23 pickleshare 2018-09-25 webencodings 2017-04-05 Script here: https://gist.github.com/simonw/6165948ce595d74c767ce2bce846558c https://gist.github.com/simonw/6165948ce595d74c767ce2bce8465...
deleted 2y ago
[deleted]

170 points by rednafi 2y ago

I enjoyed reading this perspective, but I think it left out some crucial information. My thesis here is that the PSF - already woefully underfunded, with PyPI kept afloat by a massive in-kind donation that gets to stay off the books - grossly misallocates the funding it does receive. Further, there are obvious and serious gaps in the consideration they pay to the moral values they profess to hold most dear. > The PSF currently employs 12 full-time staff members. Members of the board do not directly manage the activities of the staff—in fact board members telling staff what to do is highly inappropriate. Instead, the board is responsible for hiring an Executive Director—currently Deb Nicholson... Ms. Nicholson is listed as both a board member and a staff member, and also an officer. Another staff member, Olivia Sauls, is also listed as an officer. Between officers, the board and staff, I count 25 unique individuals, who are presumably all paid. > Many PSF activities are carried out by these volunteers, in particular via Work Groups. The membership of these Work Groups also has heavy overlap. For example, four members of the Code of Conduct Work Group are on the Board as well - including Ms. Nicholson. It's also worth noting that members of Work Groups are not necessarily elected. For example, the cited charter for the new "User Success" Work Group doesn't provide for the addition or removal of members at all, even though it's intended to operate perpetually. The Code of Conduct Work Group appoints its members, who may apply by private contact. > You can see how that money has been spent in the 2023 Annual Impact Report.... The most significant categories of expenditure in 2023 were PyCon US ($1,800,000), our Grants program ($677,000), Infrastructure (including PyPI) ($286,000) and our Fiscal Sponsorees ($204,000)—I’ll describe these in more detail below. I can't readily find these numbers in the report, but I can find that staffing for 2023 cost a total of about 1.3 million. (The report for this year is, for some reason, only available in PDF format. Others pointed out that this was not great for accessibility - supposedly a core value of the PSF and several Work Groups - and this was agreed about, and then as far as I can tell nothing was done.) > More recently, the PSF has started employing Developers in Residence to directly support the work of both the core Python team and initiatives such as the Python Package Index. To my understanding, there are currently three of these: Łukasz Langa - the individual who implemented my ban from the Python Discourse forum - since 2021, and Petr Viktorin and Serhiy Storchaka since January. That makes 28 likely people on the payroll by my count. Other core developers - dozens of them - operate purely on a volunteer basis. (In talks at PyCon, Raymond Hettinger used to joke about Guido van Rossum offering to double his $0 salary.) > PyPI’s numbers are staggering. Today there are 570,000 projects consisting of 12,035,133 files, serving 1.9 billion downloads a day (that number from PyPI Stats). Bandwidth for these downloads is donated by Fastly, a PSF Visionary Sponsor who recently signed a five year agreement to continue this service. Per the report, this amounts to over 600 petabytes of network traffic from PyPI per year. This would cost about 12 million dollars a year - nearly triple the operating budget - at market rates (https://aws.amazon.com/cloudfront/pricing/ https://aws.amazon.com/cloudfront/pricing/). My experiments suggest that about a quarter of this could be eliminated simply by enabling and then mandating the use of LZMA (XZ) compression for sdists and wheels (which currently must both use ordinary Gzip compression). There is support for LZMA in the Python standard library. (The one-time cost of recompressing existing archives should be minuscule in comparison - granted that LZMA is computationally expensive, but currently the daily download volume is on the order of dozens of times the entire repository size.) > The annual US Python Conference—PyCon US—is a big part of the PSF’s annual activities and operations. With over 3,000 attendees each year (and a $1.8m budget for 2023) running that conference represents a full-time job for several PSF staff members.... the importance of PyCon US to the Python community is such that the PSF is happy to lose money running the event if necessary. For a sense of scale, this is 200 times the grant that made DjangoCon Africa possible - though it ran into serious issues due to underfunding (https://pythonafrica.blogspot.com/2023/12/an-open-letter-to-python-software_5.html https://pythonafrica.blogspot.com/2023/12/an-open-letter-to-...). Also for a sense of scale: the PyCon US Youtube channel (https://www.youtube.com/@PyConUS https://www.youtube.com/@PyConUS) has about 29k subscribers and a total of 1.35 million views across all videos. For comparison, that's not many more people than those taking the JetBrains Python developer survey each year (e.g. https://lp.jetbrains.com/python-developers-survey-2023/ https://lp.jetbrains.com/python-developers-survey-2023/ claims 25k), and less than a sixth as many views as for the question "How do I list all files of a directory [in Python]?" on Stack Overflow (https://stackoverflow.com/questions/3207219/ https://stackoverflow.com/questions/3207219/). But perhaps "the Python community" (with inclusivity as a core value) is meant to represent a much smaller group than Python developers in general.

maroonblazer 2y ago
>To my understanding, there are currently three of these: Łukasz Langa - the individual who implemented my ban from the Python Discourse forum Go on...
- zahlman 2y ago
  Oh, I should have included the links that time I guess, I just don't want to appear overly self-promotional. https://zahlman.github.io/politics/the-psf/2024/07/31/an-open-letter-to-the-psf-coc-wg.html https://zahlman.github.io/politics/the-psf/2024/07/31/an-ope... https://zahlman.github.io/dpo_archive/ https://zahlman.github.io/dpo_archive/
- blueflow 2y ago
  What is this intended to say? "Oh, you got banned there, so there surely is a justified reason for that"? Because the lack of justified reason for bans was a big thing in the Python Forum some weeks ago.
  - tempfile 2y ago
    I think it is just asking for the gossip around the ban. It doesn't read as "the ban was justified" or not.
unsnap_biceps 2y ago
It's not unusual for board members to also be officers and staff and it's generally understood that being on the board by itself does not denote a authority over staff, however, a staff member on the board would still be able to fulfill their staff responsibilities. That said, it would be best to clarify if the board/officers are getting paid. > My experiments suggest that about a quarter of this could be eliminated simply by enabling and then mandating the use of LZMA (XZ) compression for sdists and wheels (which currently must both use ordinary Gzip compression) At this point, I wonder if jumping to zstd would be a much larger savings and require about the same amount of organizational effort, even if the technical work would be larger.
2y ago

sashank_1509 2y ago

Interesting, I always wondered how pip was funded. It works too quickly and seamlessly for a free service, interesting to see a company just sort of bankrolls it. I suppose if Fastly will stop bankrolling it then some of the big tech like Microsoft or Amazon should. It is the world’s most popular language now after all, and a lot of ML codebases are exclusively in Python.

oswalk 2y ago
> It works too quickly and seamlessly for a free service In what sense? Linux distribution package managers work just as well, if not better.
- zahlman 2y ago
  The Linux foundation is one of the few open-source organizations that actually has significant money behind it (Mozilla is the only other one I can think of). PyPI moves hundreds of petabytes of data per year and a lot of orgs are simply not prepared to scale to that size. Without Fastly's support, the PSF wouldn't be prepared, either. So it's more than a little annoying to see that resource wasted. Setuptools is one of the most downloaded packages, largely due to issues with the design of Pip. Numpy by my estimate accounts for over 10% of download volume by itself (it's both very popular and very large), and ships basically an entire development environment (including multiple test suites and patches for Setuptools) for both C and FORTRAN extensions, along with many megabytes of advanced math libraries, to clients who mostly don't need any of that. Most packages could be considerably smaller if the standards supported LZMA compression (which is already in the Python standard library). The metadata formats are awkward, both wasting space and failing to prevent downloads of package versions doomed to fail installation.

lrhag 2y ago

It is sad that open source is all about foundations and positions now, not about software development. Periodically you see "I am awesome and served on the Steering Council" posts on Stack Overflow. Some of it from people who have never been on the bug tracker, who don't know or ignore the significant social and abuse of power issues in Python. The PSF marketing completely ignores reality: Free developers have been crowded out, chased away, humiliated and libeled and replaced by a clique of true believers. I would not advise anyone to spend significant resources to donate free work to Python. I'd also warn Microsoft employees who are potentially lured in to work on a JIT that they are up against ruthless politicians and should probably better work on C# and F# for their careers.

weinzierl 2y ago
"I would not advise anyone to spend significant resources to donate free work to Python." The Python Software Foundation (PSF) is a 501(c)(3) which means it is for the benefit of the community as a whole. What better form of organization would you suggest? This is already much better than most other open source organizations[1], which are 501(c)(6) and are explicitly for the benefit of their members only, which are usually comprised of the silicon valley behemoths.
- blueflow 2y ago
  I think the issue is less their legal form, but their behavior and the resulting drama. If they are driving away the good developers, some kind of collapse might be imminent. You shouldn't invest anything in that.
  - ensignavenger 2y ago
    An alternative approach is to get involved and drive out the bullies, or better, drive out the bullying practices.
    - glaucon 2y ago
      That is the ideal but the above comment "...are up against ruthless politicians ..." applies. It's my observation that there are people involved who are : very interested in promoting a point of view; only secondarily interested in Python. They have time and motivation to protect their bridgehead. Many others who look at what's going on and hold their nose have other things they would rather be doing ... like developing software.

thenerdhead 2y ago

Foundations seem critical for the health and longevity of ecosystems. It is interesting to compare the various foundations in other ecosystems, their tax/entity status, and who comprises the board. Many boards are structured to purely benefit the company “sponsoring” and this is wrong. I’ve always looked at PSF as a means of doing it right in all regards. I wonder how much other ecosystems can grow if they gave up the control and allowed their communities to drive progress. One of the greatest parts of python and rust is the ability to still innovate the needs of the community and not just corporate interests

rhkal 2y ago
Free-threading goes in because Facebook wants it. Microsoft wants more control, too. The current PSF is doing nothing right. Up to 2014 it was a somewhat reasonable organization that marketed Python to academics, which is part of Python's success. Now it rests on its laurels, gives money to administrators and friends, stifles free speech and locks down the infrastructure. No innovation has ever come from the PSF. It takes the credit for the blood, sweat and tears of individual contributors.

mjburgess 2y ago

The elephant in the room here is the ideological capture of the PSF via its CoC working group. It seems, at best, the power of an unaccountable body to arbitrarily enforce membership conditions (and the like), has not been properly thought through (though, of course, attempts were made). The absence of due process and accountability to the community means the members of this group have arbitrary power to shape the PSF+community however they wish. They have thus far, explicitly equivocated community criticism of the PSF with "attacking" it; equivocated mentioning the difficulties some communities face with defending these difficulties; and equivocated mentioning the identities of victims of this enforcement with the converse bigotry that people of other identities ought be harmed. Thus at this point there is no open question about whether the CoC group is enforcing the CoC or using abusing their juridical power to humiliate, defame and exclude members of the community which are critical of the PSF. This is so repulsive to any reasonable person, the behaviour here is so public and so clearly abusive. Left to their own devices, a PSF operating under this capture will alienate significant numbers of the invested members of the python community -- who are aware-of, and concerned-by, such actions. I think those of us merely observing this, with some stake in python as a language and community, ought make our repulsion clear. Since this is having, and will have, a serious deleterious impact on those most inclined to participate and invest time in projects of this kind.

linsomniac 2y ago
I was surprised that there was no mention of the latest drama in "the kinds of things the board talks about" section. I would have assumed it was something that was a topic at the board retreat. But, maybe Simon was deliberately trying to avoid mentioning specifics to today and make this a more general post? I would like to see an independent investigation into the recent events of the CoC WG, because it really appears to be indefensible.
- mjburgess 2y ago
  If I were Tim, or any others who've been bullied-out, I'd sue for defamation. Members of the WG have issued briefs, on behalf of the PSF, which list the supposed infractions that read as the worst sort of libellous yellow journalism. Eg., To equivocate discussing the past difficulties faced by victims of sexual harassment in corps with defending sexual harassment is sickening. Perhaps this group of people have grown up in twitter space where the game is obnoxiously strawmanning and rephrasing another person in order to farm outrage against them (eg., "oh so when you mentioned sexism, that means you're a sexist!"). However this conduct is now on behalf of an organisation formed in law, with legal duties and responsibilities, and now has liability for this conduct that is practically absent on twitter. This is a very serious problem for the PSF. You cannot have a working group releasing a dozen accusations of the worst kinds of bigotry, entirely false and unevidenced (etc.), on your behalf. Punishing your members, and the like. The legal liability here is incredible.

pm90 2y ago

> This auditability is an interesting aspect of how 501(c)(3) organizations work, because it means you can donate funds to them and know that the IRS will ostensibly be ensuring that the money is spent in a way that supports their stated mission. Come on. IRS is woefully understaffed. This might be a good talking point but short of some sort of egregious financial crime (like actual fraud) it seems unlikely the IRS gives a shit about how PSF spends its money.

simonw 2y ago
That’s what I was trying to hint at with the word “ostensibly”.

BrannonKing 2y ago

So who manages Pypi? This document seemed vague on that. Maybe that's the problem with Pypi's progress in life. Most packages on Pypi are complete crap. It's also heavily burdened with domain-specific applications and one-off student projects. They have no standards for what makes a useful package, and no ranking system aside from the number-of-downloads. I think package maintainers should be required to push an update every other year or have their package get dropped. I think frameworks should be separate from applications. I think packages without a lot of downloads should utilize endorsements and code-cleanliness metrics.

Numerlor 2y ago
Should there be an expectation of a package being particularly useful to be in a package repository? You see the same in other places like npm or docker repositories and it is not a problem. Manually checking things is very much out of scope for a service for open source like this. Limiting it by arbitrary metrics like code cleanliness would also just give a false sense of quality. One thing that'd make sense to me would just be asking for confirmation that the upload is not more suited to test pypi instead of the main one. Not sure whether the tools aren't already doing that or not. The major problem that's being somewhat worked on now is typo squatting, names taken up by old packages, and other security considerations around pypi. Random packages being useless (or malware) doesn't fall under that in my mind as you just won't or shouldn't be downloading completely random things. Admittedly there isn't as much man power dedicated to it as I think there should be, more so after I saw how much admin there is in PSF with the recent coc debacle.
simonw 2y ago
PyPI’s policies are here: https://policies.python.org/pypi.org/Acceptable-Use-Policy/ https://policies.python.org/pypi.org/Acceptable-Use-Policy/ Outside of abuse, PyPI does not impose editorial standards on packages. That would take an incredible amount of additional work, and it’s not clear to me that it would be “better”. How much does it really matter if there’s a university student project on there with virtually no downloads? “I think package maintainers should be required to push an update every other year or have their package get dropped.” Sometimes libraries really are “finished” - if you go through your dependency stack you may find a surprising number of packages with no new releases in the past 12 months, because they didn’t need a release. I tried that myself just now, here are some of the packages I found that haven't had a release in a few years: decorator 2022-01-07 rfc3986 2022-01-10 aiosignal 2022-11-08 colorama 2022-10-25 h11 2022-09-25 jmespath 2022-06-17 mdurl 2022-08-14 rsa 2022-07-20 mergedeep 2021-02-05 dictdiffer 2021-07-22 janus 2021-12-17 conda-content-trust 2021-05-12 six 2021-05-05 uritemplate 2021-10-13 pytest-clarity 2021-06-11 ptyprocess 2020-12-28 backcall 2020-06-09 text-unidecode 2019-08-30 PySocks 2019-09-20 sphinxcontrib-jsmath 2019-01-21 pprintpp 2018-07-01 homebrew-pypi-poet 2018-02-23 pickleshare 2018-09-25 webencodings 2017-04-05 Script here: https://gist.github.com/simonw/6165948ce595d74c767ce2bce846558c https://gist.github.com/simonw/6165948ce595d74c767ce2bce8465...

deleted 2y ago

[deleted]