4 ms·

Httpx closing down issues and discussions due to "skewed gender representation"

10 points by ZeroAurora 7mo ago

ZeroAurora 7mo ago
I personally treat it as a supply chain risk, as there are no longer any way to report any bugs and security problems.
- chrisjj 7mo ago
  Then why not provide one yourself?
  - ZeroAurora 7mo ago
    Forking is a good option for companies, but not a good option for sole developers: one doesn't have that much energy. Switching to other libraries like requests and aiohttp and supporting them by contributing is clearly a better option.
    - nateb2022 7mo ago
      https://github.com/MarkusSintonen/pyreqwest https://github.com/MarkusSintonen/pyreqwest is a great alternative, much more performant than requests/httpx/aiohttp, and provides an easy httpx compatible wrapper for migration.
  - nijave 7mo ago
    No need. There are plenty of other active alternatives
- dchest 7mo ago
  How is _your_ supply chain a concern of this open source developer?
  - ZeroAurora 7mo ago
    _My_ supply chain is not a big deal, lol. But this is HTTPX. A network library that has a considerable number of users. When I say _considerable_, I'm essentially saying _nearly every_ big tech. The one I can tell for sure is OpenAI (not a fan of them though). Remember xz attack?
    - dchest 7mo ago
      Why can nearly every big tech take care of their supply chain? :) Clearly, the maintainer doesn't want to do this job anymore, and it's not a requirement when releasing your code to also do stuff unrelated to programming.
  - nijave 7mo ago
    The parent poster never said it was. They just claimed it's risky for them which I agree with
jjgreen 7mo ago
Leaves some broken links on their contributing page: https://www.python-httpx.org/contributing/ https://www.python-httpx.org/contributing/
chrisjj 7mo ago
absurdly skewed gender representation, actually! :)
- ZeroAurora 7mo ago
  limited by title length XD
replooda 7mo ago
> I've closed off access to issues and discussions. > I don't want to continue allowing an online environment with such an absurdly skewed gender representation. I find it intensely unwelcoming, and it's not reflective of the type of working environments I value. That's the totality of the message. Weirdly enough, the concept of "an environment I don't personally find welcoming is unwelcoming — and better gone" strikes me as rather unwelcoming and indicative of a diet in severe need of iron-y supplementation.
nateb2022 7mo ago
This is yet another of several reasons why we've switched from httpx to pyreqwest[0]. Not only is httpx an actual supply chain risk now, but also it shows an unwillingness to fix outstanding bugs and issues, which is problematic in a project that has been adopted by so many users. For those migrating, pyreqwest provides a completely httpx-compatible wrapper.[1] [0]: https://github.com/MarkusSintonen/pyreqwest [1]: https://github.com/MarkusSintonen/pyreqwest/tree/main/python/pyreqwest/compatibility/httpx

10 points by ZeroAurora 7mo ago

ZeroAurora 7mo ago

I personally treat it as a supply chain risk, as there are no longer any way to report any bugs and security problems.

chrisjj 7mo ago
Then why not provide one yourself?
- ZeroAurora 7mo ago
  Forking is a good option for companies, but not a good option for sole developers: one doesn't have that much energy. Switching to other libraries like requests and aiohttp and supporting them by contributing is clearly a better option.
  - nateb2022 7mo ago
    https://github.com/MarkusSintonen/pyreqwest https://github.com/MarkusSintonen/pyreqwest is a great alternative, much more performant than requests/httpx/aiohttp, and provides an easy httpx compatible wrapper for migration.
- nijave 7mo ago
  No need. There are plenty of other active alternatives
dchest 7mo ago
How is _your_ supply chain a concern of this open source developer?
- ZeroAurora 7mo ago
  _My_ supply chain is not a big deal, lol. But this is HTTPX. A network library that has a considerable number of users. When I say _considerable_, I'm essentially saying _nearly every_ big tech. The one I can tell for sure is OpenAI (not a fan of them though). Remember xz attack?
  - dchest 7mo ago
    Why can nearly every big tech take care of their supply chain? :) Clearly, the maintainer doesn't want to do this job anymore, and it's not a requirement when releasing your code to also do stuff unrelated to programming.
- nijave 7mo ago
  The parent poster never said it was. They just claimed it's risky for them which I agree with

jjgreen 7mo ago

Leaves some broken links on their contributing page: https://www.python-httpx.org/contributing/ https://www.python-httpx.org/contributing/

chrisjj 7mo ago

absurdly skewed gender representation, actually! :)

ZeroAurora 7mo ago
limited by title length XD

replooda 7mo ago

> I've closed off access to issues and discussions. > I don't want to continue allowing an online environment with such an absurdly skewed gender representation. I find it intensely unwelcoming, and it's not reflective of the type of working environments I value. That's the totality of the message. Weirdly enough, the concept of "an environment I don't personally find welcoming is unwelcoming — and better gone" strikes me as rather unwelcoming and indicative of a diet in severe need of iron-y supplementation.

nateb2022 7mo ago

This is yet another of several reasons why we've switched from httpx to pyreqwest[0]. Not only is httpx an actual supply chain risk now, but also it shows an unwillingness to fix outstanding bugs and issues, which is problematic in a project that has been adopted by so many users. For those migrating, pyreqwest provides a completely httpx-compatible wrapper.[1] [0]: https://github.com/MarkusSintonen/pyreqwest [1]: https://github.com/MarkusSintonen/pyreqwest/tree/main/python/pyreqwest/compatibility/httpx